tcp_usrreq.c revision 302995
1/*-
2 * Copyright (c) 1982, 1986, 1988, 1993
3 *	The Regents of the University of California.
4 * Copyright (c) 2006-2007 Robert N. M. Watson
5 * Copyright (c) 2010-2011 Juniper Networks, Inc.
6 * All rights reserved.
7 *
8 * Portions of this software were developed by Robert N. M. Watson under
9 * contract to Juniper Networks, Inc.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in the
18 *    documentation and/or other materials provided with the distribution.
19 * 4. Neither the name of the University nor the names of its contributors
20 *    may be used to endorse or promote products derived from this software
21 *    without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 *
35 *	From: @(#)tcp_usrreq.c	8.2 (Berkeley) 1/3/94
36 */
37
38#include <sys/cdefs.h>
39__FBSDID("$FreeBSD: stable/10/sys/netinet/tcp_usrreq.c 302995 2016-07-18 08:20:31Z jch $");
40
41#include "opt_ddb.h"
42#include "opt_inet.h"
43#include "opt_inet6.h"
44#include "opt_tcpdebug.h"
45
46#include <sys/param.h>
47#include <sys/systm.h>
48#include <sys/limits.h>
49#include <sys/malloc.h>
50#include <sys/kernel.h>
51#include <sys/sysctl.h>
52#include <sys/mbuf.h>
53#ifdef INET6
54#include <sys/domain.h>
55#endif /* INET6 */
56#include <sys/socket.h>
57#include <sys/socketvar.h>
58#include <sys/protosw.h>
59#include <sys/proc.h>
60#include <sys/jail.h>
61
62#ifdef DDB
63#include <ddb/ddb.h>
64#endif
65
66#include <net/if.h>
67#include <net/route.h>
68#include <net/vnet.h>
69
70#include <netinet/cc.h>
71#include <netinet/in.h>
72#include <netinet/in_pcb.h>
73#include <netinet/in_systm.h>
74#include <netinet/in_var.h>
75#include <netinet/ip_var.h>
76#ifdef INET6
77#include <netinet/ip6.h>
78#include <netinet6/in6_pcb.h>
79#include <netinet6/ip6_var.h>
80#include <netinet6/scope6_var.h>
81#endif
82#ifdef TCP_RFC7413
83#include <netinet/tcp_fastopen.h>
84#endif
85#include <netinet/tcp_fsm.h>
86#include <netinet/tcp_seq.h>
87#include <netinet/tcp_timer.h>
88#include <netinet/tcp_var.h>
89#include <netinet/tcpip.h>
90#ifdef TCPDEBUG
91#include <netinet/tcp_debug.h>
92#endif
93#ifdef TCP_OFFLOAD
94#include <netinet/tcp_offload.h>
95#endif
96
97/*
98 * TCP protocol interface to socket abstraction.
99 */
100static int	tcp_attach(struct socket *);
101#ifdef INET
102static int	tcp_connect(struct tcpcb *, struct sockaddr *,
103		    struct thread *td);
104#endif /* INET */
105#ifdef INET6
106static int	tcp6_connect(struct tcpcb *, struct sockaddr *,
107		    struct thread *td);
108#endif /* INET6 */
109static void	tcp_disconnect(struct tcpcb *);
110static void	tcp_usrclosed(struct tcpcb *);
111static void	tcp_fill_info(struct tcpcb *, struct tcp_info *);
112
113#ifdef TCPDEBUG
114#define	TCPDEBUG0	int ostate = 0
115#define	TCPDEBUG1()	ostate = tp ? tp->t_state : 0
116#define	TCPDEBUG2(req)	if (tp && (so->so_options & SO_DEBUG)) \
117				tcp_trace(TA_USER, ostate, tp, 0, 0, req)
118#else
119#define	TCPDEBUG0
120#define	TCPDEBUG1()
121#define	TCPDEBUG2(req)
122#endif
123
124/*
125 * TCP attaches to socket via pru_attach(), reserving space,
126 * and an internet control block.
127 */
128static int
129tcp_usr_attach(struct socket *so, int proto, struct thread *td)
130{
131	struct inpcb *inp;
132	struct tcpcb *tp = NULL;
133	int error;
134	TCPDEBUG0;
135
136	inp = sotoinpcb(so);
137	KASSERT(inp == NULL, ("tcp_usr_attach: inp != NULL"));
138	TCPDEBUG1();
139
140	error = tcp_attach(so);
141	if (error)
142		goto out;
143
144	if ((so->so_options & SO_LINGER) && so->so_linger == 0)
145		so->so_linger = TCP_LINGERTIME;
146
147	inp = sotoinpcb(so);
148	tp = intotcpcb(inp);
149out:
150	TCPDEBUG2(PRU_ATTACH);
151	return error;
152}
153
154/*
155 * tcp_detach is called when the socket layer loses its final reference
156 * to the socket, be it a file descriptor reference, a reference from TCP,
157 * etc.  At this point, there is only one case in which we will keep around
158 * inpcb state: time wait.
159 *
160 * This function can probably be re-absorbed back into tcp_usr_detach() now
161 * that there is a single detach path.
162 */
163static void
164tcp_detach(struct socket *so, struct inpcb *inp)
165{
166	struct tcpcb *tp;
167
168	INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
169	INP_WLOCK_ASSERT(inp);
170
171	KASSERT(so->so_pcb == inp, ("tcp_detach: so_pcb != inp"));
172	KASSERT(inp->inp_socket == so, ("tcp_detach: inp_socket != so"));
173
174	tp = intotcpcb(inp);
175
176	if (inp->inp_flags & INP_TIMEWAIT) {
177		/*
178		 * There are two cases to handle: one in which the time wait
179		 * state is being discarded (INP_DROPPED), and one in which
180		 * this connection will remain in timewait.  In the former,
181		 * it is time to discard all state (except tcptw, which has
182		 * already been discarded by the timewait close code, which
183		 * should be further up the call stack somewhere).  In the
184		 * latter case, we detach from the socket, but leave the pcb
185		 * present until timewait ends.
186		 *
187		 * XXXRW: Would it be cleaner to free the tcptw here?
188		 *
189		 * Astute question indeed, from twtcp perspective there are
190		 * three cases to consider:
191		 *
192		 * #1 tcp_detach is called at tcptw creation time by
193		 *  tcp_twstart, then do not discard the newly created tcptw
194		 *  and leave inpcb present until timewait ends
195		 * #2 tcp_detach is called at timewait end (or reuse) by
196		 *  tcp_twclose, then the tcptw has already been discarded
197		 *  and inpcb is freed here
198		 * #3 tcp_detach is called() after timewait ends (or reuse)
199		 *  (e.g. by soclose), then tcptw has already been discarded
200		 *  and inpcb is freed here
201		 *
202		 *  In all three cases the tcptw should not be freed here.
203		 */
204		if (inp->inp_flags & INP_DROPPED) {
205			KASSERT(tp == NULL, ("tcp_detach: INP_TIMEWAIT && "
206			    "INP_DROPPED && tp != NULL"));
207			in_pcbdetach(inp);
208			in_pcbfree(inp);
209		} else {
210			in_pcbdetach(inp);
211			INP_WUNLOCK(inp);
212		}
213	} else {
214		/*
215		 * If the connection is not in timewait, we consider two
216		 * two conditions: one in which no further processing is
217		 * necessary (dropped || embryonic), and one in which TCP is
218		 * not yet done, but no longer requires the socket, so the
219		 * pcb will persist for the time being.
220		 *
221		 * XXXRW: Does the second case still occur?
222		 */
223		if (inp->inp_flags & INP_DROPPED ||
224		    tp->t_state < TCPS_SYN_SENT) {
225			tcp_discardcb(tp);
226			in_pcbdetach(inp);
227			in_pcbfree(inp);
228		} else {
229			in_pcbdetach(inp);
230			INP_WUNLOCK(inp);
231		}
232	}
233}
234
235/*
236 * pru_detach() detaches the TCP protocol from the socket.
237 * If the protocol state is non-embryonic, then can't
238 * do this directly: have to initiate a pru_disconnect(),
239 * which may finish later; embryonic TCB's can just
240 * be discarded here.
241 */
242static void
243tcp_usr_detach(struct socket *so)
244{
245	struct inpcb *inp;
246
247	inp = sotoinpcb(so);
248	KASSERT(inp != NULL, ("tcp_usr_detach: inp == NULL"));
249	INP_INFO_WLOCK(&V_tcbinfo);
250	INP_WLOCK(inp);
251	KASSERT(inp->inp_socket != NULL,
252	    ("tcp_usr_detach: inp_socket == NULL"));
253	tcp_detach(so, inp);
254	INP_INFO_WUNLOCK(&V_tcbinfo);
255}
256
257#ifdef INET
258/*
259 * Give the socket an address.
260 */
261static int
262tcp_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
263{
264	int error = 0;
265	struct inpcb *inp;
266	struct tcpcb *tp = NULL;
267	struct sockaddr_in *sinp;
268
269	sinp = (struct sockaddr_in *)nam;
270	if (nam->sa_len != sizeof (*sinp))
271		return (EINVAL);
272	/*
273	 * Must check for multicast addresses and disallow binding
274	 * to them.
275	 */
276	if (sinp->sin_family == AF_INET &&
277	    IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
278		return (EAFNOSUPPORT);
279
280	TCPDEBUG0;
281	inp = sotoinpcb(so);
282	KASSERT(inp != NULL, ("tcp_usr_bind: inp == NULL"));
283	INP_WLOCK(inp);
284	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
285		error = EINVAL;
286		goto out;
287	}
288	tp = intotcpcb(inp);
289	TCPDEBUG1();
290	INP_HASH_WLOCK(&V_tcbinfo);
291	error = in_pcbbind(inp, nam, td->td_ucred);
292	INP_HASH_WUNLOCK(&V_tcbinfo);
293out:
294	TCPDEBUG2(PRU_BIND);
295	INP_WUNLOCK(inp);
296
297	return (error);
298}
299#endif /* INET */
300
301#ifdef INET6
302static int
303tcp6_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
304{
305	int error = 0;
306	struct inpcb *inp;
307	struct tcpcb *tp = NULL;
308	struct sockaddr_in6 *sin6p;
309
310	sin6p = (struct sockaddr_in6 *)nam;
311	if (nam->sa_len != sizeof (*sin6p))
312		return (EINVAL);
313	/*
314	 * Must check for multicast addresses and disallow binding
315	 * to them.
