xref: /freebsd/sys/netinet/tcp_usrreq.c (revision c91dd7a054b3f2bc0325749950816bed3e6397e8)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1993
5  *	The Regents of the University of California.
6  * Copyright (c) 2006-2007 Robert N. M. Watson
7  * Copyright (c) 2010-2011 Juniper Networks, Inc.
8  * All rights reserved.
9  *
10  * Portions of this software were developed by Robert N. M. Watson under
11  * contract to Juniper Networks, Inc.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 #include <sys/cdefs.h>
39 #include "opt_ddb.h"
40 #include "opt_inet.h"
41 #include "opt_inet6.h"
42 #include "opt_ipsec.h"
43 #include "opt_kern_tls.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/arb.h>
48 #include <sys/limits.h>
49 #include <sys/malloc.h>
50 #include <sys/refcount.h>
51 #include <sys/kernel.h>
52 #include <sys/ktls.h>
53 #include <sys/qmath.h>
54 #include <sys/sysctl.h>
55 #include <sys/mbuf.h>
56 #ifdef INET6
57 #include <sys/domain.h>
58 #endif /* INET6 */
59 #include <sys/socket.h>
60 #include <sys/socketvar.h>
61 #include <sys/protosw.h>
62 #include <sys/proc.h>
63 #include <sys/jail.h>
64 #include <sys/stats.h>
65 
66 #ifdef DDB
67 #include <ddb/ddb.h>
68 #endif
69 
70 #include <net/if.h>
71 #include <net/if_var.h>
72 #include <net/route.h>
73 #include <net/vnet.h>
74 
75 #include <netinet/in.h>
76 #include <netinet/in_kdtrace.h>
77 #include <netinet/in_pcb.h>
78 #include <netinet/in_systm.h>
79 #include <netinet/in_var.h>
80 #include <netinet/ip.h>
81 #include <netinet/ip_var.h>
82 #ifdef INET6
83 #include <netinet/ip6.h>
84 #include <netinet6/in6_pcb.h>
85 #include <netinet6/ip6_var.h>
86 #include <netinet6/scope6_var.h>
87 #endif
88 #include <netinet/tcp.h>
89 #include <netinet/tcp_fsm.h>
90 #include <netinet/tcp_seq.h>
91 #include <netinet/tcp_timer.h>
92 #include <netinet/tcp_var.h>
93 #include <netinet/tcp_log_buf.h>
94 #include <netinet/tcpip.h>
95 #include <netinet/cc/cc.h>
96 #include <netinet/tcp_fastopen.h>
97 #include <netinet/tcp_hpts.h>
98 #ifdef TCPPCAP
99 #include <netinet/tcp_pcap.h>
100 #endif
101 #ifdef TCP_OFFLOAD
102 #include <netinet/tcp_offload.h>
103 #endif
104 #include <netipsec/ipsec_support.h>
105 
106 #include <vm/vm.h>
107 #include <vm/vm_param.h>
108 #include <vm/pmap.h>
109 #include <vm/vm_extern.h>
110 #include <vm/vm_map.h>
111 #include <vm/vm_page.h>
112 
113 /*
114  * TCP protocol interface to socket abstraction.
115  */
116 #ifdef INET
117 static int	tcp_connect(struct tcpcb *, struct sockaddr_in *,
118 		    struct thread *td);
119 #endif /* INET */
120 #ifdef INET6
121 static int	tcp6_connect(struct tcpcb *, struct sockaddr_in6 *,
122 		    struct thread *td);
123 #endif /* INET6 */
124 static void	tcp_disconnect(struct tcpcb *);
125 static void	tcp_usrclosed(struct tcpcb *);
126 static void	tcp_fill_info(const struct tcpcb *, struct tcp_info *);
127 
128 static int	tcp_pru_options_support(struct tcpcb *tp, int flags);
129 
130 static void
131 tcp_bblog_pru(struct tcpcb *tp, uint32_t pru, int error)
132 {
133 	struct tcp_log_buffer *lgb;
134 
135 	KASSERT(tp != NULL, ("tcp_bblog_pru: tp == NULL"));
136 	INP_WLOCK_ASSERT(tptoinpcb(tp));
137 	if (tcp_bblogging_on(tp)) {
138 		lgb = tcp_log_event(tp, NULL, NULL, NULL, TCP_LOG_PRU, error,
139 		    0, NULL, false, NULL, NULL, 0, NULL);
140 	} else {
141 		lgb = NULL;
142 	}
143 	if (lgb != NULL) {
144 		if (error >= 0) {
145 			lgb->tlb_errno = (uint32_t)error;
146 		}
147 		lgb->tlb_flex1 = pru;
148 	}
149 }
150 
151 /*
152  * TCP attaches to socket via pru_attach(), reserving space,
153  * and an internet control block.
154  */
155 static int
156 tcp_usr_attach(struct socket *so, int proto, struct thread *td)
157 {
158 	struct inpcb *inp;
159 	struct tcpcb *tp = NULL;
160 	int error;
161 
162 	inp = sotoinpcb(so);
163 	KASSERT(inp == NULL, ("tcp_usr_attach: inp != NULL"));
164 
165 	error = soreserve(so, V_tcp_sendspace, V_tcp_recvspace);
166 	if (error)
167 		goto out;
168 
169 	so->so_rcv.sb_flags |= SB_AUTOSIZE;
170 	so->so_snd.sb_flags |= SB_AUTOSIZE;
171 	error = in_pcballoc(so, &V_tcbinfo);
172 	if (error)
173 		goto out;
174 	inp = sotoinpcb(so);
175 	tp = tcp_newtcpcb(inp, NULL);
176 	if (tp == NULL) {
177 		error = ENOBUFS;
178 		in_pcbfree(inp);
179 		goto out;
180 	}
181 	tp->t_state = TCPS_CLOSED;
182 	tcp_bblog_pru(tp, PRU_ATTACH, error);
183 	INP_WUNLOCK(inp);
184 	TCPSTATES_INC(TCPS_CLOSED);
185 out:
186 	TCP_PROBE2(debug__user, tp, PRU_ATTACH);
187 	return (error);
188 }
189 
190 /*
191  * tcp_usr_detach is called when the socket layer loses its final reference
192  * to the socket, be it a file descriptor reference, a reference from TCP,
193  * etc.  At this point, there is only one case in which we will keep around
194  * inpcb state: time wait.
195  */
196 static void
197 tcp_usr_detach(struct socket *so)
198 {
199 	struct inpcb *inp;
200 	struct tcpcb *tp;
201 
202 	inp = sotoinpcb(so);
203 	KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
204 	INP_WLOCK(inp);
205 	KASSERT(so->so_pcb == inp && inp->inp_socket == so,
206 		("%s: socket %p inp %p mismatch", __func__, so, inp));
207 
208 	tp = intotcpcb(inp);
209 
210 	KASSERT(inp->inp_flags & INP_DROPPED ||
211 	    tp->t_state < TCPS_SYN_SENT,
212 	    ("%s: inp %p not dropped or embryonic", __func__, inp));
213 
214 	tcp_discardcb(tp);
215 	in_pcbfree(inp);
216 }
217 
218 #ifdef INET
219 /*
220  * Give the socket an address.
221  */
222 static int
223 tcp_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
224 {
225 	int error = 0;
226 	struct inpcb *inp;
227 	struct tcpcb *tp;
228 	struct sockaddr_in *sinp;
229 
230 	inp = sotoinpcb(so);
231 	KASSERT(inp != NULL, ("tcp_usr_bind: inp == NULL"));
232 	INP_WLOCK(inp);
233 	if (inp->inp_flags & INP_DROPPED) {
234 		INP_WUNLOCK(inp);
235 		return (EINVAL);
236 	}
237 	tp = intotcpcb(inp);
238 
239 	sinp = (struct sockaddr_in *)nam;
240 	if (nam->sa_family != AF_INET) {
241 		/*
242 		 * Preserve compatibility with old programs.
243 		 */
244 		if (nam->sa_family != AF_UNSPEC ||
245 		    nam->sa_len < offsetof(struct sockaddr_in, sin_zero) ||
246 		    sinp->sin_addr.s_addr != INADDR_ANY) {
247 			error = EAFNOSUPPORT;
248 			goto out;
249 		}
250 		nam->sa_family = AF_INET;
251 	}
252 	if (nam->sa_len != sizeof(*sinp)) {
253 		error = EINVAL;
254 		goto out;
255 	}
256 	/*
257 	 * Must check for multicast addresses and disallow binding
258 	 * to them.
259 	 */
260 	if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))) {
261 		error = EAFNOSUPPORT;
262 		goto out;
263 	}
264 	INP_HASH_WLOCK(&V_tcbinfo);
265 	error = in_pcbbind(inp, sinp, td->td_ucred);
266 	INP_HASH_WUNLOCK(&V_tcbinfo);
267 out:
268 	tcp_bblog_pru(tp, PRU_BIND, error);
269 	TCP_PROBE2(debug__user, tp, PRU_BIND);
270 	INP_WUNLOCK(inp);
271 
272 	return (error);
273 }
274 #endif /* INET */
275 
276 #ifdef INET6
277 static int
278 tcp6_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
279 {
280 	int error = 0;
281 	struct inpcb *inp;
282 	struct tcpcb *tp;
283 	struct sockaddr_in6 *sin6;
284 	u_char vflagsav;
285 
286 	inp = sotoinpcb(so);
287 	KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
288 	INP_WLOCK(inp);
289 	if (inp->inp_flags & INP_DROPPED) {
290 		INP_WUNLOCK(inp);
291 		return (EINVAL);
292 	}
293 	tp = intotcpcb(inp);
294 
295 	vflagsav = inp->inp_vflag;
296 
297 	sin6 = (struct sockaddr_in6 *)nam;
298 	if (nam->sa_family != AF_INET6) {
299 		error = EAFNOSUPPORT;
300 		goto out;
301 	}
302 	if (nam->sa_len != sizeof(*sin6)) {
303 		error = EINVAL;
304 		goto out;
305 	}
306 	/*
307 	 * Must check for multicast addresses and disallow binding
308 	 * to them.
309 	 */
310 	if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
311 		error = EAFNOSUPPORT;
312 		goto out;
313 	}
314 
315 	INP_HASH_WLOCK(&V_tcbinfo);
316 	inp->inp_vflag &= ~INP_IPV4;
317 	inp->inp_vflag |= INP_IPV6;
318 #ifdef INET
319 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
320 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
321 			inp->inp_vflag |= INP_IPV4;
322 		else if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
323 			struct sockaddr_in sin;
324 
325 			in6_sin6_2_sin(&sin, sin6);
326 			if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
327 				error = EAFNOSUPPORT;
328 				INP_HASH_WUNLOCK(&V_tcbinfo);
329 				goto out;
330 			}
331 			inp->inp_vflag |= INP_IPV4;
332 			inp->inp_vflag &= ~INP_IPV6;
333 			error = in_pcbbind(inp, &sin, td->td_ucred);
334 			INP_HASH_WUNLOCK(&V_tcbinfo);
335 			goto out;
336 		}
337 	}
338 #endif
339 	error = in6_pcbbind(inp, sin6, td->td_ucred);
340 	INP_HASH_WUNLOCK(&V_tcbinfo);
341 out:
342 	if (error != 0)
343 		inp->inp_vflag = vflagsav;
344 	tcp_bblog_pru(tp, PRU_BIND, error);
345 	TCP_PROBE2(debug__user, tp, PRU_BIND);
346 	INP_WUNLOCK(inp);
347 	return (error);
348 }
349 #endif /* INET6 */
350 
351 #ifdef INET
352 /*
353  * Prepare to accept connections.
354  */
355 static int
356 tcp_usr_listen(struct socket *so, int backlog, struct thread *td)
357 {
358 	int error = 0;
359 	struct inpcb *inp;
360 	struct tcpcb *tp;
361 
362 	inp = sotoinpcb(so);
363 	KASSERT(inp != NULL, ("tcp_usr_listen: inp == NULL"));
364 	INP_WLOCK(inp);
365 	if (inp->inp_flags & INP_DROPPED) {
366 		INP_WUNLOCK(inp);
367 		return (EINVAL);
368 	}
369 	tp = intotcpcb(inp);
370 
371 	SOCK_LOCK(so);
372 	error = solisten_proto_check(so);
373 	if (error != 0) {
374 		SOCK_UNLOCK(so);
375 		goto out;
376 	}
377 	if (inp->inp_lport == 0) {
378 		INP_HASH_WLOCK(&V_tcbinfo);
379 		error = in_pcbbind(inp, NULL, td->td_ucred);
380 		INP_HASH_WUNLOCK(&V_tcbinfo);
381 	}
382 	if (error == 0) {
383 		tcp_state_change(tp, TCPS_LISTEN);
384 		solisten_proto(so, backlog);
385 #ifdef TCP_OFFLOAD
386 		if ((so->so_options & SO_NO_OFFLOAD) == 0)
387 			tcp_offload_listen_start(tp);
388 #endif
389 	} else {
390 		solisten_proto_abort(so);
391 	}
392 	SOCK_UNLOCK(so);
393 
394 	if (tp->t_flags & TF_FASTOPEN)
395 		tp->t_tfo_pending = tcp_fastopen_alloc_counter();
396 
397 out:
398 	tcp_bblog_pru(tp, PRU_LISTEN, error);
399 	TCP_PROBE2(debug__user, tp, PRU_LISTEN);
400 	INP_WUNLOCK(inp);
401 	return (error);
402 }
403 #endif /* INET */
404 
405 #ifdef INET6
406 static int
407 tcp6_usr_listen(struct socket *so, int backlog, struct thread *td)
408 {
409 	int error = 0;
410 	struct inpcb *inp;
411 	struct tcpcb *tp;
412 	u_char vflagsav;
413 
414 	inp = sotoinpcb(so);
415 	KASSERT(inp != NULL, ("tcp6_usr_listen: inp == NULL"));
416 	INP_WLOCK(inp);
417 	if (inp->inp_flags & INP_DROPPED) {
418 		INP_WUNLOCK(inp);
419 		return (EINVAL);
420 	}
421 	tp = intotcpcb(inp);
422 
423 	vflagsav = inp->inp_vflag;
424 
425 	SOCK_LOCK(so);
426 	error = solisten_proto_check(so);
427 	if (error != 0) {
428 		SOCK_UNLOCK(so);
429 		goto out;
430 	}
431 	INP_HASH_WLOCK(&V_tcbinfo);
432 	if (inp->inp_lport == 0) {
433 		inp->inp_vflag &= ~INP_IPV4;
434 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
435 			inp->inp_vflag |= INP_IPV4;
436 		error = in6_pcbbind(inp, NULL, td->td_ucred);
437 	}
438 	INP_HASH_WUNLOCK(&V_tcbinfo);
439 	if (error == 0) {
440 		tcp_state_change(tp, TCPS_LISTEN);
441 		solisten_proto(so, backlog);
442 #ifdef TCP_OFFLOAD
443 		if ((so->so_options & SO_NO_OFFLOAD) == 0)
444 			tcp_offload_listen_start(tp);
445 #endif
446 	} else {
447 		solisten_proto_abort(so);
448 	}
449 	SOCK_UNLOCK(so);
450 
451 	if (tp->t_flags & TF_FASTOPEN)
452 		tp->t_tfo_pending = tcp_fastopen_alloc_counter();
453 
454 	if (error != 0)
455 		inp->inp_vflag = vflagsav;
456 
457 out:
458 	tcp_bblog_pru(tp, PRU_LISTEN, error);
459 	TCP_PROBE2(debug__user, tp, PRU_LISTEN);
460 	INP_WUNLOCK(inp);
461 	return (error);
462 }
463 #endif /* INET6 */
464 
465 #ifdef INET
466 /*
467  * Initiate connection to peer.
468  * Create a template for use in transmissions on this connection.
469  * Enter SYN_SENT state, and mark socket as connecting.
470  * Start keep-alive timer, and seed output sequence space.
471  * Send initial segment on connection.
