xref: /freebsd/sys/netinet/tcp_usrreq.c (revision 9b37d84c87e69dabc69d818aa4d2fea718bd8b74)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1993
5  *	The Regents of the University of California.
6  * Copyright (c) 2006-2007 Robert N. M. Watson
7  * Copyright (c) 2010-2011 Juniper Networks, Inc.
8  * All rights reserved.
9  *
10  * Portions of this software were developed by Robert N. M. Watson under
11  * contract to Juniper Networks, Inc.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 #include <sys/cdefs.h>
39 #include "opt_ddb.h"
40 #include "opt_inet.h"
41 #include "opt_inet6.h"
42 #include "opt_ipsec.h"
43 #include "opt_kern_tls.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/arb.h>
48 #include <sys/limits.h>
49 #include <sys/malloc.h>
50 #include <sys/refcount.h>
51 #include <sys/kernel.h>
52 #include <sys/ktls.h>
53 #include <sys/qmath.h>
54 #include <sys/sysctl.h>
55 #include <sys/mbuf.h>
56 #ifdef INET6
57 #include <sys/domain.h>
58 #endif /* INET6 */
59 #include <sys/socket.h>
60 #include <sys/socketvar.h>
61 #include <sys/protosw.h>
62 #include <sys/proc.h>
63 #include <sys/jail.h>
64 #include <sys/stats.h>
65 
66 #ifdef DDB
67 #include <ddb/ddb.h>
68 #endif
69 
70 #include <net/if.h>
71 #include <net/if_var.h>
72 #include <net/route.h>
73 #include <net/vnet.h>
74 
75 #include <netinet/in.h>
76 #include <netinet/in_kdtrace.h>
77 #include <netinet/in_pcb.h>
78 #include <netinet/in_systm.h>
79 #include <netinet/in_var.h>
80 #include <netinet/ip.h>
81 #include <netinet/ip_var.h>
82 #ifdef INET6
83 #include <netinet/ip6.h>
84 #include <netinet6/in6_pcb.h>
85 #include <netinet6/ip6_var.h>
86 #include <netinet6/scope6_var.h>
87 #endif
88 #include <netinet/tcp.h>
89 #include <netinet/tcp_fsm.h>
90 #include <netinet/tcp_seq.h>
91 #include <netinet/tcp_timer.h>
92 #include <netinet/tcp_var.h>
93 #include <netinet/tcp_log_buf.h>
94 #include <netinet/tcpip.h>
95 #include <netinet/cc/cc.h>
96 #include <netinet/tcp_fastopen.h>
97 #include <netinet/tcp_hpts.h>
98 #ifdef TCP_OFFLOAD
99 #include <netinet/tcp_offload.h>
100 #endif
101 #include <netipsec/ipsec_support.h>
102 
103 #include <vm/vm.h>
104 #include <vm/vm_param.h>
105 #include <vm/pmap.h>
106 #include <vm/vm_extern.h>
107 #include <vm/vm_map.h>
108 #include <vm/vm_page.h>
109 
110 /*
111  * TCP protocol interface to socket abstraction.
112  */
113 #ifdef INET
114 static int	tcp_connect(struct tcpcb *, struct sockaddr_in *,
115 		    struct thread *td);
116 #endif /* INET */
117 #ifdef INET6
118 static int	tcp6_connect(struct tcpcb *, struct sockaddr_in6 *,
119 		    struct thread *td);
120 #endif /* INET6 */
121 static void	tcp_disconnect(struct tcpcb *);
122 static void	tcp_usrclosed(struct tcpcb *);
123 static void	tcp_fill_info(const struct tcpcb *, struct tcp_info *);
124 
125 static int	tcp_pru_options_support(struct tcpcb *tp, int flags);
126 
127 static void
128 tcp_bblog_pru(struct tcpcb *tp, uint32_t pru, int error)
129 {
130 	struct tcp_log_buffer *lgb;
131 
132 	KASSERT(tp != NULL, ("tcp_bblog_pru: tp == NULL"));
133 	INP_WLOCK_ASSERT(tptoinpcb(tp));
134 	if (tcp_bblogging_on(tp)) {
135 		lgb = tcp_log_event(tp, NULL, NULL, NULL, TCP_LOG_PRU, error,
136 		    0, NULL, false, NULL, NULL, 0, NULL);
137 	} else {
138 		lgb = NULL;
139 	}
140 	if (lgb != NULL) {
141 		if (error >= 0) {
142 			lgb->tlb_errno = (uint32_t)error;
143 		}
144 		lgb->tlb_flex1 = pru;
145 	}
146 }
147 
148 /*
149  * TCP attaches to socket via pr_attach(), reserving space,
150  * and an internet control block.
151  */
152 static int
153 tcp_usr_attach(struct socket *so, int proto, struct thread *td)
154 {
155 	struct inpcb *inp;
156 	struct tcpcb *tp = NULL;
157 	int error;
158 
159 	inp = sotoinpcb(so);
160 	KASSERT(inp == NULL, ("tcp_usr_attach: inp != NULL"));
161 
162 	error = soreserve(so, V_tcp_sendspace, V_tcp_recvspace);
163 	if (error)
164 		goto out;
165 
166 	so->so_rcv.sb_flags |= SB_AUTOSIZE;
167 	so->so_snd.sb_flags |= SB_AUTOSIZE;
168 	error = in_pcballoc(so, &V_tcbinfo);
169 	if (error)
170 		goto out;
171 	inp = sotoinpcb(so);
172 	tp = tcp_newtcpcb(inp, NULL);
173 	if (tp == NULL) {
174 		error = ENOBUFS;
175 		in_pcbfree(inp);
176 		goto out;
177 	}
178 	tp->t_state = TCPS_CLOSED;
179 	tcp_bblog_pru(tp, PRU_ATTACH, error);
180 	INP_WUNLOCK(inp);
181 	TCPSTATES_INC(TCPS_CLOSED);
182 out:
183 	TCP_PROBE2(debug__user, tp, PRU_ATTACH);
184 	return (error);
185 }
186 
187 /*
188  * tcp_usr_detach is called when the socket layer loses its final reference
189  * to the socket, be it a file descriptor reference, a reference from TCP,
190  * etc.  At this point, there is only one case in which we will keep around
191  * inpcb state: time wait.
192  */
193 static void
194 tcp_usr_detach(struct socket *so)
195 {
196 	struct inpcb *inp;
197 	struct tcpcb *tp;
198 
199 	inp = sotoinpcb(so);
200 	KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
201 	INP_WLOCK(inp);
202 	KASSERT(so->so_pcb == inp && inp->inp_socket == so,
203 		("%s: socket %p inp %p mismatch", __func__, so, inp));
204 
205 	tp = intotcpcb(inp);
206 
207 	KASSERT(inp->inp_flags & INP_DROPPED ||
208 	    tp->t_state < TCPS_SYN_SENT,
209 	    ("%s: inp %p not dropped or embryonic", __func__, inp));
210 
211 	tcp_discardcb(tp);
212 	in_pcbfree(inp);
213 }
214 
215 #ifdef INET
216 /*
217  * Give the socket an address.
218  */
219 static int
220 tcp_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
221 {
222 	int error = 0;
223 	struct inpcb *inp;
224 	struct tcpcb *tp;
225 	struct sockaddr_in *sinp;
226 
227 	inp = sotoinpcb(so);
228 	KASSERT(inp != NULL, ("tcp_usr_bind: inp == NULL"));
229 	INP_WLOCK(inp);
230 	if (inp->inp_flags & INP_DROPPED) {
231 		INP_WUNLOCK(inp);
232 		return (EINVAL);
233 	}
234 	tp = intotcpcb(inp);
235 
236 	sinp = (struct sockaddr_in *)nam;
237 	if (nam->sa_family != AF_INET) {
238 		/*
239 		 * Preserve compatibility with old programs.
240 		 */
241 		if (nam->sa_family != AF_UNSPEC ||
242 		    nam->sa_len < offsetof(struct sockaddr_in, sin_zero) ||
243 		    sinp->sin_addr.s_addr != INADDR_ANY) {
244 			error = EAFNOSUPPORT;
245 			goto out;
246 		}
247 		nam->sa_family = AF_INET;
248 	}
249 	if (nam->sa_len != sizeof(*sinp)) {
250 		error = EINVAL;
251 		goto out;
252 	}
253 	/*
254 	 * Must check for multicast addresses and disallow binding
255 	 * to them.
256 	 */
257 	if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))) {
258 		error = EAFNOSUPPORT;
259 		goto out;
260 	}
261 	INP_HASH_WLOCK(&V_tcbinfo);
262 	error = in_pcbbind(inp, sinp, V_tcp_bind_all_fibs ? 0 : INPBIND_FIB,
263 	    td->td_ucred);
264 	INP_HASH_WUNLOCK(&V_tcbinfo);
265 out:
266 	tcp_bblog_pru(tp, PRU_BIND, error);
267 	TCP_PROBE2(debug__user, tp, PRU_BIND);
268 	INP_WUNLOCK(inp);
269 
270 	return (error);
271 }
272 #endif /* INET */
273 
274 #ifdef INET6
275 static int
276 tcp6_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
277 {
278 	int error = 0;
279 	struct inpcb *inp;
280 	struct tcpcb *tp;
281 	struct sockaddr_in6 *sin6;
282 	u_char vflagsav;
283 
284 	inp = sotoinpcb(so);
285 	KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
286 	INP_WLOCK(inp);
287 	if (inp->inp_flags & INP_DROPPED) {
288 		INP_WUNLOCK(inp);
289 		return (EINVAL);
290 	}
291 	tp = intotcpcb(inp);
292 
293 	vflagsav = inp->inp_vflag;
294 
295 	sin6 = (struct sockaddr_in6 *)nam;
296 	if (nam->sa_family != AF_INET6) {
297 		error = EAFNOSUPPORT;
298 		goto out;
299 	}
300 	if (nam->sa_len != sizeof(*sin6)) {
301 		error = EINVAL;
302 		goto out;
303 	}
304 	/*
305 	 * Must check for multicast addresses and disallow binding
306 	 * to them.
307 	 */
308 	if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
309 		error = EAFNOSUPPORT;
310 		goto out;
311 	}
312 
313 	INP_HASH_WLOCK(&V_tcbinfo);
314 	inp->inp_vflag &= ~INP_IPV4;
315 	inp->inp_vflag |= INP_IPV6;
316 #ifdef INET
317 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
318 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
319 			inp->inp_vflag |= INP_IPV4;
320 		else if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
321 			struct sockaddr_in sin;
322 
323 			in6_sin6_2_sin(&sin, sin6);
324 			if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
325 				error = EAFNOSUPPORT;
326 				INP_HASH_WUNLOCK(&V_tcbinfo);
327 				goto out;
328 			}
329 			inp->inp_vflag |= INP_IPV4;
330 			inp->inp_vflag &= ~INP_IPV6;
331 			error = in_pcbbind(inp, &sin, 0, td->td_ucred);
332 			INP_HASH_WUNLOCK(&V_tcbinfo);
333 			goto out;
334 		}
335 	}
336 #endif
337 	error = in6_pcbbind(inp, sin6, V_tcp_bind_all_fibs ? 0 : INPBIND_FIB,
338 	    td->td_ucred);
339 	INP_HASH_WUNLOCK(&V_tcbinfo);
340 out:
341 	if (error != 0)
342 		inp->inp_vflag = vflagsav;
343 	tcp_bblog_pru(tp, PRU_BIND, error);
344 	TCP_PROBE2(debug__user, tp, PRU_BIND);
345 	INP_WUNLOCK(inp);
346 	return (error);
347 }
348 #endif /* INET6 */
349 
350 #ifdef INET
351 /*
352  * Prepare to accept connections.
353  */
354 static int
355 tcp_usr_listen(struct socket *so, int backlog, struct thread *td)
356 {
357 	struct inpcb *inp;
358 	struct tcpcb *tp;
359 	int error = 0;
360 	bool already_listening;
361 
362 	inp = sotoinpcb(so);
363 	KASSERT(inp != NULL, ("tcp_usr_listen: inp == NULL"));
364 	INP_WLOCK(inp);
365 	if (inp->inp_flags & INP_DROPPED) {
366 		INP_WUNLOCK(inp);
367 		return (EINVAL);
368 	}
369 	tp = intotcpcb(inp);
370 
371 	SOCK_LOCK(so);
372 	already_listening = SOLISTENING(so);
373 	error = solisten_proto_check(so);
374 	if (error != 0) {
375 		SOCK_UNLOCK(so);
376 		goto out;
377 	}
378 	if (inp->inp_lport == 0) {
379 		INP_HASH_WLOCK(&V_tcbinfo);
380 		error = in_pcbbind(inp, NULL,
381 		    V_tcp_bind_all_fibs ? 0 : INPBIND_FIB, td->td_ucred);
382 		INP_HASH_WUNLOCK(&V_tcbinfo);
383 	}
384 	if (error == 0) {
385 		tcp_state_change(tp, TCPS_LISTEN);
386 		solisten_proto(so, backlog);
387 #ifdef TCP_OFFLOAD
388 		if ((so->so_options & SO_NO_OFFLOAD) == 0)
389 			tcp_offload_listen_start(tp);
390 #endif
391 	} else {
392 		solisten_proto_abort(so);
393 	}
394 	SOCK_UNLOCK(so);
395 	if (already_listening)
396 		goto out;
397 
398 	if (error == 0)
399 		in_pcblisten(inp);
400 	if (tp->t_flags & TF_FASTOPEN)
401 		tp->t_tfo_pending = tcp_fastopen_alloc_counter();
402 
403 out:
404 	tcp_bblog_pru(tp, PRU_LISTEN, error);
405 	TCP_PROBE2(debug__user, tp, PRU_LISTEN);
406 	INP_WUNLOCK(inp);
407 	return (error);
408 }
409 #endif /* INET */
410 
411 #ifdef INET6
412 static int
413 tcp6_usr_listen(struct socket *so, int backlog, struct thread *td)
414 {
415 	struct inpcb *inp;
416 	struct tcpcb *tp;
417 	u_char vflagsav;
418 	int error = 0;
419 	bool already_listening;
420 
421 	inp = sotoinpcb(so);
422 	KASSERT(inp != NULL, ("tcp6_usr_listen: inp == NULL"));
423 	INP_WLOCK(inp);
424 	if (inp->inp_flags & INP_DROPPED) {
425 		INP_WUNLOCK(inp);
426 		return (EINVAL);
427 	}
428 	tp = intotcpcb(inp);
429 
430 	vflagsav = inp->inp_vflag;
431 
432 	SOCK_LOCK(so);
433 	already_listening = SOLISTENING(so);
434 	error = solisten_proto_check(so);
435 	if (error != 0) {
436 		SOCK_UNLOCK(so);
437 		goto out;
438 	}
439 	INP_HASH_WLOCK(&V_tcbinfo);
440 	if (inp->inp_lport == 0) {
441 		inp->inp_vflag &= ~INP_IPV4;
442 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
443 			inp->inp_vflag |= INP_IPV4;
444 		error = in6_pcbbind(inp, NULL,
445 		    V_tcp_bind_all_fibs ? 0 : INPBIND_FIB, td->td_ucred);
446 	}
447 	INP_HASH_WUNLOCK(&V_tcbinfo);
448 	if (error == 0) {
449 		tcp_state_change(tp, TCPS_LISTEN);
450 		solisten_proto(so, backlog);
451 #ifdef TCP_OFFLOAD
452 		if ((so->so_options & SO_NO_OFFLOAD) == 0)
453 			tcp_offload_listen_start(tp);
454 #endif
455 	} else {
456 		solisten_proto_abort(so);
457 	}
458 	SOCK_UNLOCK(so);
459 	if (already_listening)
460 		goto out;
461 
462 	if (error == 0)
463 		in_pcblisten(inp);
464 	if (tp->t_flags & TF_FASTOPEN)
465 		tp->t_tfo_pending = tcp_fastopen_alloc_counter();
466 
467 	if (error != 0)
468 		inp->inp_vflag = vflagsav;
469 
470 out:
471 	tcp_bblog_pru(tp, PRU_LISTEN, error);
472 	TCP_PROBE2(debug__user, tp, PRU_LISTEN);
473 	INP_WUNLOCK(inp);
474 	return (error);
475 }
476 #endif /* INET6 */
477 
478 #ifdef INET
479 /*
480  * Initiate connection to peer.