316	 */
317	if (sin6p->sin6_family == AF_INET6 &&
318	    IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr))
319		return (EAFNOSUPPORT);
320
321	TCPDEBUG0;
322	inp = sotoinpcb(so);
323	KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
324	INP_WLOCK(inp);
325	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
326		error = EINVAL;
327		goto out;
328	}
329	tp = intotcpcb(inp);
330	TCPDEBUG1();
331	INP_HASH_WLOCK(&V_tcbinfo);
332	inp->inp_vflag &= ~INP_IPV4;
333	inp->inp_vflag |= INP_IPV6;
334#ifdef INET
335	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
336		if (IN6_IS_ADDR_UNSPECIFIED(&sin6p->sin6_addr))
337			inp->inp_vflag |= INP_IPV4;
338		else if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)) {
339			struct sockaddr_in sin;
340
341			in6_sin6_2_sin(&sin, sin6p);
342			inp->inp_vflag |= INP_IPV4;
343			inp->inp_vflag &= ~INP_IPV6;
344			error = in_pcbbind(inp, (struct sockaddr *)&sin,
345			    td->td_ucred);
346			INP_HASH_WUNLOCK(&V_tcbinfo);
347			goto out;
348		}
349	}
350#endif
351	error = in6_pcbbind(inp, nam, td->td_ucred);
352	INP_HASH_WUNLOCK(&V_tcbinfo);
353out:
354	TCPDEBUG2(PRU_BIND);
355	INP_WUNLOCK(inp);
356	return (error);
357}
358#endif /* INET6 */
359
360#ifdef INET
361/*
362 * Prepare to accept connections.
363 */
364static int
365tcp_usr_listen(struct socket *so, int backlog, struct thread *td)
366{
367	int error = 0;
368	struct inpcb *inp;
369	struct tcpcb *tp = NULL;
370
371	TCPDEBUG0;
372	inp = sotoinpcb(so);
373	KASSERT(inp != NULL, ("tcp_usr_listen: inp == NULL"));
374	INP_WLOCK(inp);
375	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
376		error = EINVAL;
377		goto out;
378	}
379	tp = intotcpcb(inp);
380	TCPDEBUG1();
381	SOCK_LOCK(so);
382	error = solisten_proto_check(so);
383	INP_HASH_WLOCK(&V_tcbinfo);
384	if (error == 0 && inp->inp_lport == 0)
385		error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
386	INP_HASH_WUNLOCK(&V_tcbinfo);
387	if (error == 0) {
388		tcp_state_change(tp, TCPS_LISTEN);
389		solisten_proto(so, backlog);
390#ifdef TCP_OFFLOAD
391		if ((so->so_options & SO_NO_OFFLOAD) == 0)
392			tcp_offload_listen_start(tp);
393#endif
394	}
395	SOCK_UNLOCK(so);
396
397#ifdef TCP_RFC7413
398	if (tp->t_flags & TF_FASTOPEN)
399		tp->t_tfo_pending = tcp_fastopen_alloc_counter();
400#endif
401out:
402	TCPDEBUG2(PRU_LISTEN);
403	INP_WUNLOCK(inp);
404	return (error);
405}
406#endif /* INET */
407
408#ifdef INET6
409static int
410tcp6_usr_listen(struct socket *so, int backlog, struct thread *td)
411{
412	int error = 0;
413	struct inpcb *inp;
414	struct tcpcb *tp = NULL;
415
416	TCPDEBUG0;
417	inp = sotoinpcb(so);
418	KASSERT(inp != NULL, ("tcp6_usr_listen: inp == NULL"));
419	INP_WLOCK(inp);
420	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
421		error = EINVAL;
422		goto out;
423	}
424	tp = intotcpcb(inp);
425	TCPDEBUG1();
426	SOCK_LOCK(so);
427	error = solisten_proto_check(so);
428	INP_HASH_WLOCK(&V_tcbinfo);
429	if (error == 0 && inp->inp_lport == 0) {
430		inp->inp_vflag &= ~INP_IPV4;
431		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
432			inp->inp_vflag |= INP_IPV4;
433		error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
434	}
435	INP_HASH_WUNLOCK(&V_tcbinfo);
436	if (error == 0) {
437		tcp_state_change(tp, TCPS_LISTEN);
438		solisten_proto(so, backlog);
439#ifdef TCP_OFFLOAD
440		if ((so->so_options & SO_NO_OFFLOAD) == 0)
441			tcp_offload_listen_start(tp);
442#endif
443	}
444	SOCK_UNLOCK(so);
445
446#ifdef TCP_RFC7413
447	if (tp->t_flags & TF_FASTOPEN)
448		tp->t_tfo_pending = tcp_fastopen_alloc_counter();
449#endif
450out:
451	TCPDEBUG2(PRU_LISTEN);
452	INP_WUNLOCK(inp);
453	return (error);
454}
455#endif /* INET6 */
456
457#ifdef INET
458/*
459 * Initiate connection to peer.
460 * Create a template for use in transmissions on this connection.
461 * Enter SYN_SENT state, and mark socket as connecting.
462 * Start keep-alive timer, and seed output sequence space.
463 * Send initial segment on connection.
464 */
465static int
466tcp_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
467{
468	int error = 0;
469	struct inpcb *inp;
470	struct tcpcb *tp = NULL;
471	struct sockaddr_in *sinp;
472
473	sinp = (struct sockaddr_in *)nam;
474	if (nam->sa_len != sizeof (*sinp))
475		return (EINVAL);
476	/*
477	 * Must disallow TCP ``connections'' to multicast addresses.
478	 */
479	if (sinp->sin_family == AF_INET
480	    && IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
481		return (EAFNOSUPPORT);
482	if ((error = prison_remote_ip4(td->td_ucred, &sinp->sin_addr)) != 0)
483		return (error);
484
485	TCPDEBUG0;
486	inp = sotoinpcb(so);
487	KASSERT(inp != NULL, ("tcp_usr_connect: inp == NULL"));
488	INP_WLOCK(inp);
489	if (inp->inp_flags & INP_TIMEWAIT) {
490		error = EADDRINUSE;
491		goto out;
492	}
493	if (inp->inp_flags & INP_DROPPED) {
494		error = ECONNREFUSED;
495		goto out;
496	}
497	tp = intotcpcb(inp);
498	TCPDEBUG1();
499	if ((error = tcp_connect(tp, nam, td)) != 0)
500		goto out;
501#ifdef TCP_OFFLOAD
502	if (registered_toedevs > 0 &&
503	    (so->so_options & SO_NO_OFFLOAD) == 0 &&
504	    (error = tcp_offload_connect(so, nam)) == 0)
505		goto out;
506#endif
507	tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
508	error = tcp_output(tp);
509out:
510	TCPDEBUG2(PRU_CONNECT);
511	INP_WUNLOCK(inp);
512	return (error);
513}
514#endif /* INET */
515
516#ifdef INET6
517static int
518tcp6_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
519{
520	int error = 0;
521	struct inpcb *inp;
522	struct tcpcb *tp = NULL;
523	struct sockaddr_in6 *sin6p;
524
525	TCPDEBUG0;
526
527	sin6p = (struct sockaddr_in6 *)nam;
528	if (nam->sa_len != sizeof (*sin6p))
529		return (EINVAL);
530	/*
531	 * Must disallow TCP ``connections'' to multicast addresses.
532	 */
533	if (sin6p->sin6_family == AF_INET6
534	    && IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr))
535		return (EAFNOSUPPORT);
536
537	inp = sotoinpcb(so);
538	KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
539	INP_WLOCK(inp);
540	if (inp->inp_flags & INP_TIMEWAIT) {
541		error = EADDRINUSE;
542		goto out;
543	}
544	if (inp->inp_flags & INP_DROPPED) {
545		error = ECONNREFUSED;
546		goto out;
547	}
548	tp = intotcpcb(inp);
549	TCPDEBUG1();
550#ifdef INET
551	/*
552	 * XXXRW: Some confusion: V4/V6 flags relate to binding, and
553	 * therefore probably require the hash lock, which isn't held here.
554	 * Is this a significant problem?
555	 */
556	if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)) {
557		struct sockaddr_in sin;
558
559		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
560			error = EINVAL;
561			goto out;
562		}
563
564		in6_sin6_2_sin(&sin, sin6p);
565		inp->inp_vflag |= INP_IPV4;
566		inp->inp_vflag &= ~INP_IPV6;
567		if ((error = prison_remote_ip4(td->td_ucred,
568		    &sin.sin_addr)) != 0)
569			goto out;
570		if ((error = tcp_connect(tp, (struct sockaddr *)&sin, td)) != 0)
571			goto out;
572#ifdef TCP_OFFLOAD
573		if (registered_toedevs > 0 &&
574		    (so->so_options & SO_NO_OFFLOAD) == 0 &&
575		    (error = tcp_offload_connect(so, nam)) == 0)
576			goto out;
577#endif
578		error = tcp_output(tp);
579		goto out;
580	}
581#endif
582	inp->inp_vflag &= ~INP_IPV4;
583	inp->inp_vflag |= INP_IPV6;
584	inp->inp_inc.inc_flags |= INC_ISIPV6;
585	if ((error = prison_remote_ip6(td->td_ucred, &sin6p->sin6_addr)) != 0)
586		goto out;
587	if ((error = tcp6_connect(tp, nam, td)) != 0)
588		goto out;
589#ifdef TCP_OFFLOAD
590	if (registered_toedevs > 0 &&
591	    (so->so_options & SO_NO_OFFLOAD) == 0 &&
592	    (error = tcp_offload_connect(so, nam)) == 0)
593		goto out;
594#endif
595	tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
596	error = tcp_output(tp);
597
598out:
599	TCPDEBUG2(PRU_CONNECT);
600	INP_WUNLOCK(inp);
601	return (error);
602}
603#endif /* INET6 */
604
605/*
606 * Initiate disconnect from peer.
