/usr/src/sys/netinet/tcp

Bug Summary

File:	netinet/tcp_usrreq.c
Warning:	line 1471, column 11 Copies out a struct with a partially unsanitized field

Annotated Source Code

/*-

* The Regents of the University of California.

* Portions of this software were developed by Robert N. M. Watson under

* contract to Juniper Networks, Inc.

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

* 4. Neither the name of the University nor the names of its contributors

* may be used to endorse or promote products derived from this software

* without specific prior written permission.

* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND

* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE

* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

* SUCH DAMAGE.

* From: @(#)tcp_usrreq.c 8.2 (Berkeley) 1/3/94

#include <sys/cdefs.h>

__FBSDID("$FreeBSD: releng/11.0/sys/netinet/tcp_usrreq.c 298673 2016-04-26 23:02:18Z cem $")__asm__(".ident\t\"" "$FreeBSD: releng/11.0/sys/netinet/tcp_usrreq.c 298673 2016-04-26 23:02:18Z cem $"
"\"");

#include "opt_ddb.h"

#include "opt_inet.h"

#include "opt_inet6.h"

#include "opt_tcpdebug.h"

#include <sys/param.h>

#include <sys/systm.h>

#include <sys/limits.h>

#include <sys/malloc.h>

#include <sys/refcount.h>

#include <sys/kernel.h>

#include <sys/sysctl.h>

#include <sys/mbuf.h>

#ifdef INET61

#include <sys/domain.h>

#endif /* INET6 */

#include <sys/socket.h>

#include <sys/socketvar.h>

#include <sys/protosw.h>

#include <sys/proc.h>

#include <sys/jail.h>

#ifdef DDB

#include <ddb/ddb.h>

#endif

#include <net/if.h>

#include <net/if_var.h>

#include <net/route.h>

#include <net/vnet.h>

#include <netinet/in.h>

#include <netinet/in_kdtrace.h>

#include <netinet/in_pcb.h>

#include <netinet/in_systm.h>

#include <netinet/in_var.h>

#include <netinet/ip_var.h>

#ifdef INET61

#include <netinet/ip6.h>

#include <netinet6/in6_pcb.h>

#include <netinet6/ip6_var.h>

#include <netinet6/scope6_var.h>

#endif

#ifdef TCP_RFC7413

#include <netinet/tcp_fastopen.h>

#endif

#include <netinet/tcp.h>

#include <netinet/tcp_fsm.h>

#include <netinet/tcp_seq.h>

#include <netinet/tcp_timer.h>

#include <netinet/tcp_var.h>

#include <netinet/tcpip.h>

#include <netinet/cc/cc.h>

#ifdef TCPPCAP

#include <netinet/tcp_pcap.h>

#endif

#ifdef TCPDEBUG

#include <netinet/tcp_debug.h>

#endif

100

#ifdef TCP_OFFLOAD1

101

#include <netinet/tcp_offload.h>

102

#endif

103

104

105

* TCP protocol interface to socket abstraction.

106

107

static int tcp_attach(struct socket *);

108

#ifdef INET1

109

static int tcp_connect(struct tcpcb *, struct sockaddr *,

110

struct thread *td);

111

#endif /* INET */

112

#ifdef INET61

113

static int tcp6_connect(struct tcpcb *, struct sockaddr *,

114

struct thread *td);

115

#endif /* INET6 */

116

static void tcp_disconnect(struct tcpcb *);

117

static void tcp_usrclosed(struct tcpcb *);

118

static void tcp_fill_info(struct tcpcb *, struct tcp_info *);

119

120

#ifdef TCPDEBUG

121

#define TCPDEBUG0 int ostate = 0

122

#define TCPDEBUG1() ostate = tp ? tp->t_state : 0

123

#define TCPDEBUG2(req) if (tp && (so->so_options & SO_DEBUG0x0001)) \

124

tcp_trace(TA_USER, ostate, tp, 0, 0, req)

125

#else

126

#define TCPDEBUG0

127

#define TCPDEBUG1()

128

#define TCPDEBUG2(req)

129

#endif

130

131

132

* TCP attaches to socket via pru_attach(), reserving space,

133

* and an internet control block.

134

135

static int

136

tcp_usr_attach(struct socket *so, int proto, struct thread *td)

137

{

138

struct inpcb *inp;

139

struct tcpcb *tp = NULL((void *)0);

140

int error;

141

TCPDEBUG0;

142

143

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

144

KASSERT(inp == NULL, ("tcp_usr_attach: inp != NULL"))do { } while (0);

145

TCPDEBUG1();

146

147

error = tcp_attach(so);

148

if (error)

149

goto out;

150

151

if ((so->so_options & SO_LINGER0x0080) && so->so_linger == 0)

152

so->so_linger = TCP_LINGERTIME120;

153

154

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

155

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

156

out:

157

TCPDEBUG2(PRU_ATTACH);

158

TCP_PROBE2(debug__user, tp, PRU_ATTACH)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0)
; } while (0);

159

return error;

160

}

161

162

163

* tcp_detach is called when the socket layer loses its final reference

164

* to the socket, be it a file descriptor reference, a reference from TCP,

165

* etc. At this point, there is only one case in which we will keep around

166

* inpcb state: time wait.

167

168

* This function can probably be re-absorbed back into tcp_usr_detach() now

169

* that there is a single detach path.

170

171

static void

172

tcp_detach(struct socket *so, struct inpcb *inp)

173

{

174

struct tcpcb *tp;

175

176

INP_INFO_LOCK_ASSERT(&V_tcbinfo);

177

INP_WLOCK_ASSERT(inp);

178

179

KASSERT(so->so_pcb == inp, ("tcp_detach: so_pcb != inp"))do { } while (0);

180

KASSERT(inp->inp_socket == so, ("tcp_detach: inp_socket != so"))do { } while (0);

181

182

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

183

184

if (inp->inp_flags & INP_TIMEWAIT0x01000000) {

185

186

* There are two cases to handle: one in which the time wait

187

* state is being discarded (INP_DROPPED), and one in which

188

* this connection will remain in timewait. In the former,

189

* it is time to discard all state (except tcptw, which has

190

* already been discarded by the timewait close code, which

191

* should be further up the call stack somewhere). In the

192

* latter case, we detach from the socket, but leave the pcb

193

* present until timewait ends.

194

195

* XXXRW: Would it be cleaner to free the tcptw here?

196

197

* Astute question indeed, from twtcp perspective there are

198

* three cases to consider:

199

200

* #1 tcp_detach is called at tcptw creation time by

201

* tcp_twstart, then do not discard the newly created tcptw

202

* and leave inpcb present until timewait ends

203

* #2 tcp_detach is called at timewait end (or reuse) by

204

* tcp_twclose, then the tcptw has already been discarded

205

* (or reused) and inpcb is freed here

206

* #3 tcp_detach is called() after timewait ends (or reuse)

207

* (e.g. by soclose), then tcptw has already been discarded

208

* (or reused) and inpcb is freed here

209

210

* In all three cases the tcptw should not be freed here.

211

212

if (inp->inp_flags & INP_DROPPED0x04000000) {

213

KASSERT(tp == NULL, ("tcp_detach: INP_TIMEWAIT && "do { } while (0)

214

"INP_DROPPED && tp != NULL"))do { } while (0);

215

in_pcbdetach(inp);

216

in_pcbfree(inp);

217

} else {

218

in_pcbdetach(inp);

219

INP_WUNLOCK(inp)do { uintptr_t _tid = (uintptr_t)((__curthread())); if (((&
(inp)->inp_lock))->lock_object.lo_data) ((&(inp)->
inp_lock))->lock_object.lo_data--; else { do { (void)0; do
{ if (__builtin_expect((sdt_lockstat___rw__release->id), 0
)) (*sdt_probe_func)(sdt_lockstat___rw__release->id, (uintptr_t
) (&(inp)->inp_lock), (uintptr_t) 0, (uintptr_t) 0, (uintptr_t
) 0, (uintptr_t) 0); } while (0); } while (0); if (((&(inp
)->inp_lock))->rw_lock != _tid || !atomic_cmpset_long(&
(((&(inp)->inp_lock)))->rw_lock, (_tid), ((0) <<
4 | 0x01))) __rw_wunlock_hard(&(((&(inp)->inp_lock
)))->rw_lock, _tid, (((void *)0)), (0)); } } while (0);

220

}

221

} else {

222

223

* If the connection is not in timewait, we consider two

224

* two conditions: one in which no further processing is

225

* necessary (dropped || embryonic), and one in which TCP is

226

* not yet done, but no longer requires the socket, so the

227

* pcb will persist for the time being.

228

229

* XXXRW: Does the second case still occur?

230

231

if (inp->inp_flags & INP_DROPPED0x04000000 ||

232

tp->t_state < TCPS_SYN_SENT2) {

233

tcp_discardcb(tp);

234

in_pcbdetach(inp);

235

in_pcbfree(inp);

236

} else {

237

in_pcbdetach(inp);

238

239

}

240

}

241

}

242

243

244

* pru_detach() detaches the TCP protocol from the socket.

245

* If the protocol state is non-embryonic, then can't

246

* do this directly: have to initiate a pru_disconnect(),

247

* which may finish later; embryonic TCB's can just

248

* be discarded here.

249

250

static void

251

tcp_usr_detach(struct socket *so)

252

{

253

struct inpcb *inp;

254

int rlock = 0;

255

256

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

257

KASSERT(inp != NULL, ("tcp_usr_detach: inp == NULL"))do { } while (0);

258

if (!INP_INFO_WLOCKED(&V_tcbinfo)_rw_wowned(&(&(&(tcbinfo))->ipi_lock)->rw_lock
)) {

259

INP_INFO_RLOCK(&V_tcbinfo)__rw_rlock(&((&(&(tcbinfo))->ipi_lock))->rw_lock
, ((void *)0), 0);

260

rlock = 1;

261

}

262

INP_WLOCK(inp)do { uintptr_t _tid = (uintptr_t)((__curthread())); if (((&
(inp)->inp_lock))->rw_lock != ((0) << 4 | 0x01) ||
!atomic_cmpset_long(&(((&(inp)->inp_lock)))->rw_lock
, ((0) << 4 | 0x01), (_tid))) __rw_wlock_hard(&(((&
(inp)->inp_lock)))->rw_lock, _tid, (((void *)0)), (0));
else do { (void)0; do { if (__builtin_expect((sdt_lockstat___rw__acquire
->id), 0)) (*sdt_probe_func)(sdt_lockstat___rw__acquire->
id, (uintptr_t) (&(inp)->inp_lock), (uintptr_t) 0, (uintptr_t
) 0, (uintptr_t) 0, (uintptr_t) 0); } while (0); } while (0);
} while (0);

263

KASSERT(inp->inp_socket != NULL,do { } while (0)

264

("tcp_usr_detach: inp_socket == NULL"))do { } while (0);

265

tcp_detach(so, inp);

266

if (rlock)

267

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

268

}

269

270

#ifdef INET1

271

272

* Give the socket an address.