481  * Create a template for use in transmissions on this connection.
482  * Enter SYN_SENT state, and mark socket as connecting.
483  * Start keep-alive timer, and seed output sequence space.
484  * Send initial segment on connection.
485  */
486 static int
487 tcp_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
488 {
489 	struct epoch_tracker et;
490 	int error = 0;
491 	struct inpcb *inp;
492 	struct tcpcb *tp;
493 	struct sockaddr_in *sinp;
494 
495 	inp = sotoinpcb(so);
496 	KASSERT(inp != NULL, ("tcp_usr_connect: inp == NULL"));
497 	INP_WLOCK(inp);
498 	if (inp->inp_flags & INP_DROPPED) {
499 		INP_WUNLOCK(inp);
500 		return (ECONNREFUSED);
501 	}
502 	tp = intotcpcb(inp);
503 
504 	sinp = (struct sockaddr_in *)nam;
505 	if (nam->sa_family != AF_INET) {
506 		error = EAFNOSUPPORT;
507 		goto out;
508 	}
509 	if (nam->sa_len != sizeof (*sinp)) {
510 		error = EINVAL;
511 		goto out;
512 	}
513 	/*
514 	 * Must disallow TCP ``connections'' to multicast addresses.
515 	 */
516 	if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))) {
517 		error = EAFNOSUPPORT;
518 		goto out;
519 	}
520 	if (ntohl(sinp->sin_addr.s_addr) == INADDR_BROADCAST) {
521 		error = EACCES;
522 		goto out;
523 	}
524 	if ((error = prison_remote_ip4(td->td_ucred, &sinp->sin_addr)) != 0)
525 		goto out;
526 	if (SOLISTENING(so) || so->so_options & SO_REUSEPORT_LB) {
527 		error = EOPNOTSUPP;
528 		goto out;
529 	}
530 	NET_EPOCH_ENTER(et);
531 	if ((error = tcp_connect(tp, sinp, td)) != 0)
532 		goto out_in_epoch;
533 #ifdef TCP_OFFLOAD
534 	if (registered_toedevs > 0 &&
535 	    (so->so_options & SO_NO_OFFLOAD) == 0 &&
536 	    (error = tcp_offload_connect(so, nam)) == 0)
537 		goto out_in_epoch;
538 #endif
539 	tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
540 	error = tcp_output(tp);
541 	KASSERT(error >= 0, ("TCP stack %s requested tcp_drop(%p) at connect()"
542 	    ", error code %d", tp->t_fb->tfb_tcp_block_name, tp, -error));
543 out_in_epoch:
544 	NET_EPOCH_EXIT(et);
545 out:
546 	tcp_bblog_pru(tp, PRU_CONNECT, error);
547 	TCP_PROBE2(debug__user, tp, PRU_CONNECT);
548 	INP_WUNLOCK(inp);
549 	return (error);
550 }
551 #endif /* INET */
552 
553 #ifdef INET6
554 static int
555 tcp6_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
556 {
557 	struct epoch_tracker et;
558 	int error = 0;
559 	struct inpcb *inp;
560 	struct tcpcb *tp;
561 	struct sockaddr_in6 *sin6;
562 	u_int8_t incflagsav;
563 	u_char vflagsav;
564 
565 	inp = sotoinpcb(so);
566 	KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
567 	INP_WLOCK(inp);
568 	if (inp->inp_flags & INP_DROPPED) {
569 		INP_WUNLOCK(inp);
570 		return (ECONNREFUSED);
571 	}
572 	tp = intotcpcb(inp);
573 
574 	vflagsav = inp->inp_vflag;
575 	incflagsav = inp->inp_inc.inc_flags;
576 
577 	sin6 = (struct sockaddr_in6 *)nam;
578 	if (nam->sa_family != AF_INET6) {
579 		error = EAFNOSUPPORT;
580 		goto out;
581 	}
582 	if (nam->sa_len != sizeof (*sin6)) {
583 		error = EINVAL;
584 		goto out;
585 	}
586 	/*
587 	 * Must disallow TCP ``connections'' to multicast addresses.
588 	 */
589 	if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
590 		error = EAFNOSUPPORT;
591 		goto out;
592 	}
593 	if (SOLISTENING(so) || so->so_options & SO_REUSEPORT_LB) {
594 		error = EOPNOTSUPP;
595 		goto out;
596 	}
597 #ifdef INET
598 	/*
599 	 * XXXRW: Some confusion: V4/V6 flags relate to binding, and
600 	 * therefore probably require the hash lock, which isn't held here.
601 	 * Is this a significant problem?
602 	 */
603 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
604 		struct sockaddr_in sin;
605 
606 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
607 			error = EINVAL;
608 			goto out;
609 		}
610 		if ((inp->inp_vflag & INP_IPV4) == 0) {
611 			error = EAFNOSUPPORT;
612 			goto out;
613 		}
614 
615 		in6_sin6_2_sin(&sin, sin6);
616 		if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
617 			error = EAFNOSUPPORT;
618 			goto out;
619 		}
620 		if (ntohl(sin.sin_addr.s_addr) == INADDR_BROADCAST) {
621 			error = EACCES;
622 			goto out;
623 		}
624 		if ((error = prison_remote_ip4(td->td_ucred,
625 		    &sin.sin_addr)) != 0)
626 			goto out;
627 		inp->inp_vflag |= INP_IPV4;
628 		inp->inp_vflag &= ~INP_IPV6;
629 		NET_EPOCH_ENTER(et);
630 		if ((error = tcp_connect(tp, &sin, td)) != 0)
631 			goto out_in_epoch;
632 #ifdef TCP_OFFLOAD
633 		if (registered_toedevs > 0 &&
634 		    (so->so_options & SO_NO_OFFLOAD) == 0 &&
635 		    (error = tcp_offload_connect(so, nam)) == 0)
636 			goto out_in_epoch;
637 #endif
638 		error = tcp_output(tp);
639 		goto out_in_epoch;
640 	} else {
641 		if ((inp->inp_vflag & INP_IPV6) == 0) {
642 			error = EAFNOSUPPORT;
643 			goto out;
644 		}
645 	}
646 #endif
647 	if ((error = prison_remote_ip6(td->td_ucred, &sin6->sin6_addr)) != 0)
648 		goto out;
649 	inp->inp_vflag &= ~INP_IPV4;
650 	inp->inp_vflag |= INP_IPV6;
651 	inp->inp_inc.inc_flags |= INC_ISIPV6;
652 	NET_EPOCH_ENTER(et);
653 	if ((error = tcp6_connect(tp, sin6, td)) != 0)
654 		goto out_in_epoch;
655 #ifdef TCP_OFFLOAD
656 	if (registered_toedevs > 0 &&
657 	    (so->so_options & SO_NO_OFFLOAD) == 0 &&
658 	    (error = tcp_offload_connect(so, nam)) == 0)
659 		goto out_in_epoch;
660 #endif
661 	tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
662 	error = tcp_output(tp);
663 out_in_epoch:
664 	NET_EPOCH_EXIT(et);
665 out:
666 	KASSERT(error >= 0, ("TCP stack %s requested tcp_drop(%p) at connect()"
667 	    ", error code %d", tp->t_fb->tfb_tcp_block_name, tp, -error));
668 	/*
669 	 * If the implicit bind in the connect call fails, restore
670 	 * the flags we modified.
671 	 */
672 	if (error != 0 && inp->inp_lport == 0) {
673 		inp->inp_vflag = vflagsav;
674 		inp->inp_inc.inc_flags = incflagsav;
675 	}
676 
677 	tcp_bblog_pru(tp, PRU_CONNECT, error);
678 	TCP_PROBE2(debug__user, tp, PRU_CONNECT);
679 	INP_WUNLOCK(inp);
680 	return (error);
681 }
682 #endif /* INET6 */
683 
684 /*
685  * Initiate disconnect from peer.
686  * If connection never passed embryonic stage, just drop;
687  * else if don't need to let data drain, then can just drop anyways,
688  * else have to begin TCP shutdown process: mark socket disconnecting,
689  * drain unread data, state switch to reflect user close, and
690  * send segment (e.g. FIN) to peer.  Socket will be really disconnected
691  * when peer sends FIN and acks ours.
692  *
693  * SHOULD IMPLEMENT LATER PRU_CONNECT VIA REALLOC TCPCB.
694  */
695 static int
696 tcp_usr_disconnect(struct socket *so)
697 {
698 	struct inpcb *inp;
699 	struct tcpcb *tp = NULL;
700 	struct epoch_tracker et;
701 
702 	NET_EPOCH_ENTER(et);
703 	inp = sotoinpcb(so);
704 	KASSERT(inp != NULL, ("tcp_usr_disconnect: inp == NULL"));
705 	INP_WLOCK(inp);
706 	tp = intotcpcb(inp);
707 
708 	if (tp->t_state == TCPS_TIME_WAIT)
709 		goto out;
710 	tcp_disconnect(tp);
711 out:
712 	tcp_bblog_pru(tp, PRU_DISCONNECT, 0);
713 	TCP_PROBE2(debug__user, tp, PRU_DISCONNECT);
714 	INP_WUNLOCK(inp);
715 	NET_EPOCH_EXIT(et);
716 	return (0);
717 }
718 
719 #ifdef INET
720 /*
721  * Accept a connection.  Essentially all the work is done at higher levels;
722  * just return the address of the peer, storing through addr.
723  */
724 static int
725 tcp_usr_accept(struct socket *so, struct sockaddr *sa)
726 {
727 	struct inpcb *inp;
728 	struct tcpcb *tp;
729 	int error = 0;
730 
731 	inp = sotoinpcb(so);
732 	KASSERT(inp != NULL, ("tcp_usr_accept: inp == NULL"));
733 	INP_WLOCK(inp);
734 	if (inp->inp_flags & INP_DROPPED) {
735 		INP_WUNLOCK(inp);
736 		return (ECONNABORTED);
737 	}
738 	tp = intotcpcb(inp);
739 
740 	if (so->so_state & SS_ISDISCONNECTED)
741 		error = ECONNABORTED;
742 	else
743 		*(struct sockaddr_in *)sa = (struct sockaddr_in ){
744 			.sin_family = AF_INET,
745 			.sin_len = sizeof(struct sockaddr_in),
746 			.sin_port = inp->inp_fport,
747 			.sin_addr = inp->inp_faddr,
748 		};
749 	tcp_bblog_pru(tp, PRU_ACCEPT, error);
750 	TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
751 	INP_WUNLOCK(inp);
752 
753 	return (error);
754 }
755 #endif /* INET */
756 
757 #ifdef INET6
758 static int
759 tcp6_usr_accept(struct socket *so, struct sockaddr *sa)
760 {
761 	struct inpcb *inp;
762 	struct tcpcb *tp;
763 	int error = 0;
764 
765 	inp = sotoinpcb(so);
766 	KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
767 	INP_WLOCK(inp);
768 	if (inp->inp_flags & INP_DROPPED) {
769 		INP_WUNLOCK(inp);
770 		return (ECONNABORTED);
771 	}
772 	tp = intotcpcb(inp);
773 
774 	if (so->so_state & SS_ISDISCONNECTED) {
775 		error = ECONNABORTED;
776 	} else {
777 		if (inp->inp_vflag & INP_IPV4) {
778 			struct sockaddr_in sin = {
779 				.sin_family = AF_INET,
780 				.sin_len = sizeof(struct sockaddr_in),
781 				.sin_port = inp->inp_fport,
782 				.sin_addr = inp->inp_faddr,
783 			};
784 			in6_sin_2_v4mapsin6(&sin, (struct sockaddr_in6 *)sa);
785 		} else {
786 			*(struct sockaddr_in6 *)sa = (struct sockaddr_in6 ){
787 				.sin6_family = AF_INET6,
788 				.sin6_len = sizeof(struct sockaddr_in6),
789 				.sin6_port = inp->inp_fport,
790 				.sin6_addr = inp->in6p_faddr,
791 			};
792 			/* XXX: should catch errors */
793 			(void)sa6_recoverscope((struct sockaddr_in6 *)sa);
794 		}
795 	}
796 
797 	tcp_bblog_pru(tp, PRU_ACCEPT, error);
798 	TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
799 	INP_WUNLOCK(inp);
800 
801 	return (error);
802 }
803 #endif /* INET6 */
804 
805 /*
806  * Mark the connection as being incapable of further output.
807  */
808 static int
809 tcp_usr_shutdown(struct socket *so, enum shutdown_how how)
810 {
811 	struct epoch_tracker et;
812 	struct inpcb *inp = sotoinpcb(so);
813 	struct tcpcb *tp = intotcpcb(inp);
814 	int error = 0;
815 
816 	SOCK_LOCK(so);
817 	if (SOLISTENING(so)) {
818 		if (how != SHUT_WR) {
819 			so->so_error = ECONNABORTED;
820 			solisten_wakeup(so);	/* unlocks so */
821 		} else
822 			SOCK_UNLOCK(so);
823 		return (ENOTCONN);
824 	} else if ((so->so_state &
825 	    (SS_ISCONNECTED | SS_ISCONNECTING | SS_ISDISCONNECTING)) == 0) {
826 		SOCK_UNLOCK(so);
827 		return (ENOTCONN);
828 	}
829 	SOCK_UNLOCK(so);
830 
831 	switch (how) {
832 	case SHUT_RD:
833 		sorflush(so);
834 		break;
835 	case SHUT_RDWR:
836 		sorflush(so);
837 		/* FALLTHROUGH */
838 	case SHUT_WR:
839 		/*
840 		 * XXXGL: mimicing old soshutdown() here. But shouldn't we
841 		 * return ECONNRESEST for SHUT_RD as well?
842 		 */
843 		INP_WLOCK(inp);
844 		if (inp->inp_flags & INP_DROPPED) {
845 			INP_WUNLOCK(inp);
846 			return (ECONNRESET);
847 		}
848 
849 		socantsendmore(so);
850 		NET_EPOCH_ENTER(et);
851 		tcp_usrclosed(tp);
852 		error = tcp_output_nodrop(tp);
853 		tcp_bblog_pru(tp, PRU_SHUTDOWN, error);
854 		TCP_PROBE2(debug__user, tp, PRU_SHUTDOWN);
855 		error = tcp_unlock_or_drop(tp, error);
856 		NET_EPOCH_EXIT(et);
857 	}
858 	wakeup(&so->so_timeo);
859 
860 	return (error);
861 }
862 
863 /*
864  * After a receive, possibly send window update to peer.
865  */
866 static int
867 tcp_usr_rcvd(struct socket *so, int flags)
868 {
869 	struct epoch_tracker et;
870 	struct inpcb *inp;
871 	struct tcpcb *tp;
872 	int outrv = 0, error = 0;
873 
874 	inp = sotoinpcb(so);
875 	KASSERT(inp != NULL, ("tcp_usr_rcvd: inp == NULL"));
876 	INP_WLOCK(inp);
877 	if (inp->inp_flags & INP_DROPPED) {
878 		INP_WUNLOCK(inp);
879 		return (ECONNRESET);
880 	}
881 	tp = intotcpcb(inp);
882 
883 	NET_EPOCH_ENTER(et);
884 	/*
885 	 * For passively-created TFO connections, don't attempt a window
886 	 * update while still in SYN_RECEIVED as this may trigger an early
887 	 * SYN|ACK.  It is preferable to have the SYN|ACK be sent along with
888 	 * application response data, or failing that, when the DELACK timer
889 	 * expires.
890 	 */
891 	if ((tp->t_flags & TF_FASTOPEN) && (tp->t_state == TCPS_SYN_RECEIVED))
892 		goto out;
893 #ifdef TCP_OFFLOAD
894 	if (tp->t_flags & TF_TOE)
895 		tcp_offload_rcvd(tp);
896 	else
897 #endif
898 		outrv = tcp_output_nodrop(tp);
899 out:
900 	tcp_bblog_pru(tp, PRU_RCVD, error);
901 	TCP_PROBE2(debug__user, tp, PRU_RCVD);
902 	(void) tcp_unlock_or_drop(tp, outrv);
903 	NET_EPOCH_EXIT(et);
904 	return (error);
905 }
906 
907 /*
908  * Do a send by putting data in output queue and updating urgent
909  * marker if URG set.  Possibly send more data.  Unlike the other
910  * pr_*() routines, the mbuf chains are our responsibility.  We
911  * must either enqueue them or free them.  The other pr_*() routines
912  * generally are caller-frees.