607 * If connection never passed embryonic stage, just drop;
608 * else if don't need to let data drain, then can just drop anyways,
609 * else have to begin TCP shutdown process: mark socket disconnecting,
610 * drain unread data, state switch to reflect user close, and
611 * send segment (e.g. FIN) to peer.  Socket will be really disconnected
612 * when peer sends FIN and acks ours.
613 *
614 * SHOULD IMPLEMENT LATER PRU_CONNECT VIA REALLOC TCPCB.
615 */
616static int
617tcp_usr_disconnect(struct socket *so)
618{
619	struct inpcb *inp;
620	struct tcpcb *tp = NULL;
621	int error = 0;
622
623	TCPDEBUG0;
624	INP_INFO_WLOCK(&V_tcbinfo);
625	inp = sotoinpcb(so);
626	KASSERT(inp != NULL, ("tcp_usr_disconnect: inp == NULL"));
627	INP_WLOCK(inp);
628	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
629		error = ECONNRESET;
630		goto out;
631	}
632	tp = intotcpcb(inp);
633	TCPDEBUG1();
634	tcp_disconnect(tp);
635out:
636	TCPDEBUG2(PRU_DISCONNECT);
637	INP_WUNLOCK(inp);
638	INP_INFO_WUNLOCK(&V_tcbinfo);
639	return (error);
640}
641
642#ifdef INET
643/*
644 * Accept a connection.  Essentially all the work is done at higher levels;
645 * just return the address of the peer, storing through addr.
646 */
647static int
648tcp_usr_accept(struct socket *so, struct sockaddr **nam)
649{
650	int error = 0;
651	struct inpcb *inp = NULL;
652	struct tcpcb *tp = NULL;
653	struct in_addr addr;
654	in_port_t port = 0;
655	TCPDEBUG0;
656
657	if (so->so_state & SS_ISDISCONNECTED)
658		return (ECONNABORTED);
659
660	inp = sotoinpcb(so);
661	KASSERT(inp != NULL, ("tcp_usr_accept: inp == NULL"));
662	INP_WLOCK(inp);
663	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
664		error = ECONNABORTED;
665		goto out;
666	}
667	tp = intotcpcb(inp);
668	TCPDEBUG1();
669
670	/*
671	 * We inline in_getpeeraddr and COMMON_END here, so that we can
672	 * copy the data of interest and defer the malloc until after we
673	 * release the lock.
674	 */
675	port = inp->inp_fport;
676	addr = inp->inp_faddr;
677
678out:
679	TCPDEBUG2(PRU_ACCEPT);
680	INP_WUNLOCK(inp);
681	if (error == 0)
682		*nam = in_sockaddr(port, &addr);
683	return error;
684}
685#endif /* INET */
686
687#ifdef INET6
688static int
689tcp6_usr_accept(struct socket *so, struct sockaddr **nam)
690{
691	struct inpcb *inp = NULL;
692	int error = 0;
693	struct tcpcb *tp = NULL;
694	struct in_addr addr;
695	struct in6_addr addr6;
696	in_port_t port = 0;
697	int v4 = 0;
698	TCPDEBUG0;
699
700	if (so->so_state & SS_ISDISCONNECTED)
701		return (ECONNABORTED);
702
703	inp = sotoinpcb(so);
704	KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
705	INP_INFO_RLOCK(&V_tcbinfo);
706	INP_WLOCK(inp);
707	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
708		error = ECONNABORTED;
709		goto out;
710	}
711	tp = intotcpcb(inp);
712	TCPDEBUG1();
713
714	/*
715	 * We inline in6_mapped_peeraddr and COMMON_END here, so that we can
716	 * copy the data of interest and defer the malloc until after we
717	 * release the lock.
718	 */
719	if (inp->inp_vflag & INP_IPV4) {
720		v4 = 1;
721		port = inp->inp_fport;
722		addr = inp->inp_faddr;
723	} else {
724		port = inp->inp_fport;
725		addr6 = inp->in6p_faddr;
726	}
727
728out:
729	TCPDEBUG2(PRU_ACCEPT);
730	INP_WUNLOCK(inp);
731	INP_INFO_RUNLOCK(&V_tcbinfo);
732	if (error == 0) {
733		if (v4)
734			*nam = in6_v4mapsin6_sockaddr(port, &addr);
735		else
736			*nam = in6_sockaddr(port, &addr6);
737	}
738	return error;
739}
740#endif /* INET6 */
741
742/*
743 * Mark the connection as being incapable of further output.
744 */
745static int
746tcp_usr_shutdown(struct socket *so)
747{
748	int error = 0;
749	struct inpcb *inp;
750	struct tcpcb *tp = NULL;
751
752	TCPDEBUG0;
753	INP_INFO_WLOCK(&V_tcbinfo);
754	inp = sotoinpcb(so);
755	KASSERT(inp != NULL, ("inp == NULL"));
756	INP_WLOCK(inp);
757	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
758		error = ECONNRESET;
759		goto out;
760	}
761	tp = intotcpcb(inp);
762	TCPDEBUG1();
763	socantsendmore(so);
764	tcp_usrclosed(tp);
765	if (!(inp->inp_flags & INP_DROPPED))
766		error = tcp_output(tp);
767
768out:
769	TCPDEBUG2(PRU_SHUTDOWN);
770	INP_WUNLOCK(inp);
771	INP_INFO_WUNLOCK(&V_tcbinfo);
772
773	return (error);
774}
775
776/*
777 * After a receive, possibly send window update to peer.
778 */
779static int
780tcp_usr_rcvd(struct socket *so, int flags)
781{
782	struct inpcb *inp;
783	struct tcpcb *tp = NULL;
784	int error = 0;
785
786	TCPDEBUG0;
787	inp = sotoinpcb(so);
788	KASSERT(inp != NULL, ("tcp_usr_rcvd: inp == NULL"));
789	INP_WLOCK(inp);
790	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
791		error = ECONNRESET;
792		goto out;
793	}
794	tp = intotcpcb(inp);
795	TCPDEBUG1();
796#ifdef TCP_RFC7413
797	/*
798	 * For passively-created TFO connections, don't attempt a window
799	 * update while still in SYN_RECEIVED as this may trigger an early
800	 * SYN|ACK.  It is preferable to have the SYN|ACK be sent along with
801	 * application response data, or failing that, when the DELACK timer
802	 * expires.
803	 */
804	if ((tp->t_flags & TF_FASTOPEN) &&
805	    (tp->t_state == TCPS_SYN_RECEIVED))
806		goto out;
807#endif
808#ifdef TCP_OFFLOAD
809	if (tp->t_flags & TF_TOE)
810		tcp_offload_rcvd(tp);
811	else
812#endif
813	tcp_output(tp);
814
815out:
816	TCPDEBUG2(PRU_RCVD);
817	INP_WUNLOCK(inp);
818	return (error);
819}
820
821/*
822 * Do a send by putting data in output queue and updating urgent
823 * marker if URG set.  Possibly send more data.  Unlike the other
824 * pru_*() routines, the mbuf chains are our responsibility.  We
825 * must either enqueue them or free them.  The other pru_* routines
826 * generally are caller-frees.
827 */
828static int
829tcp_usr_send(struct socket *so, int flags, struct mbuf *m,
830    struct sockaddr *nam, struct mbuf *control, struct thread *td)
831{
832	int error = 0;
833	struct inpcb *inp;
834	struct tcpcb *tp = NULL;
835#ifdef INET6
836	int isipv6;
837#endif
838	TCPDEBUG0;
839
840	/*
841	 * We require the pcbinfo lock if we will close the socket as part of
842	 * this call.
843	 */
844	if (flags & PRUS_EOF)
845		INP_INFO_WLOCK(&V_tcbinfo);
846	inp = sotoinpcb(so);
847	KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"));
848	INP_WLOCK(inp);
849	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
850		if (control)
851			m_freem(control);
852		if (m)
853			m_freem(m);
854		error = ECONNRESET;
855		goto out;
856	}
857#ifdef INET6
858	isipv6 = nam && nam->sa_family == AF_INET6;
859#endif /* INET6 */
860	tp = intotcpcb(inp);
861	TCPDEBUG1();
862	if (control) {
863		/* TCP doesn't do control messages (rights, creds, etc) */
864		if (control->m_len) {
865			m_freem(control);
866			if (m)
867				m_freem(m);
868			error = EINVAL;
869			goto out;
870		}
871		m_freem(control);	/* empty control, just free it */
872	}
873	if (!(flags & PRUS_OOB)) {
874		sbappendstream(&so->so_snd, m);
875		if (nam && tp->t_state < TCPS_SYN_SENT) {
876			/*
877			 * Do implied connect if not yet connected,
878			 * initialize window to default value, and
879			 * initialize maxseg/maxopd using peer's cached
880			 * MSS.
881			 */
882#ifdef INET6
883			if (isipv6)
884				error = tcp6_connect(tp, nam, td);
885#endif /* INET6 */
886#if defined(INET6) && defined(INET)
887			else
888#endif
889#ifdef INET
890				error = tcp_connect(tp, nam, td);
891#endif
892			if (error)
893				goto out;
894			tp->snd_wnd = TTCP_CLIENT_SND_WND;
895			tcp_mss(tp, -1);
896		}
897		if (flags & PRUS_EOF) {
898			/*
899			 * Close the send side of the connection after
900			 * the data is sent.