273

274

static int

275

tcp_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)

276

{

277

int error = 0;

278

struct inpcb *inp;

279

struct tcpcb *tp = NULL((void *)0);

280

struct sockaddr_in *sinp;

281

282

sinp = (struct sockaddr_in *)nam;

283

if (nam->sa_len != sizeof (*sinp))

284

return (EINVAL22);

285

286

* Must check for multicast addresses and disallow binding

287

* to them.

288

289

if (sinp->sin_family == AF_INET2 &&

290

IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))(((in_addr_t)((__builtin_constant_p(sinp->sin_addr.s_addr)
? (((__uint32_t)((__uint16_t)(__builtin_constant_p(((__uint32_t
)(sinp->sin_addr.s_addr)) & 0xffff) ? (__uint16_t)(((__uint16_t
)(((__uint32_t)(sinp->sin_addr.s_addr)) & 0xffff)) <<
8 | ((__uint16_t)(((__uint32_t)(sinp->sin_addr.s_addr)) &
0xffff)) >> 8) : __bswap16_var(((__uint32_t)(sinp->
sin_addr.s_addr)) & 0xffff))) << 16) | ((__uint16_t
)(__builtin_constant_p(((__uint32_t)(sinp->sin_addr.s_addr
)) >> 16) ? (__uint16_t)(((__uint16_t)(((__uint32_t)(sinp
->sin_addr.s_addr)) >> 16)) << 8 | ((__uint16_t
)(((__uint32_t)(sinp->sin_addr.s_addr)) >> 16)) >>
8) : __bswap16_var(((__uint32_t)(sinp->sin_addr.s_addr)) >>
16)))) : __bswap32_var(sinp->sin_addr.s_addr))) & 0xf0000000
) == 0xe0000000))

291

return (EAFNOSUPPORT47);

292

293

TCPDEBUG0;

294

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

295

KASSERT(inp != NULL, ("tcp_usr_bind: inp == NULL"))do { } while (0);

296

297

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

298

error = EINVAL22;

299

goto out;

300

}

301

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

302

TCPDEBUG1();

303

INP_HASH_WLOCK(&V_tcbinfo)do { uintptr_t _tid = (uintptr_t)((__curthread())); if (((&
(&(tcbinfo))->ipi_hash_lock))->rw_lock != ((0) <<
4 | 0x01) || !atomic_cmpset_long(&(((&(&(tcbinfo
))->ipi_hash_lock)))->rw_lock, ((0) << 4 | 0x01),
(_tid))) __rw_wlock_hard(&(((&(&(tcbinfo))->ipi_hash_lock
)))->rw_lock, _tid, (((void *)0)), (0)); else do { (void)0
; do { if (__builtin_expect((sdt_lockstat___rw__acquire->id
), 0)) (*sdt_probe_func)(sdt_lockstat___rw__acquire->id, (
uintptr_t) (&(&(tcbinfo))->ipi_hash_lock), (uintptr_t
) 0, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0); } while (0
); } while (0); } while (0);

304

error = in_pcbbind(inp, nam, td->td_ucred);

305

INP_HASH_WUNLOCK(&V_tcbinfo)do { uintptr_t _tid = (uintptr_t)((__curthread())); if (((&
(&(tcbinfo))->ipi_hash_lock))->lock_object.lo_data)
((&(&(tcbinfo))->ipi_hash_lock))->lock_object.
lo_data--; else { do { (void)0; do { if (__builtin_expect((sdt_lockstat___rw__release
->id), 0)) (*sdt_probe_func)(sdt_lockstat___rw__release->
id, (uintptr_t) (&(&(tcbinfo))->ipi_hash_lock), (uintptr_t
) 0, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0); } while (0
); } while (0); if (((&(&(tcbinfo))->ipi_hash_lock
))->rw_lock != _tid || !atomic_cmpset_long(&(((&(&
(tcbinfo))->ipi_hash_lock)))->rw_lock, (_tid), ((0) <<
4 | 0x01))) __rw_wunlock_hard(&(((&(&(tcbinfo))->
ipi_hash_lock)))->rw_lock, _tid, (((void *)0)), (0)); } } while
(0);

306

out:

307

TCPDEBUG2(PRU_BIND);

308

TCP_PROBE2(debug__user, tp, PRU_BIND)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 2, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0)
; } while (0);

309

310

311

return (error);

312

}

313

#endif /* INET */

314

315

#ifdef INET61

316

static int

317

tcp6_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)

318

{

319

int error = 0;

320

struct inpcb *inp;

321

struct tcpcb *tp = NULL((void *)0);

322

struct sockaddr_in6 *sin6p;

323

324

sin6p = (struct sockaddr_in6 *)nam;

325

if (nam->sa_len != sizeof (*sin6p))

326

return (EINVAL22);

327

328

* Must check for multicast addresses and disallow binding

329

* to them.

330

331

if (sin6p->sin6_family == AF_INET628 &&

332

IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr)((&sin6p->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xff
))

333

return (EAFNOSUPPORT47);

334

335

TCPDEBUG0;

336

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

337

KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"))do { } while (0);

338

339

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

340

error = EINVAL22;

341

goto out;

342

}

343

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

344

TCPDEBUG1();

345

346

inp->inp_vflag &= ~INP_IPV40x1;

347

inp->inp_vflag |= INP_IPV60x2;

348

#ifdef INET1

349

if ((inp->inp_flags & IN6P_IPV6_V6ONLY0x00008000) == 0) {

350

if (IN6_IS_ADDR_UNSPECIFIED(&sin6p->sin6_addr)((&sin6p->sin6_addr)->__u6_addr.__u6_addr32[0] == 0
&& (&sin6p->sin6_addr)->__u6_addr.__u6_addr32
[1] == 0 && (&sin6p->sin6_addr)->__u6_addr.
__u6_addr32[2] == 0 && (&sin6p->sin6_addr)->
__u6_addr.__u6_addr32[3] == 0))

351

inp->inp_vflag |= INP_IPV40x1;

352

else if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)((&sin6p->sin6_addr)->__u6_addr.__u6_addr32[0] == 0
&& (&sin6p->sin6_addr)->__u6_addr.__u6_addr32
[1] == 0 && (&sin6p->sin6_addr)->__u6_addr.
__u6_addr32[2] == (__builtin_constant_p(0x0000ffff) ? (((__uint32_t
)((__uint16_t)(__builtin_constant_p(((__uint32_t)(0x0000ffff)
) & 0xffff) ? (__uint16_t)(((__uint16_t)(((__uint32_t)(0x0000ffff
)) & 0xffff)) << 8 | ((__uint16_t)(((__uint32_t)(0x0000ffff
)) & 0xffff)) >> 8) : __bswap16_var(((__uint32_t)(0x0000ffff
)) & 0xffff))) << 16) | ((__uint16_t)(__builtin_constant_p
(((__uint32_t)(0x0000ffff)) >> 16) ? (__uint16_t)(((__uint16_t
)(((__uint32_t)(0x0000ffff)) >> 16)) << 8 | ((__uint16_t
)(((__uint32_t)(0x0000ffff)) >> 16)) >> 8) : __bswap16_var
(((__uint32_t)(0x0000ffff)) >> 16)))) : __bswap32_var(0x0000ffff
)))) {

353

struct sockaddr_in sin;

354

355

in6_sin6_2_sin(&sin, sin6p);

356

inp->inp_vflag |= INP_IPV40x1;

357

inp->inp_vflag &= ~INP_IPV60x2;

358

error = in_pcbbind(inp, (struct sockaddr *)&sin,

359

td->td_ucred);

360

361

goto out;

362

}

363

}

364

#endif

365

error = in6_pcbbind(inp, nam, td->td_ucred);

366

367

out:

368

TCPDEBUG2(PRU_BIND);

369

370

371

return (error);

372

}

373

#endif /* INET6 */

374

375

#ifdef INET1

376

377

* Prepare to accept connections.

378

379

static int

380

tcp_usr_listen(struct socket *so, int backlog, struct thread *td)

381

{

382

int error = 0;

383

struct inpcb *inp;

384

struct tcpcb *tp = NULL((void *)0);

385

386

TCPDEBUG0;

387

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

388

KASSERT(inp != NULL, ("tcp_usr_listen: inp == NULL"))do { } while (0);

389

390

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

391

error = EINVAL22;

392

goto out;

393

}

394

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

395

TCPDEBUG1();

396

SOCK_LOCK(so)do { uintptr_t _tid = (uintptr_t)((__curthread())); if ((((((
(&(&(so)->so_rcv)->sb_mtx)))))->mtx_lock != 0x00000004
|| !atomic_cmpset_long(&((((((&(&(so)->so_rcv
)->sb_mtx))))))->mtx_lock, 0x00000004, (_tid)))) __mtx_lock_sleep
(&((((((&(&(so)->so_rcv)->sb_mtx))))))->
mtx_lock, _tid, (((0))), ((((void *)0))), ((0))); else do { (
void)0; do { if (__builtin_expect((sdt_lockstat___adaptive__acquire
->id), 0)) (*sdt_probe_func)(sdt_lockstat___adaptive__acquire
->id, (uintptr_t) ((((&(&(so)->so_rcv)->sb_mtx
)))), (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t
) 0); } while (0); } while (0); } while (0);

397

error = solisten_proto_check(so);

398

399

if (error == 0 && inp->inp_lportinp_inc.inc_ie.ie_lport == 0)

400

error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);

401

402

if (error == 0) {

403

tcp_state_change(tp, TCPS_LISTEN1);

404

solisten_proto(so, backlog);

405

#ifdef TCP_OFFLOAD1

406

if ((so->so_options & SO_NO_OFFLOAD0x4000) == 0)

407

tcp_offload_listen_start(tp);

408

#endif

409

}

410

SOCK_UNLOCK(so)do { uintptr_t _tid = (uintptr_t)((__curthread())); if ((((((
&(&(so)->so_rcv)->sb_mtx)))))->lock_object.lo_data
== 0) do { (void)0; do { if (__builtin_expect((sdt_lockstat___adaptive__release
->id), 0)) (*sdt_probe_func)(sdt_lockstat___adaptive__release
->id, (uintptr_t) ((((&(&(so)->so_rcv)->sb_mtx
)))), (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t
) 0); } while (0); } while (0); if ((((((&(&(so)->
so_rcv)->sb_mtx)))))->mtx_lock != _tid || !atomic_cmpset_long
(&((((((&(&(so)->so_rcv)->sb_mtx))))))->
mtx_lock, (_tid), 0x00000004)) __mtx_unlock_sleep(&((((((
&(&(so)->so_rcv)->sb_mtx))))))->mtx_lock, ((
(0))), ((((void *)0))), ((0))); } while (0);