472  */
473 static int
474 tcp_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
475 {
476 	struct epoch_tracker et;
477 	int error = 0;
478 	struct inpcb *inp;
479 	struct tcpcb *tp;
480 	struct sockaddr_in *sinp;
481 
482 	inp = sotoinpcb(so);
483 	KASSERT(inp != NULL, ("tcp_usr_connect: inp == NULL"));
484 	INP_WLOCK(inp);
485 	if (inp->inp_flags & INP_DROPPED) {
486 		INP_WUNLOCK(inp);
487 		return (ECONNREFUSED);
488 	}
489 	tp = intotcpcb(inp);
490 
491 	sinp = (struct sockaddr_in *)nam;
492 	if (nam->sa_family != AF_INET) {
493 		error = EAFNOSUPPORT;
494 		goto out;
495 	}
496 	if (nam->sa_len != sizeof (*sinp)) {
497 		error = EINVAL;
498 		goto out;
499 	}
500 	/*
501 	 * Must disallow TCP ``connections'' to multicast addresses.
502 	 */
503 	if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))) {
504 		error = EAFNOSUPPORT;
505 		goto out;
506 	}
507 	if (ntohl(sinp->sin_addr.s_addr) == INADDR_BROADCAST) {
508 		error = EACCES;
509 		goto out;
510 	}
511 	if ((error = prison_remote_ip4(td->td_ucred, &sinp->sin_addr)) != 0)
512 		goto out;
513 	if (SOLISTENING(so)) {
514 		error = EOPNOTSUPP;
515 		goto out;
516 	}
517 	NET_EPOCH_ENTER(et);
518 	if ((error = tcp_connect(tp, sinp, td)) != 0)
519 		goto out_in_epoch;
520 #ifdef TCP_OFFLOAD
521 	if (registered_toedevs > 0 &&
522 	    (so->so_options & SO_NO_OFFLOAD) == 0 &&
523 	    (error = tcp_offload_connect(so, nam)) == 0)
524 		goto out_in_epoch;
525 #endif
526 	tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
527 	error = tcp_output(tp);
528 	KASSERT(error >= 0, ("TCP stack %s requested tcp_drop(%p) at connect()"
529 	    ", error code %d", tp->t_fb->tfb_tcp_block_name, tp, -error));
530 out_in_epoch:
531 	NET_EPOCH_EXIT(et);
532 out:
533 	tcp_bblog_pru(tp, PRU_CONNECT, error);
534 	TCP_PROBE2(debug__user, tp, PRU_CONNECT);
535 	INP_WUNLOCK(inp);
536 	return (error);
537 }
538 #endif /* INET */
539 
540 #ifdef INET6
541 static int
542 tcp6_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
543 {
544 	struct epoch_tracker et;
545 	int error = 0;
546 	struct inpcb *inp;
547 	struct tcpcb *tp;
548 	struct sockaddr_in6 *sin6;
549 	u_int8_t incflagsav;
550 	u_char vflagsav;
551 
552 	inp = sotoinpcb(so);
553 	KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
554 	INP_WLOCK(inp);
555 	if (inp->inp_flags & INP_DROPPED) {
556 		INP_WUNLOCK(inp);
557 		return (ECONNREFUSED);
558 	}
559 	tp = intotcpcb(inp);
560 
561 	vflagsav = inp->inp_vflag;
562 	incflagsav = inp->inp_inc.inc_flags;
563 
564 	sin6 = (struct sockaddr_in6 *)nam;
565 	if (nam->sa_family != AF_INET6) {
566 		error = EAFNOSUPPORT;
567 		goto out;
568 	}
569 	if (nam->sa_len != sizeof (*sin6)) {
570 		error = EINVAL;
571 		goto out;
572 	}
573 	/*
574 	 * Must disallow TCP ``connections'' to multicast addresses.
575 	 */
576 	if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
577 		error = EAFNOSUPPORT;
578 		goto out;
579 	}
580 	if (SOLISTENING(so)) {
581 		error = EINVAL;
582 		goto out;
583 	}
584 #ifdef INET
585 	/*
586 	 * XXXRW: Some confusion: V4/V6 flags relate to binding, and
587 	 * therefore probably require the hash lock, which isn't held here.
588 	 * Is this a significant problem?
589 	 */
590 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
591 		struct sockaddr_in sin;
592 
593 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
594 			error = EINVAL;
595 			goto out;
596 		}
597 		if ((inp->inp_vflag & INP_IPV4) == 0) {
598 			error = EAFNOSUPPORT;
599 			goto out;
600 		}
601 
602 		in6_sin6_2_sin(&sin, sin6);
603 		if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
604 			error = EAFNOSUPPORT;
605 			goto out;
606 		}
607 		if (ntohl(sin.sin_addr.s_addr) == INADDR_BROADCAST) {
608 			error = EACCES;
609 			goto out;
610 		}
611 		if ((error = prison_remote_ip4(td->td_ucred,
612 		    &sin.sin_addr)) != 0)
613 			goto out;
614 		inp->inp_vflag |= INP_IPV4;
615 		inp->inp_vflag &= ~INP_IPV6;
616 		NET_EPOCH_ENTER(et);
617 		if ((error = tcp_connect(tp, &sin, td)) != 0)
618 			goto out_in_epoch;
619 #ifdef TCP_OFFLOAD
620 		if (registered_toedevs > 0 &&
621 		    (so->so_options & SO_NO_OFFLOAD) == 0 &&
622 		    (error = tcp_offload_connect(so, nam)) == 0)
623 			goto out_in_epoch;
624 #endif
625 		error = tcp_output(tp);
626 		goto out_in_epoch;
627 	} else {
628 		if ((inp->inp_vflag & INP_IPV6) == 0) {
629 			error = EAFNOSUPPORT;
630 			goto out;
631 		}
632 	}
633 #endif
634 	if ((error = prison_remote_ip6(td->td_ucred, &sin6->sin6_addr)) != 0)
635 		goto out;
636 	inp->inp_vflag &= ~INP_IPV4;
637 	inp->inp_vflag |= INP_IPV6;
638 	inp->inp_inc.inc_flags |= INC_ISIPV6;
639 	NET_EPOCH_ENTER(et);
640 	if ((error = tcp6_connect(tp, sin6, td)) != 0)
641 		goto out_in_epoch;
642 #ifdef TCP_OFFLOAD
643 	if (registered_toedevs > 0 &&
644 	    (so->so_options & SO_NO_OFFLOAD) == 0 &&
645 	    (error = tcp_offload_connect(so, nam)) == 0)
646 		goto out_in_epoch;
647 #endif
648 	tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
649 	error = tcp_output(tp);
650 out_in_epoch:
651 	NET_EPOCH_EXIT(et);
652 out:
653 	KASSERT(error >= 0, ("TCP stack %s requested tcp_drop(%p) at connect()"
654 	    ", error code %d", tp->t_fb->tfb_tcp_block_name, tp, -error));
655 	/*
656 	 * If the implicit bind in the connect call fails, restore
657 	 * the flags we modified.
658 	 */
659 	if (error != 0 && inp->inp_lport == 0) {
660 		inp->inp_vflag = vflagsav;
661 		inp->inp_inc.inc_flags = incflagsav;
662 	}
663 
664 	tcp_bblog_pru(tp, PRU_CONNECT, error);
665 	TCP_PROBE2(debug__user, tp, PRU_CONNECT);
666 	INP_WUNLOCK(inp);
667 	return (error);
668 }
669 #endif /* INET6 */
670 
671 /*
672  * Initiate disconnect from peer.
673  * If connection never passed embryonic stage, just drop;
674  * else if don't need to let data drain, then can just drop anyways,
675  * else have to begin TCP shutdown process: mark socket disconnecting,
676  * drain unread data, state switch to reflect user close, and
677  * send segment (e.g. FIN) to peer.  Socket will be really disconnected
678  * when peer sends FIN and acks ours.
679  *
680  * SHOULD IMPLEMENT LATER PRU_CONNECT VIA REALLOC TCPCB.
681  */
682 static int
683 tcp_usr_disconnect(struct socket *so)
684 {
685 	struct inpcb *inp;
686 	struct tcpcb *tp = NULL;
687 	struct epoch_tracker et;
688 
689 	NET_EPOCH_ENTER(et);
690 	inp = sotoinpcb(so);
691 	KASSERT(inp != NULL, ("tcp_usr_disconnect: inp == NULL"));
692 	INP_WLOCK(inp);
693 	if (inp->inp_flags & INP_DROPPED) {
694 		INP_WUNLOCK(inp);
695 		NET_EPOCH_EXIT(et);
696 		return (ECONNRESET);
697 	}
698 	tp = intotcpcb(inp);
699 
700 	if (tp->t_state == TCPS_TIME_WAIT)
701 		goto out;
702 	tcp_disconnect(tp);
703 out:
704 	tcp_bblog_pru(tp, PRU_DISCONNECT, 0);
705 	TCP_PROBE2(debug__user, tp, PRU_DISCONNECT);
706 	INP_WUNLOCK(inp);
707 	NET_EPOCH_EXIT(et);
708 	return (0);
709 }
710 
711 #ifdef INET
712 /*
713  * Accept a connection.  Essentially all the work is done at higher levels;
714  * just return the address of the peer, storing through addr.
715  */
716 static int
717 tcp_usr_accept(struct socket *so, struct sockaddr *sa)
718 {
719 	struct inpcb *inp;
720 	struct tcpcb *tp;
721 	int error = 0;
722 
723 	inp = sotoinpcb(so);
724 	KASSERT(inp != NULL, ("tcp_usr_accept: inp == NULL"));
725 	INP_WLOCK(inp);
726 	if (inp->inp_flags & INP_DROPPED) {
727 		INP_WUNLOCK(inp);
728 		return (ECONNABORTED);
729 	}
730 	tp = intotcpcb(inp);
731 
732 	if (so->so_state & SS_ISDISCONNECTED)
733 		error = ECONNABORTED;
734 	else
735 		*(struct sockaddr_in *)sa = (struct sockaddr_in ){
736 			.sin_family = AF_INET,
737 			.sin_len = sizeof(struct sockaddr_in),
738 			.sin_port = inp->inp_fport,
739 			.sin_addr = inp->inp_faddr,
740 		};
741 	tcp_bblog_pru(tp, PRU_ACCEPT, error);
742 	TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
743 	INP_WUNLOCK(inp);
744 
745 	return (error);
746 }
747 #endif /* INET */
748 
749 #ifdef INET6
750 static int
751 tcp6_usr_accept(struct socket *so, struct sockaddr *sa)
752 {
753 	struct inpcb *inp;
754 	struct tcpcb *tp;
755 	int error = 0;
756 
757 	inp = sotoinpcb(so);
758 	KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
759 	INP_WLOCK(inp);
760 	if (inp->inp_flags & INP_DROPPED) {
761 		INP_WUNLOCK(inp);
762 		return (ECONNABORTED);
763 	}
764 	tp = intotcpcb(inp);
765 
766 	if (so->so_state & SS_ISDISCONNECTED) {
767 		error = ECONNABORTED;
768 	} else {
769 		if (inp->inp_vflag & INP_IPV4) {
770 			struct sockaddr_in sin = {
771 				.sin_family = AF_INET,
772 				.sin_len = sizeof(struct sockaddr_in),
773 				.sin_port = inp->inp_fport,
774 				.sin_addr = inp->inp_faddr,
775 			};
776 			in6_sin_2_v4mapsin6(&sin, (struct sockaddr_in6 *)sa);
777 		} else {
778 			*(struct sockaddr_in6 *)sa = (struct sockaddr_in6 ){
779 				.sin6_family = AF_INET6,
780 				.sin6_len = sizeof(struct sockaddr_in6),
781 				.sin6_port = inp->inp_fport,
782 				.sin6_addr = inp->in6p_faddr,
783 			};
784 			/* XXX: should catch errors */
785 			(void)sa6_recoverscope((struct sockaddr_in6 *)sa);
786 		}
787 	}
788 
789 	tcp_bblog_pru(tp, PRU_ACCEPT, error);
790 	TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
791 	INP_WUNLOCK(inp);
792 
793 	return (error);
794 }
795 #endif /* INET6 */
796 
797 /*
798  * Mark the connection as being incapable of further output.
799  */
800 static int
801 tcp_usr_shutdown(struct socket *so, enum shutdown_how how)
802 {
803 	struct epoch_tracker et;
804 	struct inpcb *inp = sotoinpcb(so);
805 	struct tcpcb *tp = intotcpcb(inp);
806 	int error = 0;
807 
808 	SOCK_LOCK(so);
809 	if (SOLISTENING(so)) {
810 		if (how != SHUT_WR) {
811 			so->so_error = ECONNABORTED;
812 			solisten_wakeup(so);	/* unlocks so */
813 		} else
814 			SOCK_UNLOCK(so);
815 		return (ENOTCONN);
816 	} else if ((so->so_state &
817 	    (SS_ISCONNECTED | SS_ISCONNECTING | SS_ISDISCONNECTING)) == 0) {
818 		SOCK_UNLOCK(so);
819 		return (ENOTCONN);
820 	}
821 	SOCK_UNLOCK(so);
822 
823 	switch (how) {
824 	case SHUT_RD:
825 		sorflush(so);
826 		break;
827 	case SHUT_RDWR:
828 		sorflush(so);
829 		/* FALLTHROUGH */
830 	case SHUT_WR:
831 		/*
832 		 * XXXGL: mimicing old soshutdown() here. But shouldn't we
833 		 * return ECONNRESEST for SHUT_RD as well?
834 		 */
835 		INP_WLOCK(inp);
836 		if (inp->inp_flags & INP_DROPPED) {
837 			INP_WUNLOCK(inp);
838 			return (ECONNRESET);
839 		}
840 
841 		socantsendmore(so);
842 		NET_EPOCH_ENTER(et);
843 		tcp_usrclosed(tp);
844 		error = tcp_output_nodrop(tp);
845 		tcp_bblog_pru(tp, PRU_SHUTDOWN, error);
846 		TCP_PROBE2(debug__user, tp, PRU_SHUTDOWN);
847 		error = tcp_unlock_or_drop(tp, error);
848 		NET_EPOCH_EXIT(et);
849 	}
850 	wakeup(&so->so_timeo);
851 
852 	return (error);
853 }
854 
855 /*
856  * After a receive, possibly send window update to peer.
857  */
858 static int
859 tcp_usr_rcvd(struct socket *so, int flags)
860 {
861 	struct epoch_tracker et;
862 	struct inpcb *inp;
863 	struct tcpcb *tp;
864 	int outrv = 0, error = 0;
865 
866 	inp = sotoinpcb(so);
867 	KASSERT(inp != NULL, ("tcp_usr_rcvd: inp == NULL"));
868 	INP_WLOCK(inp);
869 	if (inp->inp_flags & INP_DROPPED) {
870 		INP_WUNLOCK(inp);
871 		return (ECONNRESET);
872 	}
873 	tp = intotcpcb(inp);
874 
875 	NET_EPOCH_ENTER(et);
876 	/*
877 	 * For passively-created TFO connections, don't attempt a window
878 	 * update while still in SYN_RECEIVED as this may trigger an early
879 	 * SYN|ACK.  It is preferable to have the SYN|ACK be sent along with
880 	 * application response data, or failing that, when the DELACK timer
881 	 * expires.
882 	 */
883 	if ((tp->t_flags & TF_FASTOPEN) && (tp->t_state == TCPS_SYN_RECEIVED))
884 		goto out;
885 #ifdef TCP_OFFLOAD
886 	if (tp->t_flags & TF_TOE)
887 		tcp_offload_rcvd(tp);
888 	else
889 #endif
890 		outrv = tcp_output_nodrop(tp);
891 out:
892 	tcp_bblog_pru(tp, PRU_RCVD, error);
893 	TCP_PROBE2(debug__user, tp, PRU_RCVD);
894 	(void) tcp_unlock_or_drop(tp, outrv);
895 	NET_EPOCH_EXIT(et);
896 	return (error);
897 }
898 
899 /*
900  * Do a send by putting data in output queue and updating urgent
901  * marker if URG set.  Possibly send more data.  Unlike the other
902  * pru_*() routines, the mbuf chains are our responsibility.  We
903  * must either enqueue them or free them.  The other pru_* routines
904  * generally are caller-frees.