901			 */
902			INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
903			socantsendmore(so);
904			tcp_usrclosed(tp);
905		}
906		if (!(inp->inp_flags & INP_DROPPED)) {
907			if (flags & PRUS_MORETOCOME)
908				tp->t_flags |= TF_MORETOCOME;
909			error = tcp_output(tp);
910			if (flags & PRUS_MORETOCOME)
911				tp->t_flags &= ~TF_MORETOCOME;
912		}
913	} else {
914		/*
915		 * XXXRW: PRUS_EOF not implemented with PRUS_OOB?
916		 */
917		SOCKBUF_LOCK(&so->so_snd);
918		if (sbspace(&so->so_snd) < -512) {
919			SOCKBUF_UNLOCK(&so->so_snd);
920			m_freem(m);
921			error = ENOBUFS;
922			goto out;
923		}
924		/*
925		 * According to RFC961 (Assigned Protocols),
926		 * the urgent pointer points to the last octet
927		 * of urgent data.  We continue, however,
928		 * to consider it to indicate the first octet
929		 * of data past the urgent section.
930		 * Otherwise, snd_up should be one lower.
931		 */
932		sbappendstream_locked(&so->so_snd, m);
933		SOCKBUF_UNLOCK(&so->so_snd);
934		if (nam && tp->t_state < TCPS_SYN_SENT) {
935			/*
936			 * Do implied connect if not yet connected,
937			 * initialize window to default value, and
938			 * initialize maxseg/maxopd using peer's cached
939			 * MSS.
940			 */
941#ifdef INET6
942			if (isipv6)
943				error = tcp6_connect(tp, nam, td);
944#endif /* INET6 */
945#if defined(INET6) && defined(INET)
946			else
947#endif
948#ifdef INET
949				error = tcp_connect(tp, nam, td);
950#endif
951			if (error)
952				goto out;
953			tp->snd_wnd = TTCP_CLIENT_SND_WND;
954			tcp_mss(tp, -1);
955		}
956		tp->snd_up = tp->snd_una + so->so_snd.sb_cc;
957		tp->t_flags |= TF_FORCEDATA;
958		error = tcp_output(tp);
959		tp->t_flags &= ~TF_FORCEDATA;
960	}
961out:
962	TCPDEBUG2((flags & PRUS_OOB) ? PRU_SENDOOB :
963		  ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
964	INP_WUNLOCK(inp);
965	if (flags & PRUS_EOF)
966		INP_INFO_WUNLOCK(&V_tcbinfo);
967	return (error);
968}
969
970/*
971 * Abort the TCP.  Drop the connection abruptly.
972 */
973static void
974tcp_usr_abort(struct socket *so)
975{
976	struct inpcb *inp;
977	struct tcpcb *tp = NULL;
978	TCPDEBUG0;
979
980	inp = sotoinpcb(so);
981	KASSERT(inp != NULL, ("tcp_usr_abort: inp == NULL"));
982
983	INP_INFO_WLOCK(&V_tcbinfo);
984	INP_WLOCK(inp);
985	KASSERT(inp->inp_socket != NULL,
986	    ("tcp_usr_abort: inp_socket == NULL"));
987
988	/*
989	 * If we still have full TCP state, and we're not dropped, drop.
990	 */
991	if (!(inp->inp_flags & INP_TIMEWAIT) &&
992	    !(inp->inp_flags & INP_DROPPED)) {
993		tp = intotcpcb(inp);
994		TCPDEBUG1();
995		tcp_drop(tp, ECONNABORTED);
996		TCPDEBUG2(PRU_ABORT);
997	}
998	if (!(inp->inp_flags & INP_DROPPED)) {
999		SOCK_LOCK(so);
1000		so->so_state |= SS_PROTOREF;
1001		SOCK_UNLOCK(so);
1002		inp->inp_flags |= INP_SOCKREF;
1003	}
1004	INP_WUNLOCK(inp);
1005	INP_INFO_WUNLOCK(&V_tcbinfo);
1006}
1007
1008/*
1009 * TCP socket is closed.  Start friendly disconnect.
1010 */
1011static void
1012tcp_usr_close(struct socket *so)
1013{
1014	struct inpcb *inp;
1015	struct tcpcb *tp = NULL;
1016	TCPDEBUG0;
1017
1018	inp = sotoinpcb(so);
1019	KASSERT(inp != NULL, ("tcp_usr_close: inp == NULL"));
1020
1021	INP_INFO_WLOCK(&V_tcbinfo);
1022	INP_WLOCK(inp);
1023	KASSERT(inp->inp_socket != NULL,
1024	    ("tcp_usr_close: inp_socket == NULL"));
1025
1026	/*
1027	 * If we still have full TCP state, and we're not dropped, initiate
1028	 * a disconnect.
1029	 */
1030	if (!(inp->inp_flags & INP_TIMEWAIT) &&
1031	    !(inp->inp_flags & INP_DROPPED)) {
1032		tp = intotcpcb(inp);
1033		TCPDEBUG1();
1034		tcp_disconnect(tp);
1035		TCPDEBUG2(PRU_CLOSE);
1036	}
1037	if (!(inp->inp_flags & INP_DROPPED)) {
1038		SOCK_LOCK(so);
1039		so->so_state |= SS_PROTOREF;
1040		SOCK_UNLOCK(so);
1041		inp->inp_flags |= INP_SOCKREF;
1042	}
1043	INP_WUNLOCK(inp);
1044	INP_INFO_WUNLOCK(&V_tcbinfo);
1045}
1046
1047/*
1048 * Receive out-of-band data.
1049 */
1050static int
1051tcp_usr_rcvoob(struct socket *so, struct mbuf *m, int flags)
1052{
1053	int error = 0;
1054	struct inpcb *inp;
1055	struct tcpcb *tp = NULL;
1056
1057	TCPDEBUG0;
1058	inp = sotoinpcb(so);
1059	KASSERT(inp != NULL, ("tcp_usr_rcvoob: inp == NULL"));
1060	INP_WLOCK(inp);
1061	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1062		error = ECONNRESET;
1063		goto out;
1064	}
1065	tp = intotcpcb(inp);
1066	TCPDEBUG1();
1067	if ((so->so_oobmark == 0 &&
1068	     (so->so_rcv.sb_state & SBS_RCVATMARK) == 0) ||
1069	    so->so_options & SO_OOBINLINE ||
1070	    tp->t_oobflags & TCPOOB_HADDATA) {
1071		error = EINVAL;
1072		goto out;
1073	}
1074	if ((tp->t_oobflags & TCPOOB_HAVEDATA) == 0) {
1075		error = EWOULDBLOCK;
1076		goto out;
1077	}
1078	m->m_len = 1;
1079	*mtod(m, caddr_t) = tp->t_iobc;
1080	if ((flags & MSG_PEEK) == 0)
1081		tp->t_oobflags ^= (TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1082
1083out:
1084	TCPDEBUG2(PRU_RCVOOB);
1085	INP_WUNLOCK(inp);
1086	return (error);
1087}
1088
1089#ifdef INET
1090struct pr_usrreqs tcp_usrreqs = {
1091	.pru_abort =		tcp_usr_abort,
1092	.pru_accept =		tcp_usr_accept,
1093	.pru_attach =		tcp_usr_attach,
1094	.pru_bind =		tcp_usr_bind,
1095	.pru_connect =		tcp_usr_connect,
1096	.pru_control =		in_control,
1097	.pru_detach =		tcp_usr_detach,
1098	.pru_disconnect =	tcp_usr_disconnect,
1099	.pru_listen =		tcp_usr_listen,
1100	.pru_peeraddr =		in_getpeeraddr,
1101	.pru_rcvd =		tcp_usr_rcvd,
1102	.pru_rcvoob =		tcp_usr_rcvoob,
1103	.pru_send =		tcp_usr_send,
1104	.pru_shutdown =		tcp_usr_shutdown,
1105	.pru_sockaddr =		in_getsockaddr,
1106	.pru_sosetlabel =	in_pcbsosetlabel,
1107	.pru_close =		tcp_usr_close,
1108};
1109#endif /* INET */
1110
1111#ifdef INET6
1112struct pr_usrreqs tcp6_usrreqs = {
1113	.pru_abort =		tcp_usr_abort,
1114	.pru_accept =		tcp6_usr_accept,
1115	.pru_attach =		tcp_usr_attach,
1116	.pru_bind =		tcp6_usr_bind,
1117	.pru_connect =		tcp6_usr_connect,
1118	.pru_control =		in6_control,
1119	.pru_detach =		tcp_usr_detach,
1120	.pru_disconnect =	tcp_usr_disconnect,
1121	.pru_listen =		tcp6_usr_listen,
1122	.pru_peeraddr =		in6_mapped_peeraddr,
1123	.pru_rcvd =		tcp_usr_rcvd,
1124	.pru_rcvoob =		tcp_usr_rcvoob,
1125	.pru_send =		tcp_usr_send,
1126	.pru_shutdown =		tcp_usr_shutdown,
1127	.pru_sockaddr =		in6_mapped_sockaddr,
1128	.pru_sosetlabel =	in_pcbsosetlabel,
1129	.pru_close =		tcp_usr_close,
1130};
1131#endif /* INET6 */
1132
1133#ifdef INET
1134/*
1135 * Common subroutine to open a TCP connection to remote host specified
1136 * by struct sockaddr_in in mbuf *nam.  Call in_pcbbind to assign a local
1137 * port number if needed.  Call in_pcbconnect_setup to do the routing and
1138 * to choose a local host address (interface).  If there is an existing
1139 * incarnation of the same connection in TIME-WAIT state and if the remote
1140 * host was sending CC options and if the connection duration was < MSL, then
1141 * truncate the previous TIME-WAIT state and proceed.