913  */
914 static int
915 tcp_usr_send(struct socket *so, int flags, struct mbuf *m,
916     struct sockaddr *nam, struct mbuf *control, struct thread *td)
917 {
918 	struct epoch_tracker et;
919 	int error = 0;
920 	struct inpcb *inp;
921 	struct tcpcb *tp;
922 #ifdef INET
923 #ifdef INET6
924 	struct sockaddr_in sin;
925 #endif
926 	struct sockaddr_in *sinp;
927 #endif
928 #ifdef INET6
929 	struct sockaddr_in6 *sin6;
930 	int isipv6;
931 #endif
932 	u_int8_t incflagsav;
933 	u_char vflagsav;
934 	bool restoreflags;
935 
936 	inp = sotoinpcb(so);
937 	KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"));
938 	INP_WLOCK(inp);
939 	if (inp->inp_flags & INP_DROPPED) {
940 		if (m != NULL && (flags & PRUS_NOTREADY) == 0)
941 			m_freem(m);
942 		INP_WUNLOCK(inp);
943 		return (ECONNRESET);
944 	}
945 	tp = intotcpcb(inp);
946 
947 	vflagsav = inp->inp_vflag;
948 	incflagsav = inp->inp_inc.inc_flags;
949 	restoreflags = false;
950 
951 	NET_EPOCH_ENTER(et);
952 	if (control != NULL) {
953 		/* TCP doesn't do control messages (rights, creds, etc) */
954 		if (control->m_len > 0) {
955 			m_freem(control);
956 			error = EINVAL;
957 			goto out;
958 		}
959 		m_freem(control);	/* empty control, just free it */
960 	}
961 
962 	if ((flags & PRUS_OOB) != 0 &&
963 	    (error = tcp_pru_options_support(tp, PRUS_OOB)) != 0)
964 		goto out;
965 
966 	if (nam != NULL && tp->t_state < TCPS_SYN_SENT) {
967 		if (tp->t_state == TCPS_LISTEN) {
968 			error = EINVAL;
969 			goto out;
970 		}
971 		switch (nam->sa_family) {
972 #ifdef INET
973 		case AF_INET:
974 			sinp = (struct sockaddr_in *)nam;
975 			if (sinp->sin_len != sizeof(struct sockaddr_in)) {
976 				error = EINVAL;
977 				goto out;
978 			}
979 			if ((inp->inp_vflag & INP_IPV6) != 0) {
980 				error = EAFNOSUPPORT;
981 				goto out;
982 			}
983 			if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))) {
984 				error = EAFNOSUPPORT;
985 				goto out;
986 			}
987 			if (ntohl(sinp->sin_addr.s_addr) == INADDR_BROADCAST) {
988 				error = EACCES;
989 				goto out;
990 			}
991 			if ((error = prison_remote_ip4(td->td_ucred,
992 			    &sinp->sin_addr)))
993 				goto out;
994 #ifdef INET6
995 			isipv6 = 0;
996 #endif
997 			break;
998 #endif /* INET */
999 #ifdef INET6
1000 		case AF_INET6:
1001 			sin6 = (struct sockaddr_in6 *)nam;
1002 			if (sin6->sin6_len != sizeof(*sin6)) {
1003 				error = EINVAL;
1004 				goto out;
1005 			}
1006 			if ((inp->inp_vflag & INP_IPV6PROTO) == 0) {
1007 				error = EAFNOSUPPORT;
1008 				goto out;
1009 			}
1010 			if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
1011 				error = EAFNOSUPPORT;
1012 				goto out;
1013 			}
1014 			if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
1015 #ifdef INET
1016 				if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
1017 					error = EINVAL;
1018 					goto out;
1019 				}
1020 				if ((inp->inp_vflag & INP_IPV4) == 0) {
1021 					error = EAFNOSUPPORT;
1022 					goto out;
1023 				}
1024 				restoreflags = true;
1025 				inp->inp_vflag &= ~INP_IPV6;
1026 				sinp = &sin;
1027 				in6_sin6_2_sin(sinp, sin6);
1028 				if (IN_MULTICAST(
1029 				    ntohl(sinp->sin_addr.s_addr))) {
1030 					error = EAFNOSUPPORT;
1031 					goto out;
1032 				}
1033 				if ((error = prison_remote_ip4(td->td_ucred,
1034 				    &sinp->sin_addr)))
1035 					goto out;
1036 				isipv6 = 0;
1037 #else /* !INET */
1038 				error = EAFNOSUPPORT;
1039 				goto out;
1040 #endif /* INET */
1041 			} else {
1042 				if ((inp->inp_vflag & INP_IPV6) == 0) {
1043 					error = EAFNOSUPPORT;
1044 					goto out;
1045 				}
1046 				restoreflags = true;
1047 				inp->inp_vflag &= ~INP_IPV4;
1048 				inp->inp_inc.inc_flags |= INC_ISIPV6;
1049 				if ((error = prison_remote_ip6(td->td_ucred,
1050 				    &sin6->sin6_addr)))
1051 					goto out;
1052 				isipv6 = 1;
1053 			}
1054 			break;
1055 #endif /* INET6 */
1056 		default:
1057 			error = EAFNOSUPPORT;
1058 			goto out;
1059 		}
1060 	}
1061 	if (!(flags & PRUS_OOB)) {
1062 		if (tp->t_acktime == 0)
1063 			tp->t_acktime = ticks;
1064 		sbappendstream(&so->so_snd, m, flags);
1065 		m = NULL;
1066 		if (nam && tp->t_state < TCPS_SYN_SENT) {
1067 			KASSERT(tp->t_state == TCPS_CLOSED,
1068 			    ("%s: tp %p is listening", __func__, tp));
1069 
1070 			/*
1071 			 * Do implied connect if not yet connected,
1072 			 * initialize window to default value, and
1073 			 * initialize maxseg using peer's cached MSS.
1074 			 */
1075 #ifdef INET6
1076 			if (isipv6)
1077 				error = tcp6_connect(tp, sin6, td);
1078 #endif /* INET6 */
1079 #if defined(INET6) && defined(INET)
1080 			else
1081 #endif
1082 #ifdef INET
1083 				error = tcp_connect(tp, sinp, td);
1084 #endif
1085 			/*
1086 			 * The bind operation in tcp_connect succeeded. We
1087 			 * no longer want to restore the flags if later
1088 			 * operations fail.
1089 			 */
1090 			if (error == 0 || inp->inp_lport != 0)
1091 				restoreflags = false;
1092 
1093 			if (error) {
1094 				/* m is freed if PRUS_NOTREADY is unset. */
1095 				sbflush(&so->so_snd);
1096 				goto out;
1097 			}
1098 			if (tp->t_flags & TF_FASTOPEN)
1099 				tcp_fastopen_connect(tp);
1100 			else {
1101 				tp->snd_wnd = TTCP_CLIENT_SND_WND;
1102 				tcp_mss(tp, -1);
1103 			}
1104 		}
1105 		if (flags & PRUS_EOF) {
1106 			/*
1107 			 * Close the send side of the connection after
1108 			 * the data is sent.
1109 			 */
1110 			socantsendmore(so);
1111 			tcp_usrclosed(tp);
1112 		}
1113 		if (TCPS_HAVEESTABLISHED(tp->t_state) &&
1114 		    ((tp->t_flags2 & TF2_FBYTES_COMPLETE) == 0) &&
1115 		    (tp->t_fbyte_out == 0) &&
1116 		    (so->so_snd.sb_ccc > 0)) {
1117 			tp->t_fbyte_out = ticks;
1118 			if (tp->t_fbyte_out == 0)
1119 				tp->t_fbyte_out = 1;
1120 			if (tp->t_fbyte_out && tp->t_fbyte_in)
1121 				tp->t_flags2 |= TF2_FBYTES_COMPLETE;
1122 		}
1123 		if (!(inp->inp_flags & INP_DROPPED) &&
1124 		    !(flags & PRUS_NOTREADY)) {
1125 			if (flags & PRUS_MORETOCOME)
1126 				tp->t_flags |= TF_MORETOCOME;
1127 			error = tcp_output_nodrop(tp);
1128 			if (flags & PRUS_MORETOCOME)
1129 				tp->t_flags &= ~TF_MORETOCOME;
1130 		}
1131 	} else {
1132 		/*
1133 		 * XXXRW: PRUS_EOF not implemented with PRUS_OOB?
1134 		 */
1135 		SOCK_SENDBUF_LOCK(so);
1136 		if (sbspace(&so->so_snd) < -512) {
1137 			SOCK_SENDBUF_UNLOCK(so);
1138 			error = ENOBUFS;
1139 			goto out;
1140 		}
1141 		/*
1142 		 * According to RFC961 (Assigned Protocols),
1143 		 * the urgent pointer points to the last octet
1144 		 * of urgent data.  We continue, however,
1145 		 * to consider it to indicate the first octet
1146 		 * of data past the urgent section.
1147 		 * Otherwise, snd_up should be one lower.
1148 		 */
1149 		if (tp->t_acktime == 0)
1150 			tp->t_acktime = ticks;
1151 		sbappendstream_locked(&so->so_snd, m, flags);
1152 		SOCK_SENDBUF_UNLOCK(so);
1153 		m = NULL;
1154 		if (nam && tp->t_state < TCPS_SYN_SENT) {
1155 			/*
1156 			 * Do implied connect if not yet connected,
1157 			 * initialize window to default value, and
1158 			 * initialize maxseg using peer's cached MSS.
1159 			 */
1160 
1161 			/*
1162 			 * Not going to contemplate SYN|URG
1163 			 */
1164 			if (tp->t_flags & TF_FASTOPEN)
1165 				tp->t_flags &= ~TF_FASTOPEN;
1166 #ifdef INET6
1167 			if (isipv6)
1168 				error = tcp6_connect(tp, sin6, td);
1169 #endif /* INET6 */
1170 #if defined(INET6) && defined(INET)
1171 			else
1172 #endif
1173 #ifdef INET
1174 				error = tcp_connect(tp, sinp, td);
1175 #endif
1176 			/*
1177 			 * The bind operation in tcp_connect succeeded. We
1178 			 * no longer want to restore the flags if later
1179 			 * operations fail.
1180 			 */
1181 			if (error == 0 || inp->inp_lport != 0)
1182 				restoreflags = false;
1183 
1184 			if (error != 0) {
1185 				/* m is freed if PRUS_NOTREADY is unset. */
1186 				sbflush(&so->so_snd);
1187 				goto out;
1188 			}
1189 			tp->snd_wnd = TTCP_CLIENT_SND_WND;
1190 			tcp_mss(tp, -1);
1191 		}
1192 		tp->snd_up = tp->snd_una + sbavail(&so->so_snd);
1193 		if ((flags & PRUS_NOTREADY) == 0) {
1194 			tp->t_flags |= TF_FORCEDATA;
1195 			error = tcp_output_nodrop(tp);
1196 			tp->t_flags &= ~TF_FORCEDATA;
1197 		}
1198 	}
1199 	TCP_LOG_EVENT(tp, NULL,
1200 	    &inp->inp_socket->so_rcv,
1201 	    &inp->inp_socket->so_snd,
1202 	    TCP_LOG_USERSEND, error,
1203 	    0, NULL, false);
1204 
1205 out:
1206 	/*
1207 	 * In case of PRUS_NOTREADY, the caller or tcp_usr_ready() is
1208 	 * responsible for freeing memory.
1209 	 */
1210 	if (m != NULL && (flags & PRUS_NOTREADY) == 0)
1211 		m_freem(m);
1212 
1213 	/*
1214 	 * If the request was unsuccessful and we changed flags,
1215 	 * restore the original flags.
1216 	 */
1217 	if (error != 0 && restoreflags) {
1218 		inp->inp_vflag = vflagsav;
1219 		inp->inp_inc.inc_flags = incflagsav;
1220 	}
1221 	tcp_bblog_pru(tp, (flags & PRUS_OOB) ? PRU_SENDOOB :
1222 		      ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND), error);
1223 	TCP_PROBE2(debug__user, tp, (flags & PRUS_OOB) ? PRU_SENDOOB :
1224 		   ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
1225 	error = tcp_unlock_or_drop(tp, error);
1226 	NET_EPOCH_EXIT(et);
1227 	return (error);
1228 }
1229 
1230 static int
1231 tcp_usr_ready(struct socket *so, struct mbuf *m, int count)
1232 {
1233 	struct epoch_tracker et;
1234 	struct inpcb *inp;
1235 	struct tcpcb *tp;
1236 	int error;
1237 
1238 	inp = sotoinpcb(so);
1239 	INP_WLOCK(inp);
1240 	if (inp->inp_flags & INP_DROPPED) {
1241 		INP_WUNLOCK(inp);
1242 		mb_free_notready(m, count);
1243 		return (ECONNRESET);
1244 	}
1245 	tp = intotcpcb(inp);
1246 
1247 	SOCK_SENDBUF_LOCK(so);
1248 	error = sbready(&so->so_snd, m, count);
1249 	SOCK_SENDBUF_UNLOCK(so);
1250 	if (error) {
1251 		INP_WUNLOCK(inp);
1252 		return (error);
1253 	}
1254 	NET_EPOCH_ENTER(et);
1255 	error = tcp_output_unlock(tp);
1256 	NET_EPOCH_EXIT(et);
1257 
1258 	return (error);
1259 }
1260 
1261 /*
1262  * Abort the TCP.  Drop the connection abruptly.
1263  */
1264 static void
1265 tcp_usr_abort(struct socket *so)
1266 {
1267 	struct inpcb *inp;
1268 	struct tcpcb *tp;
1269 	struct epoch_tracker et;
1270 
1271 	inp = sotoinpcb(so);
1272 	KASSERT(inp != NULL, ("tcp_usr_abort: inp == NULL"));
1273 
1274 	NET_EPOCH_ENTER(et);
1275 	INP_WLOCK(inp);
1276 	KASSERT(inp->inp_socket != NULL,
1277 	    ("tcp_usr_abort: inp_socket == NULL"));
1278 
1279 	/*
1280 	 * If we still have full TCP state, and we're not dropped, drop.
1281 	 */
1282 	if (!(inp->inp_flags & INP_DROPPED)) {
1283 		tp = intotcpcb(inp);
1284 		tp = tcp_drop(tp, ECONNABORTED);
1285 		if (tp == NULL)
1286 			goto dropped;
1287 		tcp_bblog_pru(tp, PRU_ABORT, 0);
1288 		TCP_PROBE2(debug__user, tp, PRU_ABORT);
1289 	}
1290 	if (!(inp->inp_flags & INP_DROPPED)) {
1291 		soref(so);
1292 		inp->inp_flags |= INP_SOCKREF;
1293 	}
1294 	INP_WUNLOCK(inp);
1295 dropped:
1296 	NET_EPOCH_EXIT(et);
1297 }
1298 
1299 /*
1300  * TCP socket is closed.  Start friendly disconnect.
1301  */
1302 static void
1303 tcp_usr_close(struct socket *so)
1304 {
1305 	struct inpcb *inp;
1306 	struct tcpcb *tp;
1307 	struct epoch_tracker et;
1308 
1309 	inp = sotoinpcb(so);
1310 	KASSERT(inp != NULL, ("tcp_usr_close: inp == NULL"));
1311 
1312 	NET_EPOCH_ENTER(et);
1313 	INP_WLOCK(inp);
1314 	KASSERT(inp->inp_socket != NULL,
1315 	    ("tcp_usr_close: inp_socket == NULL"));
1316 
1317 	/*
1318 	 * If we are still connected and we're not dropped, initiate
1319 	 * a disconnect.
1320 	 */
1321 	if (!(inp->inp_flags & INP_DROPPED)) {
1322 		tp = intotcpcb(inp);
1323 		if (tp->t_state != TCPS_TIME_WAIT) {
1324 			tp->t_flags |= TF_CLOSED;
1325 			tcp_disconnect(tp);
1326 			tcp_bblog_pru(tp, PRU_CLOSE, 0);
1327 			TCP_PROBE2(debug__user, tp, PRU_CLOSE);
1328 		}
1329 	}
1330 	if (!(inp->inp_flags & INP_DROPPED)) {
1331 		soref(so);
1332 		inp->inp_flags |= INP_SOCKREF;
1333 	}
1334 	INP_WUNLOCK(inp);
1335 	NET_EPOCH_EXIT(et);
1336 }
1337 
1338 static int
1339 tcp_pru_options_support(struct tcpcb *tp, int flags)
1340 {
1341 	/*
1342 	 * If the specific TCP stack has a pru_options
1343 	 * specified then it does not always support
1344 	 * all the PRU_XX options and we must ask it.