411

412

#ifdef TCP_RFC7413

413

if (tp->t_flags & TF_FASTOPEN0x80000000)

414

tp->t_tfo_pending = tcp_fastopen_alloc_counter();

415

#endif

416

out:

417

TCPDEBUG2(PRU_LISTEN);

418

TCP_PROBE2(debug__user, tp, PRU_LISTEN)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 3, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0)
; } while (0);

419

420

return (error);

421

}

422

#endif /* INET */

423

424

#ifdef INET61

425

static int

426

tcp6_usr_listen(struct socket *so, int backlog, struct thread *td)

427

{

428

int error = 0;

429

struct inpcb *inp;

430

struct tcpcb *tp = NULL((void *)0);

431

432

TCPDEBUG0;

433

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

434

KASSERT(inp != NULL, ("tcp6_usr_listen: inp == NULL"))do { } while (0);

435

436

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

437

error = EINVAL22;

438

goto out;

439

}

440

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

441

TCPDEBUG1();

442

443

error = solisten_proto_check(so);

444

445

if (error == 0 && inp->inp_lportinp_inc.inc_ie.ie_lport == 0) {

446

inp->inp_vflag &= ~INP_IPV40x1;

447

if ((inp->inp_flags & IN6P_IPV6_V6ONLY0x00008000) == 0)

448

inp->inp_vflag |= INP_IPV40x1;

449

error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);

450

}

451

452

if (error == 0) {

453

tcp_state_change(tp, TCPS_LISTEN1);

454

solisten_proto(so, backlog);

455

#ifdef TCP_OFFLOAD1

456

if ((so->so_options & SO_NO_OFFLOAD0x4000) == 0)

457

tcp_offload_listen_start(tp);

458

#endif

459

}

460

461

462

#ifdef TCP_RFC7413

463

if (tp->t_flags & TF_FASTOPEN0x80000000)

464

tp->t_tfo_pending = tcp_fastopen_alloc_counter();

465

#endif

466

out:

467

TCPDEBUG2(PRU_LISTEN);

468

469

470

return (error);

471

}

472

#endif /* INET6 */

473

474

#ifdef INET1

475

476

* Initiate connection to peer.

477

* Create a template for use in transmissions on this connection.

478

* Enter SYN_SENT state, and mark socket as connecting.

479

* Start keep-alive timer, and seed output sequence space.

480

* Send initial segment on connection.

481

482

static int

483

tcp_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)

484

{

485

int error = 0;

486

struct inpcb *inp;

487

struct tcpcb *tp = NULL((void *)0);

488

struct sockaddr_in *sinp;

489

490

sinp = (struct sockaddr_in *)nam;

491

if (nam->sa_len != sizeof (*sinp))

492

return (EINVAL22);

493

494

* Must disallow TCP ``connections'' to multicast addresses.

495

496

if (sinp->sin_family == AF_INET2

497

&& IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))(((in_addr_t)((__builtin_constant_p(sinp->sin_addr.s_addr)
? (((__uint32_t)((__uint16_t)(__builtin_constant_p(((__uint32_t
)(sinp->sin_addr.s_addr)) & 0xffff) ? (__uint16_t)(((__uint16_t
)(((__uint32_t)(sinp->sin_addr.s_addr)) & 0xffff)) <<
8 | ((__uint16_t)(((__uint32_t)(sinp->sin_addr.s_addr)) &
0xffff)) >> 8) : __bswap16_var(((__uint32_t)(sinp->
sin_addr.s_addr)) & 0xffff))) << 16) | ((__uint16_t
)(__builtin_constant_p(((__uint32_t)(sinp->sin_addr.s_addr
)) >> 16) ? (__uint16_t)(((__uint16_t)(((__uint32_t)(sinp
->sin_addr.s_addr)) >> 16)) << 8 | ((__uint16_t
)(((__uint32_t)(sinp->sin_addr.s_addr)) >> 16)) >>
8) : __bswap16_var(((__uint32_t)(sinp->sin_addr.s_addr)) >>
16)))) : __bswap32_var(sinp->sin_addr.s_addr))) & 0xf0000000
) == 0xe0000000))

498

return (EAFNOSUPPORT47);

499

if ((error = prison_remote_ip4(td->td_ucred, &sinp->sin_addr)) != 0)

500

return (error);

501

502

TCPDEBUG0;

503

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

504

KASSERT(inp != NULL, ("tcp_usr_connect: inp == NULL"))do { } while (0);

505

506

if (inp->inp_flags & INP_TIMEWAIT0x01000000) {

507

error = EADDRINUSE48;

508

goto out;

509

}

510

if (inp->inp_flags & INP_DROPPED0x04000000) {

511

error = ECONNREFUSED61;

512

goto out;

513

}

514

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

515

TCPDEBUG1();

516

if ((error = tcp_connect(tp, nam, td)) != 0)

517

goto out;

518

#ifdef TCP_OFFLOAD1

519

if (registered_toedevs > 0 &&

520

(so->so_options & SO_NO_OFFLOAD0x4000) == 0 &&

521

(error = tcp_offload_connect(so, nam)) == 0)

522

goto out;

523

#endif

524

tcp_timer_activate(tp, TT_KEEP0x0008, TP_KEEPINIT(tp)((tp)->t_keepinit ? (tp)->t_keepinit : tcp_keepinit));

525

error = tp->t_fb->tfb_tcp_output(tp);

526

out:

527

TCPDEBUG2(PRU_CONNECT);

528

TCP_PROBE2(debug__user, tp, PRU_CONNECT)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 4, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0)
; } while (0);

529

530

return (error);

531

}

532

#endif /* INET */

533

534

#ifdef INET61

535

static int

536

tcp6_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)

537

{

538

int error = 0;

539

struct inpcb *inp;

540

struct tcpcb *tp = NULL((void *)0);

541

struct sockaddr_in6 *sin6p;

542

543

TCPDEBUG0;

544

545

sin6p = (struct sockaddr_in6 *)nam;

546

if (nam->sa_len != sizeof (*sin6p))

547

return (EINVAL22);

548

549

* Must disallow TCP ``connections'' to multicast addresses.

550

551

if (sin6p->sin6_family == AF_INET628

552

&& IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr)((&sin6p->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xff
))

553

return (EAFNOSUPPORT47);

554

555

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

556

KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"))do { } while (0);

557

558

if (inp->inp_flags & INP_TIMEWAIT0x01000000) {

559

error = EADDRINUSE48;

560

goto out;

561

}

562

if (inp->inp_flags & INP_DROPPED0x04000000) {

563

error = ECONNREFUSED61;

564

goto out;

565

}

566

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

567

TCPDEBUG1();

568

#ifdef INET1

569

570

* XXXRW: Some confusion: V4/V6 flags relate to binding, and

571

* therefore probably require the hash lock, which isn't held here.

572

* Is this a significant problem?

573

574

if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)((&sin6p->sin6_addr)->__u6_addr.__u6_addr32[0] == 0
&& (&sin6p->sin6_addr)->__u6_addr.__u6_addr32
[1] == 0 && (&sin6p->sin6_addr)->__u6_addr.
__u6_addr32[2] == (__builtin_constant_p(0x0000ffff) ? (((__uint32_t
)((__uint16_t)(__builtin_constant_p(((__uint32_t)(0x0000ffff)
) & 0xffff) ? (__uint16_t)(((__uint16_t)(((__uint32_t)(0x0000ffff
)) & 0xffff)) << 8 | ((__uint16_t)(((__uint32_t)(0x0000ffff
)) & 0xffff)) >> 8) : __bswap16_var(((__uint32_t)(0x0000ffff
)) & 0xffff))) << 16) | ((__uint16_t)(__builtin_constant_p
(((__uint32_t)(0x0000ffff)) >> 16) ? (__uint16_t)(((__uint16_t
)(((__uint32_t)(0x0000ffff)) >> 16)) << 8 | ((__uint16_t
)(((__uint32_t)(0x0000ffff)) >> 16)) >> 8) : __bswap16_var
(((__uint32_t)(0x0000ffff)) >> 16)))) : __bswap32_var(0x0000ffff
)))) {

575

struct sockaddr_in sin;

576

577

if ((inp->inp_flags & IN6P_IPV6_V6ONLY0x00008000) != 0) {

578

error = EINVAL22;

579

goto out;

580

}

581

582

in6_sin6_2_sin(&sin, sin6p);

583

inp->inp_vflag |= INP_IPV40x1;

584

inp->inp_vflag &= ~INP_IPV60x2;

585

if ((error = prison_remote_ip4(td->td_ucred,

586

&sin.sin_addr)) != 0)

587

goto out;

588

if ((error = tcp_connect(tp, (struct sockaddr *)&sin, td)) != 0)

589

goto out;

590

#ifdef TCP_OFFLOAD1

591

if (registered_toedevs > 0 &&

592

(so->so_options & SO_NO_OFFLOAD0x4000) == 0 &&

593

(error = tcp_offload_connect(so, nam)) == 0)

594

goto out;

595

#endif

596

error = tp->t_fb->tfb_tcp_output(tp);

597

goto out;

598

}

599

#endif

600

inp->inp_vflag &= ~INP_IPV40x1;

601

inp->inp_vflag |= INP_IPV60x2;

602

inp->inp_inc.inc_flags |= INC_ISIPV60x01;

603

if ((error = prison_remote_ip6(td->td_ucred, &sin6p->sin6_addr)) != 0)

604

goto out;

605

if ((error = tcp6_connect(tp, nam, td)) != 0)

606

goto out;

607

#ifdef TCP_OFFLOAD1

608

if (registered_toedevs > 0 &&

609

(so->so_options & SO_NO_OFFLOAD0x4000) == 0 &&

610

(error = tcp_offload_connect(so, nam)) == 0)

611

goto out;

612

#endif

613

tcp_timer_activate(tp, TT_KEEP0x0008, TP_KEEPINIT(tp)((tp)->t_keepinit ? (tp)->t_keepinit : tcp_keepinit));

614

error = tp->t_fb->tfb_tcp_output(tp);

615

616

out:

617

TCPDEBUG2(PRU_CONNECT);

618

619

620

return (error);

621

}

622

#endif /* INET6 */

623

624

625

* Initiate disconnect from peer.