1142 * Initialize connection parameters and enter SYN-SENT state.
1143 */
1144static int
1145tcp_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1146{
1147	struct inpcb *inp = tp->t_inpcb, *oinp;
1148	struct socket *so = inp->inp_socket;
1149	struct in_addr laddr;
1150	u_short lport;
1151	int error;
1152
1153	INP_WLOCK_ASSERT(inp);
1154	INP_HASH_WLOCK(&V_tcbinfo);
1155
1156	if (inp->inp_lport == 0) {
1157		error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1158		if (error)
1159			goto out;
1160	}
1161
1162	/*
1163	 * Cannot simply call in_pcbconnect, because there might be an
1164	 * earlier incarnation of this same connection still in
1165	 * TIME_WAIT state, creating an ADDRINUSE error.
1166	 */
1167	laddr = inp->inp_laddr;
1168	lport = inp->inp_lport;
1169	error = in_pcbconnect_setup(inp, nam, &laddr.s_addr, &lport,
1170	    &inp->inp_faddr.s_addr, &inp->inp_fport, &oinp, td->td_ucred);
1171	if (error && oinp == NULL)
1172		goto out;
1173	if (oinp) {
1174		error = EADDRINUSE;
1175		goto out;
1176	}
1177	inp->inp_laddr = laddr;
1178	in_pcbrehash(inp);
1179	INP_HASH_WUNLOCK(&V_tcbinfo);
1180
1181	/*
1182	 * Compute window scaling to request:
1183	 * Scale to fit into sweet spot.  See tcp_syncache.c.
1184	 * XXX: This should move to tcp_output().
1185	 */
1186	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1187	    (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1188		tp->request_r_scale++;
1189
1190	soisconnecting(so);
1191	TCPSTAT_INC(tcps_connattempt);
1192	tcp_state_change(tp, TCPS_SYN_SENT);
1193	tp->iss = tcp_new_isn(tp);
1194	tcp_sendseqinit(tp);
1195
1196	return 0;
1197
1198out:
1199	INP_HASH_WUNLOCK(&V_tcbinfo);
1200	return (error);
1201}
1202#endif /* INET */
1203
1204#ifdef INET6
1205static int
1206tcp6_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1207{
1208	struct inpcb *inp = tp->t_inpcb, *oinp;
1209	struct socket *so = inp->inp_socket;
1210	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
1211	struct in6_addr addr6;
1212	int error;
1213
1214	INP_WLOCK_ASSERT(inp);
1215	INP_HASH_WLOCK(&V_tcbinfo);
1216
1217	if (inp->inp_lport == 0) {
1218		error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1219		if (error)
1220			goto out;
1221	}
1222
1223	/*
1224	 * Cannot simply call in_pcbconnect, because there might be an
1225	 * earlier incarnation of this same connection still in
1226	 * TIME_WAIT state, creating an ADDRINUSE error.
1227	 * in6_pcbladdr() also handles scope zone IDs.
1228	 *
1229	 * XXXRW: We wouldn't need to expose in6_pcblookup_hash_locked()
1230	 * outside of in6_pcb.c if there were an in6_pcbconnect_setup().
1231	 */
1232	error = in6_pcbladdr(inp, nam, &addr6);
1233	if (error)
1234		goto out;
1235	oinp = in6_pcblookup_hash_locked(inp->inp_pcbinfo,
1236				  &sin6->sin6_addr, sin6->sin6_port,
1237				  IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)
1238				  ? &addr6
1239				  : &inp->in6p_laddr,
1240				  inp->inp_lport,  0, NULL);
1241	if (oinp) {
1242		error = EADDRINUSE;
1243		goto out;
1244	}
1245	if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
1246		inp->in6p_laddr = addr6;
1247	inp->in6p_faddr = sin6->sin6_addr;
1248	inp->inp_fport = sin6->sin6_port;
1249	/* update flowinfo - draft-itojun-ipv6-flowlabel-api-00 */
1250	inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
1251	if (inp->inp_flags & IN6P_AUTOFLOWLABEL)
1252		inp->inp_flow |=
1253		    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
1254	in_pcbrehash(inp);
1255	INP_HASH_WUNLOCK(&V_tcbinfo);
1256
1257	/* Compute window scaling to request.  */
1258	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1259	    (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1260		tp->request_r_scale++;
1261
1262	soisconnecting(so);
1263	TCPSTAT_INC(tcps_connattempt);
1264	tcp_state_change(tp, TCPS_SYN_SENT);
1265	tp->iss = tcp_new_isn(tp);
1266	tcp_sendseqinit(tp);
1267
1268	return 0;
1269
1270out:
1271	INP_HASH_WUNLOCK(&V_tcbinfo);
1272	return error;
1273}
1274#endif /* INET6 */
1275
1276/*
1277 * Export TCP internal state information via a struct tcp_info, based on the
1278 * Linux 2.6 API.  Not ABI compatible as our constants are mapped differently
1279 * (TCP state machine, etc).  We export all information using FreeBSD-native
1280 * constants -- for example, the numeric values for tcpi_state will differ
1281 * from Linux.
1282 */
1283static void
1284tcp_fill_info(struct tcpcb *tp, struct tcp_info *ti)
1285{
1286
1287	INP_WLOCK_ASSERT(tp->t_inpcb);
1288	bzero(ti, sizeof(*ti));
1289
1290	ti->tcpi_state = tp->t_state;
1291	if ((tp->t_flags & TF_REQ_TSTMP) && (tp->t_flags & TF_RCVD_TSTMP))
1292		ti->tcpi_options |= TCPI_OPT_TIMESTAMPS;
1293	if (tp->t_flags & TF_SACK_PERMIT)
1294		ti->tcpi_options |= TCPI_OPT_SACK;
1295	if ((tp->t_flags & TF_REQ_SCALE) && (tp->t_flags & TF_RCVD_SCALE)) {
1296		ti->tcpi_options |= TCPI_OPT_WSCALE;
1297		ti->tcpi_snd_wscale = tp->snd_scale;
1298		ti->tcpi_rcv_wscale = tp->rcv_scale;
1299	}
1300
1301	ti->tcpi_rto = tp->t_rxtcur * tick;
1302	ti->tcpi_last_data_recv = (long)(ticks - (int)tp->t_rcvtime) * tick;
1303	ti->tcpi_rtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT;
1304	ti->tcpi_rttvar = ((u_int64_t)tp->t_rttvar * tick) >> TCP_RTTVAR_SHIFT;
1305
1306	ti->tcpi_snd_ssthresh = tp->snd_ssthresh;
1307	ti->tcpi_snd_cwnd = tp->snd_cwnd;
1308
1309	/*
1310	 * FreeBSD-specific extension fields for tcp_info.
1311	 */
1312	ti->tcpi_rcv_space = tp->rcv_wnd;
1313	ti->tcpi_rcv_nxt = tp->rcv_nxt;
1314	ti->tcpi_snd_wnd = tp->snd_wnd;
1315	ti->tcpi_snd_bwnd = 0;		/* Unused, kept for compat. */
1316	ti->tcpi_snd_nxt = tp->snd_nxt;
1317	ti->tcpi_snd_mss = tp->t_maxseg;
1318	ti->tcpi_rcv_mss = tp->t_maxseg;
1319	if (tp->t_flags & TF_TOE)
1320		ti->tcpi_options |= TCPI_OPT_TOE;
1321	ti->tcpi_snd_rexmitpack = tp->t_sndrexmitpack;
1322	ti->tcpi_rcv_ooopack = tp->t_rcvoopack;
1323	ti->tcpi_snd_zerowin = tp->t_sndzerowin;
1324}
1325
1326/*
1327 * tcp_ctloutput() must drop the inpcb lock before performing copyin on
1328 * socket option arguments.  When it re-acquires the lock after the copy, it
1329 * has to revalidate that the connection is still valid for the socket
1330 * option.