1345 	 * If the function is not specified then all
1346 	 * of the PRU_XX options are supported.
1347 	 */
1348 	int ret = 0;
1349 
1350 	if (tp->t_fb->tfb_pru_options) {
1351 		ret = (*tp->t_fb->tfb_pru_options)(tp, flags);
1352 	}
1353 	return (ret);
1354 }
1355 
1356 /*
1357  * Receive out-of-band data.
1358  */
1359 static int
1360 tcp_usr_rcvoob(struct socket *so, struct mbuf *m, int flags)
1361 {
1362 	int error = 0;
1363 	struct inpcb *inp;
1364 	struct tcpcb *tp;
1365 
1366 	inp = sotoinpcb(so);
1367 	KASSERT(inp != NULL, ("tcp_usr_rcvoob: inp == NULL"));
1368 	INP_WLOCK(inp);
1369 	if (inp->inp_flags & INP_DROPPED) {
1370 		INP_WUNLOCK(inp);
1371 		return (ECONNRESET);
1372 	}
1373 	tp = intotcpcb(inp);
1374 
1375 	error = tcp_pru_options_support(tp, PRUS_OOB);
1376 	if (error) {
1377 		goto out;
1378 	}
1379 	if ((so->so_oobmark == 0 &&
1380 	     (so->so_rcv.sb_state & SBS_RCVATMARK) == 0) ||
1381 	    so->so_options & SO_OOBINLINE ||
1382 	    tp->t_oobflags & TCPOOB_HADDATA) {
1383 		error = EINVAL;
1384 		goto out;
1385 	}
1386 	if ((tp->t_oobflags & TCPOOB_HAVEDATA) == 0) {
1387 		error = EWOULDBLOCK;
1388 		goto out;
1389 	}
1390 	m->m_len = 1;
1391 	*mtod(m, caddr_t) = tp->t_iobc;
1392 	if ((flags & MSG_PEEK) == 0)
1393 		tp->t_oobflags ^= (TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1394 
1395 out:
1396 	tcp_bblog_pru(tp, PRU_RCVOOB, error);
1397 	TCP_PROBE2(debug__user, tp, PRU_RCVOOB);
1398 	INP_WUNLOCK(inp);
1399 	return (error);
1400 }
1401 
1402 #ifdef INET
1403 struct protosw tcp_protosw = {
1404 	.pr_type =		SOCK_STREAM,
1405 	.pr_protocol =		IPPROTO_TCP,
1406 	.pr_flags =		PR_CONNREQUIRED | PR_IMPLOPCL | PR_WANTRCVD |
1407 				    PR_CAPATTACH,
1408 	.pr_ctloutput =		tcp_ctloutput,
1409 	.pr_abort =		tcp_usr_abort,
1410 	.pr_accept =		tcp_usr_accept,
1411 	.pr_attach =		tcp_usr_attach,
1412 	.pr_bind =		tcp_usr_bind,
1413 	.pr_connect =		tcp_usr_connect,
1414 	.pr_control =		in_control,
1415 	.pr_detach =		tcp_usr_detach,
1416 	.pr_disconnect =	tcp_usr_disconnect,
1417 	.pr_listen =		tcp_usr_listen,
1418 	.pr_peeraddr =		in_getpeeraddr,
1419 	.pr_rcvd =		tcp_usr_rcvd,
1420 	.pr_rcvoob =		tcp_usr_rcvoob,
1421 	.pr_send =		tcp_usr_send,
1422 	.pr_sendfile_wait =	sendfile_wait_generic,
1423 	.pr_ready =		tcp_usr_ready,
1424 	.pr_shutdown =		tcp_usr_shutdown,
1425 	.pr_sockaddr =		in_getsockaddr,
1426 	.pr_sosetlabel =	in_pcbsosetlabel,
1427 	.pr_close =		tcp_usr_close,
1428 };
1429 #endif /* INET */
1430 
1431 #ifdef INET6
1432 struct protosw tcp6_protosw = {
1433 	.pr_type =		SOCK_STREAM,
1434 	.pr_protocol =		IPPROTO_TCP,
1435 	.pr_flags =		PR_CONNREQUIRED | PR_IMPLOPCL |PR_WANTRCVD |
1436 				    PR_CAPATTACH,
1437 	.pr_ctloutput =		tcp_ctloutput,
1438 	.pr_abort =		tcp_usr_abort,
1439 	.pr_accept =		tcp6_usr_accept,
1440 	.pr_attach =		tcp_usr_attach,
1441 	.pr_bind =		tcp6_usr_bind,
1442 	.pr_connect =		tcp6_usr_connect,
1443 	.pr_control =		in6_control,
1444 	.pr_detach =		tcp_usr_detach,
1445 	.pr_disconnect =	tcp_usr_disconnect,
1446 	.pr_listen =		tcp6_usr_listen,
1447 	.pr_peeraddr =		in6_mapped_peeraddr,
1448 	.pr_rcvd =		tcp_usr_rcvd,
1449 	.pr_rcvoob =		tcp_usr_rcvoob,
1450 	.pr_send =		tcp_usr_send,
1451 	.pr_sendfile_wait =	sendfile_wait_generic,
1452 	.pr_ready =		tcp_usr_ready,
1453 	.pr_shutdown =		tcp_usr_shutdown,
1454 	.pr_sockaddr =		in6_mapped_sockaddr,
1455 	.pr_sosetlabel =	in_pcbsosetlabel,
1456 	.pr_close =		tcp_usr_close,
1457 };
1458 #endif /* INET6 */
1459 
1460 #ifdef INET
1461 /*
1462  * Common subroutine to open a TCP connection to remote host specified
1463  * by struct sockaddr_in.  Call in_pcbconnect() to choose local host address
1464  * and assign a local port number and install the inpcb into the hash.
1465  * Initialize connection parameters and enter SYN-SENT state.
1466  */
1467 static int
1468 tcp_connect(struct tcpcb *tp, struct sockaddr_in *sin, struct thread *td)
1469 {
1470 	struct inpcb *inp = tptoinpcb(tp);
1471 	struct socket *so = tptosocket(tp);
1472 	int error;
1473 
1474 	NET_EPOCH_ASSERT();
1475 	INP_WLOCK_ASSERT(inp);
1476 
1477 	if (__predict_false((so->so_state &
1478 	    (SS_ISCONNECTING | SS_ISCONNECTED | SS_ISDISCONNECTING |
1479 	    SS_ISDISCONNECTED)) != 0))
1480 		return (EISCONN);
1481 
1482 	INP_HASH_WLOCK(&V_tcbinfo);
1483 	error = in_pcbconnect(inp, sin, td->td_ucred);
1484 	INP_HASH_WUNLOCK(&V_tcbinfo);
1485 	if (error != 0)
1486 		return (error);
1487 
1488 	/*
1489 	 * Compute window scaling to request:
1490 	 * Scale to fit into sweet spot.  See tcp_syncache.c.
1491 	 * XXX: This should move to tcp_output().
1492 	 */
1493 	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1494 	    (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1495 		tp->request_r_scale++;
1496 
1497 	soisconnecting(so);
1498 	TCPSTAT_INC(tcps_connattempt);
1499 	tcp_state_change(tp, TCPS_SYN_SENT);
1500 	tp->iss = tcp_new_isn(&inp->inp_inc);
1501 	if (tp->t_flags & TF_REQ_TSTMP)
1502 		tp->ts_offset = tcp_new_ts_offset(&inp->inp_inc);
1503 	tcp_sendseqinit(tp);
1504 
1505 	return (0);
1506 }
1507 #endif /* INET */
1508 
1509 #ifdef INET6
1510 static int
1511 tcp6_connect(struct tcpcb *tp, struct sockaddr_in6 *sin6, struct thread *td)
1512 {
1513 	struct inpcb *inp = tptoinpcb(tp);
1514 	struct socket *so = tptosocket(tp);
1515 	int error;
1516 
1517 	NET_EPOCH_ASSERT();
1518 	INP_WLOCK_ASSERT(inp);
1519 
1520 	if (__predict_false((so->so_state &
1521 	    (SS_ISCONNECTING | SS_ISCONNECTED)) != 0))
1522 		return (EISCONN);
1523 
1524 	INP_HASH_WLOCK(&V_tcbinfo);
1525 	error = in6_pcbconnect(inp, sin6, td->td_ucred, true);
1526 	INP_HASH_WUNLOCK(&V_tcbinfo);
1527 	if (error != 0)
1528 		return (error);
1529 
1530 	/* Compute window scaling to request.  */
1531 	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1532 	    (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1533 		tp->request_r_scale++;
1534 
1535 	soisconnecting(so);
1536 	TCPSTAT_INC(tcps_connattempt);
1537 	tcp_state_change(tp, TCPS_SYN_SENT);
1538 	tp->iss = tcp_new_isn(&inp->inp_inc);
1539 	if (tp->t_flags & TF_REQ_TSTMP)
1540 		tp->ts_offset = tcp_new_ts_offset(&inp->inp_inc);
1541 	tcp_sendseqinit(tp);
1542 
1543 	return (0);
1544 }
1545 #endif /* INET6 */
1546 
1547 /*
1548  * Export TCP internal state information via a struct tcp_info, based on the
1549  * Linux 2.6 API.  Not ABI compatible as our constants are mapped differently
1550  * (TCP state machine, etc).  We export all information using FreeBSD-native
1551  * constants -- for example, the numeric values for tcpi_state will differ
1552  * from Linux.
1553  */
1554 void
1555 tcp_fill_info(const struct tcpcb *tp, struct tcp_info *ti)
1556 {
1557 
1558 	INP_LOCK_ASSERT(tptoinpcb(tp));
1559 	bzero(ti, sizeof(*ti));
1560 
1561 	ti->tcpi_state = tp->t_state;
1562 	if ((tp->t_flags & TF_REQ_TSTMP) && (tp->t_flags & TF_RCVD_TSTMP))
1563 		ti->tcpi_options |= TCPI_OPT_TIMESTAMPS;
1564 	if (tp->t_flags & TF_SACK_PERMIT)
1565 		ti->tcpi_options |= TCPI_OPT_SACK;
1566 	if ((tp->t_flags & TF_REQ_SCALE) && (tp->t_flags & TF_RCVD_SCALE)) {
1567 		ti->tcpi_options |= TCPI_OPT_WSCALE;
1568 		ti->tcpi_snd_wscale = tp->snd_scale;
1569 		ti->tcpi_rcv_wscale = tp->rcv_scale;
1570 	}
1571 	switch (tp->t_flags2 & (TF2_ECN_PERMIT | TF2_ACE_PERMIT)) {
1572 		case TF2_ECN_PERMIT:
1573 			ti->tcpi_options |= TCPI_OPT_ECN;
1574 			break;
1575 		case TF2_ACE_PERMIT:
1576 			/* FALLTHROUGH */
1577 		case TF2_ECN_PERMIT | TF2_ACE_PERMIT:
1578 			ti->tcpi_options |= TCPI_OPT_ACE;
1579 			break;
1580 		default:
1581 			break;
1582 	}
1583 	if (tp->t_flags & TF_FASTOPEN)
1584 		ti->tcpi_options |= TCPI_OPT_TFO;
1585 
1586 	ti->tcpi_rto = tp->t_rxtcur * tick;
1587 	ti->tcpi_last_data_recv = ((uint32_t)ticks - tp->t_rcvtime) * tick;
1588 	ti->tcpi_rtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT;
1589 	ti->tcpi_rttvar = ((u_int64_t)tp->t_rttvar * tick) >> TCP_RTTVAR_SHIFT;
1590 
1591 	ti->tcpi_snd_ssthresh = tp->snd_ssthresh;
1592 	ti->tcpi_snd_cwnd = tp->snd_cwnd;
1593 
1594 	/*
1595 	 * FreeBSD-specific extension fields for tcp_info.
1596 	 */
1597 	ti->tcpi_rcv_space = tp->rcv_wnd;
1598 	ti->tcpi_rcv_nxt = tp->rcv_nxt;
1599 	ti->tcpi_snd_wnd = tp->snd_wnd;
1600 	ti->tcpi_snd_bwnd = 0;		/* Unused, kept for compat. */
1601 	ti->tcpi_snd_nxt = tp->snd_nxt;
1602 	ti->tcpi_snd_mss = tp->t_maxseg;
1603 	ti->tcpi_rcv_mss = tp->t_maxseg;
1604 	ti->tcpi_snd_rexmitpack = tp->t_sndrexmitpack;
1605 	ti->tcpi_rcv_ooopack = tp->t_rcvoopack;
1606 	ti->tcpi_snd_zerowin = tp->t_sndzerowin;
1607 	ti->tcpi_snd_una = tp->snd_una;
1608 	ti->tcpi_snd_max = tp->snd_max;
1609 	ti->tcpi_rcv_numsacks = tp->rcv_numsacks;
1610 	ti->tcpi_rcv_adv = tp->rcv_adv;
1611 	ti->tcpi_dupacks = tp->t_dupacks;
1612 	ti->tcpi_rttmin = tp->t_rttlow;
1613 #ifdef TCP_OFFLOAD
1614 	if (tp->t_flags & TF_TOE) {
1615 		ti->tcpi_options |= TCPI_OPT_TOE;
1616 		tcp_offload_tcp_info(tp, ti);
1617 	}
1618 #endif
1619 	/*
1620 	 * AccECN related counters.
1621 	 */
1622 	if ((tp->t_flags2 & (TF2_ECN_PERMIT | TF2_ACE_PERMIT)) ==
1623 	    (TF2_ECN_PERMIT | TF2_ACE_PERMIT))
1624 		/*
1625 		 * Internal counter starts at 5 for AccECN
1626 		 * but 0 for RFC3168 ECN.
1627 		 */
1628 		ti->tcpi_delivered_ce = tp->t_scep - 5;
1629 	else
1630 		ti->tcpi_delivered_ce = tp->t_scep;
1631 	ti->tcpi_received_ce = tp->t_rcep;
1632 }
1633 
1634 /*
1635  * tcp_ctloutput() must drop the inpcb lock before performing copyin on
1636  * socket option arguments.  When it re-acquires the lock after the copy, it
1637  * has to revalidate that the connection is still valid for the socket
1638  * option.
1639  */
1640 #define INP_WLOCK_RECHECK_CLEANUP(inp, cleanup) do {			\
1641 	INP_WLOCK(inp);							\
1642 	if (inp->inp_flags & INP_DROPPED) {				\
1643 		INP_WUNLOCK(inp);					\
1644 		cleanup;						\
1645 		return (ECONNRESET);					\
1646 	}								\
1647 	tp = intotcpcb(inp);						\
1648 } while(0)
1649 #define INP_WLOCK_RECHECK(inp) INP_WLOCK_RECHECK_CLEANUP((inp), /* noop */)
1650 
1651 int
1652 tcp_ctloutput_set(struct inpcb *inp, struct sockopt *sopt)
1653 {
1654 	struct socket *so = inp->inp_socket;
1655 	struct tcpcb *tp = intotcpcb(inp);
1656 	int error = 0;
1657 
1658 	MPASS(sopt->sopt_dir == SOPT_SET);
1659 	INP_WLOCK_ASSERT(inp);
1660 	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
1661 	    ("inp_flags == %x", inp->inp_flags));
1662 	KASSERT(so != NULL, ("inp_socket == NULL"));
1663 
1664 	if (sopt->sopt_level != IPPROTO_TCP) {
1665 		INP_WUNLOCK(inp);
1666 #ifdef INET6
1667 		if (inp->inp_vflag & INP_IPV6PROTO)
1668 			error = ip6_ctloutput(so, sopt);
1669 #endif
1670 #if defined(INET6) && defined(INET)
1671 		else
1672 #endif
1673 #ifdef INET
1674 			error = ip_ctloutput(so, sopt);
1675 #endif
1676 		/*
1677 		 * When an IP-level socket option affects TCP, pass control
1678 		 * down to stack tfb_tcp_ctloutput, otherwise return what
1679 		 * IP level returned.