905  */
906 static int
907 tcp_usr_send(struct socket *so, int flags, struct mbuf *m,
908     struct sockaddr *nam, struct mbuf *control, struct thread *td)
909 {
910 	struct epoch_tracker et;
911 	int error = 0;
912 	struct inpcb *inp;
913 	struct tcpcb *tp;
914 #ifdef INET
915 #ifdef INET6
916 	struct sockaddr_in sin;
917 #endif
918 	struct sockaddr_in *sinp;
919 #endif
920 #ifdef INET6
921 	struct sockaddr_in6 *sin6;
922 	int isipv6;
923 #endif
924 	u_int8_t incflagsav;
925 	u_char vflagsav;
926 	bool restoreflags;
927 
928 	inp = sotoinpcb(so);
929 	KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"));
930 	INP_WLOCK(inp);
931 	if (inp->inp_flags & INP_DROPPED) {
932 		if (m != NULL && (flags & PRUS_NOTREADY) == 0)
933 			m_freem(m);
934 		INP_WUNLOCK(inp);
935 		return (ECONNRESET);
936 	}
937 	tp = intotcpcb(inp);
938 
939 	vflagsav = inp->inp_vflag;
940 	incflagsav = inp->inp_inc.inc_flags;
941 	restoreflags = false;
942 
943 	NET_EPOCH_ENTER(et);
944 	if (control != NULL) {
945 		/* TCP doesn't do control messages (rights, creds, etc) */
946 		if (control->m_len > 0) {
947 			m_freem(control);
948 			error = EINVAL;
949 			goto out;
950 		}
951 		m_freem(control);	/* empty control, just free it */
952 	}
953 
954 	if ((flags & PRUS_OOB) != 0 &&
955 	    (error = tcp_pru_options_support(tp, PRUS_OOB)) != 0)
956 		goto out;
957 
958 	if (nam != NULL && tp->t_state < TCPS_SYN_SENT) {
959 		if (tp->t_state == TCPS_LISTEN) {
960 			error = EINVAL;
961 			goto out;
962 		}
963 		switch (nam->sa_family) {
964 #ifdef INET
965 		case AF_INET:
966 			sinp = (struct sockaddr_in *)nam;
967 			if (sinp->sin_len != sizeof(struct sockaddr_in)) {
968 				error = EINVAL;
969 				goto out;
970 			}
971 			if ((inp->inp_vflag & INP_IPV6) != 0) {
972 				error = EAFNOSUPPORT;
973 				goto out;
974 			}
975 			if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))) {
976 				error = EAFNOSUPPORT;
977 				goto out;
978 			}
979 			if (ntohl(sinp->sin_addr.s_addr) == INADDR_BROADCAST) {
980 				error = EACCES;
981 				goto out;
982 			}
983 			if ((error = prison_remote_ip4(td->td_ucred,
984 			    &sinp->sin_addr)))
985 				goto out;
986 #ifdef INET6
987 			isipv6 = 0;
988 #endif
989 			break;
990 #endif /* INET */
991 #ifdef INET6
992 		case AF_INET6:
993 			sin6 = (struct sockaddr_in6 *)nam;
994 			if (sin6->sin6_len != sizeof(*sin6)) {
995 				error = EINVAL;
996 				goto out;
997 			}
998 			if ((inp->inp_vflag & INP_IPV6PROTO) == 0) {
999 				error = EAFNOSUPPORT;
1000 				goto out;
1001 			}
1002 			if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
1003 				error = EAFNOSUPPORT;
1004 				goto out;
1005 			}
1006 			if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
1007 #ifdef INET
1008 				if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
1009 					error = EINVAL;
1010 					goto out;
1011 				}
1012 				if ((inp->inp_vflag & INP_IPV4) == 0) {
1013 					error = EAFNOSUPPORT;
1014 					goto out;
1015 				}
1016 				restoreflags = true;
1017 				inp->inp_vflag &= ~INP_IPV6;
1018 				sinp = &sin;
1019 				in6_sin6_2_sin(sinp, sin6);
1020 				if (IN_MULTICAST(
1021 				    ntohl(sinp->sin_addr.s_addr))) {
1022 					error = EAFNOSUPPORT;
1023 					goto out;
1024 				}
1025 				if ((error = prison_remote_ip4(td->td_ucred,
1026 				    &sinp->sin_addr)))
1027 					goto out;
1028 				isipv6 = 0;
1029 #else /* !INET */
1030 				error = EAFNOSUPPORT;
1031 				goto out;
1032 #endif /* INET */
1033 			} else {
1034 				if ((inp->inp_vflag & INP_IPV6) == 0) {
1035 					error = EAFNOSUPPORT;
1036 					goto out;
1037 				}
1038 				restoreflags = true;
1039 				inp->inp_vflag &= ~INP_IPV4;
1040 				inp->inp_inc.inc_flags |= INC_ISIPV6;
1041 				if ((error = prison_remote_ip6(td->td_ucred,
1042 				    &sin6->sin6_addr)))
1043 					goto out;
1044 				isipv6 = 1;
1045 			}
1046 			break;
1047 #endif /* INET6 */
1048 		default:
1049 			error = EAFNOSUPPORT;
1050 			goto out;
1051 		}
1052 	}
1053 	if (!(flags & PRUS_OOB)) {
1054 		if (tp->t_acktime == 0)
1055 			tp->t_acktime = ticks;
1056 		sbappendstream(&so->so_snd, m, flags);
1057 		m = NULL;
1058 		if (nam && tp->t_state < TCPS_SYN_SENT) {
1059 			KASSERT(tp->t_state == TCPS_CLOSED,
1060 			    ("%s: tp %p is listening", __func__, tp));
1061 
1062 			/*
1063 			 * Do implied connect if not yet connected,
1064 			 * initialize window to default value, and
1065 			 * initialize maxseg using peer's cached MSS.
1066 			 */
1067 #ifdef INET6
1068 			if (isipv6)
1069 				error = tcp6_connect(tp, sin6, td);
1070 #endif /* INET6 */
1071 #if defined(INET6) && defined(INET)
1072 			else
1073 #endif
1074 #ifdef INET
1075 				error = tcp_connect(tp, sinp, td);
1076 #endif
1077 			/*
1078 			 * The bind operation in tcp_connect succeeded. We
1079 			 * no longer want to restore the flags if later
1080 			 * operations fail.
1081 			 */
1082 			if (error == 0 || inp->inp_lport != 0)
1083 				restoreflags = false;
1084 
1085 			if (error) {
1086 				/* m is freed if PRUS_NOTREADY is unset. */
1087 				sbflush(&so->so_snd);
1088 				goto out;
1089 			}
1090 			if (tp->t_flags & TF_FASTOPEN)
1091 				tcp_fastopen_connect(tp);
1092 			else {
1093 				tp->snd_wnd = TTCP_CLIENT_SND_WND;
1094 				tcp_mss(tp, -1);
1095 			}
1096 		}
1097 		if (flags & PRUS_EOF) {
1098 			/*
1099 			 * Close the send side of the connection after
1100 			 * the data is sent.
1101 			 */
1102 			socantsendmore(so);
1103 			tcp_usrclosed(tp);
1104 		}
1105 		if (TCPS_HAVEESTABLISHED(tp->t_state) &&
1106 		    ((tp->t_flags2 & TF2_FBYTES_COMPLETE) == 0) &&
1107 		    (tp->t_fbyte_out == 0) &&
1108 		    (so->so_snd.sb_ccc > 0)) {
1109 			tp->t_fbyte_out = ticks;
1110 			if (tp->t_fbyte_out == 0)
1111 				tp->t_fbyte_out = 1;
1112 			if (tp->t_fbyte_out && tp->t_fbyte_in)
1113 				tp->t_flags2 |= TF2_FBYTES_COMPLETE;
1114 		}
1115 		if (!(inp->inp_flags & INP_DROPPED) &&
1116 		    !(flags & PRUS_NOTREADY)) {
1117 			if (flags & PRUS_MORETOCOME)
1118 				tp->t_flags |= TF_MORETOCOME;
1119 			error = tcp_output_nodrop(tp);
1120 			if (flags & PRUS_MORETOCOME)
1121 				tp->t_flags &= ~TF_MORETOCOME;
1122 		}
1123 	} else {
1124 		/*
1125 		 * XXXRW: PRUS_EOF not implemented with PRUS_OOB?
1126 		 */
1127 		SOCK_SENDBUF_LOCK(so);
1128 		if (sbspace(&so->so_snd) < -512) {
1129 			SOCK_SENDBUF_UNLOCK(so);
1130 			error = ENOBUFS;
1131 			goto out;
1132 		}
1133 		/*
1134 		 * According to RFC961 (Assigned Protocols),
1135 		 * the urgent pointer points to the last octet
1136 		 * of urgent data.  We continue, however,
1137 		 * to consider it to indicate the first octet
1138 		 * of data past the urgent section.
1139 		 * Otherwise, snd_up should be one lower.
1140 		 */
1141 		if (tp->t_acktime == 0)
1142 			tp->t_acktime = ticks;
1143 		sbappendstream_locked(&so->so_snd, m, flags);
1144 		SOCK_SENDBUF_UNLOCK(so);
1145 		m = NULL;
1146 		if (nam && tp->t_state < TCPS_SYN_SENT) {
1147 			/*
1148 			 * Do implied connect if not yet connected,
1149 			 * initialize window to default value, and
1150 			 * initialize maxseg using peer's cached MSS.
1151 			 */
1152 
1153 			/*
1154 			 * Not going to contemplate SYN|URG
1155 			 */
1156 			if (tp->t_flags & TF_FASTOPEN)
1157 				tp->t_flags &= ~TF_FASTOPEN;
1158 #ifdef INET6
1159 			if (isipv6)
1160 				error = tcp6_connect(tp, sin6, td);
1161 #endif /* INET6 */
1162 #if defined(INET6) && defined(INET)
1163 			else
1164 #endif
1165 #ifdef INET
1166 				error = tcp_connect(tp, sinp, td);
1167 #endif
1168 			/*
1169 			 * The bind operation in tcp_connect succeeded. We
1170 			 * no longer want to restore the flags if later
1171 			 * operations fail.
1172 			 */
1173 			if (error == 0 || inp->inp_lport != 0)
1174 				restoreflags = false;
1175 
1176 			if (error != 0) {
1177 				/* m is freed if PRUS_NOTREADY is unset. */
1178 				sbflush(&so->so_snd);
1179 				goto out;
1180 			}
1181 			tp->snd_wnd = TTCP_CLIENT_SND_WND;
1182 			tcp_mss(tp, -1);
1183 		}
1184 		tp->snd_up = tp->snd_una + sbavail(&so->so_snd);
1185 		if ((flags & PRUS_NOTREADY) == 0) {
1186 			tp->t_flags |= TF_FORCEDATA;
1187 			error = tcp_output_nodrop(tp);
1188 			tp->t_flags &= ~TF_FORCEDATA;
1189 		}
1190 	}
1191 	TCP_LOG_EVENT(tp, NULL,
1192 	    &inp->inp_socket->so_rcv,
1193 	    &inp->inp_socket->so_snd,
1194 	    TCP_LOG_USERSEND, error,
1195 	    0, NULL, false);
1196 
1197 out:
1198 	/*
1199 	 * In case of PRUS_NOTREADY, the caller or tcp_usr_ready() is
1200 	 * responsible for freeing memory.
1201 	 */
1202 	if (m != NULL && (flags & PRUS_NOTREADY) == 0)
1203 		m_freem(m);
1204 
1205 	/*
1206 	 * If the request was unsuccessful and we changed flags,
1207 	 * restore the original flags.
1208 	 */
1209 	if (error != 0 && restoreflags) {
1210 		inp->inp_vflag = vflagsav;
1211 		inp->inp_inc.inc_flags = incflagsav;
1212 	}
1213 	tcp_bblog_pru(tp, (flags & PRUS_OOB) ? PRU_SENDOOB :
1214 		      ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND), error);
1215 	TCP_PROBE2(debug__user, tp, (flags & PRUS_OOB) ? PRU_SENDOOB :
1216 		   ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
1217 	error = tcp_unlock_or_drop(tp, error);
1218 	NET_EPOCH_EXIT(et);
1219 	return (error);
1220 }
1221 
1222 static int
1223 tcp_usr_ready(struct socket *so, struct mbuf *m, int count)
1224 {
1225 	struct epoch_tracker et;
1226 	struct inpcb *inp;
1227 	struct tcpcb *tp;
1228 	int error;
1229 
1230 	inp = sotoinpcb(so);
1231 	INP_WLOCK(inp);
1232 	if (inp->inp_flags & INP_DROPPED) {
1233 		INP_WUNLOCK(inp);
1234 		mb_free_notready(m, count);
1235 		return (ECONNRESET);
1236 	}
1237 	tp = intotcpcb(inp);
1238 
1239 	SOCK_SENDBUF_LOCK(so);
1240 	error = sbready(&so->so_snd, m, count);
1241 	SOCK_SENDBUF_UNLOCK(so);
1242 	if (error) {
1243 		INP_WUNLOCK(inp);
1244 		return (error);
1245 	}
1246 	NET_EPOCH_ENTER(et);
1247 	error = tcp_output_unlock(tp);
1248 	NET_EPOCH_EXIT(et);
1249 
1250 	return (error);
1251 }
1252 
1253 /*
1254  * Abort the TCP.  Drop the connection abruptly.
1255  */
1256 static void
1257 tcp_usr_abort(struct socket *so)
1258 {
1259 	struct inpcb *inp;
1260 	struct tcpcb *tp;
1261 	struct epoch_tracker et;
1262 
1263 	inp = sotoinpcb(so);
1264 	KASSERT(inp != NULL, ("tcp_usr_abort: inp == NULL"));
1265 
1266 	NET_EPOCH_ENTER(et);
1267 	INP_WLOCK(inp);
1268 	KASSERT(inp->inp_socket != NULL,
1269 	    ("tcp_usr_abort: inp_socket == NULL"));
1270 
1271 	/*
1272 	 * If we still have full TCP state, and we're not dropped, drop.
1273 	 */
1274 	if (!(inp->inp_flags & INP_DROPPED)) {
1275 		tp = intotcpcb(inp);
1276 		tp = tcp_drop(tp, ECONNABORTED);
1277 		if (tp == NULL)
1278 			goto dropped;
1279 		tcp_bblog_pru(tp, PRU_ABORT, 0);
1280 		TCP_PROBE2(debug__user, tp, PRU_ABORT);
1281 	}
1282 	if (!(inp->inp_flags & INP_DROPPED)) {
1283 		soref(so);
1284 		inp->inp_flags |= INP_SOCKREF;
1285 	}
1286 	INP_WUNLOCK(inp);
1287 dropped:
1288 	NET_EPOCH_EXIT(et);
1289 }
1290 
1291 /*
1292  * TCP socket is closed.  Start friendly disconnect.
1293  */
1294 static void
1295 tcp_usr_close(struct socket *so)
1296 {
1297 	struct inpcb *inp;
1298 	struct tcpcb *tp;
1299 	struct epoch_tracker et;
1300 
1301 	inp = sotoinpcb(so);
1302 	KASSERT(inp != NULL, ("tcp_usr_close: inp == NULL"));
1303 
1304 	NET_EPOCH_ENTER(et);
1305 	INP_WLOCK(inp);
1306 	KASSERT(inp->inp_socket != NULL,
1307 	    ("tcp_usr_close: inp_socket == NULL"));
1308 
1309 	/*
1310 	 * If we are still connected and we're not dropped, initiate
1311 	 * a disconnect.