1331 */
1332#define INP_WLOCK_RECHECK(inp) do {					\
1333	INP_WLOCK(inp);							\
1334	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {		\
1335		INP_WUNLOCK(inp);					\
1336		return (ECONNRESET);					\
1337	}								\
1338	tp = intotcpcb(inp);						\
1339} while(0)
1340
1341int
1342tcp_ctloutput(struct socket *so, struct sockopt *sopt)
1343{
1344	int	error, opt, optval;
1345	u_int	ui;
1346	struct	inpcb *inp;
1347	struct	tcpcb *tp;
1348	struct	tcp_info ti;
1349	char buf[TCP_CA_NAME_MAX];
1350	struct cc_algo *algo;
1351
1352	error = 0;
1353	inp = sotoinpcb(so);
1354	KASSERT(inp != NULL, ("tcp_ctloutput: inp == NULL"));
1355	INP_WLOCK(inp);
1356	if (sopt->sopt_level != IPPROTO_TCP) {
1357#ifdef INET6
1358		if (inp->inp_vflag & INP_IPV6PROTO) {
1359			INP_WUNLOCK(inp);
1360			error = ip6_ctloutput(so, sopt);
1361		}
1362#endif /* INET6 */
1363#if defined(INET6) && defined(INET)
1364		else
1365#endif
1366#ifdef INET
1367		{
1368			INP_WUNLOCK(inp);
1369			error = ip_ctloutput(so, sopt);
1370		}
1371#endif
1372		return (error);
1373	}
1374	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1375		INP_WUNLOCK(inp);
1376		return (ECONNRESET);
1377	}
1378
1379	switch (sopt->sopt_dir) {
1380	case SOPT_SET:
1381		switch (sopt->sopt_name) {
1382#ifdef TCP_SIGNATURE
1383		case TCP_MD5SIG:
1384			INP_WUNLOCK(inp);
1385			error = sooptcopyin(sopt, &optval, sizeof optval,
1386			    sizeof optval);
1387			if (error)
1388				return (error);
1389
1390			INP_WLOCK_RECHECK(inp);
1391			if (optval > 0)
1392				tp->t_flags |= TF_SIGNATURE;
1393			else
1394				tp->t_flags &= ~TF_SIGNATURE;
1395			goto unlock_and_done;
1396#endif /* TCP_SIGNATURE */
1397
1398		case TCP_NODELAY:
1399		case TCP_NOOPT:
1400			INP_WUNLOCK(inp);
1401			error = sooptcopyin(sopt, &optval, sizeof optval,
1402			    sizeof optval);
1403			if (error)
1404				return (error);
1405
1406			INP_WLOCK_RECHECK(inp);
1407			switch (sopt->sopt_name) {
1408			case TCP_NODELAY:
1409				opt = TF_NODELAY;
1410				break;
1411			case TCP_NOOPT:
1412				opt = TF_NOOPT;
1413				break;
1414			default:
1415				opt = 0; /* dead code to fool gcc */
1416				break;
1417			}
1418
1419			if (optval)
1420				tp->t_flags |= opt;
1421			else
1422				tp->t_flags &= ~opt;
1423unlock_and_done:
1424#ifdef TCP_OFFLOAD
1425			if (tp->t_flags & TF_TOE) {
1426				tcp_offload_ctloutput(tp, sopt->sopt_dir,
1427				    sopt->sopt_name);
1428			}
1429#endif
1430			INP_WUNLOCK(inp);
1431			break;
1432
1433		case TCP_NOPUSH:
1434			INP_WUNLOCK(inp);
1435			error = sooptcopyin(sopt, &optval, sizeof optval,
1436			    sizeof optval);
1437			if (error)
1438				return (error);
1439
1440			INP_WLOCK_RECHECK(inp);
1441			if (optval)
1442				tp->t_flags |= TF_NOPUSH;
1443			else if (tp->t_flags & TF_NOPUSH) {
1444				tp->t_flags &= ~TF_NOPUSH;
1445				if (TCPS_HAVEESTABLISHED(tp->t_state))
1446					error = tcp_output(tp);
1447			}
1448			goto unlock_and_done;
1449
1450		case TCP_MAXSEG:
1451			INP_WUNLOCK(inp);
1452			error = sooptcopyin(sopt, &optval, sizeof optval,
1453			    sizeof optval);
1454			if (error)
1455				return (error);
1456
1457			INP_WLOCK_RECHECK(inp);
1458			if (optval > 0 && optval <= tp->t_maxseg &&
1459			    optval + 40 >= V_tcp_minmss)
1460				tp->t_maxseg = optval;
1461			else
1462				error = EINVAL;
1463			goto unlock_and_done;
1464
1465		case TCP_INFO:
1466			INP_WUNLOCK(inp);
1467			error = EINVAL;
1468			break;
1469
1470		case TCP_CONGESTION:
1471			INP_WUNLOCK(inp);
1472			bzero(buf, sizeof(buf));
1473			error = sooptcopyin(sopt, &buf, sizeof(buf), 1);
1474			if (error)
1475				break;
1476			INP_WLOCK_RECHECK(inp);
1477			/*
1478			 * Return EINVAL if we can't find the requested cc algo.
1479			 */
1480			error = EINVAL;
1481			CC_LIST_RLOCK();
1482			STAILQ_FOREACH(algo, &cc_list, entries) {
1483				if (strncmp(buf, algo->name, TCP_CA_NAME_MAX)
1484				    == 0) {
1485					/* We've found the requested algo. */
1486					error = 0;
1487					/*
1488					 * We hold a write lock over the tcb
1489					 * so it's safe to do these things
1490					 * without ordering concerns.
1491					 */
1492					if (CC_ALGO(tp)->cb_destroy != NULL)
1493						CC_ALGO(tp)->cb_destroy(tp->ccv);
1494					CC_ALGO(tp) = algo;
1495					/*
1496					 * If something goes pear shaped
1497					 * initialising the new algo,
1498					 * fall back to newreno (which
1499					 * does not require initialisation).
1500					 */
1501					if (algo->cb_init != NULL)
1502						if (algo->cb_init(tp->ccv) > 0) {
1503							CC_ALGO(tp) = &newreno_cc_algo;
1504							/*
1505							 * The only reason init
1506							 * should fail is
1507							 * because of malloc.
1508							 */
1509							error = ENOMEM;
1510						}
1511					break; /* Break the STAILQ_FOREACH. */
1512				}
1513			}
1514			CC_LIST_RUNLOCK();
1515			goto unlock_and_done;
1516
1517		case TCP_KEEPIDLE:
1518		case TCP_KEEPINTVL:
1519		case TCP_KEEPINIT:
1520			INP_WUNLOCK(inp);
1521			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
1522			if (error)
1523				return (error);
1524
1525			if (ui > (UINT_MAX / hz)) {
1526				error = EINVAL;
1527				break;
1528			}
1529			ui *= hz;
1530
1531			INP_WLOCK_RECHECK(inp);
1532			switch (sopt->sopt_name) {
1533			case TCP_KEEPIDLE:
1534				tp->t_keepidle = ui;
1535				/*
1536				 * XXX: better check current remaining
1537				 * timeout and "merge" it with new value.
1538				 */
1539				if ((tp->t_state > TCPS_LISTEN) &&
1540				    (tp->t_state <= TCPS_CLOSING))
1541					tcp_timer_activate(tp, TT_KEEP,
1542					    TP_KEEPIDLE(tp));
1543				break;
1544			case TCP_KEEPINTVL:
1545				tp->t_keepintvl = ui;
1546				if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1547				    (TP_MAXIDLE(tp) > 0))
1548					tcp_timer_activate(tp, TT_2MSL,
1549					    TP_MAXIDLE(tp));
1550				break;
1551			case TCP_KEEPINIT:
1552				tp->t_keepinit = ui;
1553				if (tp->t_state == TCPS_SYN_RECEIVED ||
1554				    tp->t_state == TCPS_SYN_SENT)
1555					tcp_timer_activate(tp, TT_KEEP,
1556					    TP_KEEPINIT(tp));
1557				break;
1558			}
1559			goto unlock_and_done;
1560
1561		case TCP_KEEPCNT:
1562			INP_WUNLOCK(inp);
1563			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
1564			if (error)
1565				return (error);
1566
1567			INP_WLOCK_RECHECK(inp);
1568			tp->t_keepcnt = ui;
1569			if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1570			    (TP_MAXIDLE(tp) > 0))
1571				tcp_timer_activate(tp, TT_2MSL,
1572				    TP_MAXIDLE(tp));
1573			goto unlock_and_done;
1574
1575#ifdef TCP_RFC7413
1576		case TCP_FASTOPEN:
1577			INP_WUNLOCK(inp);
1578			if (!V_tcp_fastopen_enabled)
1579				return (EPERM);
1580
1581			error = sooptcopyin(sopt, &optval, sizeof optval,
1582			    sizeof optval);
1583			if (error)
1584				return (error);
1585
1586			INP_WLOCK_RECHECK(inp);
1587			if (optval) {
1588				tp->t_flags |= TF_FASTOPEN;
1589				if ((tp->t_state == TCPS_LISTEN) &&
1590				    (tp->t_tfo_pending == NULL))
1591					tp->t_tfo_pending =
1592					    tcp_fastopen_alloc_counter();
1593			} else
1594				tp->t_flags &= ~TF_FASTOPEN;
1595			goto unlock_and_done;
1596#endif
1597
1598		default:
1599			INP_WUNLOCK(inp);
1600			error = ENOPROTOOPT;
1601			break;
1602		}
1603		break;
1604
1605	case SOPT_GET:
1606		tp = intotcpcb(inp);
1607		switch (sopt->sopt_name) {
1608#ifdef TCP_SIGNATURE
1609		case TCP_MD5SIG:
1610			optval = (tp->t_flags & TF_SIGNATURE) ? 1 : 0;
1611			INP_WUNLOCK(inp);
1612			error = sooptcopyout(sopt, &optval, sizeof optval);
1613			break;
1614#endif
1615
1616		case TCP_NODELAY:
1617			optval = tp->t_flags & TF_NODELAY;
1618			INP_WUNLOCK(inp);
1619			error = sooptcopyout(sopt, &optval, sizeof optval);
1620			break;
1621		case TCP_MAXSEG:
1622			optval = tp->t_maxseg;
1623			INP_WUNLOCK(inp);
1624			error = sooptcopyout(sopt, &optval, sizeof optval);
1625			break;
1626		case TCP_NOOPT:
1627			optval = tp->t_flags & TF_NOOPT;
1628			INP_WUNLOCK(inp);
1629			error = sooptcopyout(sopt, &optval, sizeof optval);
1630			break;
1631		case TCP_NOPUSH:
1632			optval = tp->t_flags & TF_NOPUSH;
1633			INP_WUNLOCK(inp);
1634			error = sooptcopyout(sopt, &optval, sizeof optval);
1635			break;
1636		case TCP_INFO:
1637			tcp_fill_info(tp, &ti);
1638			INP_WUNLOCK(inp);
1639			error = sooptcopyout(sopt, &ti, sizeof ti);
1640			break;
1641		case TCP_CONGESTION:
1642			bzero(buf, sizeof(buf));
1643			strlcpy(buf, CC_ALGO(tp)->name, TCP_CA_NAME_MAX);
1644			INP_WUNLOCK(inp);
1645			error = sooptcopyout(sopt, buf, TCP_CA_NAME_MAX);
1646			break;
1647		case TCP_KEEPIDLE:
1648		case TCP_KEEPINTVL:
1649		case TCP_KEEPINIT:
1650		case TCP_KEEPCNT:
1651			switch (sopt->sopt_name) {
1652			case TCP_KEEPIDLE:
1653				ui = tp->t_keepidle / hz;
1654				break;
1655			case TCP_KEEPINTVL:
1656				ui = tp->t_keepintvl / hz;
1657				break;
1658			case TCP_KEEPINIT:
1659				ui = tp->t_keepinit / hz;
1660				break;
1661			case TCP_KEEPCNT:
1662				ui = tp->t_keepcnt;
1663				break;
1664			}
1665			INP_WUNLOCK(inp);
1666			error = sooptcopyout(sopt, &ui, sizeof(ui));
1667			break;
1668#ifdef TCP_RFC7413
1669		case TCP_FASTOPEN:
1670			optval = tp->t_flags & TF_FASTOPEN;
1671			INP_WUNLOCK(inp);
1672			error = sooptcopyout(sopt, &optval, sizeof optval);
1673			break;
1674#endif
1675		default:
1676			INP_WUNLOCK(inp);
1677			error = ENOPROTOOPT;
1678			break;
1679		}
1680		break;
1681	}
1682	return (error);
1683}
1684#undef INP_WLOCK_RECHECK
1685
1686/*
1687 * Attach TCP protocol to socket, allocating
1688 * internet protocol control block, tcp control block,
1689 * bufer space, and entering LISTEN state if to accept connections.