1680 		 */
1681 		switch (sopt->sopt_level) {
1682 #ifdef INET6
1683 		case IPPROTO_IPV6:
1684 			if ((inp->inp_vflag & INP_IPV6PROTO) == 0)
1685 				return (error);
1686 			switch (sopt->sopt_name) {
1687 			case IPV6_TCLASS:
1688 				/* Notify tcp stacks that care (e.g. RACK). */
1689 				break;
1690 			case IPV6_USE_MIN_MTU:
1691 				/* Update t_maxseg accordingly. */
1692 				break;
1693 			default:
1694 				return (error);
1695 			}
1696 			break;
1697 #endif
1698 #ifdef INET
1699 		case IPPROTO_IP:
1700 			switch (sopt->sopt_name) {
1701 			case IP_TOS:
1702 				inp->inp_ip_tos &= ~IPTOS_ECN_MASK;
1703 				break;
1704 			case IP_TTL:
1705 				/* Notify tcp stacks that care (e.g. RACK). */
1706 				break;
1707 			default:
1708 				return (error);
1709 			}
1710 			break;
1711 #endif
1712 		default:
1713 			return (error);
1714 		}
1715 		INP_WLOCK_RECHECK(inp);
1716 	} else if (sopt->sopt_name == TCP_FUNCTION_BLK) {
1717 		/*
1718 		 * Protect the TCP option TCP_FUNCTION_BLK so
1719 		 * that a sub-function can *never* overwrite this.
1720 		 */
1721 		struct tcp_function_set fsn;
1722 		struct tcp_function_block *blk;
1723 		void *ptr = NULL;
1724 
1725 		INP_WUNLOCK(inp);
1726 		error = sooptcopyin(sopt, &fsn, sizeof fsn, sizeof fsn);
1727 		if (error)
1728 			return (error);
1729 
1730 		INP_WLOCK_RECHECK(inp);
1731 
1732 		blk = find_and_ref_tcp_functions(&fsn);
1733 		if (blk == NULL) {
1734 			INP_WUNLOCK(inp);
1735 			return (ENOENT);
1736 		}
1737 		if (tp->t_fb == blk) {
1738 			/* You already have this */
1739 			refcount_release(&blk->tfb_refcnt);
1740 			INP_WUNLOCK(inp);
1741 			return (0);
1742 		}
1743 		if (blk->tfb_flags & TCP_FUNC_BEING_REMOVED) {
1744 			refcount_release(&blk->tfb_refcnt);
1745 			INP_WUNLOCK(inp);
1746 			return (ENOENT);
1747 		}
1748 		error = (*blk->tfb_tcp_handoff_ok)(tp);
1749 		if (error) {
1750 			refcount_release(&blk->tfb_refcnt);
1751 			INP_WUNLOCK(inp);
1752 			return (error);
1753 		}
1754 		/*
1755 		 * Ensure the new stack takes ownership with a
1756 		 * clean slate on peak rate threshold.
1757 		 */
1758 		if (tp->t_fb->tfb_tcp_timer_stop_all != NULL)
1759 			tp->t_fb->tfb_tcp_timer_stop_all(tp);
1760 		if (blk->tfb_tcp_fb_init) {
1761 			error = (*blk->tfb_tcp_fb_init)(tp, &ptr);
1762 			if (error) {
1763 				/*
1764 				 * Release the ref count the lookup
1765 				 * acquired.
1766 				 */
1767 				refcount_release(&blk->tfb_refcnt);
1768 				/*
1769 				 * Now there is a chance that the
1770 				 * init() function mucked with some
1771 				 * things before it failed, such as
1772 				 * hpts or inp_flags2 or timer granularity.
1773 				 * It should not of, but lets give the old
1774 				 * stack a chance to reset to a known good state.
1775 				 */
1776 				if (tp->t_fb->tfb_switch_failed) {
1777 					(*tp->t_fb->tfb_switch_failed)(tp);
1778 				}
1779 			 	goto err_out;
1780 			}
1781 		}
1782 		if (tp->t_fb->tfb_tcp_fb_fini) {
1783 			struct epoch_tracker et;
1784 			/*
1785 			 * Tell the stack to cleanup with 0 i.e.
1786 			 * the tcb is not going away.
1787 			 */
1788 			NET_EPOCH_ENTER(et);
1789 			(*tp->t_fb->tfb_tcp_fb_fini)(tp, 0);
1790 			NET_EPOCH_EXIT(et);
1791 		}
1792 		/*
1793 		 * Release the old refcnt, the
1794 		 * lookup acquired a ref on the
1795 		 * new one already.
1796 		 */
1797 		refcount_release(&tp->t_fb->tfb_refcnt);
1798 		/*
1799 		 * Set in the new stack.
1800 		 */
1801 		tp->t_fb = blk;
1802 		tp->t_fb_ptr = ptr;
1803 #ifdef TCP_OFFLOAD
1804 		if (tp->t_flags & TF_TOE) {
1805 			tcp_offload_ctloutput(tp, sopt->sopt_dir,
1806 			     sopt->sopt_name);
1807 		}
1808 #endif
1809 err_out:
1810 		INP_WUNLOCK(inp);
1811 		return (error);
1812 
1813 	}
1814 
1815 	/* Pass in the INP locked, callee must unlock it. */
1816 	return (tp->t_fb->tfb_tcp_ctloutput(tp, sopt));
1817 }
1818 
1819 static int
1820 tcp_ctloutput_get(struct inpcb *inp, struct sockopt *sopt)
1821 {
1822 	struct socket *so = inp->inp_socket;
1823 	struct tcpcb *tp = intotcpcb(inp);
1824 	int error = 0;
1825 
1826 	MPASS(sopt->sopt_dir == SOPT_GET);
1827 	INP_WLOCK_ASSERT(inp);
1828 	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
1829 	    ("inp_flags == %x", inp->inp_flags));
1830 	KASSERT(so != NULL, ("inp_socket == NULL"));
1831 
1832 	if (sopt->sopt_level != IPPROTO_TCP) {
1833 		INP_WUNLOCK(inp);
1834 #ifdef INET6
1835 		if (inp->inp_vflag & INP_IPV6PROTO)
1836 			error = ip6_ctloutput(so, sopt);
1837 #endif /* INET6 */
1838 #if defined(INET6) && defined(INET)
1839 		else
1840 #endif
1841 #ifdef INET
1842 			error = ip_ctloutput(so, sopt);
1843 #endif
1844 		return (error);
1845 	}
1846 	if (((sopt->sopt_name == TCP_FUNCTION_BLK) ||
1847 	     (sopt->sopt_name == TCP_FUNCTION_ALIAS))) {
1848 		struct tcp_function_set fsn;
1849 
1850 		if (sopt->sopt_name == TCP_FUNCTION_ALIAS) {
1851 			memset(&fsn, 0, sizeof(fsn));
1852 			find_tcp_function_alias(tp->t_fb, &fsn);
1853 		} else {
1854 			strncpy(fsn.function_set_name,
1855 			    tp->t_fb->tfb_tcp_block_name,
1856 			    TCP_FUNCTION_NAME_LEN_MAX);
1857 			fsn.function_set_name[TCP_FUNCTION_NAME_LEN_MAX - 1] = '\0';
1858 		}
1859 		fsn.pcbcnt = tp->t_fb->tfb_refcnt;
1860 		INP_WUNLOCK(inp);
1861 		error = sooptcopyout(sopt, &fsn, sizeof fsn);
1862 		return (error);
1863 	}
1864 
1865 	/* Pass in the INP locked, callee must unlock it. */
1866 	return (tp->t_fb->tfb_tcp_ctloutput(tp, sopt));
1867 }
1868 
1869 int
1870 tcp_ctloutput(struct socket *so, struct sockopt *sopt)
1871 {
1872 	struct	inpcb *inp;
1873 
1874 	inp = sotoinpcb(so);
1875 	KASSERT(inp != NULL, ("tcp_ctloutput: inp == NULL"));
1876 
1877 	INP_WLOCK(inp);
1878 	if (inp->inp_flags & INP_DROPPED) {
1879 		INP_WUNLOCK(inp);
1880 		return (ECONNRESET);
1881 	}
1882 	if (sopt->sopt_dir == SOPT_SET)
1883 		return (tcp_ctloutput_set(inp, sopt));
1884 	else if (sopt->sopt_dir == SOPT_GET)
1885 		return (tcp_ctloutput_get(inp, sopt));
1886 	else
1887 		panic("%s: sopt_dir $%d", __func__, sopt->sopt_dir);
1888 }
1889 
1890 /*
1891  * If this assert becomes untrue, we need to change the size of the buf
1892  * variable in tcp_default_ctloutput().
1893  */
1894 #ifdef CTASSERT
1895 CTASSERT(TCP_CA_NAME_MAX <= TCP_LOG_ID_LEN);
1896 CTASSERT(TCP_LOG_REASON_LEN <= TCP_LOG_ID_LEN);
1897 #endif
1898 
1899 extern struct cc_algo newreno_cc_algo;
1900 
1901 static int
1902 tcp_set_cc_mod(struct inpcb *inp, struct sockopt *sopt)
1903 {
1904 	struct cc_algo *algo;
1905 	void *ptr = NULL;
1906 	struct tcpcb *tp;
1907 	struct cc_var cc_mem;
1908 	char	buf[TCP_CA_NAME_MAX];
1909 	size_t mem_sz;
1910 	int error;
1911 
1912 	INP_WUNLOCK(inp);
1913 	error = sooptcopyin(sopt, buf, TCP_CA_NAME_MAX - 1, 1);
1914 	if (error)
1915 		return(error);
1916 	buf[sopt->sopt_valsize] = '\0';
1917 	CC_LIST_RLOCK();
1918 	STAILQ_FOREACH(algo, &cc_list, entries) {
1919 		if (strncmp(buf, algo->name,
1920 			    TCP_CA_NAME_MAX) == 0) {
1921 			if (algo->flags & CC_MODULE_BEING_REMOVED) {
1922 				/* We can't "see" modules being unloaded */
1923 				continue;
1924 			}
1925 			break;
1926 		}
1927 	}
1928 	if (algo == NULL) {
1929 		CC_LIST_RUNLOCK();
1930 		return(ESRCH);
1931 	}
1932 	/*
1933 	 * With a reference the algorithm cannot be removed
1934 	 * so we hold a reference through the change process.
1935 	 */
1936 	cc_refer(algo);
1937 	CC_LIST_RUNLOCK();
1938 	if (algo->cb_init != NULL) {
1939 		/* We can now pre-get the memory for the CC */
1940 		mem_sz = (*algo->cc_data_sz)();
1941 		if (mem_sz == 0) {
1942 			goto no_mem_needed;
1943 		}
1944 		ptr = malloc(mem_sz, M_CC_MEM, M_WAITOK);
1945 	} else {
1946 no_mem_needed:
1947 		mem_sz = 0;
1948 		ptr = NULL;
1949 	}
1950 	/*
1951 	 * Make sure its all clean and zero and also get
1952 	 * back the inplock.
1953 	 */
1954 	memset(&cc_mem, 0, sizeof(cc_mem));
1955 	INP_WLOCK(inp);
1956 	if (inp->inp_flags & INP_DROPPED) {
1957 		INP_WUNLOCK(inp);
1958 		if (ptr)
1959 			free(ptr, M_CC_MEM);
1960 		/* Release our temp reference */
1961 		CC_LIST_RLOCK();
1962 		cc_release(algo);
1963 		CC_LIST_RUNLOCK();
1964 		return (ECONNRESET);
1965 	}
1966 	tp = intotcpcb(inp);
1967 	if (ptr != NULL)
1968 		memset(ptr, 0, mem_sz);
1969 	cc_mem.tp = tp;
1970 	/*
1971 	 * We once again hold a write lock over the tcb so it's
1972 	 * safe to do these things without ordering concerns.
1973 	 * Note here we init into stack memory.
1974 	 */
1975 	if (algo->cb_init != NULL)
1976 		error = algo->cb_init(&cc_mem, ptr);
1977 	else
1978 		error = 0;
1979 	/*
1980 	 * The CC algorithms, when given their memory
1981 	 * should not fail we could in theory have a
1982 	 * KASSERT here.
1983 	 */
1984 	if (error == 0) {
1985 		/*
1986 		 * Touchdown, lets go ahead and move the
1987 		 * connection to the new CC module by
1988 		 * copying in the cc_mem after we call
1989 		 * the old ones cleanup (if any).
1990 		 */
1991 		if (CC_ALGO(tp)->cb_destroy != NULL)
1992 			CC_ALGO(tp)->cb_destroy(&tp->t_ccv);
1993 		/* Detach the old CC from the tcpcb  */
1994 		cc_detach(tp);
1995 		/* Copy in our temp memory that was inited */
1996 		memcpy(&tp->t_ccv, &cc_mem, sizeof(struct cc_var));
1997 		/* Now attach the new, which takes a reference */
1998 		cc_attach(tp, algo);
1999 		/* Ok now are we where we have gotten past any conn_init? */
2000 		if (TCPS_HAVEESTABLISHED(tp->t_state) && (CC_ALGO(tp)->conn_init != NULL)) {
2001 			/* Yep run the connection init for the new CC */
2002 			CC_ALGO(tp)->conn_init(&tp->t_ccv);
2003 		}
2004 	} else if (ptr)
2005 		free(ptr, M_CC_MEM);
2006 	INP_WUNLOCK(inp);
2007 	/* Now lets release our temp reference */
2008 	CC_LIST_RLOCK();
2009 	cc_release(algo);
2010 	CC_LIST_RUNLOCK();
2011 	return (error);
2012 }
2013 
2014 int
2015 tcp_default_ctloutput(struct tcpcb *tp, struct sockopt *sopt)
2016 {
2017 	struct inpcb *inp = tptoinpcb(tp);
2018 	int	error, opt, optval;
2019 	u_int	ui;
2020 	struct	tcp_info ti;
2021 #ifdef KERN_TLS
2022 	struct tls_enable tls;
2023 	struct socket *so = inp->inp_socket;
2024 #endif
2025 	char	*pbuf, buf[TCP_LOG_ID_LEN];
2026 #ifdef STATS
2027 	struct statsblob *sbp;
2028 #endif
2029 	size_t	len;
2030 
2031 	INP_WLOCK_ASSERT(inp);
2032 	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
2033 	    ("inp_flags == %x", inp->inp_flags));
2034 	KASSERT(inp->inp_socket != NULL, ("inp_socket == NULL"));
2035 
2036 	switch (sopt->sopt_level) {
2037 #ifdef INET6
2038 	case IPPROTO_IPV6:
2039 		MPASS(inp->inp_vflag & INP_IPV6PROTO);
2040 		switch (sopt->sopt_name) {
2041 		case IPV6_USE_MIN_MTU:
2042 			tcp6_use_min_mtu(tp);
2043 			/* FALLTHROUGH */
2044 		}
2045 		INP_WUNLOCK(inp);
2046 		return (0);
2047 #endif
2048 #ifdef INET
2049 	case IPPROTO_IP:
2050 		INP_WUNLOCK(inp);
2051 		return (0);
2052 #endif
2053 	}
2054 
2055 	/*
2056 	 * For TCP_CCALGOOPT forward the control to CC module, for both
2057 	 * SOPT_SET and SOPT_GET.