1312 	 */
1313 	if (!(inp->inp_flags & INP_DROPPED)) {
1314 		tp = intotcpcb(inp);
1315 		if (tp->t_state != TCPS_TIME_WAIT) {
1316 			tp->t_flags |= TF_CLOSED;
1317 			tcp_disconnect(tp);
1318 			tcp_bblog_pru(tp, PRU_CLOSE, 0);
1319 			TCP_PROBE2(debug__user, tp, PRU_CLOSE);
1320 		}
1321 	}
1322 	if (!(inp->inp_flags & INP_DROPPED)) {
1323 		soref(so);
1324 		inp->inp_flags |= INP_SOCKREF;
1325 	}
1326 	INP_WUNLOCK(inp);
1327 	NET_EPOCH_EXIT(et);
1328 }
1329 
1330 static int
1331 tcp_pru_options_support(struct tcpcb *tp, int flags)
1332 {
1333 	/*
1334 	 * If the specific TCP stack has a pru_options
1335 	 * specified then it does not always support
1336 	 * all the PRU_XX options and we must ask it.
1337 	 * If the function is not specified then all
1338 	 * of the PRU_XX options are supported.
1339 	 */
1340 	int ret = 0;
1341 
1342 	if (tp->t_fb->tfb_pru_options) {
1343 		ret = (*tp->t_fb->tfb_pru_options)(tp, flags);
1344 	}
1345 	return (ret);
1346 }
1347 
1348 /*
1349  * Receive out-of-band data.
1350  */
1351 static int
1352 tcp_usr_rcvoob(struct socket *so, struct mbuf *m, int flags)
1353 {
1354 	int error = 0;
1355 	struct inpcb *inp;
1356 	struct tcpcb *tp;
1357 
1358 	inp = sotoinpcb(so);
1359 	KASSERT(inp != NULL, ("tcp_usr_rcvoob: inp == NULL"));
1360 	INP_WLOCK(inp);
1361 	if (inp->inp_flags & INP_DROPPED) {
1362 		INP_WUNLOCK(inp);
1363 		return (ECONNRESET);
1364 	}
1365 	tp = intotcpcb(inp);
1366 
1367 	error = tcp_pru_options_support(tp, PRUS_OOB);
1368 	if (error) {
1369 		goto out;
1370 	}
1371 	if ((so->so_oobmark == 0 &&
1372 	     (so->so_rcv.sb_state & SBS_RCVATMARK) == 0) ||
1373 	    so->so_options & SO_OOBINLINE ||
1374 	    tp->t_oobflags & TCPOOB_HADDATA) {
1375 		error = EINVAL;
1376 		goto out;
1377 	}
1378 	if ((tp->t_oobflags & TCPOOB_HAVEDATA) == 0) {
1379 		error = EWOULDBLOCK;
1380 		goto out;
1381 	}
1382 	m->m_len = 1;
1383 	*mtod(m, caddr_t) = tp->t_iobc;
1384 	if ((flags & MSG_PEEK) == 0)
1385 		tp->t_oobflags ^= (TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1386 
1387 out:
1388 	tcp_bblog_pru(tp, PRU_RCVOOB, error);
1389 	TCP_PROBE2(debug__user, tp, PRU_RCVOOB);
1390 	INP_WUNLOCK(inp);
1391 	return (error);
1392 }
1393 
1394 #ifdef INET
1395 struct protosw tcp_protosw = {
1396 	.pr_type =		SOCK_STREAM,
1397 	.pr_protocol =		IPPROTO_TCP,
1398 	.pr_flags =		PR_CONNREQUIRED | PR_IMPLOPCL | PR_WANTRCVD |
1399 				    PR_CAPATTACH,
1400 	.pr_ctloutput =		tcp_ctloutput,
1401 	.pr_abort =		tcp_usr_abort,
1402 	.pr_accept =		tcp_usr_accept,
1403 	.pr_attach =		tcp_usr_attach,
1404 	.pr_bind =		tcp_usr_bind,
1405 	.pr_connect =		tcp_usr_connect,
1406 	.pr_control =		in_control,
1407 	.pr_detach =		tcp_usr_detach,
1408 	.pr_disconnect =	tcp_usr_disconnect,
1409 	.pr_listen =		tcp_usr_listen,
1410 	.pr_peeraddr =		in_getpeeraddr,
1411 	.pr_rcvd =		tcp_usr_rcvd,
1412 	.pr_rcvoob =		tcp_usr_rcvoob,
1413 	.pr_send =		tcp_usr_send,
1414 	.pr_ready =		tcp_usr_ready,
1415 	.pr_shutdown =		tcp_usr_shutdown,
1416 	.pr_sockaddr =		in_getsockaddr,
1417 	.pr_sosetlabel =	in_pcbsosetlabel,
1418 	.pr_close =		tcp_usr_close,
1419 };
1420 #endif /* INET */
1421 
1422 #ifdef INET6
1423 struct protosw tcp6_protosw = {
1424 	.pr_type =		SOCK_STREAM,
1425 	.pr_protocol =		IPPROTO_TCP,
1426 	.pr_flags =		PR_CONNREQUIRED | PR_IMPLOPCL |PR_WANTRCVD |
1427 				    PR_CAPATTACH,
1428 	.pr_ctloutput =		tcp_ctloutput,
1429 	.pr_abort =		tcp_usr_abort,
1430 	.pr_accept =		tcp6_usr_accept,
1431 	.pr_attach =		tcp_usr_attach,
1432 	.pr_bind =		tcp6_usr_bind,
1433 	.pr_connect =		tcp6_usr_connect,
1434 	.pr_control =		in6_control,
1435 	.pr_detach =		tcp_usr_detach,
1436 	.pr_disconnect =	tcp_usr_disconnect,
1437 	.pr_listen =		tcp6_usr_listen,
1438 	.pr_peeraddr =		in6_mapped_peeraddr,
1439 	.pr_rcvd =		tcp_usr_rcvd,
1440 	.pr_rcvoob =		tcp_usr_rcvoob,
1441 	.pr_send =		tcp_usr_send,
1442 	.pr_ready =		tcp_usr_ready,
1443 	.pr_shutdown =		tcp_usr_shutdown,
1444 	.pr_sockaddr =		in6_mapped_sockaddr,
1445 	.pr_sosetlabel =	in_pcbsosetlabel,
1446 	.pr_close =		tcp_usr_close,
1447 };
1448 #endif /* INET6 */
1449 
1450 #ifdef INET
1451 /*
1452  * Common subroutine to open a TCP connection to remote host specified
1453  * by struct sockaddr_in.  Call in_pcbconnect() to choose local host address
1454  * and assign a local port number and install the inpcb into the hash.
1455  * Initialize connection parameters and enter SYN-SENT state.
1456  */
1457 static int
1458 tcp_connect(struct tcpcb *tp, struct sockaddr_in *sin, struct thread *td)
1459 {
1460 	struct inpcb *inp = tptoinpcb(tp);
1461 	struct socket *so = tptosocket(tp);
1462 	int error;
1463 
1464 	NET_EPOCH_ASSERT();
1465 	INP_WLOCK_ASSERT(inp);
1466 
1467 	if (__predict_false((so->so_state &
1468 	    (SS_ISCONNECTING | SS_ISCONNECTED | SS_ISDISCONNECTING |
1469 	    SS_ISDISCONNECTED)) != 0))
1470 		return (EISCONN);
1471 
1472 	INP_HASH_WLOCK(&V_tcbinfo);
1473 	error = in_pcbconnect(inp, sin, td->td_ucred);
1474 	INP_HASH_WUNLOCK(&V_tcbinfo);
1475 	if (error != 0)
1476 		return (error);
1477 
1478 	/*
1479 	 * Compute window scaling to request:
1480 	 * Scale to fit into sweet spot.  See tcp_syncache.c.
1481 	 * XXX: This should move to tcp_output().
1482 	 */
1483 	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1484 	    (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1485 		tp->request_r_scale++;
1486 
1487 	soisconnecting(so);
1488 	TCPSTAT_INC(tcps_connattempt);
1489 	tcp_state_change(tp, TCPS_SYN_SENT);
1490 	tp->iss = tcp_new_isn(&inp->inp_inc);
1491 	if (tp->t_flags & TF_REQ_TSTMP)
1492 		tp->ts_offset = tcp_new_ts_offset(&inp->inp_inc);
1493 	tcp_sendseqinit(tp);
1494 
1495 	return (0);
1496 }
1497 #endif /* INET */
1498 
1499 #ifdef INET6
1500 static int
1501 tcp6_connect(struct tcpcb *tp, struct sockaddr_in6 *sin6, struct thread *td)
1502 {
1503 	struct inpcb *inp = tptoinpcb(tp);
1504 	struct socket *so = tptosocket(tp);
1505 	int error;
1506 
1507 	NET_EPOCH_ASSERT();
1508 	INP_WLOCK_ASSERT(inp);
1509 
1510 	if (__predict_false((so->so_state &
1511 	    (SS_ISCONNECTING | SS_ISCONNECTED)) != 0))
1512 		return (EISCONN);
1513 
1514 	INP_HASH_WLOCK(&V_tcbinfo);
1515 	error = in6_pcbconnect(inp, sin6, td->td_ucred, true);
1516 	INP_HASH_WUNLOCK(&V_tcbinfo);
1517 	if (error != 0)
1518 		return (error);
1519 
1520 	/* Compute window scaling to request.  */
1521 	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1522 	    (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1523 		tp->request_r_scale++;
1524 
1525 	soisconnecting(so);
1526 	TCPSTAT_INC(tcps_connattempt);
1527 	tcp_state_change(tp, TCPS_SYN_SENT);
1528 	tp->iss = tcp_new_isn(&inp->inp_inc);
1529 	if (tp->t_flags & TF_REQ_TSTMP)
1530 		tp->ts_offset = tcp_new_ts_offset(&inp->inp_inc);
1531 	tcp_sendseqinit(tp);
1532 
1533 	return (0);
1534 }
1535 #endif /* INET6 */
1536 
1537 /*
1538  * Export TCP internal state information via a struct tcp_info, based on the
1539  * Linux 2.6 API.  Not ABI compatible as our constants are mapped differently
1540  * (TCP state machine, etc).  We export all information using FreeBSD-native
1541  * constants -- for example, the numeric values for tcpi_state will differ
1542  * from Linux.
1543  */
1544 void
1545 tcp_fill_info(const struct tcpcb *tp, struct tcp_info *ti)
1546 {
1547 
1548 	INP_LOCK_ASSERT(tptoinpcb(tp));
1549 	bzero(ti, sizeof(*ti));
1550 
1551 	ti->tcpi_state = tp->t_state;
1552 	if ((tp->t_flags & TF_REQ_TSTMP) && (tp->t_flags & TF_RCVD_TSTMP))
1553 		ti->tcpi_options |= TCPI_OPT_TIMESTAMPS;
1554 	if (tp->t_flags & TF_SACK_PERMIT)
1555 		ti->tcpi_options |= TCPI_OPT_SACK;
1556 	if ((tp->t_flags & TF_REQ_SCALE) && (tp->t_flags & TF_RCVD_SCALE)) {
1557 		ti->tcpi_options |= TCPI_OPT_WSCALE;
1558 		ti->tcpi_snd_wscale = tp->snd_scale;
1559 		ti->tcpi_rcv_wscale = tp->rcv_scale;
1560 	}
1561 	switch (tp->t_flags2 & (TF2_ECN_PERMIT | TF2_ACE_PERMIT)) {
1562 		case TF2_ECN_PERMIT:
1563 			ti->tcpi_options |= TCPI_OPT_ECN;
1564 			break;
1565 		case TF2_ACE_PERMIT:
1566 			/* FALLTHROUGH */
1567 		case TF2_ECN_PERMIT | TF2_ACE_PERMIT:
1568 			ti->tcpi_options |= TCPI_OPT_ACE;
1569 			break;
1570 		default:
1571 			break;
1572 	}
1573 	if (tp->t_flags & TF_FASTOPEN)
1574 		ti->tcpi_options |= TCPI_OPT_TFO;
1575 
1576 	ti->tcpi_rto = tp->t_rxtcur * tick;
1577 	ti->tcpi_last_data_recv = ((uint32_t)ticks - tp->t_rcvtime) * tick;
1578 	ti->tcpi_rtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT;
1579 	ti->tcpi_rttvar = ((u_int64_t)tp->t_rttvar * tick) >> TCP_RTTVAR_SHIFT;
1580 
1581 	ti->tcpi_snd_ssthresh = tp->snd_ssthresh;
1582 	ti->tcpi_snd_cwnd = tp->snd_cwnd;
1583 
1584 	/*
1585 	 * FreeBSD-specific extension fields for tcp_info.
1586 	 */
1587 	ti->tcpi_rcv_space = tp->rcv_wnd;
1588 	ti->tcpi_rcv_nxt = tp->rcv_nxt;
1589 	ti->tcpi_snd_wnd = tp->snd_wnd;
1590 	ti->tcpi_snd_bwnd = 0;		/* Unused, kept for compat. */
1591 	ti->tcpi_snd_nxt = tp->snd_nxt;
1592 	ti->tcpi_snd_mss = tp->t_maxseg;
1593 	ti->tcpi_rcv_mss = tp->t_maxseg;
1594 	ti->tcpi_snd_rexmitpack = tp->t_sndrexmitpack;
1595 	ti->tcpi_rcv_ooopack = tp->t_rcvoopack;
1596 	ti->tcpi_snd_zerowin = tp->t_sndzerowin;
1597 	ti->tcpi_snd_una = tp->snd_una;
1598 	ti->tcpi_snd_max = tp->snd_max;
1599 	ti->tcpi_rcv_numsacks = tp->rcv_numsacks;
1600 	ti->tcpi_rcv_adv = tp->rcv_adv;
1601 	ti->tcpi_dupacks = tp->t_dupacks;
1602 	ti->tcpi_rttmin = tp->t_rttlow;
1603 #ifdef TCP_OFFLOAD
1604 	if (tp->t_flags & TF_TOE) {
1605 		ti->tcpi_options |= TCPI_OPT_TOE;
1606 		tcp_offload_tcp_info(tp, ti);
1607 	}
1608 #endif
1609 	/*
1610 	 * AccECN related counters.
1611 	 */
1612 	if ((tp->t_flags2 & (TF2_ECN_PERMIT | TF2_ACE_PERMIT)) ==
1613 	    (TF2_ECN_PERMIT | TF2_ACE_PERMIT))
1614 		/*
1615 		 * Internal counter starts at 5 for AccECN
1616 		 * but 0 for RFC3168 ECN.
1617 		 */
1618 		ti->tcpi_delivered_ce = tp->t_scep - 5;
1619 	else
1620 		ti->tcpi_delivered_ce = tp->t_scep;
1621 	ti->tcpi_received_ce = tp->t_rcep;
1622 }
1623 
1624 /*
1625  * tcp_ctloutput() must drop the inpcb lock before performing copyin on
1626  * socket option arguments.  When it re-acquires the lock after the copy, it
1627  * has to revalidate that the connection is still valid for the socket
1628  * option.
1629  */
1630 #define INP_WLOCK_RECHECK_CLEANUP(inp, cleanup) do {			\
1631 	INP_WLOCK(inp);							\
1632 	if (inp->inp_flags & INP_DROPPED) {				\
1633 		INP_WUNLOCK(inp);					\
1634 		cleanup;						\
1635 		return (ECONNRESET);					\
1636 	}								\
1637 	tp = intotcpcb(inp);						\
1638 } while(0)
1639 #define INP_WLOCK_RECHECK(inp) INP_WLOCK_RECHECK_CLEANUP((inp), /* noop */)
1640 
1641 int
1642 tcp_ctloutput_set(struct inpcb *inp, struct sockopt *sopt)
1643 {
1644 	struct socket *so = inp->inp_socket;
1645 	struct tcpcb *tp = intotcpcb(inp);
1646 	int error = 0;
1647 
1648 	MPASS(sopt->sopt_dir == SOPT_SET);
1649 	INP_WLOCK_ASSERT(inp);
1650 	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
1651 	    ("inp_flags == %x", inp->inp_flags));
1652 	KASSERT(so != NULL, ("inp_socket == NULL"));
1653 
1654 	if (sopt->sopt_level != IPPROTO_TCP) {
1655 		INP_WUNLOCK(inp);
1656 #ifdef INET6
1657 		if (inp->inp_vflag & INP_IPV6PROTO)
1658 			error = ip6_ctloutput(so, sopt);
1659 #endif
1660 #if defined(INET6) && defined(INET)
1661 		else
1662 #endif
1663 #ifdef INET
1664 			error = ip_ctloutput(so, sopt);
1665 #endif
1666 		/*
1667 		 * When an IP-level socket option affects TCP, pass control
1668 		 * down to stack tfb_tcp_ctloutput, otherwise return what
1669 		 * IP level returned.