626

* If connection never passed embryonic stage, just drop;

627

* else if don't need to let data drain, then can just drop anyways,

628

* else have to begin TCP shutdown process: mark socket disconnecting,

629

* drain unread data, state switch to reflect user close, and

630

* send segment (e.g. FIN) to peer. Socket will be really disconnected

631

* when peer sends FIN and acks ours.

632

633

* SHOULD IMPLEMENT LATER PRU_CONNECT VIA REALLOC TCPCB.

634

635

static int

636

tcp_usr_disconnect(struct socket *so)

637

{

638

struct inpcb *inp;

639

struct tcpcb *tp = NULL((void *)0);

640

int error = 0;

641

642

TCPDEBUG0;

643

INP_INFO_RLOCK(&V_tcbinfo)__rw_rlock(&((&(&(tcbinfo))->ipi_lock))->rw_lock
, ((void *)0), 0);

644

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

645

KASSERT(inp != NULL, ("tcp_usr_disconnect: inp == NULL"))do { } while (0);

646

647

if (inp->inp_flags & INP_TIMEWAIT0x01000000)

648

goto out;

649

if (inp->inp_flags & INP_DROPPED0x04000000) {

650

error = ECONNRESET54;

651

goto out;

652

}

653

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

654

TCPDEBUG1();

655

tcp_disconnect(tp);

656

out:

657

TCPDEBUG2(PRU_DISCONNECT);

658

TCP_PROBE2(debug__user, tp, PRU_DISCONNECT)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 6, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0)
; } while (0);

659

660

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

661

return (error);

662

}

663

664

#ifdef INET1

665

666

* Accept a connection. Essentially all the work is done at higher levels;

667

* just return the address of the peer, storing through addr.

668

669

static int

670

tcp_usr_accept(struct socket *so, struct sockaddr **nam)

671

{

672

int error = 0;

673

struct inpcb *inp = NULL((void *)0);

674

struct tcpcb *tp = NULL((void *)0);

675

struct in_addr addr;

676

in_port_t port = 0;

677

TCPDEBUG0;

678

679

if (so->so_state & SS_ISDISCONNECTED0x2000)

680

return (ECONNABORTED53);

681

682

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

683

KASSERT(inp != NULL, ("tcp_usr_accept: inp == NULL"))do { } while (0);

684

685

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

686

error = ECONNABORTED53;

687

goto out;

688

}

689

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

690

TCPDEBUG1();

691

692

693

* We inline in_getpeeraddr and COMMON_END here, so that we can

694

* copy the data of interest and defer the malloc until after we

695

* release the lock.

696

697

port = inp->inp_fportinp_inc.inc_ie.ie_fport;

698

addr = inp->inp_faddrinp_inc.inc_ie.ie_dependfaddr.ie46_foreign.ia46_addr4;

699

700

out:

701

TCPDEBUG2(PRU_ACCEPT);

702

TCP_PROBE2(debug__user, tp, PRU_ACCEPT)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 5, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0)
; } while (0);

703

704

if (error == 0)

705

*nam = in_sockaddr(port, &addr);

706

return error;

707

}

708

#endif /* INET */

709

710

#ifdef INET61

711

static int

712

tcp6_usr_accept(struct socket *so, struct sockaddr **nam)

713

{

714

struct inpcb *inp = NULL((void *)0);

715

int error = 0;

716

struct tcpcb *tp = NULL((void *)0);

717

struct in_addr addr;

718

struct in6_addr addr6;

719

in_port_t port = 0;

720

int v4 = 0;

721

TCPDEBUG0;

722

723

if (so->so_state & SS_ISDISCONNECTED0x2000)

724

return (ECONNABORTED53);

725

726

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

727

KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"))do { } while (0);

728

INP_INFO_RLOCK(&V_tcbinfo)__rw_rlock(&((&(&(tcbinfo))->ipi_lock))->rw_lock
, ((void *)0), 0);

729

730

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

731

error = ECONNABORTED53;

732

goto out;

733

}

734

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

735

TCPDEBUG1();

736

737

738

* We inline in6_mapped_peeraddr and COMMON_END here, so that we can

739

* copy the data of interest and defer the malloc until after we

740

* release the lock.

741

742

if (inp->inp_vflag & INP_IPV40x1) {

743

v4 = 1;

744

port = inp->inp_fportinp_inc.inc_ie.ie_fport;

745

addr = inp->inp_faddrinp_inc.inc_ie.ie_dependfaddr.ie46_foreign.ia46_addr4;

746

} else {

747

port = inp->inp_fportinp_inc.inc_ie.ie_fport;

748

addr6 = inp->in6p_faddrinp_inc.inc_ie.ie_dependfaddr.ie6_foreign;

749

}

750

751

out:

752

TCPDEBUG2(PRU_ACCEPT);

753

754

755

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

756

if (error == 0) {

757

if (v4)

758

*nam = in6_v4mapsin6_sockaddr(port, &addr);

759

else

760

*nam = in6_sockaddr(port, &addr6);

761

}

762

return error;

763

}

764

#endif /* INET6 */

765

766

767

* Mark the connection as being incapable of further output.

768

769

static int

770

tcp_usr_shutdown(struct socket *so)

771

{

772

int error = 0;

773

struct inpcb *inp;

774

struct tcpcb *tp = NULL((void *)0);

775

776

TCPDEBUG0;

777

INP_INFO_RLOCK(&V_tcbinfo)__rw_rlock(&((&(&(tcbinfo))->ipi_lock))->rw_lock
, ((void *)0), 0);

778

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

779

KASSERT(inp != NULL, ("inp == NULL"))do { } while (0);

780

781

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

782

error = ECONNRESET54;

783

goto out;

784

}

785

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

786

TCPDEBUG1();

787

socantsendmore(so);

788

tcp_usrclosed(tp);

789

if (!(inp->inp_flags & INP_DROPPED0x04000000))

790

error = tp->t_fb->tfb_tcp_output(tp);

791

792

out:

793

TCPDEBUG2(PRU_SHUTDOWN);

794

TCP_PROBE2(debug__user, tp, PRU_SHUTDOWN)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 7, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0)
; } while (0);

795

796

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

797

798

return (error);

799

}

800

801

802

* After a receive, possibly send window update to peer.

803

804

static int

805

tcp_usr_rcvd(struct socket *so, int flags)

806

{

807

struct inpcb *inp;

808

struct tcpcb *tp = NULL((void *)0);

809

int error = 0;

810

811

TCPDEBUG0;

812

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

813

KASSERT(inp != NULL, ("tcp_usr_rcvd: inp == NULL"))do { } while (0);

814

815

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

816

error = ECONNRESET54;

817

goto out;

818

}

819

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

820

TCPDEBUG1();

821

#ifdef TCP_RFC7413

822

823

* For passively-created TFO connections, don't attempt a window

824

* update while still in SYN_RECEIVED as this may trigger an early

825

* SYN|ACK. It is preferable to have the SYN|ACK be sent along with

826

* application response data, or failing that, when the DELACK timer

827

* expires.

828

829

if ((tp->t_flags & TF_FASTOPEN0x80000000) &&

830

(tp->t_state == TCPS_SYN_RECEIVED3))

831

goto out;

832

#endif

833

#ifdef TCP_OFFLOAD1

834

if (tp->t_flags & TF_TOE0x2000000)

835

tcp_offload_rcvd(tp);

836

else

837

#endif

838

tp->t_fb->tfb_tcp_output(tp);

839

840

out:

841

TCPDEBUG2(PRU_RCVD);

842

TCP_PROBE2(debug__user, tp, PRU_RCVD)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 8, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0)
; } while (0);

843

844

return (error);

845

}

846

847

848

* Do a send by putting data in output queue and updating urgent

849

* marker if URG set. Possibly send more data. Unlike the other

850

* pru_*() routines, the mbuf chains are our responsibility. We

851

* must either enqueue them or free them. The other pru_* routines

852

* generally are caller-frees.

853

854

static int

855

tcp_usr_send(struct socket *so, int flags, struct mbuf *m,

856

struct sockaddr *nam, struct mbuf *control, struct thread *td)

857

{

858

int error = 0;

859

struct inpcb *inp;

860

struct tcpcb *tp = NULL((void *)0);

861

#ifdef INET61

862

int isipv6;

863

#endif

864

TCPDEBUG0;

865

866

867

* We require the pcbinfo lock if we will close the socket as part of

868

* this call.

869

870

if (flags & PRUS_EOF0x2)

871

INP_INFO_RLOCK(&V_tcbinfo)__rw_rlock(&((&(&(tcbinfo))->ipi_lock))->rw_lock
, ((void *)0), 0);

872

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

873

KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"))do { } while (0);

874

875

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

876

if (control)

877

m_freem(control);

878

879

* In case of PRUS_NOTREADY, tcp_usr_ready() is responsible

880

* for freeing memory.

881

882

if (m && (flags & PRUS_NOTREADY0x8) == 0)

883

m_freem(m);

884

error = ECONNRESET54;

885

goto out;

886

}

887

#ifdef INET61

888

isipv6 = nam && nam->sa_family == AF_INET628;

889

#endif /* INET6 */

890

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

891

TCPDEBUG1();

892

if (control) {

893

/* TCP doesn't do control messages (rights, creds, etc) */

894

if (control->m_len) {

895

m_freem(control);

896

if (m)

897

m_freem(m);

898

error = EINVAL22;

899

goto out;

900

}

901

m_freem(control); /* empty control, just free it */

902

}

903

if (!(flags & PRUS_OOB0x1)) {

904

sbappendstream(&so->so_snd, m, flags);

905

if (nam && tp->t_state < TCPS_SYN_SENT2) {

906

907

* Do implied connect if not yet connected,

908

* initialize window to default value, and

909

* initialize maxseg using peer's cached MSS.

910

911

#ifdef INET61

912

if (isipv6)

913

error = tcp6_connect(tp, nam, td);

914

#endif /* INET6 */

915

#if defined(INET61) && defined(INET1)

916

else

917

#endif

918

#ifdef INET1

919

error = tcp_connect(tp, nam, td);

920

#endif

921

if (error)

922

goto out;

923

tp->snd_wnd = TTCP_CLIENT_SND_WND4096;

924

tcp_mss(tp, -1);

925

}

926

if (flags & PRUS_EOF0x2) {

927

928

* Close the send side of the connection after

929

* the data is sent.