2058 	 */
2059 	switch (sopt->sopt_name) {
2060 	case TCP_CCALGOOPT:
2061 		INP_WUNLOCK(inp);
2062 		if (sopt->sopt_valsize > CC_ALGOOPT_LIMIT)
2063 			return (EINVAL);
2064 		pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
2065 		error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
2066 		    sopt->sopt_valsize);
2067 		if (error) {
2068 			free(pbuf, M_TEMP);
2069 			return (error);
2070 		}
2071 		INP_WLOCK_RECHECK_CLEANUP(inp, free(pbuf, M_TEMP));
2072 		if (CC_ALGO(tp)->ctl_output != NULL)
2073 			error = CC_ALGO(tp)->ctl_output(&tp->t_ccv, sopt, pbuf);
2074 		else
2075 			error = ENOENT;
2076 		INP_WUNLOCK(inp);
2077 		if (error == 0 && sopt->sopt_dir == SOPT_GET)
2078 			error = sooptcopyout(sopt, pbuf, sopt->sopt_valsize);
2079 		free(pbuf, M_TEMP);
2080 		return (error);
2081 	}
2082 
2083 	switch (sopt->sopt_dir) {
2084 	case SOPT_SET:
2085 		switch (sopt->sopt_name) {
2086 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
2087 		case TCP_MD5SIG:
2088 			INP_WUNLOCK(inp);
2089 			if (!TCPMD5_ENABLED())
2090 				return (ENOPROTOOPT);
2091 			error = TCPMD5_PCBCTL(inp, sopt);
2092 			if (error)
2093 				return (error);
2094 			INP_WLOCK_RECHECK(inp);
2095 			goto unlock_and_done;
2096 #endif /* IPSEC */
2097 
2098 		case TCP_NODELAY:
2099 		case TCP_NOOPT:
2100 			INP_WUNLOCK(inp);
2101 			error = sooptcopyin(sopt, &optval, sizeof optval,
2102 			    sizeof optval);
2103 			if (error)
2104 				return (error);
2105 
2106 			INP_WLOCK_RECHECK(inp);
2107 			switch (sopt->sopt_name) {
2108 			case TCP_NODELAY:
2109 				opt = TF_NODELAY;
2110 				break;
2111 			case TCP_NOOPT:
2112 				opt = TF_NOOPT;
2113 				break;
2114 			default:
2115 				opt = 0; /* dead code to fool gcc */
2116 				break;
2117 			}
2118 
2119 			if (optval)
2120 				tp->t_flags |= opt;
2121 			else
2122 				tp->t_flags &= ~opt;
2123 unlock_and_done:
2124 #ifdef TCP_OFFLOAD
2125 			if (tp->t_flags & TF_TOE) {
2126 				tcp_offload_ctloutput(tp, sopt->sopt_dir,
2127 				    sopt->sopt_name);
2128 			}
2129 #endif
2130 			INP_WUNLOCK(inp);
2131 			break;
2132 
2133 		case TCP_NOPUSH:
2134 			INP_WUNLOCK(inp);
2135 			error = sooptcopyin(sopt, &optval, sizeof optval,
2136 			    sizeof optval);
2137 			if (error)
2138 				return (error);
2139 
2140 			INP_WLOCK_RECHECK(inp);
2141 			if (optval)
2142 				tp->t_flags |= TF_NOPUSH;
2143 			else if (tp->t_flags & TF_NOPUSH) {
2144 				tp->t_flags &= ~TF_NOPUSH;
2145 				if (TCPS_HAVEESTABLISHED(tp->t_state)) {
2146 					struct epoch_tracker et;
2147 
2148 					NET_EPOCH_ENTER(et);
2149 					error = tcp_output_nodrop(tp);
2150 					NET_EPOCH_EXIT(et);
2151 				}
2152 			}
2153 			goto unlock_and_done;
2154 
2155 		case TCP_REMOTE_UDP_ENCAPS_PORT:
2156 			INP_WUNLOCK(inp);
2157 			error = sooptcopyin(sopt, &optval, sizeof optval,
2158 			    sizeof optval);
2159 			if (error)
2160 				return (error);
2161 			if ((optval < TCP_TUNNELING_PORT_MIN) ||
2162 			    (optval > TCP_TUNNELING_PORT_MAX)) {
2163 				/* Its got to be in range */
2164 				return (EINVAL);
2165 			}
2166 			if ((V_tcp_udp_tunneling_port == 0) && (optval != 0)) {
2167 				/* You have to have enabled a UDP tunneling port first */
2168 				return (EINVAL);
2169 			}
2170 			INP_WLOCK_RECHECK(inp);
2171 			if (tp->t_state != TCPS_CLOSED) {
2172 				/* You can't change after you are connected */
2173 				error = EINVAL;
2174 			} else {
2175 				/* Ok we are all good set the port */
2176 				tp->t_port = htons(optval);
2177 			}
2178 			goto unlock_and_done;
2179 
2180 		case TCP_MAXSEG:
2181 			INP_WUNLOCK(inp);
2182 			error = sooptcopyin(sopt, &optval, sizeof optval,
2183 			    sizeof optval);
2184 			if (error)
2185 				return (error);
2186 
2187 			INP_WLOCK_RECHECK(inp);
2188 			if (optval > 0 && optval <= tp->t_maxseg &&
2189 			    optval + 40 >= V_tcp_minmss) {
2190 				tp->t_maxseg = optval;
2191 				if (tp->t_maxseg < V_tcp_mssdflt) {
2192 					/*
2193 					 * The MSS is so small we should not process incoming
2194 					 * SACK's since we are subject to attack in such a
2195 					 * case.
2196 					 */
2197 					tp->t_flags2 |= TF2_PROC_SACK_PROHIBIT;
2198 				} else {
2199 					tp->t_flags2 &= ~TF2_PROC_SACK_PROHIBIT;
2200 				}
2201 			} else
2202 				error = EINVAL;
2203 			goto unlock_and_done;
2204 
2205 		case TCP_INFO:
2206 			INP_WUNLOCK(inp);
2207 			error = EINVAL;
2208 			break;
2209 
2210 		case TCP_STATS:
2211 			INP_WUNLOCK(inp);
2212 #ifdef STATS
2213 			error = sooptcopyin(sopt, &optval, sizeof optval,
2214 			    sizeof optval);
2215 			if (error)
2216 				return (error);
2217 
2218 			if (optval > 0)
2219 				sbp = stats_blob_alloc(
2220 				    V_tcp_perconn_stats_dflt_tpl, 0);
2221 			else
2222 				sbp = NULL;
2223 
2224 			INP_WLOCK_RECHECK(inp);
2225 			if ((tp->t_stats != NULL && sbp == NULL) ||
2226 			    (tp->t_stats == NULL && sbp != NULL)) {
2227 				struct statsblob *t = tp->t_stats;
2228 				tp->t_stats = sbp;
2229 				sbp = t;
2230 			}
2231 			INP_WUNLOCK(inp);
2232 
2233 			stats_blob_destroy(sbp);
2234 #else
2235 			return (EOPNOTSUPP);
2236 #endif /* !STATS */
2237 			break;
2238 
2239 		case TCP_CONGESTION:
2240 			error = tcp_set_cc_mod(inp, sopt);
2241 			break;
2242 
2243 		case TCP_REUSPORT_LB_NUMA:
2244 			INP_WUNLOCK(inp);
2245 			error = sooptcopyin(sopt, &optval, sizeof(optval),
2246 			    sizeof(optval));
2247 			INP_WLOCK_RECHECK(inp);
2248 			if (!error)
2249 				error = in_pcblbgroup_numa(inp, optval);
2250 			INP_WUNLOCK(inp);
2251 			break;
2252 
2253 #ifdef KERN_TLS
2254 		case TCP_TXTLS_ENABLE:
2255 			INP_WUNLOCK(inp);
2256 			error = ktls_copyin_tls_enable(sopt, &tls);
2257 			if (error != 0)
2258 				break;
2259 			error = ktls_enable_tx(so, &tls);
2260 			ktls_cleanup_tls_enable(&tls);
2261 			break;
2262 		case TCP_TXTLS_MODE:
2263 			INP_WUNLOCK(inp);
2264 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2265 			if (error != 0)
2266 				return (error);
2267 
2268 			INP_WLOCK_RECHECK(inp);
2269 			error = ktls_set_tx_mode(so, ui);
2270 			INP_WUNLOCK(inp);
2271 			break;
2272 		case TCP_RXTLS_ENABLE:
2273 			INP_WUNLOCK(inp);
2274 			error = ktls_copyin_tls_enable(sopt, &tls);
2275 			if (error != 0)
2276 				break;
2277 			error = ktls_enable_rx(so, &tls);
2278 			ktls_cleanup_tls_enable(&tls);
2279 			break;
2280 #endif
2281 		case TCP_MAXUNACKTIME:
2282 		case TCP_KEEPIDLE:
2283 		case TCP_KEEPINTVL:
2284 		case TCP_KEEPINIT:
2285 			INP_WUNLOCK(inp);
2286 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2287 			if (error)
2288 				return (error);
2289 
2290 			if (ui > (UINT_MAX / hz)) {
2291 				error = EINVAL;
2292 				break;
2293 			}
2294 			ui *= hz;
2295 
2296 			INP_WLOCK_RECHECK(inp);
2297 			switch (sopt->sopt_name) {
2298 			case TCP_MAXUNACKTIME:
2299 				tp->t_maxunacktime = ui;
2300 				break;
2301 
2302 			case TCP_KEEPIDLE:
2303 				tp->t_keepidle = ui;
2304 				/*
2305 				 * XXX: better check current remaining
2306 				 * timeout and "merge" it with new value.
2307 				 */
2308 				if ((tp->t_state > TCPS_LISTEN) &&
2309 				    (tp->t_state <= TCPS_CLOSING))
2310 					tcp_timer_activate(tp, TT_KEEP,
2311 					    TP_KEEPIDLE(tp));
2312 				break;
2313 			case TCP_KEEPINTVL:
2314 				tp->t_keepintvl = ui;
2315 				if ((tp->t_state == TCPS_FIN_WAIT_2) &&
2316 				    (TP_MAXIDLE(tp) > 0))
2317 					tcp_timer_activate(tp, TT_2MSL,
2318 					    TP_MAXIDLE(tp));
2319 				break;
2320 			case TCP_KEEPINIT:
2321 				tp->t_keepinit = ui;
2322 				if (tp->t_state == TCPS_SYN_RECEIVED ||
2323 				    tp->t_state == TCPS_SYN_SENT)
2324 					tcp_timer_activate(tp, TT_KEEP,
2325 					    TP_KEEPINIT(tp));
2326 				break;
2327 			}
2328 			goto unlock_and_done;
2329 
2330 		case TCP_KEEPCNT:
2331 			INP_WUNLOCK(inp);
2332 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2333 			if (error)
2334 				return (error);
2335 
2336 			INP_WLOCK_RECHECK(inp);
2337 			tp->t_keepcnt = ui;
2338 			if ((tp->t_state == TCPS_FIN_WAIT_2) &&
2339 			    (TP_MAXIDLE(tp) > 0))
2340 				tcp_timer_activate(tp, TT_2MSL,
2341 				    TP_MAXIDLE(tp));
2342 			goto unlock_and_done;
2343 
2344 		case TCP_FASTOPEN: {
2345 			struct tcp_fastopen tfo_optval;
2346 
2347 			INP_WUNLOCK(inp);
2348 			if (!V_tcp_fastopen_client_enable &&
2349 			    !V_tcp_fastopen_server_enable)
2350 				return (EPERM);
2351 
2352 			error = sooptcopyin(sopt, &tfo_optval,
2353 				    sizeof(tfo_optval), sizeof(int));
2354 			if (error)
2355 				return (error);
2356 
2357 			INP_WLOCK_RECHECK(inp);
2358 			if ((tp->t_state != TCPS_CLOSED) &&
2359 			    (tp->t_state != TCPS_LISTEN)) {
2360 				error = EINVAL;
2361 				goto unlock_and_done;
2362 			}
2363 			if (tfo_optval.enable) {
2364 				if (tp->t_state == TCPS_LISTEN) {
2365 					if (!V_tcp_fastopen_server_enable) {
2366 						error = EPERM;
2367 						goto unlock_and_done;
2368 					}
2369 
2370 					if (tp->t_tfo_pending == NULL)
2371 						tp->t_tfo_pending =
2372 						    tcp_fastopen_alloc_counter();
2373 				} else {
2374 					/*
2375 					 * If a pre-shared key was provided,
2376 					 * stash it in the client cookie
2377 					 * field of the tcpcb for use during
2378 					 * connect.
2379 					 */
2380 					if (sopt->sopt_valsize ==
2381 					    sizeof(tfo_optval)) {
2382 						memcpy(tp->t_tfo_cookie.client,
2383 						       tfo_optval.psk,
2384 						       TCP_FASTOPEN_PSK_LEN);
2385 						tp->t_tfo_client_cookie_len =
2386 						    TCP_FASTOPEN_PSK_LEN;
2387 					}
2388 				}
2389 				tp->t_flags |= TF_FASTOPEN;
2390 			} else
2391 				tp->t_flags &= ~TF_FASTOPEN;
2392 			goto unlock_and_done;
2393 		}
2394 
2395 #ifdef TCP_BLACKBOX
2396 		case TCP_LOG:
2397 			INP_WUNLOCK(inp);
2398 			error = sooptcopyin(sopt, &optval, sizeof optval,
2399 			    sizeof optval);
2400 			if (error)
2401 				return (error);
2402 
2403 			INP_WLOCK_RECHECK(inp);
2404 			error = tcp_log_state_change(tp, optval);
2405 			goto unlock_and_done;
2406 
2407 		case TCP_LOGBUF:
2408 			INP_WUNLOCK(inp);
2409 			error = EINVAL;
2410 			break;
2411 
2412 		case TCP_LOGID:
2413 			INP_WUNLOCK(inp);
2414 			error = sooptcopyin(sopt, buf, TCP_LOG_ID_LEN - 1, 0);
2415 			if (error)
2416 				break;
2417 			buf[sopt->sopt_valsize] = '\0';
2418 			INP_WLOCK_RECHECK(inp);
2419 			error = tcp_log_set_id(tp, buf);
2420 			/* tcp_log_set_id() unlocks the INP. */
2421 			break;
2422 
2423 		case TCP_LOGDUMP:
2424 		case TCP_LOGDUMPID:
2425 			INP_WUNLOCK(inp);
2426 			error =
2427 			    sooptcopyin(sopt, buf, TCP_LOG_REASON_LEN - 1, 0);
2428 			if (error)
2429 				break;
2430 			buf[sopt->sopt_valsize] = '\0';
2431 			INP_WLOCK_RECHECK(inp);
2432 			if (sopt->sopt_name == TCP_LOGDUMP) {
2433 				error = tcp_log_dump_tp_logbuf(tp, buf,
2434 				    M_WAITOK, true);
2435 				INP_WUNLOCK(inp);
2436 			} else {
2437 				tcp_log_dump_tp_bucket_logbufs(tp, buf);
2438 				/*
2439 				 * tcp_log_dump_tp_bucket_logbufs() drops the
2440 				 * INP lock.