1670 		 */
1671 		switch (sopt->sopt_level) {
1672 #ifdef INET6
1673 		case IPPROTO_IPV6:
1674 			if ((inp->inp_vflag & INP_IPV6PROTO) == 0)
1675 				return (error);
1676 			switch (sopt->sopt_name) {
1677 			case IPV6_TCLASS:
1678 				/* Notify tcp stacks that care (e.g. RACK). */
1679 				break;
1680 			case IPV6_USE_MIN_MTU:
1681 				/* Update t_maxseg accordingly. */
1682 				break;
1683 			default:
1684 				return (error);
1685 			}
1686 			break;
1687 #endif
1688 #ifdef INET
1689 		case IPPROTO_IP:
1690 			switch (sopt->sopt_name) {
1691 			case IP_TOS:
1692 				inp->inp_ip_tos &= ~IPTOS_ECN_MASK;
1693 				break;
1694 			case IP_TTL:
1695 				/* Notify tcp stacks that care (e.g. RACK). */
1696 				break;
1697 			default:
1698 				return (error);
1699 			}
1700 			break;
1701 #endif
1702 		default:
1703 			return (error);
1704 		}
1705 		INP_WLOCK_RECHECK(inp);
1706 	} else if (sopt->sopt_name == TCP_FUNCTION_BLK) {
1707 		/*
1708 		 * Protect the TCP option TCP_FUNCTION_BLK so
1709 		 * that a sub-function can *never* overwrite this.
1710 		 */
1711 		struct tcp_function_set fsn;
1712 		struct tcp_function_block *blk;
1713 		void *ptr = NULL;
1714 
1715 		INP_WUNLOCK(inp);
1716 		error = sooptcopyin(sopt, &fsn, sizeof fsn, sizeof fsn);
1717 		if (error)
1718 			return (error);
1719 
1720 		INP_WLOCK_RECHECK(inp);
1721 
1722 		blk = find_and_ref_tcp_functions(&fsn);
1723 		if (blk == NULL) {
1724 			INP_WUNLOCK(inp);
1725 			return (ENOENT);
1726 		}
1727 		if (tp->t_fb == blk) {
1728 			/* You already have this */
1729 			refcount_release(&blk->tfb_refcnt);
1730 			INP_WUNLOCK(inp);
1731 			return (0);
1732 		}
1733 		if (blk->tfb_flags & TCP_FUNC_BEING_REMOVED) {
1734 			refcount_release(&blk->tfb_refcnt);
1735 			INP_WUNLOCK(inp);
1736 			return (ENOENT);
1737 		}
1738 		error = (*blk->tfb_tcp_handoff_ok)(tp);
1739 		if (error) {
1740 			refcount_release(&blk->tfb_refcnt);
1741 			INP_WUNLOCK(inp);
1742 			return (error);
1743 		}
1744 		/*
1745 		 * Ensure the new stack takes ownership with a
1746 		 * clean slate on peak rate threshold.
1747 		 */
1748 		if (tp->t_fb->tfb_tcp_timer_stop_all != NULL)
1749 			tp->t_fb->tfb_tcp_timer_stop_all(tp);
1750 		if (blk->tfb_tcp_fb_init) {
1751 			error = (*blk->tfb_tcp_fb_init)(tp, &ptr);
1752 			if (error) {
1753 				/*
1754 				 * Release the ref count the lookup
1755 				 * acquired.
1756 				 */
1757 				refcount_release(&blk->tfb_refcnt);
1758 				/*
1759 				 * Now there is a chance that the
1760 				 * init() function mucked with some
1761 				 * things before it failed, such as
1762 				 * hpts or inp_flags2 or timer granularity.
1763 				 * It should not of, but lets give the old
1764 				 * stack a chance to reset to a known good state.
1765 				 */
1766 				if (tp->t_fb->tfb_switch_failed) {
1767 					(*tp->t_fb->tfb_switch_failed)(tp);
1768 				}
1769 			 	goto err_out;
1770 			}
1771 		}
1772 		if (tp->t_fb->tfb_tcp_fb_fini) {
1773 			struct epoch_tracker et;
1774 			/*
1775 			 * Tell the stack to cleanup with 0 i.e.
1776 			 * the tcb is not going away.
1777 			 */
1778 			NET_EPOCH_ENTER(et);
1779 			(*tp->t_fb->tfb_tcp_fb_fini)(tp, 0);
1780 			NET_EPOCH_EXIT(et);
1781 		}
1782 		/*
1783 		 * Release the old refcnt, the
1784 		 * lookup acquired a ref on the
1785 		 * new one already.
1786 		 */
1787 		refcount_release(&tp->t_fb->tfb_refcnt);
1788 		/*
1789 		 * Set in the new stack.
1790 		 */
1791 		tp->t_fb = blk;
1792 		tp->t_fb_ptr = ptr;
1793 #ifdef TCP_OFFLOAD
1794 		if (tp->t_flags & TF_TOE) {
1795 			tcp_offload_ctloutput(tp, sopt->sopt_dir,
1796 			     sopt->sopt_name);
1797 		}
1798 #endif
1799 err_out:
1800 		INP_WUNLOCK(inp);
1801 		return (error);
1802 
1803 	}
1804 
1805 	/* Pass in the INP locked, callee must unlock it. */
1806 	return (tp->t_fb->tfb_tcp_ctloutput(tp, sopt));
1807 }
1808 
1809 static int
1810 tcp_ctloutput_get(struct inpcb *inp, struct sockopt *sopt)
1811 {
1812 	struct socket *so = inp->inp_socket;
1813 	struct tcpcb *tp = intotcpcb(inp);
1814 	int error = 0;
1815 
1816 	MPASS(sopt->sopt_dir == SOPT_GET);
1817 	INP_WLOCK_ASSERT(inp);
1818 	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
1819 	    ("inp_flags == %x", inp->inp_flags));
1820 	KASSERT(so != NULL, ("inp_socket == NULL"));
1821 
1822 	if (sopt->sopt_level != IPPROTO_TCP) {
1823 		INP_WUNLOCK(inp);
1824 #ifdef INET6
1825 		if (inp->inp_vflag & INP_IPV6PROTO)
1826 			error = ip6_ctloutput(so, sopt);
1827 #endif /* INET6 */
1828 #if defined(INET6) && defined(INET)
1829 		else
1830 #endif
1831 #ifdef INET
1832 			error = ip_ctloutput(so, sopt);
1833 #endif
1834 		return (error);
1835 	}
1836 	if (((sopt->sopt_name == TCP_FUNCTION_BLK) ||
1837 	     (sopt->sopt_name == TCP_FUNCTION_ALIAS))) {
1838 		struct tcp_function_set fsn;
1839 
1840 		if (sopt->sopt_name == TCP_FUNCTION_ALIAS) {
1841 			memset(&fsn, 0, sizeof(fsn));
1842 			find_tcp_function_alias(tp->t_fb, &fsn);
1843 		} else {
1844 			strncpy(fsn.function_set_name,
1845 			    tp->t_fb->tfb_tcp_block_name,
1846 			    TCP_FUNCTION_NAME_LEN_MAX);
1847 			fsn.function_set_name[TCP_FUNCTION_NAME_LEN_MAX - 1] = '\0';
1848 		}
1849 		fsn.pcbcnt = tp->t_fb->tfb_refcnt;
1850 		INP_WUNLOCK(inp);
1851 		error = sooptcopyout(sopt, &fsn, sizeof fsn);
1852 		return (error);
1853 	}
1854 
1855 	/* Pass in the INP locked, callee must unlock it. */
1856 	return (tp->t_fb->tfb_tcp_ctloutput(tp, sopt));
1857 }
1858 
1859 int
1860 tcp_ctloutput(struct socket *so, struct sockopt *sopt)
1861 {
1862 	struct	inpcb *inp;
1863 
1864 	inp = sotoinpcb(so);
1865 	KASSERT(inp != NULL, ("tcp_ctloutput: inp == NULL"));
1866 
1867 	INP_WLOCK(inp);
1868 	if (inp->inp_flags & INP_DROPPED) {
1869 		INP_WUNLOCK(inp);
1870 		return (ECONNRESET);
1871 	}
1872 	if (sopt->sopt_dir == SOPT_SET)
1873 		return (tcp_ctloutput_set(inp, sopt));
1874 	else if (sopt->sopt_dir == SOPT_GET)
1875 		return (tcp_ctloutput_get(inp, sopt));
1876 	else
1877 		panic("%s: sopt_dir $%d", __func__, sopt->sopt_dir);
1878 }
1879 
1880 /*
1881  * If this assert becomes untrue, we need to change the size of the buf
1882  * variable in tcp_default_ctloutput().
1883  */
1884 #ifdef CTASSERT
1885 CTASSERT(TCP_CA_NAME_MAX <= TCP_LOG_ID_LEN);
1886 CTASSERT(TCP_LOG_REASON_LEN <= TCP_LOG_ID_LEN);
1887 #endif
1888 
1889 extern struct cc_algo newreno_cc_algo;
1890 
1891 static int
1892 tcp_set_cc_mod(struct inpcb *inp, struct sockopt *sopt)
1893 {
1894 	struct cc_algo *algo;
1895 	void *ptr = NULL;
1896 	struct tcpcb *tp;
1897 	struct cc_var cc_mem;
1898 	char	buf[TCP_CA_NAME_MAX];
1899 	size_t mem_sz;
1900 	int error;
1901 
1902 	INP_WUNLOCK(inp);
1903 	error = sooptcopyin(sopt, buf, TCP_CA_NAME_MAX - 1, 1);
1904 	if (error)
1905 		return(error);
1906 	buf[sopt->sopt_valsize] = '\0';
1907 	CC_LIST_RLOCK();
1908 	STAILQ_FOREACH(algo, &cc_list, entries) {
1909 		if (strncmp(buf, algo->name,
1910 			    TCP_CA_NAME_MAX) == 0) {
1911 			if (algo->flags & CC_MODULE_BEING_REMOVED) {
1912 				/* We can't "see" modules being unloaded */
1913 				continue;
1914 			}
1915 			break;
1916 		}
1917 	}
1918 	if (algo == NULL) {
1919 		CC_LIST_RUNLOCK();
1920 		return(ESRCH);
1921 	}
1922 	/*
1923 	 * With a reference the algorithm cannot be removed
1924 	 * so we hold a reference through the change process.
1925 	 */
1926 	cc_refer(algo);
1927 	CC_LIST_RUNLOCK();
1928 	if (algo->cb_init != NULL) {
1929 		/* We can now pre-get the memory for the CC */
1930 		mem_sz = (*algo->cc_data_sz)();
1931 		if (mem_sz == 0) {
1932 			goto no_mem_needed;
1933 		}
1934 		ptr = malloc(mem_sz, M_CC_MEM, M_WAITOK);
1935 	} else {
1936 no_mem_needed:
1937 		mem_sz = 0;
1938 		ptr = NULL;
1939 	}
1940 	/*
1941 	 * Make sure its all clean and zero and also get
1942 	 * back the inplock.
1943 	 */
1944 	memset(&cc_mem, 0, sizeof(cc_mem));
1945 	INP_WLOCK(inp);
1946 	if (inp->inp_flags & INP_DROPPED) {
1947 		INP_WUNLOCK(inp);
1948 		if (ptr)
1949 			free(ptr, M_CC_MEM);
1950 		/* Release our temp reference */
1951 		CC_LIST_RLOCK();
1952 		cc_release(algo);
1953 		CC_LIST_RUNLOCK();
1954 		return (ECONNRESET);
1955 	}
1956 	tp = intotcpcb(inp);
1957 	if (ptr != NULL)
1958 		memset(ptr, 0, mem_sz);
1959 	cc_mem.tp = tp;
1960 	/*
1961 	 * We once again hold a write lock over the tcb so it's
1962 	 * safe to do these things without ordering concerns.
1963 	 * Note here we init into stack memory.
1964 	 */
1965 	if (algo->cb_init != NULL)
1966 		error = algo->cb_init(&cc_mem, ptr);
1967 	else
1968 		error = 0;
1969 	/*
1970 	 * The CC algorithms, when given their memory
1971 	 * should not fail we could in theory have a
1972 	 * KASSERT here.
1973 	 */
1974 	if (error == 0) {
1975 		/*
1976 		 * Touchdown, lets go ahead and move the
1977 		 * connection to the new CC module by
1978 		 * copying in the cc_mem after we call
1979 		 * the old ones cleanup (if any).
1980 		 */
1981 		if (CC_ALGO(tp)->cb_destroy != NULL)
1982 			CC_ALGO(tp)->cb_destroy(&tp->t_ccv);
1983 		/* Detach the old CC from the tcpcb  */
1984 		cc_detach(tp);
1985 		/* Copy in our temp memory that was inited */
1986 		memcpy(&tp->t_ccv, &cc_mem, sizeof(struct cc_var));
1987 		/* Now attach the new, which takes a reference */
1988 		cc_attach(tp, algo);
1989 		/* Ok now are we where we have gotten past any conn_init? */
1990 		if (TCPS_HAVEESTABLISHED(tp->t_state) && (CC_ALGO(tp)->conn_init != NULL)) {
1991 			/* Yep run the connection init for the new CC */
1992 			CC_ALGO(tp)->conn_init(&tp->t_ccv);
1993 		}
1994 	} else if (ptr)
1995 		free(ptr, M_CC_MEM);
1996 	INP_WUNLOCK(inp);
1997 	/* Now lets release our temp reference */
1998 	CC_LIST_RLOCK();
1999 	cc_release(algo);
2000 	CC_LIST_RUNLOCK();
2001 	return (error);
2002 }
2003 
2004 int
2005 tcp_default_ctloutput(struct tcpcb *tp, struct sockopt *sopt)
2006 {
2007 	struct inpcb *inp = tptoinpcb(tp);
2008 	int	error, opt, optval;
2009 	u_int	ui;
2010 	struct	tcp_info ti;
2011 #ifdef KERN_TLS
2012 	struct tls_enable tls;
2013 	struct socket *so = inp->inp_socket;
2014 #endif
2015 	char	*pbuf, buf[TCP_LOG_ID_LEN];
2016 #ifdef STATS
2017 	struct statsblob *sbp;
2018 #endif
2019 	size_t	len;
2020 
2021 	INP_WLOCK_ASSERT(inp);
2022 	KASSERT((inp->inp_flags & INP_DROPPED) == 0,
2023 	    ("inp_flags == %x", inp->inp_flags));
2024 	KASSERT(inp->inp_socket != NULL, ("inp_socket == NULL"));
2025 
2026 	switch (sopt->sopt_level) {
2027 #ifdef INET6
2028 	case IPPROTO_IPV6:
2029 		MPASS(inp->inp_vflag & INP_IPV6PROTO);
2030 		switch (sopt->sopt_name) {
2031 		case IPV6_USE_MIN_MTU:
2032 			tcp6_use_min_mtu(tp);
2033 			/* FALLTHROUGH */
2034 		}
2035 		INP_WUNLOCK(inp);
2036 		return (0);
2037 #endif
2038 #ifdef INET
2039 	case IPPROTO_IP:
2040 		INP_WUNLOCK(inp);
2041 		return (0);
2042 #endif
2043 	}
2044 
2045 	/*
2046 	 * For TCP_CCALGOOPT forward the control to CC module, for both
2047 	 * SOPT_SET and SOPT_GET.