930

931

INP_INFO_RLOCK_ASSERT(&V_tcbinfo);

932

socantsendmore(so);

933

tcp_usrclosed(tp);

934

}

935

if (!(inp->inp_flags & INP_DROPPED0x04000000) &&

936

!(flags & PRUS_NOTREADY0x8)) {

937

if (flags & PRUS_MORETOCOME0x4)

938

tp->t_flags |= TF_MORETOCOME0x010000;

939

error = tp->t_fb->tfb_tcp_output(tp);

940

if (flags & PRUS_MORETOCOME0x4)

941

tp->t_flags &= ~TF_MORETOCOME0x010000;

942

}

943

} else {

944

945

* XXXRW: PRUS_EOF not implemented with PRUS_OOB?

946

947

SOCKBUF_LOCK(&so->so_snd)do { uintptr_t _tid = (uintptr_t)((__curthread())); if ((((((
(&(&so->so_snd)->sb_mtx)))))->mtx_lock != 0x00000004
|| !atomic_cmpset_long(&((((((&(&so->so_snd)->
sb_mtx))))))->mtx_lock, 0x00000004, (_tid)))) __mtx_lock_sleep
(&((((((&(&so->so_snd)->sb_mtx))))))->mtx_lock
, _tid, (((0))), ((((void *)0))), ((0))); else do { (void)0; do
{ if (__builtin_expect((sdt_lockstat___adaptive__acquire->
id), 0)) (*sdt_probe_func)(sdt_lockstat___adaptive__acquire->
id, (uintptr_t) ((((&(&so->so_snd)->sb_mtx)))),
(uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0);
} while (0); } while (0); } while (0);

948

if (sbspace(&so->so_snd) < -512) {

949

SOCKBUF_UNLOCK(&so->so_snd)do { uintptr_t _tid = (uintptr_t)((__curthread())); if ((((((
&(&so->so_snd)->sb_mtx)))))->lock_object.lo_data
== 0) do { (void)0; do { if (__builtin_expect((sdt_lockstat___adaptive__release
->id), 0)) (*sdt_probe_func)(sdt_lockstat___adaptive__release
->id, (uintptr_t) ((((&(&so->so_snd)->sb_mtx
)))), (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t
) 0); } while (0); } while (0); if ((((((&(&so->so_snd
)->sb_mtx)))))->mtx_lock != _tid || !atomic_cmpset_long
(&((((((&(&so->so_snd)->sb_mtx))))))->mtx_lock
, (_tid), 0x00000004)) __mtx_unlock_sleep(&((((((&(&
so->so_snd)->sb_mtx))))))->mtx_lock, (((0))), ((((void
*)0))), ((0))); } while (0);

950

m_freem(m);

951

error = ENOBUFS55;

952

goto out;

953

}

954

955

* According to RFC961 (Assigned Protocols),

956

* the urgent pointer points to the last octet

957

* of urgent data. We continue, however,

958

* to consider it to indicate the first octet

959

* of data past the urgent section.

960

* Otherwise, snd_up should be one lower.

961

962

sbappendstream_locked(&so->so_snd, m, flags);

963

964

if (nam && tp->t_state < TCPS_SYN_SENT2) {

965

966

* Do implied connect if not yet connected,

967

* initialize window to default value, and

968

* initialize maxseg using peer's cached MSS.

969

970

#ifdef INET61

971

if (isipv6)

972

error = tcp6_connect(tp, nam, td);

973

#endif /* INET6 */

974

#if defined(INET61) && defined(INET1)

975

else

976

#endif

977

#ifdef INET1

978

error = tcp_connect(tp, nam, td);

979

#endif

980

if (error)

981

goto out;

982

tp->snd_wnd = TTCP_CLIENT_SND_WND4096;

983

tcp_mss(tp, -1);

984

}

985

tp->snd_up = tp->snd_una + sbavail(&so->so_snd);

986

if (!(flags & PRUS_NOTREADY0x8)) {

987

tp->t_flags |= TF_FORCEDATA0x800000;

988

error = tp->t_fb->tfb_tcp_output(tp);

989

tp->t_flags &= ~TF_FORCEDATA0x800000;

990

}

991

}

992

out:

993

TCPDEBUG2((flags & PRUS_OOB) ? PRU_SENDOOB :

994

((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));

995

TCP_PROBE2(debug__user, tp, (flags & PRUS_OOB) ? PRU_SENDOOB :do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) (flags & 0x1) ? 14 : ((flags & 0x2) ? 22
: 9), (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0); } while (
0)

996

((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND))do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) (flags & 0x1) ? 14 : ((flags & 0x2) ? 22
: 9), (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0); } while (
0);

997

998

if (flags & PRUS_EOF0x2)

999

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

1000

return (error);

1001

}

1002

1003

static int

1004

tcp_usr_ready(struct socket *so, struct mbuf *m, int count)

1005

{

1006

struct inpcb *inp;

1007

struct tcpcb *tp;

1008

int error;

1009

1010

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

1011

1012

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

1013

1014

for (int i = 0; i < count; i++)

1015

m = m_free(m);

1016

return (ECONNRESET54);

1017

}

1018

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

1019

1020

1021

error = sbready(&so->so_snd, m, count);

1022

1023

if (error == 0)

1024

error = tp->t_fb->tfb_tcp_output(tp);

1025

1026

1027

return (error);

1028

}

1029

1030

1031

* Abort the TCP. Drop the connection abruptly.

1032

1033

static void

1034

tcp_usr_abort(struct socket *so)

1035

{

1036

struct inpcb *inp;

1037

struct tcpcb *tp = NULL((void *)0);

1038

TCPDEBUG0;

1039

1040

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

1041

KASSERT(inp != NULL, ("tcp_usr_abort: inp == NULL"))do { } while (0);

1042

1043

INP_INFO_RLOCK(&V_tcbinfo)__rw_rlock(&((&(&(tcbinfo))->ipi_lock))->rw_lock
, ((void *)0), 0);

1044

1045

KASSERT(inp->inp_socket != NULL,do { } while (0)

1046

("tcp_usr_abort: inp_socket == NULL"))do { } while (0);

1047

1048

1049

* If we still have full TCP state, and we're not dropped, drop.

1050

1051

if (!(inp->inp_flags & INP_TIMEWAIT0x01000000) &&

1052

!(inp->inp_flags & INP_DROPPED0x04000000)) {

1053

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

1054

TCPDEBUG1();

1055

tcp_drop(tp, ECONNABORTED53);

1056

TCPDEBUG2(PRU_ABORT);

1057

TCP_PROBE2(debug__user, tp, PRU_ABORT)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 10, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0
); } while (0);

1058

}

1059

if (!(inp->inp_flags & INP_DROPPED0x04000000)) {

1060

1061

so->so_state |= SS_PROTOREF0x4000;

1062

1063

inp->inp_flags |= INP_SOCKREF0x08000000;

1064

}

1065

1066

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

1067

}

1068

1069

1070

* TCP socket is closed. Start friendly disconnect.

1071

1072

static void

1073

tcp_usr_close(struct socket *so)

1074

{

1075

struct inpcb *inp;

1076

struct tcpcb *tp = NULL((void *)0);

1077

TCPDEBUG0;

1078

1079

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

1080

KASSERT(inp != NULL, ("tcp_usr_close: inp == NULL"))do { } while (0);

1081

1082

INP_INFO_RLOCK(&V_tcbinfo)__rw_rlock(&((&(&(tcbinfo))->ipi_lock))->rw_lock
, ((void *)0), 0);

1083

1084

KASSERT(inp->inp_socket != NULL,do { } while (0)

1085

("tcp_usr_close: inp_socket == NULL"))do { } while (0);

1086

1087

1088

* If we still have full TCP state, and we're not dropped, initiate

1089

* a disconnect.

1090

1091

if (!(inp->inp_flags & INP_TIMEWAIT0x01000000) &&

1092

!(inp->inp_flags & INP_DROPPED0x04000000)) {

1093

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

1094

TCPDEBUG1();

1095

tcp_disconnect(tp);

1096

TCPDEBUG2(PRU_CLOSE);

1097

TCP_PROBE2(debug__user, tp, PRU_CLOSE)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 24, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0
); } while (0);

1098

}

1099

if (!(inp->inp_flags & INP_DROPPED0x04000000)) {

1100

1101

so->so_state |= SS_PROTOREF0x4000;

1102

1103

inp->inp_flags |= INP_SOCKREF0x08000000;

1104

}

1105

1106

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

1107

}

1108

1109

1110

* Receive out-of-band data.

1111

1112

static int

1113

tcp_usr_rcvoob(struct socket *so, struct mbuf *m, int flags)

1114

{

1115

int error = 0;

1116

struct inpcb *inp;

1117

struct tcpcb *tp = NULL((void *)0);

1118

1119

TCPDEBUG0;

1120

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

1121

KASSERT(inp != NULL, ("tcp_usr_rcvoob: inp == NULL"))do { } while (0);

1122

1123

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

1124

error = ECONNRESET54;

1125

goto out;

1126

}

1127

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

1128

TCPDEBUG1();

1129

if ((so->so_oobmark == 0 &&

1130

(so->so_rcv.sb_state & SBS_RCVATMARK0x0040) == 0) ||

1131

so->so_options & SO_OOBINLINE0x0100 ||

1132

tp->t_oobflags & TCPOOB_HADDATA0x02) {

1133

error = EINVAL22;

1134

goto out;

1135

}

1136

if ((tp->t_oobflags & TCPOOB_HAVEDATA0x01) == 0) {

1137

error = EWOULDBLOCK35;

1138

goto out;

1139

}

1140

m->m_len = 1;

1141

*mtod(m, caddr_t)((caddr_t)((m)->m_data)) = tp->t_iobc;

1142

if ((flags & MSG_PEEK0x2) == 0)

1143

tp->t_oobflags ^= (TCPOOB_HAVEDATA0x01 | TCPOOB_HADDATA0x02);

1144

1145

out:

1146

TCPDEBUG2(PRU_RCVOOB);

1147

TCP_PROBE2(debug__user, tp, PRU_RCVOOB)do { if (__builtin_expect((sdt_tcp___debug__user->id), 0))
(*sdt_probe_func)(sdt_tcp___debug__user->id, (uintptr_t) tp
, (uintptr_t) 13, (uintptr_t) 0, (uintptr_t) 0, (uintptr_t) 0
); } while (0);

1148

1149

return (error);