2441 				 */
2442 			}
2443 			break;
2444 #endif
2445 
2446 		default:
2447 			INP_WUNLOCK(inp);
2448 			error = ENOPROTOOPT;
2449 			break;
2450 		}
2451 		break;
2452 
2453 	case SOPT_GET:
2454 		tp = intotcpcb(inp);
2455 		switch (sopt->sopt_name) {
2456 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
2457 		case TCP_MD5SIG:
2458 			INP_WUNLOCK(inp);
2459 			if (!TCPMD5_ENABLED())
2460 				return (ENOPROTOOPT);
2461 			error = TCPMD5_PCBCTL(inp, sopt);
2462 			break;
2463 #endif
2464 
2465 		case TCP_NODELAY:
2466 			optval = tp->t_flags & TF_NODELAY;
2467 			INP_WUNLOCK(inp);
2468 			error = sooptcopyout(sopt, &optval, sizeof optval);
2469 			break;
2470 		case TCP_MAXSEG:
2471 			optval = tp->t_maxseg;
2472 			INP_WUNLOCK(inp);
2473 			error = sooptcopyout(sopt, &optval, sizeof optval);
2474 			break;
2475 		case TCP_REMOTE_UDP_ENCAPS_PORT:
2476 			optval = ntohs(tp->t_port);
2477 			INP_WUNLOCK(inp);
2478 			error = sooptcopyout(sopt, &optval, sizeof optval);
2479 			break;
2480 		case TCP_NOOPT:
2481 			optval = tp->t_flags & TF_NOOPT;
2482 			INP_WUNLOCK(inp);
2483 			error = sooptcopyout(sopt, &optval, sizeof optval);
2484 			break;
2485 		case TCP_NOPUSH:
2486 			optval = tp->t_flags & TF_NOPUSH;
2487 			INP_WUNLOCK(inp);
2488 			error = sooptcopyout(sopt, &optval, sizeof optval);
2489 			break;
2490 		case TCP_INFO:
2491 			tcp_fill_info(tp, &ti);
2492 			INP_WUNLOCK(inp);
2493 			error = sooptcopyout(sopt, &ti, sizeof ti);
2494 			break;
2495 		case TCP_STATS:
2496 			{
2497 #ifdef STATS
2498 			int nheld;
2499 			TYPEOF_MEMBER(struct statsblob, flags) sbflags = 0;
2500 
2501 			error = 0;
2502 			socklen_t outsbsz = sopt->sopt_valsize;
2503 			if (tp->t_stats == NULL)
2504 				error = ENOENT;
2505 			else if (outsbsz >= tp->t_stats->cursz)
2506 				outsbsz = tp->t_stats->cursz;
2507 			else if (outsbsz >= sizeof(struct statsblob))
2508 				outsbsz = sizeof(struct statsblob);
2509 			else
2510 				error = EINVAL;
2511 			INP_WUNLOCK(inp);
2512 			if (error)
2513 				break;
2514 
2515 			sbp = sopt->sopt_val;
2516 			nheld = atop(round_page(((vm_offset_t)sbp) +
2517 			    (vm_size_t)outsbsz) - trunc_page((vm_offset_t)sbp));
2518 			vm_page_t ma[nheld];
2519 			if (vm_fault_quick_hold_pages(
2520 			    &curproc->p_vmspace->vm_map, (vm_offset_t)sbp,
2521 			    outsbsz, VM_PROT_READ | VM_PROT_WRITE, ma,
2522 			    nheld) < 0) {
2523 				error = EFAULT;
2524 				break;
2525 			}
2526 
2527 			if ((error = copyin_nofault(&(sbp->flags), &sbflags,
2528 			    SIZEOF_MEMBER(struct statsblob, flags))))
2529 				goto unhold;
2530 
2531 			INP_WLOCK_RECHECK(inp);
2532 			error = stats_blob_snapshot(&sbp, outsbsz, tp->t_stats,
2533 			    sbflags | SB_CLONE_USRDSTNOFAULT);
2534 			INP_WUNLOCK(inp);
2535 			sopt->sopt_valsize = outsbsz;
2536 unhold:
2537 			vm_page_unhold_pages(ma, nheld);
2538 #else
2539 			INP_WUNLOCK(inp);
2540 			error = EOPNOTSUPP;
2541 #endif /* !STATS */
2542 			break;
2543 			}
2544 		case TCP_CONGESTION:
2545 			len = strlcpy(buf, CC_ALGO(tp)->name, TCP_CA_NAME_MAX);
2546 			INP_WUNLOCK(inp);
2547 			error = sooptcopyout(sopt, buf, len + 1);
2548 			break;
2549 		case TCP_MAXUNACKTIME:
2550 		case TCP_KEEPIDLE:
2551 		case TCP_KEEPINTVL:
2552 		case TCP_KEEPINIT:
2553 		case TCP_KEEPCNT:
2554 			switch (sopt->sopt_name) {
2555 			case TCP_MAXUNACKTIME:
2556 				ui = TP_MAXUNACKTIME(tp) / hz;
2557 				break;
2558 			case TCP_KEEPIDLE:
2559 				ui = TP_KEEPIDLE(tp) / hz;
2560 				break;
2561 			case TCP_KEEPINTVL:
2562 				ui = TP_KEEPINTVL(tp) / hz;
2563 				break;
2564 			case TCP_KEEPINIT:
2565 				ui = TP_KEEPINIT(tp) / hz;
2566 				break;
2567 			case TCP_KEEPCNT:
2568 				ui = TP_KEEPCNT(tp);
2569 				break;
2570 			}
2571 			INP_WUNLOCK(inp);
2572 			error = sooptcopyout(sopt, &ui, sizeof(ui));
2573 			break;
2574 		case TCP_FASTOPEN:
2575 			optval = tp->t_flags & TF_FASTOPEN;
2576 			INP_WUNLOCK(inp);
2577 			error = sooptcopyout(sopt, &optval, sizeof optval);
2578 			break;
2579 #ifdef TCP_BLACKBOX
2580 		case TCP_LOG:
2581 			optval = tcp_get_bblog_state(tp);
2582 			INP_WUNLOCK(inp);
2583 			error = sooptcopyout(sopt, &optval, sizeof(optval));
2584 			break;
2585 		case TCP_LOGBUF:
2586 			/* tcp_log_getlogbuf() does INP_WUNLOCK(inp) */
2587 			error = tcp_log_getlogbuf(sopt, tp);
2588 			break;
2589 		case TCP_LOGID:
2590 			len = tcp_log_get_id(tp, buf);
2591 			INP_WUNLOCK(inp);
2592 			error = sooptcopyout(sopt, buf, len + 1);
2593 			break;
2594 		case TCP_LOGDUMP:
2595 		case TCP_LOGDUMPID:
2596 			INP_WUNLOCK(inp);
2597 			error = EINVAL;
2598 			break;
2599 #endif
2600 #ifdef KERN_TLS
2601 		case TCP_TXTLS_MODE:
2602 			error = ktls_get_tx_mode(so, &optval);
2603 			INP_WUNLOCK(inp);
2604 			if (error == 0)
2605 				error = sooptcopyout(sopt, &optval,
2606 				    sizeof(optval));
2607 			break;
2608 		case TCP_RXTLS_MODE:
2609 			error = ktls_get_rx_mode(so, &optval);
2610 			INP_WUNLOCK(inp);
2611 			if (error == 0)
2612 				error = sooptcopyout(sopt, &optval,
2613 				    sizeof(optval));
2614 			break;
2615 #endif
2616 		default:
2617 			INP_WUNLOCK(inp);
2618 			error = ENOPROTOOPT;
2619 			break;
2620 		}
2621 		break;
2622 	}
2623 	return (error);
2624 }
2625 #undef INP_WLOCK_RECHECK
2626 #undef INP_WLOCK_RECHECK_CLEANUP
2627 
2628 /*
2629  * Initiate (or continue) disconnect.
2630  * If embryonic state, just send reset (once).
2631  * If in ``let data drain'' option and linger null, just drop.
2632  * Otherwise (hard), mark socket disconnecting and drop
2633  * current input data; switch states based on user close, and
2634  * send segment to peer (with FIN).
2635  */
2636 static void
2637 tcp_disconnect(struct tcpcb *tp)
2638 {
2639 	struct inpcb *inp = tptoinpcb(tp);
2640 	struct socket *so = tptosocket(tp);
2641 
2642 	NET_EPOCH_ASSERT();
2643 	INP_WLOCK_ASSERT(inp);
2644 
2645 	/*
2646 	 * Neither tcp_close() nor tcp_drop() should return NULL, as the
2647 	 * socket is still open.
2648 	 */
2649 	if (tp->t_state < TCPS_ESTABLISHED &&
2650 	    !(tp->t_state > TCPS_LISTEN && (tp->t_flags & TF_FASTOPEN))) {
2651 		tp = tcp_close(tp);
2652 		KASSERT(tp != NULL,
2653 		    ("tcp_disconnect: tcp_close() returned NULL"));
2654 	} else if ((so->so_options & SO_LINGER) && so->so_linger == 0) {
2655 		tp = tcp_drop(tp, 0);
2656 		KASSERT(tp != NULL,
2657 		    ("tcp_disconnect: tcp_drop() returned NULL"));
2658 	} else {
2659 		soisdisconnecting(so);
2660 		sbflush(&so->so_rcv);
2661 		tcp_usrclosed(tp);
2662 		if (!(inp->inp_flags & INP_DROPPED))
2663 			/* Ignore stack's drop request, we already at it. */
2664 			(void)tcp_output_nodrop(tp);
2665 	}
2666 }
2667 
2668 /*
2669  * User issued close, and wish to trail through shutdown states:
2670  * if never received SYN, just forget it.  If got a SYN from peer,
2671  * but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN.
2672  * If already got a FIN from peer, then almost done; go to LAST_ACK
2673  * state.  In all other cases, have already sent FIN to peer (e.g.
2674  * after PRU_SHUTDOWN), and just have to play tedious game waiting
2675  * for peer to send FIN or not respond to keep-alives, etc.
2676  * We can let the user exit from the close as soon as the FIN is acked.
2677  */
2678 static void
2679 tcp_usrclosed(struct tcpcb *tp)
2680 {
2681 
2682 	NET_EPOCH_ASSERT();
2683 	INP_WLOCK_ASSERT(tptoinpcb(tp));
2684 
2685 	switch (tp->t_state) {
2686 	case TCPS_LISTEN:
2687 #ifdef TCP_OFFLOAD
2688 		tcp_offload_listen_stop(tp);
2689 #endif
2690 		tcp_state_change(tp, TCPS_CLOSED);
2691 		/* FALLTHROUGH */
2692 	case TCPS_CLOSED:
2693 		tp = tcp_close(tp);
2694 		/*
2695 		 * tcp_close() should never return NULL here as the socket is
2696 		 * still open.
2697 		 */
2698 		KASSERT(tp != NULL,
2699 		    ("tcp_usrclosed: tcp_close() returned NULL"));
2700 		break;
2701 
2702 	case TCPS_SYN_SENT:
2703 	case TCPS_SYN_RECEIVED:
2704 		tp->t_flags |= TF_NEEDFIN;
2705 		break;
2706 
2707 	case TCPS_ESTABLISHED:
2708 		tcp_state_change(tp, TCPS_FIN_WAIT_1);
2709 		break;
2710 
2711 	case TCPS_CLOSE_WAIT:
2712 		tcp_state_change(tp, TCPS_LAST_ACK);
2713 		break;
2714 	}
2715 	if (tp->t_acktime == 0)
2716 		tp->t_acktime = ticks;
2717 	if (tp->t_state >= TCPS_FIN_WAIT_2) {
2718 		tcp_free_sackholes(tp);
2719 		soisdisconnected(tptosocket(tp));
2720 		/* Prevent the connection hanging in FIN_WAIT_2 forever. */
2721 		if (tp->t_state == TCPS_FIN_WAIT_2) {
2722 			int timeout;
2723 
2724 			timeout = (tcp_fast_finwait2_recycle) ?
2725 			    tcp_finwait2_timeout : TP_MAXIDLE(tp);
2726 			tcp_timer_activate(tp, TT_2MSL, timeout);
2727 		}
2728 	}
2729 }
2730 
2731 #ifdef DDB
2732 static void
2733 db_print_indent(int indent)
2734 {
2735 	int i;
2736 
2737 	for (i = 0; i < indent; i++)
2738 		db_printf(" ");
2739 }
2740 
2741 static void
2742 db_print_tstate(int t_state)
2743 {
2744 
2745 	switch (t_state) {
2746 	case TCPS_CLOSED:
2747 		db_printf("TCPS_CLOSED");
2748 		return;
2749 
2750 	case TCPS_LISTEN:
2751 		db_printf("TCPS_LISTEN");
2752 		return;
2753 
2754 	case TCPS_SYN_SENT:
2755 		db_printf("TCPS_SYN_SENT");
2756 		return;
2757 
2758 	case TCPS_SYN_RECEIVED:
2759 		db_printf("TCPS_SYN_RECEIVED");
2760 		return;
2761 
2762 	case TCPS_ESTABLISHED:
2763 		db_printf("TCPS_ESTABLISHED");
2764 		return;
2765 
2766 	case TCPS_CLOSE_WAIT:
2767 		db_printf("TCPS_CLOSE_WAIT");
2768 		return;
2769 
2770 	case TCPS_FIN_WAIT_1:
2771 		db_printf("TCPS_FIN_WAIT_1");
2772 		return;
2773 
2774 	case TCPS_CLOSING:
2775 		db_printf("TCPS_CLOSING");
2776 		return;
2777 
2778 	case TCPS_LAST_ACK:
2779 		db_printf("TCPS_LAST_ACK");
2780 		return;
2781 
2782 	case TCPS_FIN_WAIT_2:
2783 		db_printf("TCPS_FIN_WAIT_2");
2784 		return;
2785 
2786 	case TCPS_TIME_WAIT:
2787 		db_printf("TCPS_TIME_WAIT");
2788 		return;
2789 
2790 	default:
2791 		db_printf("unknown");
2792 		return;
2793 	}
2794 }
2795 
2796 static void
2797 db_print_tflags(u_int t_flags)
2798 {
2799 	int comma;
2800 
2801 	comma = 0;
2802 	if (t_flags & TF_ACKNOW) {
2803 		db_printf("%sTF_ACKNOW", comma ? ", " : "");
2804 		comma = 1;
2805 	}
2806 	if (t_flags & TF_DELACK) {
2807 		db_printf("%sTF_DELACK", comma ? ", " : "");
2808 		comma = 1;
2809 	}
2810 	if (t_flags & TF_NODELAY) {
2811 		db_printf("%sTF_NODELAY", comma ? ", " : "");
2812 		comma = 1;
2813 	}
2814 	if (t_flags & TF_NOOPT) {
2815 		db_printf("%sTF_NOOPT", comma ? ", " : "");
2816 		comma = 1;
2817 	}
2818 	if (t_flags & TF_SENTFIN) {
2819 		db_printf("%sTF_SENTFIN", comma ? ", " : "");
2820 		comma = 1;
2821 	}
2822 	if (t_flags & TF_REQ_SCALE) {
2823 		db_printf("%sTF_REQ_SCALE", comma ? ", " : "");
2824 		comma = 1;
2825 	}
2826 	if (t_flags & TF_RCVD_SCALE) {
2827 		db_printf("%sTF_RECVD_SCALE", comma ? ", " : "");
2828 		comma = 1;
2829 	}
2830 	if (t_flags & TF_REQ_TSTMP) {
2831 		db_printf("%sTF_REQ_TSTMP", comma ? ", " : "");
2832 		comma = 1;
2833 	}
2834 	if (t_flags & TF_RCVD_TSTMP) {
2835 		db_printf("%sTF_RCVD_TSTMP", comma ? ", " : "");
2836 		comma = 1;
2837 	}
2838 	if (t_flags & TF_SACK_PERMIT) {
2839 		db_printf("%sTF_SACK_PERMIT", comma ? ", " : "");
2840 		comma = 1;
2841 	}
2842 	if (t_flags & TF_NEEDSYN) {
2843 		db_printf("%sTF_NEEDSYN", comma ? ", " : "");
2844 		comma = 1;
2845 	}
2846 	if (t_flags & TF_NEEDFIN) {
2847 		db_printf("%sTF_NEEDFIN", comma ? ", " : "");
2848 		comma = 1;
2849 	}
2850 	if (t_flags & TF_NOPUSH) {
2851 		db_printf("%sTF_NOPUSH", comma ? ", " : "");
2852 		comma = 1;
2853 	}
2854 	if (t_flags & TF_PREVVALID) {
2855 		db_printf("%sTF_PREVVALID", comma ? ", " : "");
2856 		comma = 1;
2857 	}
2858 	if (t_flags & TF_WAKESOR) {
2859 		db_printf("%sTF_WAKESOR", comma ? ", " : "");
2860 		comma = 1;
2861 	}
2862 	if (t_flags & TF_GPUTINPROG) {