2048 	 */
2049 	switch (sopt->sopt_name) {
2050 	case TCP_CCALGOOPT:
2051 		INP_WUNLOCK(inp);
2052 		if (sopt->sopt_valsize > CC_ALGOOPT_LIMIT)
2053 			return (EINVAL);
2054 		pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
2055 		error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
2056 		    sopt->sopt_valsize);
2057 		if (error) {
2058 			free(pbuf, M_TEMP);
2059 			return (error);
2060 		}
2061 		INP_WLOCK_RECHECK_CLEANUP(inp, free(pbuf, M_TEMP));
2062 		if (CC_ALGO(tp)->ctl_output != NULL)
2063 			error = CC_ALGO(tp)->ctl_output(&tp->t_ccv, sopt, pbuf);
2064 		else
2065 			error = ENOENT;
2066 		INP_WUNLOCK(inp);
2067 		if (error == 0 && sopt->sopt_dir == SOPT_GET)
2068 			error = sooptcopyout(sopt, pbuf, sopt->sopt_valsize);
2069 		free(pbuf, M_TEMP);
2070 		return (error);
2071 	}
2072 
2073 	switch (sopt->sopt_dir) {
2074 	case SOPT_SET:
2075 		switch (sopt->sopt_name) {
2076 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
2077 		case TCP_MD5SIG:
2078 			INP_WUNLOCK(inp);
2079 			if (!TCPMD5_ENABLED())
2080 				return (ENOPROTOOPT);
2081 			error = TCPMD5_PCBCTL(inp, sopt);
2082 			if (error)
2083 				return (error);
2084 			INP_WLOCK_RECHECK(inp);
2085 			goto unlock_and_done;
2086 #endif /* IPSEC */
2087 
2088 		case TCP_NODELAY:
2089 		case TCP_NOOPT:
2090 			INP_WUNLOCK(inp);
2091 			error = sooptcopyin(sopt, &optval, sizeof optval,
2092 			    sizeof optval);
2093 			if (error)
2094 				return (error);
2095 
2096 			INP_WLOCK_RECHECK(inp);
2097 			switch (sopt->sopt_name) {
2098 			case TCP_NODELAY:
2099 				opt = TF_NODELAY;
2100 				break;
2101 			case TCP_NOOPT:
2102 				opt = TF_NOOPT;
2103 				break;
2104 			default:
2105 				opt = 0; /* dead code to fool gcc */
2106 				break;
2107 			}
2108 
2109 			if (optval)
2110 				tp->t_flags |= opt;
2111 			else
2112 				tp->t_flags &= ~opt;
2113 unlock_and_done:
2114 #ifdef TCP_OFFLOAD
2115 			if (tp->t_flags & TF_TOE) {
2116 				tcp_offload_ctloutput(tp, sopt->sopt_dir,
2117 				    sopt->sopt_name);
2118 			}
2119 #endif
2120 			INP_WUNLOCK(inp);
2121 			break;
2122 
2123 		case TCP_NOPUSH:
2124 			INP_WUNLOCK(inp);
2125 			error = sooptcopyin(sopt, &optval, sizeof optval,
2126 			    sizeof optval);
2127 			if (error)
2128 				return (error);
2129 
2130 			INP_WLOCK_RECHECK(inp);
2131 			if (optval)
2132 				tp->t_flags |= TF_NOPUSH;
2133 			else if (tp->t_flags & TF_NOPUSH) {
2134 				tp->t_flags &= ~TF_NOPUSH;
2135 				if (TCPS_HAVEESTABLISHED(tp->t_state)) {
2136 					struct epoch_tracker et;
2137 
2138 					NET_EPOCH_ENTER(et);
2139 					error = tcp_output_nodrop(tp);
2140 					NET_EPOCH_EXIT(et);
2141 				}
2142 			}
2143 			goto unlock_and_done;
2144 
2145 		case TCP_REMOTE_UDP_ENCAPS_PORT:
2146 			INP_WUNLOCK(inp);
2147 			error = sooptcopyin(sopt, &optval, sizeof optval,
2148 			    sizeof optval);
2149 			if (error)
2150 				return (error);
2151 			if ((optval < TCP_TUNNELING_PORT_MIN) ||
2152 			    (optval > TCP_TUNNELING_PORT_MAX)) {
2153 				/* Its got to be in range */
2154 				return (EINVAL);
2155 			}
2156 			if ((V_tcp_udp_tunneling_port == 0) && (optval != 0)) {
2157 				/* You have to have enabled a UDP tunneling port first */
2158 				return (EINVAL);
2159 			}
2160 			INP_WLOCK_RECHECK(inp);
2161 			if (tp->t_state != TCPS_CLOSED) {
2162 				/* You can't change after you are connected */
2163 				error = EINVAL;
2164 			} else {
2165 				/* Ok we are all good set the port */
2166 				tp->t_port = htons(optval);
2167 			}
2168 			goto unlock_and_done;
2169 
2170 		case TCP_MAXSEG:
2171 			INP_WUNLOCK(inp);
2172 			error = sooptcopyin(sopt, &optval, sizeof optval,
2173 			    sizeof optval);
2174 			if (error)
2175 				return (error);
2176 
2177 			INP_WLOCK_RECHECK(inp);
2178 			if (optval > 0 && optval <= tp->t_maxseg &&
2179 			    optval + 40 >= V_tcp_minmss) {
2180 				tp->t_maxseg = optval;
2181 				if (tp->t_maxseg < V_tcp_mssdflt) {
2182 					/*
2183 					 * The MSS is so small we should not process incoming
2184 					 * SACK's since we are subject to attack in such a
2185 					 * case.
2186 					 */
2187 					tp->t_flags2 |= TF2_PROC_SACK_PROHIBIT;
2188 				} else {
2189 					tp->t_flags2 &= ~TF2_PROC_SACK_PROHIBIT;
2190 				}
2191 			} else
2192 				error = EINVAL;
2193 			goto unlock_and_done;
2194 
2195 		case TCP_INFO:
2196 			INP_WUNLOCK(inp);
2197 			error = EINVAL;
2198 			break;
2199 
2200 		case TCP_STATS:
2201 			INP_WUNLOCK(inp);
2202 #ifdef STATS
2203 			error = sooptcopyin(sopt, &optval, sizeof optval,
2204 			    sizeof optval);
2205 			if (error)
2206 				return (error);
2207 
2208 			if (optval > 0)
2209 				sbp = stats_blob_alloc(
2210 				    V_tcp_perconn_stats_dflt_tpl, 0);
2211 			else
2212 				sbp = NULL;
2213 
2214 			INP_WLOCK_RECHECK(inp);
2215 			if ((tp->t_stats != NULL && sbp == NULL) ||
2216 			    (tp->t_stats == NULL && sbp != NULL)) {
2217 				struct statsblob *t = tp->t_stats;
2218 				tp->t_stats = sbp;
2219 				sbp = t;
2220 			}
2221 			INP_WUNLOCK(inp);
2222 
2223 			stats_blob_destroy(sbp);
2224 #else
2225 			return (EOPNOTSUPP);
2226 #endif /* !STATS */
2227 			break;
2228 
2229 		case TCP_CONGESTION:
2230 			error = tcp_set_cc_mod(inp, sopt);
2231 			break;
2232 
2233 		case TCP_REUSPORT_LB_NUMA:
2234 			INP_WUNLOCK(inp);
2235 			error = sooptcopyin(sopt, &optval, sizeof(optval),
2236 			    sizeof(optval));
2237 			INP_WLOCK_RECHECK(inp);
2238 			if (!error)
2239 				error = in_pcblbgroup_numa(inp, optval);
2240 			INP_WUNLOCK(inp);
2241 			break;
2242 
2243 #ifdef KERN_TLS
2244 		case TCP_TXTLS_ENABLE:
2245 			INP_WUNLOCK(inp);
2246 			error = ktls_copyin_tls_enable(sopt, &tls);
2247 			if (error != 0)
2248 				break;
2249 			error = ktls_enable_tx(so, &tls);
2250 			ktls_cleanup_tls_enable(&tls);
2251 			break;
2252 		case TCP_TXTLS_MODE:
2253 			INP_WUNLOCK(inp);
2254 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2255 			if (error != 0)
2256 				return (error);
2257 
2258 			INP_WLOCK_RECHECK(inp);
2259 			error = ktls_set_tx_mode(so, ui);
2260 			INP_WUNLOCK(inp);
2261 			break;
2262 		case TCP_RXTLS_ENABLE:
2263 			INP_WUNLOCK(inp);
2264 			error = ktls_copyin_tls_enable(sopt, &tls);
2265 			if (error != 0)
2266 				break;
2267 			error = ktls_enable_rx(so, &tls);
2268 			ktls_cleanup_tls_enable(&tls);
2269 			break;
2270 #endif
2271 		case TCP_MAXUNACKTIME:
2272 		case TCP_KEEPIDLE:
2273 		case TCP_KEEPINTVL:
2274 		case TCP_KEEPINIT:
2275 			INP_WUNLOCK(inp);
2276 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2277 			if (error)
2278 				return (error);
2279 
2280 			if (ui > (UINT_MAX / hz)) {
2281 				error = EINVAL;
2282 				break;
2283 			}
2284 			ui *= hz;
2285 
2286 			INP_WLOCK_RECHECK(inp);
2287 			switch (sopt->sopt_name) {
2288 			case TCP_MAXUNACKTIME:
2289 				tp->t_maxunacktime = ui;
2290 				break;
2291 
2292 			case TCP_KEEPIDLE:
2293 				tp->t_keepidle = ui;
2294 				/*
2295 				 * XXX: better check current remaining
2296 				 * timeout and "merge" it with new value.
2297 				 */
2298 				if ((tp->t_state > TCPS_LISTEN) &&
2299 				    (tp->t_state <= TCPS_CLOSING))
2300 					tcp_timer_activate(tp, TT_KEEP,
2301 					    TP_KEEPIDLE(tp));
2302 				break;
2303 			case TCP_KEEPINTVL:
2304 				tp->t_keepintvl = ui;
2305 				if ((tp->t_state == TCPS_FIN_WAIT_2) &&
2306 				    (TP_MAXIDLE(tp) > 0))
2307 					tcp_timer_activate(tp, TT_2MSL,
2308 					    TP_MAXIDLE(tp));
2309 				break;
2310 			case TCP_KEEPINIT:
2311 				tp->t_keepinit = ui;
2312 				if (tp->t_state == TCPS_SYN_RECEIVED ||
2313 				    tp->t_state == TCPS_SYN_SENT)
2314 					tcp_timer_activate(tp, TT_KEEP,
2315 					    TP_KEEPINIT(tp));
2316 				break;
2317 			}
2318 			goto unlock_and_done;
2319 
2320 		case TCP_KEEPCNT:
2321 			INP_WUNLOCK(inp);
2322 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2323 			if (error)
2324 				return (error);
2325 
2326 			INP_WLOCK_RECHECK(inp);
2327 			tp->t_keepcnt = ui;
2328 			if ((tp->t_state == TCPS_FIN_WAIT_2) &&
2329 			    (TP_MAXIDLE(tp) > 0))
2330 				tcp_timer_activate(tp, TT_2MSL,
2331 				    TP_MAXIDLE(tp));
2332 			goto unlock_and_done;
2333 
2334 #ifdef TCPPCAP
2335 		case TCP_PCAP_OUT:
2336 		case TCP_PCAP_IN:
2337 			INP_WUNLOCK(inp);
2338 			error = sooptcopyin(sopt, &optval, sizeof optval,
2339 			    sizeof optval);
2340 			if (error)
2341 				return (error);
2342 
2343 			INP_WLOCK_RECHECK(inp);
2344 			if (optval >= 0)
2345 				tcp_pcap_set_sock_max(
2346 					(sopt->sopt_name == TCP_PCAP_OUT) ?
2347 					&(tp->t_outpkts) : &(tp->t_inpkts),
2348 					optval);
2349 			else
2350 				error = EINVAL;
2351 			goto unlock_and_done;
2352 #endif
2353 
2354 		case TCP_FASTOPEN: {
2355 			struct tcp_fastopen tfo_optval;
2356 
2357 			INP_WUNLOCK(inp);
2358 			if (!V_tcp_fastopen_client_enable &&
2359 			    !V_tcp_fastopen_server_enable)
2360 				return (EPERM);
2361 
2362 			error = sooptcopyin(sopt, &tfo_optval,
2363 				    sizeof(tfo_optval), sizeof(int));
2364 			if (error)
2365 				return (error);
2366 
2367 			INP_WLOCK_RECHECK(inp);
2368 			if ((tp->t_state != TCPS_CLOSED) &&
2369 			    (tp->t_state != TCPS_LISTEN)) {
2370 				error = EINVAL;
2371 				goto unlock_and_done;
2372 			}
2373 			if (tfo_optval.enable) {
2374 				if (tp->t_state == TCPS_LISTEN) {
2375 					if (!V_tcp_fastopen_server_enable) {
2376 						error = EPERM;
2377 						goto unlock_and_done;
2378 					}
2379 
2380 					if (tp->t_tfo_pending == NULL)
2381 						tp->t_tfo_pending =
2382 						    tcp_fastopen_alloc_counter();
2383 				} else {
2384 					/*
2385 					 * If a pre-shared key was provided,
2386 					 * stash it in the client cookie
2387 					 * field of the tcpcb for use during
2388 					 * connect.
2389 					 */
2390 					if (sopt->sopt_valsize ==
2391 					    sizeof(tfo_optval)) {
2392 						memcpy(tp->t_tfo_cookie.client,
2393 						       tfo_optval.psk,
2394 						       TCP_FASTOPEN_PSK_LEN);
2395 						tp->t_tfo_client_cookie_len =
2396 						    TCP_FASTOPEN_PSK_LEN;
2397 					}
2398 				}
2399 				tp->t_flags |= TF_FASTOPEN;
2400 			} else
2401 				tp->t_flags &= ~TF_FASTOPEN;
2402 			goto unlock_and_done;
2403 		}
2404 
2405 #ifdef TCP_BLACKBOX
2406 		case TCP_LOG:
2407 			INP_WUNLOCK(inp);
2408 			error = sooptcopyin(sopt, &optval, sizeof optval,
2409 			    sizeof optval);
2410 			if (error)
2411 				return (error);
2412 
2413 			INP_WLOCK_RECHECK(inp);
2414 			error = tcp_log_state_change(tp, optval);
2415 			goto unlock_and_done;
2416 
2417 		case TCP_LOGBUF:
2418 			INP_WUNLOCK(inp);
2419 			error = EINVAL;
2420 			break;
2421 
2422 		case TCP_LOGID:
2423 			INP_WUNLOCK(inp);
2424 			error = sooptcopyin(sopt, buf, TCP_LOG_ID_LEN - 1, 0);
2425 			if (error)
2426 				break;
2427 			buf[sopt->sopt_valsize] = '\0';
2428 			INP_WLOCK_RECHECK(inp);
2429 			error = tcp_log_set_id(tp, buf);
2430 			/* tcp_log_set_id() unlocks the INP. */
2431 			break;
2432 
2433 		case TCP_LOGDUMP:
2434 		case TCP_LOGDUMPID:
2435 			INP_WUNLOCK(inp);
2436 			error =
2437 			    sooptcopyin(sopt, buf, TCP_LOG_REASON_LEN - 1, 0);
2438 			if (error)
2439 				break;
2440 			buf[sopt->sopt_valsize] = '\0';
2441 			INP_WLOCK_RECHECK(inp);
2442 			if (sopt->sopt_name == TCP_LOGDUMP) {
2443 				error = tcp_log_dump_tp_logbuf(tp, buf,
2444 				    M_WAITOK, true);
2445 				INP_WUNLOCK(inp);
2446 			} else {
2447 				tcp_log_dump_tp_bucket_logbufs(tp, buf);
2448 				/*
2449 				 * tcp_log_dump_tp_bucket_logbufs() drops the
2450 				 * INP lock.