1690 */
1691static int
1692tcp_attach(struct socket *so)
1693{
1694	struct tcpcb *tp;
1695	struct inpcb *inp;
1696	int error;
1697
1698	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
1699		error = soreserve(so, V_tcp_sendspace, V_tcp_recvspace);
1700		if (error)
1701			return (error);
1702	}
1703	so->so_rcv.sb_flags |= SB_AUTOSIZE;
1704	so->so_snd.sb_flags |= SB_AUTOSIZE;
1705	INP_INFO_WLOCK(&V_tcbinfo);
1706	error = in_pcballoc(so, &V_tcbinfo);
1707	if (error) {
1708		INP_INFO_WUNLOCK(&V_tcbinfo);
1709		return (error);
1710	}
1711	inp = sotoinpcb(so);
1712#ifdef INET6
1713	if (inp->inp_vflag & INP_IPV6PROTO) {
1714		inp->inp_vflag |= INP_IPV6;
1715		inp->in6p_hops = -1;	/* use kernel default */
1716	}
1717	else
1718#endif
1719	inp->inp_vflag |= INP_IPV4;
1720	tp = tcp_newtcpcb(inp);
1721	if (tp == NULL) {
1722		in_pcbdetach(inp);
1723		in_pcbfree(inp);
1724		INP_INFO_WUNLOCK(&V_tcbinfo);
1725		return (ENOBUFS);
1726	}
1727	tp->t_state = TCPS_CLOSED;
1728	INP_WUNLOCK(inp);
1729	INP_INFO_WUNLOCK(&V_tcbinfo);
1730	return (0);
1731}
1732
1733/*
1734 * Initiate (or continue) disconnect.
1735 * If embryonic state, just send reset (once).
1736 * If in ``let data drain'' option and linger null, just drop.
1737 * Otherwise (hard), mark socket disconnecting and drop
1738 * current input data; switch states based on user close, and
1739 * send segment to peer (with FIN).
1740 */
1741static void
1742tcp_disconnect(struct tcpcb *tp)
1743{
1744	struct inpcb *inp = tp->t_inpcb;
1745	struct socket *so = inp->inp_socket;
1746
1747	INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
1748	INP_WLOCK_ASSERT(inp);
1749
1750	/*
1751	 * Neither tcp_close() nor tcp_drop() should return NULL, as the
1752	 * socket is still open.
1753	 */
1754	if (tp->t_state < TCPS_ESTABLISHED) {
1755		tp = tcp_close(tp);
1756		KASSERT(tp != NULL,
1757		    ("tcp_disconnect: tcp_close() returned NULL"));
1758	} else if ((so->so_options & SO_LINGER) && so->so_linger == 0) {
1759		tp = tcp_drop(tp, 0);
1760		KASSERT(tp != NULL,
1761		    ("tcp_disconnect: tcp_drop() returned NULL"));
1762	} else {
1763		soisdisconnecting(so);
1764		sbflush(&so->so_rcv);
1765		tcp_usrclosed(tp);
1766		if (!(inp->inp_flags & INP_DROPPED))
1767			tcp_output(tp);
1768	}
1769}
1770
1771/*
1772 * User issued close, and wish to trail through shutdown states:
1773 * if never received SYN, just forget it.  If got a SYN from peer,
1774 * but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN.
1775 * If already got a FIN from peer, then almost done; go to LAST_ACK
1776 * state.  In all other cases, have already sent FIN to peer (e.g.
1777 * after PRU_SHUTDOWN), and just have to play tedious game waiting
1778 * for peer to send FIN or not respond to keep-alives, etc.
1779 * We can let the user exit from the close as soon as the FIN is acked.
1780 */
1781static void
1782tcp_usrclosed(struct tcpcb *tp)
1783{
1784
1785	INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
1786	INP_WLOCK_ASSERT(tp->t_inpcb);
1787
1788	switch (tp->t_state) {
1789	case TCPS_LISTEN:
1790#ifdef TCP_OFFLOAD
1791		tcp_offload_listen_stop(tp);
1792#endif
1793		tcp_state_change(tp, TCPS_CLOSED);
1794		/* FALLTHROUGH */
1795	case TCPS_CLOSED:
1796		tp = tcp_close(tp);
1797		/*
1798		 * tcp_close() should never return NULL here as the socket is
1799		 * still open.
1800		 */
1801		KASSERT(tp != NULL,
1802		    ("tcp_usrclosed: tcp_close() returned NULL"));
1803		break;
1804
1805	case TCPS_SYN_SENT:
1806	case TCPS_SYN_RECEIVED:
1807		tp->t_flags |= TF_NEEDFIN;
1808		break;
1809
1810	case TCPS_ESTABLISHED:
1811		tcp_state_change(tp, TCPS_FIN_WAIT_1);
1812		break;
1813
1814	case TCPS_CLOSE_WAIT:
1815		tcp_state_change(tp, TCPS_LAST_ACK);
1816		break;
1817	}
1818	if (tp->t_state >= TCPS_FIN_WAIT_2) {
1819		soisdisconnected(tp->t_inpcb->inp_socket);
1820		/* Prevent the connection hanging in FIN_WAIT_2 forever. */
1821		if (tp->t_state == TCPS_FIN_WAIT_2) {
1822			int timeout;
1823
1824			timeout = (tcp_fast_finwait2_recycle) ?
1825			    tcp_finwait2_timeout : TP_MAXIDLE(tp);
1826			tcp_timer_activate(tp, TT_2MSL, timeout);
1827		}
1828	}
1829}
1830
1831#ifdef DDB
1832static void
1833db_print_indent(int indent)
1834{
1835	int i;
1836
1837	for (i = 0; i < indent; i++)
1838		db_printf(" ");
1839}
1840
1841static void
1842db_print_tstate(int t_state)
1843{
1844
1845	switch (t_state) {
1846	case TCPS_CLOSED:
1847		db_printf("TCPS_CLOSED");
1848		return;
1849
1850	case TCPS_LISTEN:
1851		db_printf("TCPS_LISTEN");
1852		return;
1853
1854	case TCPS_SYN_SENT:
1855		db_printf("TCPS_SYN_SENT");
1856		return;
1857
1858	case TCPS_SYN_RECEIVED:
1859		db_printf("TCPS_SYN_RECEIVED");
1860		return;
1861
1862	case TCPS_ESTABLISHED:
1863		db_printf("TCPS_ESTABLISHED");
1864		return;
1865
1866	case TCPS_CLOSE_WAIT:
1867		db_printf("TCPS_CLOSE_WAIT");
1868		return;
1869
1870	case TCPS_FIN_WAIT_1:
1871		db_printf("TCPS_FIN_WAIT_1");
1872		return;
1873
1874	case TCPS_CLOSING:
1875		db_printf("TCPS_CLOSING");
1876		return;
1877
1878	case TCPS_LAST_ACK:
1879		db_printf("TCPS_LAST_ACK");
1880		return;
1881
1882	case TCPS_FIN_WAIT_2:
1883		db_printf("TCPS_FIN_WAIT_2");
1884		return;
1885
1886	case TCPS_TIME_WAIT:
1887		db_printf("TCPS_TIME_WAIT");
1888		return;
1889
1890	default:
1891		db_printf("unknown");
1892		return;
1893	}
1894}
1895
1896static void
1897db_print_tflags(u_int t_flags)
1898{
1899	int comma;
1900
1901	comma = 0;
1902	if (t_flags & TF_ACKNOW) {
1903		db_printf("%sTF_ACKNOW", comma ? ", " : "");
1904		comma = 1;
1905	}
1906	if (t_flags & TF_DELACK) {
1907		db_printf("%sTF_DELACK", comma ? ", " : "");
1908		comma = 1;
1909	}
1910	if (t_flags & TF_NODELAY) {
1911		db_printf("%sTF_NODELAY", comma ? ", " : "");
1912		comma = 1;
1913	}
1914	if (t_flags & TF_NOOPT) {
1915		db_printf("%sTF_NOOPT", comma ? ", " : "");
1916		comma = 1;
1917	}
1918	if (t_flags & TF_SENTFIN) {
1919		db_printf("%sTF_SENTFIN", comma ? ", " : "");
1920		comma = 1;
1921	}
1922	if (t_flags & TF_REQ_SCALE) {
1923		db_printf("%sTF_REQ_SCALE", comma ? ", " : "");
1924		comma = 1;
1925	}
1926	if (t_flags & TF_RCVD_SCALE) {
1927		db_printf("%sTF_RECVD_SCALE", comma ? ", " : "");
1928		comma = 1;
1929	}
1930	if (t_flags & TF_REQ_TSTMP) {
1931		db_printf("%sTF_REQ_TSTMP", comma ? ", " : "");
1932		comma = 1;
1933	}
1934	if (t_flags & TF_RCVD_TSTMP) {
1935		db_printf("%sTF_RCVD_TSTMP", comma ? ", " : "");
1936		comma = 1;
1937	}
1938	if (t_flags & TF_SACK_PERMIT) {