1150

}

1151

1152

#ifdef INET1

1153

struct pr_usrreqs tcp_usrreqs = {

1154

.pru_abort = tcp_usr_abort,

1155

.pru_accept = tcp_usr_accept,

1156

.pru_attach = tcp_usr_attach,

1157

.pru_bind = tcp_usr_bind,

1158

.pru_connect = tcp_usr_connect,

1159

.pru_control = in_control,

1160

.pru_detach = tcp_usr_detach,

1161

.pru_disconnect = tcp_usr_disconnect,

1162

.pru_listen = tcp_usr_listen,

1163

.pru_peeraddr = in_getpeeraddr,

1164

.pru_rcvd = tcp_usr_rcvd,

1165

.pru_rcvoob = tcp_usr_rcvoob,

1166

.pru_send = tcp_usr_send,

1167

.pru_ready = tcp_usr_ready,

1168

.pru_shutdown = tcp_usr_shutdown,

1169

.pru_sockaddr = in_getsockaddr,

1170

.pru_sosetlabel = in_pcbsosetlabel,

1171

.pru_close = tcp_usr_close,

1172

};

1173

#endif /* INET */

1174

1175

#ifdef INET61

1176

struct pr_usrreqs tcp6_usrreqs = {

1177

.pru_abort = tcp_usr_abort,

1178

.pru_accept = tcp6_usr_accept,

1179

.pru_attach = tcp_usr_attach,

1180

.pru_bind = tcp6_usr_bind,

1181

.pru_connect = tcp6_usr_connect,

1182

.pru_control = in6_control,

1183

.pru_detach = tcp_usr_detach,

1184

.pru_disconnect = tcp_usr_disconnect,

1185

.pru_listen = tcp6_usr_listen,

1186

.pru_peeraddr = in6_mapped_peeraddr,

1187

.pru_rcvd = tcp_usr_rcvd,

1188

.pru_rcvoob = tcp_usr_rcvoob,

1189

.pru_send = tcp_usr_send,

1190

.pru_ready = tcp_usr_ready,

1191

.pru_shutdown = tcp_usr_shutdown,

1192

.pru_sockaddr = in6_mapped_sockaddr,

1193

.pru_sosetlabel = in_pcbsosetlabel,

1194

.pru_close = tcp_usr_close,

1195

};

1196

#endif /* INET6 */

1197

1198

#ifdef INET1

1199

1200

* Common subroutine to open a TCP connection to remote host specified

1201

* by struct sockaddr_in in mbuf *nam. Call in_pcbbind to assign a local

1202

* port number if needed. Call in_pcbconnect_setup to do the routing and

1203

* to choose a local host address (interface). If there is an existing

1204

* incarnation of the same connection in TIME-WAIT state and if the remote

1205

* host was sending CC options and if the connection duration was < MSL, then

1206

* truncate the previous TIME-WAIT state and proceed.

1207

* Initialize connection parameters and enter SYN-SENT state.

1208

1209

static int

1210

tcp_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)

1211

{

1212

struct inpcb *inp = tp->t_inpcb, *oinp;

1213

struct socket *so = inp->inp_socket;

1214

struct in_addr laddr;

1215

u_short lport;

1216

int error;

1217

1218

INP_WLOCK_ASSERT(inp);

1219

1220

1221

if (inp->inp_lportinp_inc.inc_ie.ie_lport == 0) {

1222

error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);

1223

if (error)

1224

goto out;

1225

}

1226

1227

1228

* Cannot simply call in_pcbconnect, because there might be an

1229

* earlier incarnation of this same connection still in

1230

* TIME_WAIT state, creating an ADDRINUSE error.

1231

1232

laddr = inp->inp_laddrinp_inc.inc_ie.ie_dependladdr.ie46_local.ia46_addr4;

1233

lport = inp->inp_lportinp_inc.inc_ie.ie_lport;

1234

error = in_pcbconnect_setup(inp, nam, &laddr.s_addr, &lport,

1235

&inp->inp_faddrinp_inc.inc_ie.ie_dependfaddr.ie46_foreign.ia46_addr4.s_addr, &inp->inp_fportinp_inc.inc_ie.ie_fport, &oinp, td->td_ucred);

1236

if (error && oinp == NULL((void *)0))

1237

goto out;

1238

if (oinp) {

1239

error = EADDRINUSE48;

1240

goto out;

1241

}

1242

inp->inp_laddrinp_inc.inc_ie.ie_dependladdr.ie46_local.ia46_addr4 = laddr;

1243

in_pcbrehash(inp);

1244

1245

1246

1247

* Compute window scaling to request:

1248

* Scale to fit into sweet spot. See tcp_syncache.c.

1249

* XXX: This should move to tcp_output().

1250

1251

while (tp->request_r_scale < TCP_MAX_WINSHIFT14 &&

1252

(TCP_MAXWIN65535 << tp->request_r_scale) < sb_max)

1253

tp->request_r_scale++;

1254

1255

soisconnecting(so);

1256

TCPSTAT_INC(tcps_connattempt)counter_u64_add((tcpstat)[__builtin_offsetof(struct tcpstat, tcps_connattempt
) / sizeof(uint64_t)], ((1)));

1257

tcp_state_change(tp, TCPS_SYN_SENT2);

1258

tp->iss = tcp_new_isn(tp);

1259

tcp_sendseqinit(tp)(tp)->snd_una = (tp)->snd_nxt = (tp)->snd_max = (tp)
->snd_up = (tp)->snd_recover = (tp)->iss;

1260

1261

return 0;

1262

1263

out:

1264

1265

return (error);

1266

}

1267

#endif /* INET */

1268

1269

#ifdef INET61

1270

static int

1271

tcp6_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)

1272

{

1273

struct inpcb *inp = tp->t_inpcb;

1274

int error;

1275

1276

INP_WLOCK_ASSERT(inp);

1277

1278

1279

if (inp->inp_lportinp_inc.inc_ie.ie_lport == 0) {

1280

error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);

1281

if (error)

1282

goto out;

1283

}

1284

error = in6_pcbconnect(inp, nam, td->td_ucred);

1285

if (error != 0)

1286

goto out;

1287

1288

1289

/* Compute window scaling to request. */

1290

while (tp->request_r_scale < TCP_MAX_WINSHIFT14 &&

1291

(TCP_MAXWIN65535 << tp->request_r_scale) < sb_max)

1292

tp->request_r_scale++;

1293

1294

soisconnecting(inp->inp_socket);

1295

TCPSTAT_INC(tcps_connattempt)counter_u64_add((tcpstat)[__builtin_offsetof(struct tcpstat, tcps_connattempt
) / sizeof(uint64_t)], ((1)));

1296

tcp_state_change(tp, TCPS_SYN_SENT2);

1297

tp->iss = tcp_new_isn(tp);

1298

tcp_sendseqinit(tp)(tp)->snd_una = (tp)->snd_nxt = (tp)->snd_max = (tp)
->snd_up = (tp)->snd_recover = (tp)->iss;

1299

1300

return 0;

1301

1302

out:

1303

1304

return error;

1305

}

1306

#endif /* INET6 */

1307

1308

1309

* Export TCP internal state information via a struct tcp_info, based on the

1310

* Linux 2.6 API. Not ABI compatible as our constants are mapped differently

1311

* (TCP state machine, etc). We export all information using FreeBSD-native

1312

* constants -- for example, the numeric values for tcpi_state will differ

1313

* from Linux.

1314

1315

static void

1316

tcp_fill_info(struct tcpcb *tp, struct tcp_info *ti)

1317

{

1318

1319

INP_WLOCK_ASSERT(tp->t_inpcb);

1320

bzero(ti, sizeof(*ti));

1321

1322

ti->tcpi_state = tp->t_state;

1323

if ((tp->t_flags & TF_REQ_TSTMP0x000080) && (tp->t_flags & TF_RCVD_TSTMP0x000100))

1324

ti->tcpi_options |= TCPI_OPT_TIMESTAMPS0x01;

1325

if (tp->t_flags & TF_SACK_PERMIT0x000200)

1326

ti->tcpi_options |= TCPI_OPT_SACK0x02;

1327

if ((tp->t_flags & TF_REQ_SCALE0x000020) && (tp->t_flags & TF_RCVD_SCALE0x000040)) {

1328

ti->tcpi_options |= TCPI_OPT_WSCALE0x04;

1329

ti->tcpi_snd_wscale = tp->snd_scale;

1330

ti->tcpi_rcv_wscale = tp->rcv_scale;

1331

}

1332

1333

ti->tcpi_rto = tp->t_rxtcur * tick;

1334

ti->tcpi_last_data_recv = (long)(ticks - (int)tp->t_rcvtime) * tick;

1335

ti->tcpi_rtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT5;

1336

ti->tcpi_rttvar = ((u_int64_t)tp->t_rttvar * tick) >> TCP_RTTVAR_SHIFT4;

1337

1338

ti->tcpi_snd_ssthresh = tp->snd_ssthresh;

1339

ti->tcpi_snd_cwnd = tp->snd_cwnd;

1340

1341

1342

* FreeBSD-specific extension fields for tcp_info.

1343

1344

ti->tcpi_rcv_space = tp->rcv_wnd;

1345

ti->tcpi_rcv_nxt = tp->rcv_nxt;

1346

ti->tcpi_snd_wnd = tp->snd_wnd;

1347

ti->tcpi_snd_bwnd = 0; /* Unused, kept for compat. */

1348

ti->tcpi_snd_nxt = tp->snd_nxt;

1349

ti->tcpi_snd_mss = tp->t_maxseg;

1350

ti->tcpi_rcv_mss = tp->t_maxseg;

1351

if (tp->t_flags & TF_TOE0x2000000)

1352

ti->tcpi_options |= TCPI_OPT_TOE0x10;

1353

ti->tcpi_snd_rexmitpack = tp->t_sndrexmitpack;

1354

ti->tcpi_rcv_ooopack = tp->t_rcvoopack;

1355

ti->tcpi_snd_zerowin = tp->t_sndzerowin;

1356

}

1357

1358

1359

* tcp_ctloutput() must drop the inpcb lock before performing copyin on

1360

* socket option arguments. When it re-acquires the lock after the copy, it

1361

* has to revalidate that the connection is still valid for the socket

1362

* option.