2451 				 */
2452 			}
2453 			break;
2454 #endif
2455 
2456 		default:
2457 			INP_WUNLOCK(inp);
2458 			error = ENOPROTOOPT;
2459 			break;
2460 		}
2461 		break;
2462 
2463 	case SOPT_GET:
2464 		tp = intotcpcb(inp);
2465 		switch (sopt->sopt_name) {
2466 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
2467 		case TCP_MD5SIG:
2468 			INP_WUNLOCK(inp);
2469 			if (!TCPMD5_ENABLED())
2470 				return (ENOPROTOOPT);
2471 			error = TCPMD5_PCBCTL(inp, sopt);
2472 			break;
2473 #endif
2474 
2475 		case TCP_NODELAY:
2476 			optval = tp->t_flags & TF_NODELAY;
2477 			INP_WUNLOCK(inp);
2478 			error = sooptcopyout(sopt, &optval, sizeof optval);
2479 			break;
2480 		case TCP_MAXSEG:
2481 			optval = tp->t_maxseg;
2482 			INP_WUNLOCK(inp);
2483 			error = sooptcopyout(sopt, &optval, sizeof optval);
2484 			break;
2485 		case TCP_REMOTE_UDP_ENCAPS_PORT:
2486 			optval = ntohs(tp->t_port);
2487 			INP_WUNLOCK(inp);
2488 			error = sooptcopyout(sopt, &optval, sizeof optval);
2489 			break;
2490 		case TCP_NOOPT:
2491 			optval = tp->t_flags & TF_NOOPT;
2492 			INP_WUNLOCK(inp);
2493 			error = sooptcopyout(sopt, &optval, sizeof optval);
2494 			break;
2495 		case TCP_NOPUSH:
2496 			optval = tp->t_flags & TF_NOPUSH;
2497 			INP_WUNLOCK(inp);
2498 			error = sooptcopyout(sopt, &optval, sizeof optval);
2499 			break;
2500 		case TCP_INFO:
2501 			tcp_fill_info(tp, &ti);
2502 			INP_WUNLOCK(inp);
2503 			error = sooptcopyout(sopt, &ti, sizeof ti);
2504 			break;
2505 		case TCP_STATS:
2506 			{
2507 #ifdef STATS
2508 			int nheld;
2509 			TYPEOF_MEMBER(struct statsblob, flags) sbflags = 0;
2510 
2511 			error = 0;
2512 			socklen_t outsbsz = sopt->sopt_valsize;
2513 			if (tp->t_stats == NULL)
2514 				error = ENOENT;
2515 			else if (outsbsz >= tp->t_stats->cursz)
2516 				outsbsz = tp->t_stats->cursz;
2517 			else if (outsbsz >= sizeof(struct statsblob))
2518 				outsbsz = sizeof(struct statsblob);
2519 			else
2520 				error = EINVAL;
2521 			INP_WUNLOCK(inp);
2522 			if (error)
2523 				break;
2524 
2525 			sbp = sopt->sopt_val;
2526 			nheld = atop(round_page(((vm_offset_t)sbp) +
2527 			    (vm_size_t)outsbsz) - trunc_page((vm_offset_t)sbp));
2528 			vm_page_t ma[nheld];
2529 			if (vm_fault_quick_hold_pages(
2530 			    &curproc->p_vmspace->vm_map, (vm_offset_t)sbp,
2531 			    outsbsz, VM_PROT_READ | VM_PROT_WRITE, ma,
2532 			    nheld) < 0) {
2533 				error = EFAULT;
2534 				break;
2535 			}
2536 
2537 			if ((error = copyin_nofault(&(sbp->flags), &sbflags,
2538 			    SIZEOF_MEMBER(struct statsblob, flags))))
2539 				goto unhold;
2540 
2541 			INP_WLOCK_RECHECK(inp);
2542 			error = stats_blob_snapshot(&sbp, outsbsz, tp->t_stats,
2543 			    sbflags | SB_CLONE_USRDSTNOFAULT);
2544 			INP_WUNLOCK(inp);
2545 			sopt->sopt_valsize = outsbsz;
2546 unhold:
2547 			vm_page_unhold_pages(ma, nheld);
2548 #else
2549 			INP_WUNLOCK(inp);
2550 			error = EOPNOTSUPP;
2551 #endif /* !STATS */
2552 			break;
2553 			}
2554 		case TCP_CONGESTION:
2555 			len = strlcpy(buf, CC_ALGO(tp)->name, TCP_CA_NAME_MAX);
2556 			INP_WUNLOCK(inp);
2557 			error = sooptcopyout(sopt, buf, len + 1);
2558 			break;
2559 		case TCP_MAXUNACKTIME:
2560 		case TCP_KEEPIDLE:
2561 		case TCP_KEEPINTVL:
2562 		case TCP_KEEPINIT:
2563 		case TCP_KEEPCNT:
2564 			switch (sopt->sopt_name) {
2565 			case TCP_MAXUNACKTIME:
2566 				ui = TP_MAXUNACKTIME(tp) / hz;
2567 				break;
2568 			case TCP_KEEPIDLE:
2569 				ui = TP_KEEPIDLE(tp) / hz;
2570 				break;
2571 			case TCP_KEEPINTVL:
2572 				ui = TP_KEEPINTVL(tp) / hz;
2573 				break;
2574 			case TCP_KEEPINIT:
2575 				ui = TP_KEEPINIT(tp) / hz;
2576 				break;
2577 			case TCP_KEEPCNT:
2578 				ui = TP_KEEPCNT(tp);
2579 				break;
2580 			}
2581 			INP_WUNLOCK(inp);
2582 			error = sooptcopyout(sopt, &ui, sizeof(ui));
2583 			break;
2584 #ifdef TCPPCAP
2585 		case TCP_PCAP_OUT:
2586 		case TCP_PCAP_IN:
2587 			optval = tcp_pcap_get_sock_max(
2588 					(sopt->sopt_name == TCP_PCAP_OUT) ?
2589 					&(tp->t_outpkts) : &(tp->t_inpkts));
2590 			INP_WUNLOCK(inp);
2591 			error = sooptcopyout(sopt, &optval, sizeof optval);
2592 			break;
2593 #endif
2594 		case TCP_FASTOPEN:
2595 			optval = tp->t_flags & TF_FASTOPEN;
2596 			INP_WUNLOCK(inp);
2597 			error = sooptcopyout(sopt, &optval, sizeof optval);
2598 			break;
2599 #ifdef TCP_BLACKBOX
2600 		case TCP_LOG:
2601 			optval = tcp_get_bblog_state(tp);
2602 			INP_WUNLOCK(inp);
2603 			error = sooptcopyout(sopt, &optval, sizeof(optval));
2604 			break;
2605 		case TCP_LOGBUF:
2606 			/* tcp_log_getlogbuf() does INP_WUNLOCK(inp) */
2607 			error = tcp_log_getlogbuf(sopt, tp);
2608 			break;
2609 		case TCP_LOGID:
2610 			len = tcp_log_get_id(tp, buf);
2611 			INP_WUNLOCK(inp);
2612 			error = sooptcopyout(sopt, buf, len + 1);
2613 			break;
2614 		case TCP_LOGDUMP:
2615 		case TCP_LOGDUMPID:
2616 			INP_WUNLOCK(inp);
2617 			error = EINVAL;
2618 			break;
2619 #endif
2620 #ifdef KERN_TLS
2621 		case TCP_TXTLS_MODE:
2622 			error = ktls_get_tx_mode(so, &optval);
2623 			INP_WUNLOCK(inp);
2624 			if (error == 0)
2625 				error = sooptcopyout(sopt, &optval,
2626 				    sizeof(optval));
2627 			break;
2628 		case TCP_RXTLS_MODE:
2629 			error = ktls_get_rx_mode(so, &optval);
2630 			INP_WUNLOCK(inp);
2631 			if (error == 0)
2632 				error = sooptcopyout(sopt, &optval,
2633 				    sizeof(optval));
2634 			break;
2635 #endif
2636 		default:
2637 			INP_WUNLOCK(inp);
2638 			error = ENOPROTOOPT;
2639 			break;
2640 		}
2641 		break;
2642 	}
2643 	return (error);
2644 }
2645 #undef INP_WLOCK_RECHECK
2646 #undef INP_WLOCK_RECHECK_CLEANUP
2647 
2648 /*
2649  * Initiate (or continue) disconnect.
2650  * If embryonic state, just send reset (once).
2651  * If in ``let data drain'' option and linger null, just drop.
2652  * Otherwise (hard), mark socket disconnecting and drop
2653  * current input data; switch states based on user close, and
2654  * send segment to peer (with FIN).
2655  */
2656 static void
2657 tcp_disconnect(struct tcpcb *tp)
2658 {
2659 	struct inpcb *inp = tptoinpcb(tp);
2660 	struct socket *so = tptosocket(tp);
2661 
2662 	NET_EPOCH_ASSERT();
2663 	INP_WLOCK_ASSERT(inp);
2664 
2665 	/*
2666 	 * Neither tcp_close() nor tcp_drop() should return NULL, as the
2667 	 * socket is still open.
2668 	 */
2669 	if (tp->t_state < TCPS_ESTABLISHED &&
2670 	    !(tp->t_state > TCPS_LISTEN && (tp->t_flags & TF_FASTOPEN))) {
2671 		tp = tcp_close(tp);
2672 		KASSERT(tp != NULL,
2673 		    ("tcp_disconnect: tcp_close() returned NULL"));
2674 	} else if ((so->so_options & SO_LINGER) && so->so_linger == 0) {
2675 		tp = tcp_drop(tp, 0);
2676 		KASSERT(tp != NULL,
2677 		    ("tcp_disconnect: tcp_drop() returned NULL"));
2678 	} else {
2679 		soisdisconnecting(so);
2680 		sbflush(&so->so_rcv);
2681 		tcp_usrclosed(tp);
2682 		if (!(inp->inp_flags & INP_DROPPED))
2683 			/* Ignore stack's drop request, we already at it. */
2684 			(void)tcp_output_nodrop(tp);
2685 	}
2686 }
2687 
2688 /*
2689  * User issued close, and wish to trail through shutdown states:
2690  * if never received SYN, just forget it.  If got a SYN from peer,
2691  * but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN.
2692  * If already got a FIN from peer, then almost done; go to LAST_ACK
2693  * state.  In all other cases, have already sent FIN to peer (e.g.
2694  * after PRU_SHUTDOWN), and just have to play tedious game waiting
2695  * for peer to send FIN or not respond to keep-alives, etc.
2696  * We can let the user exit from the close as soon as the FIN is acked.
2697  */
2698 static void
2699 tcp_usrclosed(struct tcpcb *tp)
2700 {
2701 
2702 	NET_EPOCH_ASSERT();
2703 	INP_WLOCK_ASSERT(tptoinpcb(tp));
2704 
2705 	switch (tp->t_state) {
2706 	case TCPS_LISTEN:
2707 #ifdef TCP_OFFLOAD
2708 		tcp_offload_listen_stop(tp);
2709 #endif
2710 		tcp_state_change(tp, TCPS_CLOSED);
2711 		/* FALLTHROUGH */
2712 	case TCPS_CLOSED:
2713 		tp = tcp_close(tp);
2714 		/*
2715 		 * tcp_close() should never return NULL here as the socket is
2716 		 * still open.
2717 		 */
2718 		KASSERT(tp != NULL,
2719 		    ("tcp_usrclosed: tcp_close() returned NULL"));
2720 		break;
2721 
2722 	case TCPS_SYN_SENT:
2723 	case TCPS_SYN_RECEIVED:
2724 		tp->t_flags |= TF_NEEDFIN;
2725 		break;
2726 
2727 	case TCPS_ESTABLISHED:
2728 		tcp_state_change(tp, TCPS_FIN_WAIT_1);
2729 		break;
2730 
2731 	case TCPS_CLOSE_WAIT:
2732 		tcp_state_change(tp, TCPS_LAST_ACK);
2733 		break;
2734 	}
2735 	if (tp->t_acktime == 0)
2736 		tp->t_acktime = ticks;
2737 	if (tp->t_state >= TCPS_FIN_WAIT_2) {
2738 		tcp_free_sackholes(tp);
2739 		soisdisconnected(tptosocket(tp));
2740 		/* Prevent the connection hanging in FIN_WAIT_2 forever. */
2741 		if (tp->t_state == TCPS_FIN_WAIT_2) {
2742 			int timeout;
2743 
2744 			timeout = (tcp_fast_finwait2_recycle) ?