1939		db_printf("%sTF_SACK_PERMIT", comma ? ", " : "");
1940		comma = 1;
1941	}
1942	if (t_flags & TF_NEEDSYN) {
1943		db_printf("%sTF_NEEDSYN", comma ? ", " : "");
1944		comma = 1;
1945	}
1946	if (t_flags & TF_NEEDFIN) {
1947		db_printf("%sTF_NEEDFIN", comma ? ", " : "");
1948		comma = 1;
1949	}
1950	if (t_flags & TF_NOPUSH) {
1951		db_printf("%sTF_NOPUSH", comma ? ", " : "");
1952		comma = 1;
1953	}
1954	if (t_flags & TF_MORETOCOME) {
1955		db_printf("%sTF_MORETOCOME", comma ? ", " : "");
1956		comma = 1;
1957	}
1958	if (t_flags & TF_LQ_OVERFLOW) {
1959		db_printf("%sTF_LQ_OVERFLOW", comma ? ", " : "");
1960		comma = 1;
1961	}
1962	if (t_flags & TF_LASTIDLE) {
1963		db_printf("%sTF_LASTIDLE", comma ? ", " : "");
1964		comma = 1;
1965	}
1966	if (t_flags & TF_RXWIN0SENT) {
1967		db_printf("%sTF_RXWIN0SENT", comma ? ", " : "");
1968		comma = 1;
1969	}
1970	if (t_flags & TF_FASTRECOVERY) {
1971		db_printf("%sTF_FASTRECOVERY", comma ? ", " : "");
1972		comma = 1;
1973	}
1974	if (t_flags & TF_CONGRECOVERY) {
1975		db_printf("%sTF_CONGRECOVERY", comma ? ", " : "");
1976		comma = 1;
1977	}
1978	if (t_flags & TF_WASFRECOVERY) {
1979		db_printf("%sTF_WASFRECOVERY", comma ? ", " : "");
1980		comma = 1;
1981	}
1982	if (t_flags & TF_SIGNATURE) {
1983		db_printf("%sTF_SIGNATURE", comma ? ", " : "");
1984		comma = 1;
1985	}
1986	if (t_flags & TF_FORCEDATA) {
1987		db_printf("%sTF_FORCEDATA", comma ? ", " : "");
1988		comma = 1;
1989	}
1990	if (t_flags & TF_TSO) {
1991		db_printf("%sTF_TSO", comma ? ", " : "");
1992		comma = 1;
1993	}
1994	if (t_flags & TF_ECN_PERMIT) {
1995		db_printf("%sTF_ECN_PERMIT", comma ? ", " : "");
1996		comma = 1;
1997	}
1998	if (t_flags & TF_FASTOPEN) {
1999		db_printf("%sTF_FASTOPEN", comma ? ", " : "");
2000		comma = 1;
2001	}
2002}
2003
2004static void
2005db_print_toobflags(char t_oobflags)
2006{
2007	int comma;
2008
2009	comma = 0;
2010	if (t_oobflags & TCPOOB_HAVEDATA) {
2011		db_printf("%sTCPOOB_HAVEDATA", comma ? ", " : "");
2012		comma = 1;
2013	}
2014	if (t_oobflags & TCPOOB_HADDATA) {
2015		db_printf("%sTCPOOB_HADDATA", comma ? ", " : "");
2016		comma = 1;
2017	}
2018}
2019
2020static void
2021db_print_tcpcb(struct tcpcb *tp, const char *name, int indent)
2022{
2023
2024	db_print_indent(indent);
2025	db_printf("%s at %p\n", name, tp);
2026
2027	indent += 2;
2028
2029	db_print_indent(indent);
2030	db_printf("t_segq first: %p   t_segqlen: %d   t_dupacks: %d\n",
2031	   LIST_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks);
2032
2033	db_print_indent(indent);
2034	db_printf("tt_rexmt: %p   tt_persist: %p   tt_keep: %p\n",
2035	    &tp->t_timers->tt_rexmt, &tp->t_timers->tt_persist, &tp->t_timers->tt_keep);
2036
2037	db_print_indent(indent);
2038	db_printf("tt_2msl: %p   tt_delack: %p   t_inpcb: %p\n", &tp->t_timers->tt_2msl,
2039	    &tp->t_timers->tt_delack, tp->t_inpcb);
2040
2041	db_print_indent(indent);
2042	db_printf("t_state: %d (", tp->t_state);
2043	db_print_tstate(tp->t_state);
2044	db_printf(")\n");
2045
2046	db_print_indent(indent);
2047	db_printf("t_flags: 0x%x (", tp->t_flags);
2048	db_print_tflags(tp->t_flags);
2049	db_printf(")\n");
2050
2051	db_print_indent(indent);
2052	db_printf("snd_una: 0x%08x   snd_max: 0x%08x   snd_nxt: x0%08x\n",
2053	    tp->snd_una, tp->snd_max, tp->snd_nxt);
2054
2055	db_print_indent(indent);
2056	db_printf("snd_up: 0x%08x   snd_wl1: 0x%08x   snd_wl2: 0x%08x\n",
2057	   tp->snd_up, tp->snd_wl1, tp->snd_wl2);
2058
2059	db_print_indent(indent);
2060	db_printf("iss: 0x%08x   irs: 0x%08x   rcv_nxt: 0x%08x\n",
2061	    tp->iss, tp->irs, tp->rcv_nxt);
2062
2063	db_print_indent(indent);
2064	db_printf("rcv_adv: 0x%08x   rcv_wnd: %lu   rcv_up: 0x%08x\n",
2065	    tp->rcv_adv, tp->rcv_wnd, tp->rcv_up);
2066
2067	db_print_indent(indent);
2068	db_printf("snd_wnd: %lu   snd_cwnd: %lu\n",
2069	   tp->snd_wnd, tp->snd_cwnd);
2070
2071	db_print_indent(indent);
2072	db_printf("snd_ssthresh: %lu   snd_recover: "
2073	    "0x%08x\n", tp->snd_ssthresh, tp->snd_recover);
2074
2075	db_print_indent(indent);
2076	db_printf("t_maxopd: %u   t_rcvtime: %u   t_startime: %u\n",
2077	    tp->t_maxopd, tp->t_rcvtime, tp->t_starttime);
2078
2079	db_print_indent(indent);
2080	db_printf("t_rttime: %u   t_rtsq: 0x%08x\n",
2081	    tp->t_rtttime, tp->t_rtseq);
2082
2083	db_print_indent(indent);
2084	db_printf("t_rxtcur: %d   t_maxseg: %u   t_srtt: %d\n",
2085	    tp->t_rxtcur, tp->t_maxseg, tp->t_srtt);
2086
2087	db_print_indent(indent);
2088	db_printf("t_rttvar: %d   t_rxtshift: %d   t_rttmin: %u   "
2089	    "t_rttbest: %u\n", tp->t_rttvar, tp->t_rxtshift, tp->t_rttmin,
2090	    tp->t_rttbest);
2091
2092	db_print_indent(indent);
2093	db_printf("t_rttupdated: %lu   max_sndwnd: %lu   t_softerror: %d\n",
2094	    tp->t_rttupdated, tp->max_sndwnd, tp->t_softerror);
2095
2096	db_print_indent(indent);
2097	db_printf("t_oobflags: 0x%x (", tp->t_oobflags);
2098	db_print_toobflags(tp->t_oobflags);
2099	db_printf(")   t_iobc: 0x%02x\n", tp->t_iobc);
2100
2101	db_print_indent(indent);
2102	db_printf("snd_scale: %u   rcv_scale: %u   request_r_scale: %u\n",
2103	    tp->snd_scale, tp->rcv_scale, tp->request_r_scale);
2104
2105	db_print_indent(indent);
2106	db_printf("ts_recent: %u   ts_recent_age: %u\n",
2107	    tp->ts_recent, tp->ts_recent_age);
2108
2109	db_print_indent(indent);
2110	db_printf("ts_offset: %u   last_ack_sent: 0x%08x   snd_cwnd_prev: "
2111	    "%lu\n", tp->ts_offset, tp->last_ack_sent, tp->snd_cwnd_prev);
2112
2113	db_print_indent(indent);
2114	db_printf("snd_ssthresh_prev: %lu   snd_recover_prev: 0x%08x   "
2115	    "t_badrxtwin: %u\n", tp->snd_ssthresh_prev,
2116	    tp->snd_recover_prev, tp->t_badrxtwin);
2117
2118	db_print_indent(indent);
2119	db_printf("snd_numholes: %d  snd_holes first: %p\n",
2120	    tp->snd_numholes, TAILQ_FIRST(&tp->snd_holes));
2121
2122	db_print_indent(indent);
2123	db_printf("snd_fack: 0x%08x   rcv_numsacks: %d   sack_newdata: "
2124	    "0x%08x\n", tp->snd_fack, tp->rcv_numsacks, tp->sack_newdata);
2125
2126	/* Skip sackblks, sackhint. */
2127
2128	db_print_indent(indent);
2129	db_printf("t_rttlow: %d   rfbuf_ts: %u   rfbuf_cnt: %d\n",
2130	    tp->t_rttlow, tp->rfbuf_ts, tp->rfbuf_cnt);
2131}
2132
2133DB_SHOW_COMMAND(tcpcb, db_show_tcpcb)
2134{
2135	struct tcpcb *tp;
2136
2137	if (!have_addr) {
2138		db_printf("usage: show tcpcb <addr>\n");
2139		return;
2140	}
2141	tp = (struct tcpcb *)addr;
2142
2143	db_print_tcpcb(tp, "tcpcb", 0);
2144}
2145#endif
2146