2863 		db_printf("%sTF_GPUTINPROG", comma ? ", " : "");
2864 		comma = 1;
2865 	}
2866 	if (t_flags & TF_MORETOCOME) {
2867 		db_printf("%sTF_MORETOCOME", comma ? ", " : "");
2868 		comma = 1;
2869 	}
2870 	if (t_flags & TF_SONOTCONN) {
2871 		db_printf("%sTF_SONOTCONN", comma ? ", " : "");
2872 		comma = 1;
2873 	}
2874 	if (t_flags & TF_LASTIDLE) {
2875 		db_printf("%sTF_LASTIDLE", comma ? ", " : "");
2876 		comma = 1;
2877 	}
2878 	if (t_flags & TF_RXWIN0SENT) {
2879 		db_printf("%sTF_RXWIN0SENT", comma ? ", " : "");
2880 		comma = 1;
2881 	}
2882 	if (t_flags & TF_FASTRECOVERY) {
2883 		db_printf("%sTF_FASTRECOVERY", comma ? ", " : "");
2884 		comma = 1;
2885 	}
2886 	if (t_flags & TF_WASFRECOVERY) {
2887 		db_printf("%sTF_WASFRECOVERY", comma ? ", " : "");
2888 		comma = 1;
2889 	}
2890 	if (t_flags & TF_SIGNATURE) {
2891 		db_printf("%sTF_SIGNATURE", comma ? ", " : "");
2892 		comma = 1;
2893 	}
2894 	if (t_flags & TF_FORCEDATA) {
2895 		db_printf("%sTF_FORCEDATA", comma ? ", " : "");
2896 		comma = 1;
2897 	}
2898 	if (t_flags & TF_TSO) {
2899 		db_printf("%sTF_TSO", comma ? ", " : "");
2900 		comma = 1;
2901 	}
2902 	if (t_flags & TF_TOE) {
2903 		db_printf("%sTF_TOE", comma ? ", " : "");
2904 		comma = 1;
2905 	}
2906 	if (t_flags & TF_CLOSED) {
2907 		db_printf("%sTF_CLOSED", comma ? ", " : "");
2908 		comma = 1;
2909 	}
2910 	if (t_flags & TF_SENTSYN) {
2911 		db_printf("%sTF_SENTSYN", comma ? ", " : "");
2912 		comma = 1;
2913 	}
2914 	if (t_flags & TF_LRD) {
2915 		db_printf("%sTF_LRD", comma ? ", " : "");
2916 		comma = 1;
2917 	}
2918 	if (t_flags & TF_CONGRECOVERY) {
2919 		db_printf("%sTF_CONGRECOVERY", comma ? ", " : "");
2920 		comma = 1;
2921 	}
2922 	if (t_flags & TF_WASCRECOVERY) {
2923 		db_printf("%sTF_WASCRECOVERY", comma ? ", " : "");
2924 		comma = 1;
2925 	}
2926 	if (t_flags & TF_FASTOPEN) {
2927 		db_printf("%sTF_FASTOPEN", comma ? ", " : "");
2928 		comma = 1;
2929 	}
2930 }
2931 
2932 static void
2933 db_print_tflags2(u_int t_flags2)
2934 {
2935 	int comma;
2936 
2937 	comma = 0;
2938 	if (t_flags2 & TF2_PLPMTU_BLACKHOLE) {
2939 		db_printf("%sTF2_PLPMTU_BLACKHOLE", comma ? ", " : "");
2940 		comma = 1;
2941 	}
2942 	if (t_flags2 & TF2_PLPMTU_PMTUD) {
2943 		db_printf("%sTF2_PLPMTU_PMTUD", comma ? ", " : "");
2944 		comma = 1;
2945 	}
2946 	if (t_flags2 & TF2_PLPMTU_MAXSEGSNT) {
2947 		db_printf("%sTF2_PLPMTU_MAXSEGSNT", comma ? ", " : "");
2948 		comma = 1;
2949 	}
2950 	if (t_flags2 & TF2_LOG_AUTO) {
2951 		db_printf("%sTF2_LOG_AUTO", comma ? ", " : "");
2952 		comma = 1;
2953 	}
2954 	if (t_flags2 & TF2_DROP_AF_DATA) {
2955 		db_printf("%sTF2_DROP_AF_DATA", comma ? ", " : "");
2956 		comma = 1;
2957 	}
2958 	if (t_flags2 & TF2_ECN_PERMIT) {
2959 		db_printf("%sTF2_ECN_PERMIT", comma ? ", " : "");
2960 		comma = 1;
2961 	}
2962 	if (t_flags2 & TF2_ECN_SND_CWR) {
2963 		db_printf("%sTF2_ECN_SND_CWR", comma ? ", " : "");
2964 		comma = 1;
2965 	}
2966 	if (t_flags2 & TF2_ECN_SND_ECE) {
2967 		db_printf("%sTF2_ECN_SND_ECE", comma ? ", " : "");
2968 		comma = 1;
2969 	}
2970 	if (t_flags2 & TF2_ACE_PERMIT) {
2971 		db_printf("%sTF2_ACE_PERMIT", comma ? ", " : "");
2972 		comma = 1;
2973 	}
2974 	if (t_flags2 & TF2_HPTS_CPU_SET) {
2975 		db_printf("%sTF2_HPTS_CPU_SET", comma ? ", " : "");
2976 		comma = 1;
2977 	}
2978 	if (t_flags2 & TF2_FBYTES_COMPLETE) {
2979 		db_printf("%sTF2_FBYTES_COMPLETE", comma ? ", " : "");
2980 		comma = 1;
2981 	}
2982 	if (t_flags2 & TF2_ECN_USE_ECT1) {
2983 		db_printf("%sTF2_ECN_USE_ECT1", comma ? ", " : "");
2984 		comma = 1;
2985 	}
2986 	if (t_flags2 & TF2_TCP_ACCOUNTING) {
2987 		db_printf("%sTF2_TCP_ACCOUNTING", comma ? ", " : "");
2988 		comma = 1;
2989 	}
2990 	if (t_flags2 & TF2_HPTS_CALLS) {
2991 		db_printf("%sTF2_HPTS_CALLS", comma ? ", " : "");
2992 		comma = 1;
2993 	}
2994 	if (t_flags2 & TF2_MBUF_L_ACKS) {
2995 		db_printf("%sTF2_MBUF_L_ACKS", comma ? ", " : "");
2996 		comma = 1;
2997 	}
2998 	if (t_flags2 & TF2_MBUF_ACKCMP) {
2999 		db_printf("%sTF2_MBUF_ACKCMP", comma ? ", " : "");
3000 		comma = 1;
3001 	}
3002 	if (t_flags2 & TF2_SUPPORTS_MBUFQ) {
3003 		db_printf("%sTF2_SUPPORTS_MBUFQ", comma ? ", " : "");
3004 		comma = 1;
3005 	}
3006 	if (t_flags2 & TF2_MBUF_QUEUE_READY) {
3007 		db_printf("%sTF2_MBUF_QUEUE_READY", comma ? ", " : "");
3008 		comma = 1;
3009 	}
3010 	if (t_flags2 & TF2_DONT_SACK_QUEUE) {
3011 		db_printf("%sTF2_DONT_SACK_QUEUE", comma ? ", " : "");
3012 		comma = 1;
3013 	}
3014 	if (t_flags2 & TF2_CANNOT_DO_ECN) {
3015 		db_printf("%sTF2_CANNOT_DO_ECN", comma ? ", " : "");
3016 		comma = 1;
3017 	}
3018 	if (t_flags2 & TF2_PROC_SACK_PROHIBIT) {
3019 		db_printf("%sTF2_PROC_SACK_PROHIBIT", comma ? ", " : "");
3020 		comma = 1;
3021 	}
3022 	if (t_flags2 & TF2_IPSEC_TSO) {
3023 		db_printf("%sTF2_IPSEC_TSO", comma ? ", " : "");
3024 		comma = 1;
3025 	}
3026 	if (t_flags2 & TF2_NO_ISS_CHECK) {
3027 		db_printf("%sTF2_NO_ISS_CHECK", comma ? ", " : "");
3028 		comma = 1;
3029 	}
3030 }
3031 
3032 static void
3033 db_print_toobflags(char t_oobflags)
3034 {
3035 	int comma;
3036 
3037 	comma = 0;
3038 	if (t_oobflags & TCPOOB_HAVEDATA) {
3039 		db_printf("%sTCPOOB_HAVEDATA", comma ? ", " : "");
3040 		comma = 1;
3041 	}
3042 	if (t_oobflags & TCPOOB_HADDATA) {
3043 		db_printf("%sTCPOOB_HADDATA", comma ? ", " : "");
3044 		comma = 1;
3045 	}
3046 }
3047 
3048 static void
3049 db_print_bblog_state(int state)
3050 {
3051 	switch (state) {
3052 	case TCP_LOG_STATE_RATIO_OFF:
3053 		db_printf("TCP_LOG_STATE_RATIO_OFF");
3054 		break;
3055 	case TCP_LOG_STATE_CLEAR:
3056 		db_printf("TCP_LOG_STATE_CLEAR");
3057 		break;
3058 	case TCP_LOG_STATE_OFF:
3059 		db_printf("TCP_LOG_STATE_OFF");
3060 		break;
3061 	case TCP_LOG_STATE_TAIL:
3062 		db_printf("TCP_LOG_STATE_TAIL");
3063 		break;
3064 	case TCP_LOG_STATE_HEAD:
3065 		db_printf("TCP_LOG_STATE_HEAD");
3066 		break;
3067 	case TCP_LOG_STATE_HEAD_AUTO:
3068 		db_printf("TCP_LOG_STATE_HEAD_AUTO");
3069 		break;
3070 	case TCP_LOG_STATE_CONTINUAL:
3071 		db_printf("TCP_LOG_STATE_CONTINUAL");
3072 		break;
3073 	case TCP_LOG_STATE_TAIL_AUTO:
3074 		db_printf("TCP_LOG_STATE_TAIL_AUTO");
3075 		break;
3076 	case TCP_LOG_VIA_BBPOINTS:
3077 		db_printf("TCP_LOG_STATE_BBPOINTS");
3078 		break;
3079 	default:
3080 		db_printf("UNKNOWN(%d)", state);
3081 		break;
3082 	}
3083 }
3084 
3085 static void
3086 db_print_tcpcb(struct tcpcb *tp, const char *name, int indent)
3087 {
3088 
3089 	db_print_indent(indent);
3090 	db_printf("%s at %p\n", name, tp);
3091 
3092 	indent += 2;
3093 
3094 	db_print_indent(indent);
3095 	db_printf("t_segq first: %p   t_segqlen: %d   t_dupacks: %d\n",
3096 	   TAILQ_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks);
3097 
3098 	db_print_indent(indent);
3099 	db_printf("t_callout: %p   t_timers: %p\n",
3100 	    &tp->t_callout, &tp->t_timers);
3101 
3102 	db_print_indent(indent);
3103 	db_printf("t_state: %d (", tp->t_state);
3104 	db_print_tstate(tp->t_state);
3105 	db_printf(")\n");
3106 
3107 	db_print_indent(indent);
3108 	db_printf("t_flags: 0x%x (", tp->t_flags);
3109 	db_print_tflags(tp->t_flags);
3110 	db_printf(")\n");
3111 
3112 	db_print_indent(indent);
3113 	db_printf("t_flags2: 0x%x (", tp->t_flags2);
3114 	db_print_tflags2(tp->t_flags2);
3115 	db_printf(")\n");
3116 
3117 	db_print_indent(indent);
3118 	db_printf("snd_una: 0x%08x   snd_max: 0x%08x   snd_nxt: 0x%08x\n",
3119 	    tp->snd_una, tp->snd_max, tp->snd_nxt);
3120 
3121 	db_print_indent(indent);
3122 	db_printf("snd_up: 0x%08x   snd_wl1: 0x%08x   snd_wl2: 0x%08x\n",
3123 	   tp->snd_up, tp->snd_wl1, tp->snd_wl2);
3124 
3125 	db_print_indent(indent);
3126 	db_printf("iss: 0x%08x   irs: 0x%08x   rcv_nxt: 0x%08x\n",
3127 	    tp->iss, tp->irs, tp->rcv_nxt);
3128 
3129 	db_print_indent(indent);
3130 	db_printf("rcv_adv: 0x%08x   rcv_wnd: %u   rcv_up: 0x%08x\n",
3131 	    tp->rcv_adv, tp->rcv_wnd, tp->rcv_up);
3132 
3133 	db_print_indent(indent);
3134 	db_printf("snd_wnd: %u   snd_cwnd: %u\n",
3135 	   tp->snd_wnd, tp->snd_cwnd);
3136 
3137 	db_print_indent(indent);
3138 	db_printf("snd_ssthresh: %u   snd_recover: "
3139 	    "0x%08x\n", tp->snd_ssthresh, tp->snd_recover);
3140 
3141 	db_print_indent(indent);
3142 	db_printf("t_rcvtime: %u   t_startime: %u\n",
3143 	    tp->t_rcvtime, tp->t_starttime);
3144 
3145 	db_print_indent(indent);
3146 	db_printf("t_rttime: %u   t_rtsq: 0x%08x\n",
3147 	    tp->t_rtttime, tp->t_rtseq);
3148 
3149 	db_print_indent(indent);
3150 	db_printf("t_rxtcur: %d   t_maxseg: %u   t_srtt: %d\n",
3151 	    tp->t_rxtcur, tp->t_maxseg, tp->t_srtt);
3152 
3153 	db_print_indent(indent);
3154 	db_printf("t_rttvar: %d   t_rxtshift: %d   t_rttmin: %u\n",
3155 	    tp->t_rttvar, tp->t_rxtshift, tp->t_rttmin);
3156 
3157 	db_print_indent(indent);
3158 	db_printf("t_rttupdated: %u   max_sndwnd: %u   t_softerror: %d\n",
3159 	    tp->t_rttupdated, tp->max_sndwnd, tp->t_softerror);
3160 
3161 	db_print_indent(indent);
3162 	db_printf("t_oobflags: 0x%x (", tp->t_oobflags);
3163 	db_print_toobflags(tp->t_oobflags);
3164 	db_printf(")   t_iobc: 0x%02x\n", tp->t_iobc);
3165 
3166 	db_print_indent(indent);
3167 	db_printf("snd_scale: %u   rcv_scale: %u   request_r_scale: %u\n",
3168 	    tp->snd_scale, tp->rcv_scale, tp->request_r_scale);
3169 
3170 	db_print_indent(indent);
3171 	db_printf("ts_recent: %u   ts_recent_age: %u\n",
3172 	    tp->ts_recent, tp->ts_recent_age);
3173 
3174 	db_print_indent(indent);
3175 	db_printf("ts_offset: %u   last_ack_sent: 0x%08x   snd_cwnd_prev: "
3176 	    "%u\n", tp->ts_offset, tp->last_ack_sent, tp->snd_cwnd_prev);
3177 
3178 	db_print_indent(indent);
3179 	db_printf("snd_ssthresh_prev: %u   snd_recover_prev: 0x%08x   "
3180 	    "t_badrxtwin: %u\n", tp->snd_ssthresh_prev,
3181 	    tp->snd_recover_prev, tp->t_badrxtwin);
3182 
3183 	db_print_indent(indent);
3184 	db_printf("snd_numholes: %d  snd_holes first: %p\n",
3185 	    tp->snd_numholes, TAILQ_FIRST(&tp->snd_holes));
3186 
3187 	db_print_indent(indent);
3188 	db_printf("snd_fack: 0x%08x   rcv_numsacks: %d\n",
3189 	    tp->snd_fack, tp->rcv_numsacks);
3190 
3191 	/* Skip sackblks, sackhint. */
3192 
3193 	db_print_indent(indent);
3194 	db_printf("t_rttlow: %d   rfbuf_ts: %u   rfbuf_cnt: %d\n",
3195 	    tp->t_rttlow, tp->rfbuf_ts, tp->rfbuf_cnt);
3196 
3197 	db_print_indent(indent);
3198 	db_printf("t_fb.tfb_tcp_block_name: %s\n", tp->t_fb->tfb_tcp_block_name);
3199 
3200 	db_print_indent(indent);
3201 	db_printf("t_cc.name: %s\n", tp->t_cc->name);
3202 
3203 	db_print_indent(indent);
3204 	db_printf("_t_logstate: %d (", tp->_t_logstate);
3205 	db_print_bblog_state(tp->_t_logstate);
3206 	db_printf(")\n");
3207 
3208 	db_print_indent(indent);
3209 	db_printf("t_lognum: %d   t_loglimit: %d   t_logsn: %u\n",
3210 	    tp->t_lognum, tp->t_loglimit, tp->t_logsn);
3211 }
3212 
3213 DB_SHOW_COMMAND(tcpcb, db_show_tcpcb)
3214 {
3215 	struct tcpcb *tp;
3216 
3217 	if (!have_addr) {
3218 		db_printf("usage: show tcpcb <addr>\n");
3219 		return;
3220 	}
3221 	tp = (struct tcpcb *)addr;
3222 
3223 	db_print_tcpcb(tp, "tcpcb", 0);
3224 }
3225 
3226 DB_SHOW_ALL_COMMAND(tcpcbs, db_show_all_tcpcbs)
3227 {
3228 	VNET_ITERATOR_DECL(vnet_iter);
3229 	struct inpcb *inp;
3230 	bool only_locked;
3231 
3232 	only_locked = strchr(modif, 'l') != NULL;
3233 	VNET_FOREACH(vnet_iter) {
3234 		CURVNET_SET(vnet_iter);
3235 		CK_LIST_FOREACH(inp, &V_tcbinfo.ipi_listhead, inp_list) {
3236 			if (only_locked &&
3237 			    inp->inp_lock.rw_lock == RW_UNLOCKED)
3238 				continue;
3239 			db_print_tcpcb(intotcpcb(inp), "tcpcb", 0);
3240 			if (db_pager_quit)
3241 				break;
3242 		}
3243 		CURVNET_RESTORE();
3244 		if (db_pager_quit)
3245 			break;
3246 	}
3247 }
3248 #endif
3249