2745 			    tcp_finwait2_timeout : TP_MAXIDLE(tp);
2746 			tcp_timer_activate(tp, TT_2MSL, timeout);
2747 		}
2748 	}
2749 }
2750 
2751 #ifdef DDB
2752 static void
2753 db_print_indent(int indent)
2754 {
2755 	int i;
2756 
2757 	for (i = 0; i < indent; i++)
2758 		db_printf(" ");
2759 }
2760 
2761 static void
2762 db_print_tstate(int t_state)
2763 {
2764 
2765 	switch (t_state) {
2766 	case TCPS_CLOSED:
2767 		db_printf("TCPS_CLOSED");
2768 		return;
2769 
2770 	case TCPS_LISTEN:
2771 		db_printf("TCPS_LISTEN");
2772 		return;
2773 
2774 	case TCPS_SYN_SENT:
2775 		db_printf("TCPS_SYN_SENT");
2776 		return;
2777 
2778 	case TCPS_SYN_RECEIVED:
2779 		db_printf("TCPS_SYN_RECEIVED");
2780 		return;
2781 
2782 	case TCPS_ESTABLISHED:
2783 		db_printf("TCPS_ESTABLISHED");
2784 		return;
2785 
2786 	case TCPS_CLOSE_WAIT:
2787 		db_printf("TCPS_CLOSE_WAIT");
2788 		return;
2789 
2790 	case TCPS_FIN_WAIT_1:
2791 		db_printf("TCPS_FIN_WAIT_1");
2792 		return;
2793 
2794 	case TCPS_CLOSING:
2795 		db_printf("TCPS_CLOSING");
2796 		return;
2797 
2798 	case TCPS_LAST_ACK:
2799 		db_printf("TCPS_LAST_ACK");
2800 		return;
2801 
2802 	case TCPS_FIN_WAIT_2:
2803 		db_printf("TCPS_FIN_WAIT_2");
2804 		return;
2805 
2806 	case TCPS_TIME_WAIT:
2807 		db_printf("TCPS_TIME_WAIT");
2808 		return;
2809 
2810 	default:
2811 		db_printf("unknown");
2812 		return;
2813 	}
2814 }
2815 
2816 static void
2817 db_print_tflags(u_int t_flags)
2818 {
2819 	int comma;
2820 
2821 	comma = 0;
2822 	if (t_flags & TF_ACKNOW) {
2823 		db_printf("%sTF_ACKNOW", comma ? ", " : "");
2824 		comma = 1;
2825 	}
2826 	if (t_flags & TF_DELACK) {
2827 		db_printf("%sTF_DELACK", comma ? ", " : "");
2828 		comma = 1;
2829 	}
2830 	if (t_flags & TF_NODELAY) {
2831 		db_printf("%sTF_NODELAY", comma ? ", " : "");
2832 		comma = 1;
2833 	}
2834 	if (t_flags & TF_NOOPT) {
2835 		db_printf("%sTF_NOOPT", comma ? ", " : "");
2836 		comma = 1;
2837 	}
2838 	if (t_flags & TF_SENTFIN) {
2839 		db_printf("%sTF_SENTFIN", comma ? ", " : "");
2840 		comma = 1;
2841 	}
2842 	if (t_flags & TF_REQ_SCALE) {
2843 		db_printf("%sTF_REQ_SCALE", comma ? ", " : "");
2844 		comma = 1;
2845 	}
2846 	if (t_flags & TF_RCVD_SCALE) {
2847 		db_printf("%sTF_RECVD_SCALE", comma ? ", " : "");
2848 		comma = 1;
2849 	}
2850 	if (t_flags & TF_REQ_TSTMP) {
2851 		db_printf("%sTF_REQ_TSTMP", comma ? ", " : "");
2852 		comma = 1;
2853 	}
2854 	if (t_flags & TF_RCVD_TSTMP) {
2855 		db_printf("%sTF_RCVD_TSTMP", comma ? ", " : "");
2856 		comma = 1;
2857 	}
2858 	if (t_flags & TF_SACK_PERMIT) {
2859 		db_printf("%sTF_SACK_PERMIT", comma ? ", " : "");
2860 		comma = 1;
2861 	}
2862 	if (t_flags & TF_NEEDSYN) {
2863 		db_printf("%sTF_NEEDSYN", comma ? ", " : "");
2864 		comma = 1;
2865 	}
2866 	if (t_flags & TF_NEEDFIN) {
2867 		db_printf("%sTF_NEEDFIN", comma ? ", " : "");
2868 		comma = 1;
2869 	}
2870 	if (t_flags & TF_NOPUSH) {
2871 		db_printf("%sTF_NOPUSH", comma ? ", " : "");
2872 		comma = 1;
2873 	}
2874 	if (t_flags & TF_PREVVALID) {
2875 		db_printf("%sTF_PREVVALID", comma ? ", " : "");
2876 		comma = 1;
2877 	}
2878 	if (t_flags & TF_WAKESOR) {
2879 		db_printf("%sTF_WAKESOR", comma ? ", " : "");
2880 		comma = 1;
2881 	}
2882 	if (t_flags & TF_GPUTINPROG) {
2883 		db_printf("%sTF_GPUTINPROG", comma ? ", " : "");
2884 		comma = 1;
2885 	}
2886 	if (t_flags & TF_MORETOCOME) {
2887 		db_printf("%sTF_MORETOCOME", comma ? ", " : "");
2888 		comma = 1;
2889 	}
2890 	if (t_flags & TF_SONOTCONN) {
2891 		db_printf("%sTF_SONOTCONN", comma ? ", " : "");
2892 		comma = 1;
2893 	}
2894 	if (t_flags & TF_LASTIDLE) {
2895 		db_printf("%sTF_LASTIDLE", comma ? ", " : "");
2896 		comma = 1;
2897 	}
2898 	if (t_flags & TF_RXWIN0SENT) {
2899 		db_printf("%sTF_RXWIN0SENT", comma ? ", " : "");
2900 		comma = 1;
2901 	}
2902 	if (t_flags & TF_FASTRECOVERY) {
2903 		db_printf("%sTF_FASTRECOVERY", comma ? ", " : "");
2904 		comma = 1;
2905 	}
2906 	if (t_flags & TF_WASFRECOVERY) {
2907 		db_printf("%sTF_WASFRECOVERY", comma ? ", " : "");
2908 		comma = 1;
2909 	}
2910 	if (t_flags & TF_SIGNATURE) {
2911 		db_printf("%sTF_SIGNATURE", comma ? ", " : "");
2912 		comma = 1;
2913 	}
2914 	if (t_flags & TF_FORCEDATA) {
2915 		db_printf("%sTF_FORCEDATA", comma ? ", " : "");
2916 		comma = 1;
2917 	}
2918 	if (t_flags & TF_TSO) {
2919 		db_printf("%sTF_TSO", comma ? ", " : "");
2920 		comma = 1;
2921 	}
2922 	if (t_flags & TF_TOE) {
2923 		db_printf("%sTF_TOE", comma ? ", " : "");
2924 		comma = 1;
2925 	}
2926 	if (t_flags & TF_CLOSED) {
2927 		db_printf("%sTF_CLOSED", comma ? ", " : "");
2928 		comma = 1;
2929 	}
2930 	if (t_flags & TF_SENTSYN) {
2931 		db_printf("%sTF_SENTSYN", comma ? ", " : "");
2932 		comma = 1;
2933 	}
2934 	if (t_flags & TF_LRD) {
2935 		db_printf("%sTF_LRD", comma ? ", " : "");
2936 		comma = 1;
2937 	}
2938 	if (t_flags & TF_CONGRECOVERY) {
2939 		db_printf("%sTF_CONGRECOVERY", comma ? ", " : "");
2940 		comma = 1;
2941 	}
2942 	if (t_flags & TF_WASCRECOVERY) {
2943 		db_printf("%sTF_WASCRECOVERY", comma ? ", " : "");
2944 		comma = 1;
2945 	}
2946 	if (t_flags & TF_FASTOPEN) {
2947 		db_printf("%sTF_FASTOPEN", comma ? ", " : "");
2948 		comma = 1;
2949 	}
2950 }
2951 
2952 static void
2953 db_print_tflags2(u_int t_flags2)
2954 {
2955 	int comma;
2956 
2957 	comma = 0;
2958 	if (t_flags2 & TF2_PLPMTU_BLACKHOLE) {
2959 		db_printf("%sTF2_PLPMTU_BLACKHOLE", comma ? ", " : "");
2960 		comma = 1;
2961 	}
2962 	if (t_flags2 & TF2_PLPMTU_PMTUD) {
2963 		db_printf("%sTF2_PLPMTU_PMTUD", comma ? ", " : "");
2964 		comma = 1;
2965 	}
2966 	if (t_flags2 & TF2_PLPMTU_MAXSEGSNT) {
2967 		db_printf("%sTF2_PLPMTU_MAXSEGSNT", comma ? ", " : "");
2968 		comma = 1;
2969 	}
2970 	if (t_flags2 & TF2_LOG_AUTO) {
2971 		db_printf("%sTF2_LOG_AUTO", comma ? ", " : "");
2972 		comma = 1;
2973 	}
2974 	if (t_flags2 & TF2_DROP_AF_DATA) {
2975 		db_printf("%sTF2_DROP_AF_DATA", comma ? ", " : "");
2976 		comma = 1;
2977 	}
2978 	if (t_flags2 & TF2_ECN_PERMIT) {
2979 		db_printf("%sTF2_ECN_PERMIT", comma ? ", " : "");
2980 		comma = 1;
2981 	}
2982 	if (t_flags2 & TF2_ECN_SND_CWR) {
2983 		db_printf("%sTF2_ECN_SND_CWR", comma ? ", " : "");
2984 		comma = 1;
2985 	}
2986 	if (t_flags2 & TF2_ECN_SND_ECE) {
2987 		db_printf("%sTF2_ECN_SND_ECE", comma ? ", " : "");
2988 		comma = 1;
2989 	}
2990 	if (t_flags2 & TF2_ACE_PERMIT) {
2991 		db_printf("%sTF2_ACE_PERMIT", comma ? ", " : "");
2992 		comma = 1;
2993 	}
2994 	if (t_flags2 & TF2_HPTS_CPU_SET) {
2995 		db_printf("%sTF2_HPTS_CPU_SET", comma ? ", " : "");
2996 		comma = 1;
2997 	}
2998 	if (t_flags2 & TF2_FBYTES_COMPLETE) {
2999 		db_printf("%sTF2_FBYTES_COMPLETE", comma ? ", " : "");
3000 		comma = 1;
3001 	}
3002 	if (t_flags2 & TF2_ECN_USE_ECT1) {
3003 		db_printf("%sTF2_ECN_USE_ECT1", comma ? ", " : "");
3004 		comma = 1;
3005 	}
3006 	if (t_flags2 & TF2_TCP_ACCOUNTING) {
3007 		db_printf("%sTF2_TCP_ACCOUNTING", comma ? ", " : "");
3008 		comma = 1;
3009 	}
3010 	if (t_flags2 & TF2_HPTS_CALLS) {
3011 		db_printf("%sTF2_HPTS_CALLS", comma ? ", " : "");
3012 		comma = 1;
3013 	}
3014 	if (t_flags2 & TF2_MBUF_L_ACKS) {
3015 		db_printf("%sTF2_MBUF_L_ACKS", comma ? ", " : "");
3016 		comma = 1;
3017 	}
3018 	if (t_flags2 & TF2_MBUF_ACKCMP) {
3019 		db_printf("%sTF2_MBUF_ACKCMP", comma ? ", " : "");
3020 		comma = 1;
3021 	}
3022 	if (t_flags2 & TF2_SUPPORTS_MBUFQ) {
3023 		db_printf("%sTF2_SUPPORTS_MBUFQ", comma ? ", " : "");
3024 		comma = 1;
3025 	}
3026 	if (t_flags2 & TF2_MBUF_QUEUE_READY) {
3027 		db_printf("%sTF2_MBUF_QUEUE_READY", comma ? ", " : "");
3028 		comma = 1;
3029 	}
3030 	if (t_flags2 & TF2_DONT_SACK_QUEUE) {
3031 		db_printf("%sTF2_DONT_SACK_QUEUE", comma ? ", " : "");
3032 		comma = 1;
3033 	}
3034 	if (t_flags2 & TF2_CANNOT_DO_ECN) {
3035 		db_printf("%sTF2_CANNOT_DO_ECN", comma ? ", " : "");
3036 		comma = 1;
3037 	}
3038 	if (t_flags2 & TF2_PROC_SACK_PROHIBIT) {
3039 		db_printf("%sTF2_PROC_SACK_PROHIBIT", comma ? ", " : "");
3040 		comma = 1;
3041 	}
3042 	if (t_flags2 & TF2_IPSEC_TSO) {
3043 		db_printf("%sTF2_IPSEC_TSO", comma ? ", " : "");
3044 		comma = 1;
3045 	}
3046 	if (t_flags2 & TF2_NO_ISS_CHECK) {
3047 		db_printf("%sTF2_NO_ISS_CHECK", comma ? ", " : "");
3048 		comma = 1;
3049 	}
3050 }
3051 
3052 static void
3053 db_print_toobflags(char t_oobflags)
3054 {
3055 	int comma;
3056 
3057 	comma = 0;
3058 	if (t_oobflags & TCPOOB_HAVEDATA) {
3059 		db_printf("%sTCPOOB_HAVEDATA", comma ? ", " : "");
3060 		comma = 1;
3061 	}
3062 	if (t_oobflags & TCPOOB_HADDATA) {
3063 		db_printf("%sTCPOOB_HADDATA", comma ? ", " : "");
3064 		comma = 1;
3065 	}
3066 }
3067 
3068 static void
3069 db_print_tcpcb(struct tcpcb *tp, const char *name, int indent)
3070 {
3071 
3072 	db_print_indent(indent);
3073 	db_printf("%s at %p\n", name, tp);
3074 
3075 	indent += 2;
3076 
3077 	db_print_indent(indent);
3078 	db_printf("t_segq first: %p   t_segqlen: %d   t_dupacks: %d\n",
3079 	   TAILQ_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks);
3080 
3081 	db_print_indent(indent);
3082 	db_printf("t_callout: %p   t_timers: %p\n",
3083 	    &tp->t_callout, &tp->t_timers);
3084 
3085 	db_print_indent(indent);
3086 	db_printf("t_state: %d (", tp->t_state);
3087 	db_print_tstate(tp->t_state);
3088 	db_printf(")\n");
3089 
3090 	db_print_indent(indent);
3091 	db_printf("t_flags: 0x%x (", tp->t_flags);
3092 	db_print_tflags(tp->t_flags);
3093 	db_printf(")\n");
3094 
3095 	db_print_indent(indent);
3096 	db_printf("t_flags2: 0x%x (", tp->t_flags2);
3097 	db_print_tflags2(tp->t_flags2);
3098 	db_printf(")\n");
3099 
3100 	db_print_indent(indent);
3101 	db_printf("snd_una: 0x%08x   snd_max: 0x%08x   snd_nxt: 0x%08x\n",
3102 	    tp->snd_una, tp->snd_max, tp->snd_nxt);
3103 
3104 	db_print_indent(indent);
3105 	db_printf("snd_up: 0x%08x   snd_wl1: 0x%08x   snd_wl2: 0x%08x\n",
3106 	   tp->snd_up, tp->snd_wl1, tp->snd_wl2);
3107 
3108 	db_print_indent(indent);
3109 	db_printf("iss: 0x%08x   irs: 0x%08x   rcv_nxt: 0x%08x\n",
3110 	    tp->iss, tp->irs, tp->rcv_nxt);
3111 
3112 	db_print_indent(indent);
3113 	db_printf("rcv_adv: 0x%08x   rcv_wnd: %u   rcv_up: 0x%08x\n",
3114 	    tp->rcv_adv, tp->rcv_wnd, tp->rcv_up);
3115 
3116 	db_print_indent(indent);
3117 	db_printf("snd_wnd: %u   snd_cwnd: %u\n",
3118 	   tp->snd_wnd, tp->snd_cwnd);
3119 
3120 	db_print_indent(indent);
3121 	db_printf("snd_ssthresh: %u   snd_recover: "
3122 	    "0x%08x\n", tp->snd_ssthresh, tp->snd_recover);
3123 
3124 	db_print_indent(indent);
3125 	db_printf("t_rcvtime: %u   t_startime: %u\n",
3126 	    tp->t_rcvtime, tp->t_starttime);
3127 
3128 	db_print_indent(indent);
3129 	db_printf("t_rttime: %u   t_rtsq: 0x%08x\n",
3130 	    tp->t_rtttime, tp->t_rtseq);
3131 
3132 	db_print_indent(indent);
3133 	db_printf("t_rxtcur: %d   t_maxseg: %u   t_srtt: %d\n",
3134 	    tp->t_rxtcur, tp->t_maxseg, tp->t_srtt);
3135 
3136 	db_print_indent(indent);
3137 	db_printf("t_rttvar: %d   t_rxtshift: %d   t_rttmin: %u\n",
3138 	    tp->t_rttvar, tp->t_rxtshift, tp->t_rttmin);
3139 
3140 	db_print_indent(indent);
3141 	db_printf("t_rttupdated: %u   max_sndwnd: %u   t_softerror: %d\n",
3142 	    tp->t_rttupdated, tp->max_sndwnd, tp->t_softerror);
3143 
3144 	db_print_indent(indent);
3145 	db_printf("t_oobflags: 0x%x (", tp->t_oobflags);
3146 	db_print_toobflags(tp->t_oobflags);
3147 	db_printf(")   t_iobc: 0x%02x\n", tp->t_iobc);
3148 
3149 	db_print_indent(indent);
3150 	db_printf("snd_scale: %u   rcv_scale: %u   request_r_scale: %u\n",
3151 	    tp->snd_scale, tp->rcv_scale, tp->request_r_scale);
3152 
3153 	db_print_indent(indent);
3154 	db_printf("ts_recent: %u   ts_recent_age: %u\n",
3155 	    tp->ts_recent, tp->ts_recent_age);
3156 
3157 	db_print_indent(indent);
3158 	db_printf("ts_offset: %u   last_ack_sent: 0x%08x   snd_cwnd_prev: "
3159 	    "%u\n", tp->ts_offset, tp->last_ack_sent, tp->snd_cwnd_prev);
3160 
3161 	db_print_indent(indent);
3162 	db_printf("snd_ssthresh_prev: %u   snd_recover_prev: 0x%08x   "
3163 	    "t_badrxtwin: %u\n", tp->snd_ssthresh_prev,
3164 	    tp->snd_recover_prev, tp->t_badrxtwin);
3165 
3166 	db_print_indent(indent);
3167 	db_printf("snd_numholes: %d  snd_holes first: %p\n",
3168 	    tp->snd_numholes, TAILQ_FIRST(&tp->snd_holes));
3169 
3170 	db_print_indent(indent);
3171 	db_printf("snd_fack: 0x%08x   rcv_numsacks: %d\n",
3172 	    tp->snd_fack, tp->rcv_numsacks);
3173 
3174 	/* Skip sackblks, sackhint. */
3175 
3176 	db_print_indent(indent);
3177 	db_printf("t_rttlow: %d   rfbuf_ts: %u   rfbuf_cnt: %d\n",
3178 	    tp->t_rttlow, tp->rfbuf_ts, tp->rfbuf_cnt);
3179 }
3180 
3181 DB_SHOW_COMMAND(tcpcb, db_show_tcpcb)
3182 {
3183 	struct tcpcb *tp;
3184 
3185 	if (!have_addr) {
3186 		db_printf("usage: show tcpcb <addr>\n");
3187 		return;
3188 	}
3189 	tp = (struct tcpcb *)addr;
3190 
3191 	db_print_tcpcb(tp, "tcpcb", 0);
3192 }
3193 #endif
3194