1363

1364

#define INP_WLOCK_RECHECK_CLEANUP(inp, cleanup) do { \

1365

1366

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) { \

1367

1368

cleanup; \

1369

return (ECONNRESET54); \

1370

} \

1371

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb); \

1372

} while(0)

1373

#define INP_WLOCK_RECHECK(inp) INP_WLOCK_RECHECK_CLEANUP((inp), /* noop */)

1374

1375

int

1376

tcp_ctloutput(struct socket *so, struct sockopt *sopt)

1377

{

1378

int error;

1379

struct inpcb *inp;

1380

struct tcpcb *tp;

1381

struct tcp_function_block *blk;

1382

struct tcp_function_set fsn;

1383

1384

error = 0;

1385

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

1386

KASSERT(inp != NULL, ("tcp_ctloutput: inp == NULL"))do { } while (0);

1387

1388

if (sopt->sopt_level != IPPROTO_TCP6) {

Taking false branch

→

1389

#ifdef INET61

1390

if (inp->inp_vflag & INP_IPV6PROTO0x4) {

1391

1392

error = ip6_ctloutput(so, sopt);

1393

}

1394

#endif /* INET6 */

1395

#if defined(INET61) && defined(INET1)

1396

else

1397

#endif

1398

#ifdef INET1

1399

{

1400

1401

error = ip_ctloutput(so, sopt);

1402

}

1403

#endif

1404

return (error);

1405

}

1406

if (inp->inp_flags & (INP_TIMEWAIT0x01000000 | INP_DROPPED0x04000000)) {

←

Taking false branch

→

1407

1408

return (ECONNRESET54);

1409

}

1410

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

1411

1412

* Protect the TCP option TCP_FUNCTION_BLK so

1413

* that a sub-function can *never* overwrite this.

1414

1415

if ((sopt->sopt_dir == SOPT_SET) &&

1416

(sopt->sopt_name == TCP_FUNCTION_BLK8192)) {

1417

1418

error = sooptcopyin(sopt, &fsn, sizeof fsn,

1419

sizeof fsn);

1420

if (error)

1421

return (error);

1422

INP_WLOCK_RECHECK(inp);

1423

if (tp->t_state != TCPS_CLOSED0) {

1424

1425

* The user has advanced the state

1426

* past the initial point, we can't

1427

* switch since we are down the road

1428

* and a new set of functions may

1429

* not be compatibile.

1430

1431

1432

return(EINVAL22);

1433

}

1434

blk = find_and_ref_tcp_functions(&fsn);

1435

if (blk == NULL((void *)0)) {

1436

1437

return (ENOENT2);

1438

}

1439

if (tp->t_fb != blk) {

1440

if (blk->tfb_flags & TCP_FUNC_BEING_REMOVED0x01) {

1441

refcount_release(&blk->tfb_refcnt);

1442

1443

return (ENOENT2);

1444

}

1445

1446

* Release the old refcnt, the

1447

* lookup acquires a ref on the

1448

* new one.

1449

1450

if (tp->t_fb->tfb_tcp_fb_fini)

1451

(*tp->t_fb->tfb_tcp_fb_fini)(tp);

1452

refcount_release(&tp->t_fb->tfb_refcnt);

1453

tp->t_fb = blk;

1454

if (tp->t_fb->tfb_tcp_fb_init) {

1455

(*tp->t_fb->tfb_tcp_fb_init)(tp);

1456

}

1457

}

1458

#ifdef TCP_OFFLOAD1

1459

if (tp->t_flags & TF_TOE0x2000000) {

1460

tcp_offload_ctloutput(tp, sopt->sopt_dir,

1461

sopt->sopt_name);

1462

}

1463

#endif

1464

1465

return (error);

1466

} else if ((sopt->sopt_dir == SOPT_GET) &&

←

Taking true branch

→

1467

(sopt->sopt_name == TCP_FUNCTION_BLK8192)) {

1468

strcpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name);

←

Partial initialization occurs here

→

1469

fsn.pcbcnt = tp->t_fb->tfb_refcnt;

1470

1471

error = sooptcopyout(sopt, &fsn, sizeof fsn);

←

Copies out a struct with a partially unsanitized field

1472

return (error);

1473

}

1474

/* Pass in the INP locked, called must unlock it */

1475

return (tp->t_fb->tfb_tcp_ctloutput(so, sopt, inp, tp));

1476

}

1477

1478

int

1479

tcp_default_ctloutput(struct socket *so, struct sockopt *sopt, struct inpcb *inp, struct tcpcb *tp)

1480

{

1481

int error, opt, optval;

1482

u_int ui;

1483

struct tcp_info ti;

1484

struct cc_algo *algo;

1485

char *pbuf, buf[TCP_CA_NAME_MAX16];

1486

size_t len;

1487

1488

1489

* For TCP_CCALGOOPT forward the control to CC module, for both

1490

* SOPT_SET and SOPT_GET.

1491

1492

switch (sopt->sopt_name) {

1493

case TCP_CCALGOOPT65:

1494

1495

pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK0x0002 | M_ZERO0x0100);

1496

error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,

1497

sopt->sopt_valsize);

1498

if (error) {

1499

free(pbuf, M_TEMP);

1500

return (error);

1501

}

1502

INP_WLOCK_RECHECK_CLEANUP(inp, free(pbuf, M_TEMP));

1503

if (CC_ALGO(tp)((tp)->cc_algo)->ctl_output != NULL((void *)0))

1504

error = CC_ALGO(tp)((tp)->cc_algo)->ctl_output(tp->ccv, sopt, pbuf);

1505

else

1506

error = ENOENT2;

1507

1508

if (error == 0 && sopt->sopt_dir == SOPT_GET)

1509

error = sooptcopyout(sopt, pbuf, sopt->sopt_valsize);

1510

free(pbuf, M_TEMP);

1511

return (error);

1512

}

1513

1514

switch (sopt->sopt_dir) {

1515

case SOPT_SET:

1516

switch (sopt->sopt_name) {

1517

#ifdef TCP_SIGNATURE

1518

case TCP_MD5SIG16:

1519

1520

error = sooptcopyin(sopt, &optval, sizeof optval,

1521

sizeof optval);

1522

if (error)

1523

return (error);

1524

1525

INP_WLOCK_RECHECK(inp);

1526

if (optval > 0)

1527

tp->t_flags |= TF_SIGNATURE0x400000;

1528

else

1529

tp->t_flags &= ~TF_SIGNATURE0x400000;

1530

goto unlock_and_done;

1531

#endif /* TCP_SIGNATURE */

1532

1533

case TCP_NODELAY1:

1534

case TCP_NOOPT8:

1535

1536

error = sooptcopyin(sopt, &optval, sizeof optval,

1537

sizeof optval);

1538

if (error)

1539

return (error);

1540

1541

INP_WLOCK_RECHECK(inp);

1542

switch (sopt->sopt_name) {

1543

case TCP_NODELAY1:

1544

opt = TF_NODELAY0x000004;

1545

break;

1546

case TCP_NOOPT8:

1547

opt = TF_NOOPT0x000008;

1548

break;

1549

default:

1550

opt = 0; /* dead code to fool gcc */

1551

break;

1552

}

1553

1554

if (optval)

1555

tp->t_flags |= opt;

1556

else

1557

tp->t_flags &= ~opt;

1558

unlock_and_done:

1559

#ifdef TCP_OFFLOAD1

1560

if (tp->t_flags & TF_TOE0x2000000) {

1561

tcp_offload_ctloutput(tp, sopt->sopt_dir,

1562

sopt->sopt_name);

1563

}

1564

#endif

1565

1566

break;

1567

1568

case TCP_NOPUSH4:

1569

1570

error = sooptcopyin(sopt, &optval, sizeof optval,

1571

sizeof optval);

1572

if (error)

1573

return (error);

1574

1575

INP_WLOCK_RECHECK(inp);

1576

if (optval)

1577

tp->t_flags |= TF_NOPUSH0x001000;

1578

else if (tp->t_flags & TF_NOPUSH0x001000) {

1579

tp->t_flags &= ~TF_NOPUSH0x001000;

1580

if (TCPS_HAVEESTABLISHED(tp->t_state)((tp->t_state) >= 4))

1581

error = tp->t_fb->tfb_tcp_output(tp);

1582

}

1583

goto unlock_and_done;

1584

1585

case TCP_MAXSEG2:

1586

1587

error = sooptcopyin(sopt, &optval, sizeof optval,

1588

sizeof optval);

1589

if (error)

1590

return (error);

1591

1592

INP_WLOCK_RECHECK(inp);

1593

if (optval > 0 && optval <= tp->t_maxseg &&

1594

optval + 40 >= V_tcp_minmss(tcp_minmss))

1595

tp->t_maxseg = optval;

1596

else

1597

error = EINVAL22;

1598

goto unlock_and_done;

1599

1600

case TCP_INFO32:

1601

1602

error = EINVAL22;

1603

break;

1604

1605

case TCP_CONGESTION64:

1606

1607

error = sooptcopyin(sopt, buf, TCP_CA_NAME_MAX16 - 1, 1);

1608

if (error)

1609

break;

1610

buf[sopt->sopt_valsize] = '\0';

1611

INP_WLOCK_RECHECK(inp);

1612

CC_LIST_RLOCK()__rw_rlock(&((&cc_list_lock))->rw_lock, ((void *)0
), 0);

1613

STAILQ_FOREACH(algo, &cc_list, entries)for((algo) = (((&cc_list))->stqh_first); (algo); (algo
) = (((algo))->entries.stqe_next))

1614

if (strncmp(buf, algo->name,

1615

TCP_CA_NAME_MAX16) == 0)

1616

break;

1617

CC_LIST_RUNLOCK()_rw_runlock_cookie(&((&cc_list_lock))->rw_lock, ((
void *)0), 0);

1618

if (algo == NULL((void *)0)) {

1619

1620

error = EINVAL22;

1621

break;

1622

}

1623

1624

* We hold a write lock over the tcb so it's safe to

1625

* do these things without ordering concerns.

1626

1627

if (CC_ALGO(tp)((tp)->cc_algo)->cb_destroy != NULL((void *)0))

1628

CC_ALGO(tp)((tp)->cc_algo)->cb_destroy(tp->ccv);

1629

CC_ALGO(tp)((tp)->cc_algo) = algo;

1630

1631

* If something goes pear shaped initialising the new

1632

* algo, fall back to newreno (which does not

1633

* require initialisation).

1634

1635

if (algo->cb_init != NULL((void *)0) &&

1636

algo->cb_init(tp->ccv) != 0) {

1637

CC_ALGO(tp)((tp)->cc_algo) = &newreno_cc_algo;

1638

1639

* The only reason init should fail is

1640

* because of malloc.

1641

1642

error = ENOMEM12;

1643

}

1644

1645

break;

1646

1647

case TCP_KEEPIDLE256:

1648

case TCP_KEEPINTVL512:

1649

case TCP_KEEPINIT128:

1650

1651

error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));

1652

if (error)

1653

return (error);

1654

1655

if (ui > (UINT_MAX0xffffffff / hz)) {

1656

error = EINVAL22;

1657

break;

1658

}

1659

ui *= hz;

1660

1661

INP_WLOCK_RECHECK(inp);

1662

switch (sopt->sopt_name) {

1663

case TCP_KEEPIDLE256:

1664

tp->t_keepidle = ui;

1665

1666

* XXX: better check current remaining

1667

* timeout and "merge" it with new value.

1668

1669

if ((tp->t_state > TCPS_LISTEN1) &&

1670

(tp->t_state <= TCPS_CLOSING7))

1671

tcp_timer_activate(tp, TT_KEEP0x0008,

1672

TP_KEEPIDLE(tp)((tp)->t_keepidle ? (tp)->t_keepidle : tcp_keepidle));

1673

break;

1674

case TCP_KEEPINTVL512:

1675

tp->t_keepintvl = ui;

1676

if ((tp->t_state == TCPS_FIN_WAIT_29) &&

1677

(TP_MAXIDLE(tp)(((tp)->t_keepcnt ? (tp)->t_keepcnt : tcp_keepcnt) * ((
tp)->t_keepintvl ? (tp)->t_keepintvl : tcp_keepintvl)) > 0))

1678

tcp_timer_activate(tp, TT_2MSL0x0010,

1679

TP_MAXIDLE(tp)(((tp)->t_keepcnt ? (tp)->t_keepcnt : tcp_keepcnt) * ((
tp)->t_keepintvl ? (tp)->t_keepintvl : tcp_keepintvl)));

1680

break;

1681

case TCP_KEEPINIT128:

1682

tp->t_keepinit = ui;

1683

if (tp->t_state == TCPS_SYN_RECEIVED3 ||

1684

tp->t_state == TCPS_SYN_SENT2)

1685

tcp_timer_activate(tp, TT_KEEP0x0008,

1686

TP_KEEPINIT(tp)((tp)->t_keepinit ? (tp)->t_keepinit : tcp_keepinit));

1687

break;

1688

}

1689

goto unlock_and_done;

1690

1691

case TCP_KEEPCNT1024:

1692

1693

error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));

1694

if (error)

1695

return (error);

1696

1697

INP_WLOCK_RECHECK(inp);

1698

tp->t_keepcnt = ui;

1699

if ((tp->t_state == TCPS_FIN_WAIT_29) &&

1700

(TP_MAXIDLE(tp)(((tp)->t_keepcnt ? (tp)->t_keepcnt : tcp_keepcnt) * ((
tp)->t_keepintvl ? (tp)->t_keepintvl : tcp_keepintvl)) > 0))

1701

tcp_timer_activate(tp, TT_2MSL0x0010,

1702

TP_MAXIDLE(tp)(((tp)->t_keepcnt ? (tp)->t_keepcnt : tcp_keepcnt) * ((
tp)->t_keepintvl ? (tp)->t_keepintvl : tcp_keepintvl)));

1703

goto unlock_and_done;

1704

1705

#ifdef TCPPCAP

1706

case TCP_PCAP_OUT2048:

1707

case TCP_PCAP_IN4096:

1708

1709

error = sooptcopyin(sopt, &optval, sizeof optval,

1710

sizeof optval);

1711

if (error)

1712

return (error);

1713

1714

INP_WLOCK_RECHECK(inp);

1715

if (optval >= 0)

1716

tcp_pcap_set_sock_max(TCP_PCAP_OUT2048 ?

1717

&(tp->t_outpkts) : &(tp->t_inpkts),

1718

optval);

1719

else

1720

error = EINVAL22;

1721

goto unlock_and_done;

1722

#endif

1723

1724

#ifdef TCP_RFC7413

1725

case TCP_FASTOPEN1025:

1726

1727

if (!V_tcp_fastopen_enabled)

1728

return (EPERM1);

1729

1730

error = sooptcopyin(sopt, &optval, sizeof optval,

1731

sizeof optval);

1732

if (error)

1733

return (error);

1734

1735

INP_WLOCK_RECHECK(inp);

1736

if (optval) {

1737

tp->t_flags |= TF_FASTOPEN0x80000000;

1738

if ((tp->t_state == TCPS_LISTEN1) &&

1739

(tp->t_tfo_pending == NULL((void *)0)))

1740

tp->t_tfo_pending =

1741

tcp_fastopen_alloc_counter();

1742

} else

1743

tp->t_flags &= ~TF_FASTOPEN0x80000000;

1744

goto unlock_and_done;

1745

#endif

1746

1747

default:

1748

1749

error = ENOPROTOOPT42;

1750

break;

1751

}

1752

break;

1753

1754

case SOPT_GET:

1755

tp = intotcpcb(inp)((struct tcpcb *)(inp)->inp_ppcb);

1756

switch (sopt->sopt_name) {

1757

#ifdef TCP_SIGNATURE

1758

case TCP_MD5SIG16:

1759

optval = (tp->t_flags & TF_SIGNATURE0x400000) ? 1 : 0;

1760

1761

error = sooptcopyout(sopt, &optval, sizeof optval);

1762

break;

1763

#endif

1764

1765

case TCP_NODELAY1:

1766

optval = tp->t_flags & TF_NODELAY0x000004;

1767

1768

error = sooptcopyout(sopt, &optval, sizeof optval);

1769

break;

1770

case TCP_MAXSEG2:

1771

optval = tp->t_maxseg;

1772

1773

error = sooptcopyout(sopt, &optval, sizeof optval);

1774

break;

1775

case TCP_NOOPT8:

1776

optval = tp->t_flags & TF_NOOPT0x000008;

1777

1778

error = sooptcopyout(sopt, &optval, sizeof optval);

1779

break;

1780

case TCP_NOPUSH4:

1781

optval = tp->t_flags & TF_NOPUSH0x001000;

1782

1783

error = sooptcopyout(sopt, &optval, sizeof optval);

1784

break;

1785

case TCP_INFO32:

1786

tcp_fill_info(tp, &ti);

1787

1788

error = sooptcopyout(sopt, &ti, sizeof ti);

1789

break;

1790

case TCP_CONGESTION64:

1791

len = strlcpy(buf, CC_ALGO(tp)((tp)->cc_algo)->name, TCP_CA_NAME_MAX16);

1792

1793

error = sooptcopyout(sopt, buf, len + 1);

1794

break;

1795

case TCP_KEEPIDLE256:

1796

case TCP_KEEPINTVL512:

1797

case TCP_KEEPINIT128:

1798

case TCP_KEEPCNT1024:

1799

switch (sopt->sopt_name) {

1800

case TCP_KEEPIDLE256:

1801

ui = tp->t_keepidle / hz;

1802

break;

1803

case TCP_KEEPINTVL512:

1804

ui = tp->t_keepintvl / hz;

1805

break;

1806

case TCP_KEEPINIT128:

1807

ui = tp->t_keepinit / hz;

1808

break;

1809

case TCP_KEEPCNT1024:

1810

ui = tp->t_keepcnt;

1811

break;

1812

}

1813

1814

error = sooptcopyout(sopt, &ui, sizeof(ui));

1815

break;

1816

#ifdef TCPPCAP

1817

case TCP_PCAP_OUT2048:

1818

case TCP_PCAP_IN4096:

1819

optval = tcp_pcap_get_sock_max(TCP_PCAP_OUT2048 ?

1820

&(tp->t_outpkts) : &(tp->t_inpkts));

1821

1822

error = sooptcopyout(sopt, &optval, sizeof optval);

1823

break;

1824

#endif

1825

1826

#ifdef TCP_RFC7413

1827

case TCP_FASTOPEN1025:

1828

optval = tp->t_flags & TF_FASTOPEN0x80000000;

1829

1830

error = sooptcopyout(sopt, &optval, sizeof optval);

1831

break;

1832

#endif

1833

default:

1834

1835

error = ENOPROTOOPT42;

1836

break;

1837

}

1838

break;

1839

}

1840

return (error);

1841

}

1842

#undef INP_WLOCK_RECHECK

1843

#undef INP_WLOCK_RECHECK_CLEANUP

1844

1845

1846

* Attach TCP protocol to socket, allocating

1847

* internet protocol control block, tcp control block,

1848

* bufer space, and entering LISTEN state if to accept connections.

1849

1850

static int

1851

tcp_attach(struct socket *so)

1852

{

1853

struct tcpcb *tp;

1854

struct inpcb *inp;

1855

int error;

1856

1857

if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {

1858

error = soreserve(so, V_tcp_sendspace(tcp_sendspace), V_tcp_recvspace(tcp_recvspace));

1859

if (error)

1860

return (error);

1861

}

1862

so->so_rcv.sb_flags |= SB_AUTOSIZE0x800;

1863

so->so_snd.sb_flags |= SB_AUTOSIZE0x800;

1864

INP_INFO_RLOCK(&V_tcbinfo)__rw_rlock(&((&(&(tcbinfo))->ipi_lock))->rw_lock
, ((void *)0), 0);

1865

error = in_pcballoc(so, &V_tcbinfo(tcbinfo));

1866

if (error) {

1867

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

1868

return (error);

1869

}

1870

inp = sotoinpcb(so)((struct inpcb *)(so)->so_pcb);

1871

#ifdef INET61

1872

if (inp->inp_vflag & INP_IPV6PROTO0x4) {

1873

inp->inp_vflag |= INP_IPV60x2;

1874

inp->in6p_hopsinp_depend6.inp6_hops = -1; /* use kernel default */

1875

}

1876

else

1877

#endif

1878

inp->inp_vflag |= INP_IPV40x1;

1879

tp = tcp_newtcpcb(inp);

1880

if (tp == NULL((void *)0)) {

1881

in_pcbdetach(inp);

1882

in_pcbfree(inp);

1883

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

1884

return (ENOBUFS55);

1885

}

1886

tp->t_state = TCPS_CLOSED0;

1887

1888

INP_INFO_RUNLOCK(&V_tcbinfo)_rw_runlock_cookie(&((&(&(tcbinfo))->ipi_lock)
)->rw_lock, ((void *)0), 0);

1889

TCPSTATES_INC(TCPS_CLOSED)counter_u64_add((tcps_states)[0], 1);

1890

return (0);

1891

}

1892

1893

1894

* Initiate (or continue) disconnect.

1895

* If embryonic state, just send reset (once).

1896

* If in ``let data drain'' option and linger null, just drop.

1897

* Otherwise (hard), mark socket disconnecting and drop

1898

* current input data; switch states based on user close, and

1899

* send segment to peer (with FIN).

1900

1901

static void

1902

tcp_disconnect(struct tcpcb *tp)

1903

{

1904

struct inpcb *inp = tp->t_inpcb;

1905

struct socket *so = inp->inp_socket;

1906

1907

INP_INFO_RLOCK_ASSERT(&V_tcbinfo);

1908

INP_WLOCK_ASSERT(inp);

1909

1910

1911

* Neither tcp_close() nor tcp_drop() should return NULL, as the

1912

* socket is still open.

1913

1914

if (tp->t_state < TCPS_ESTABLISHED4) {

1915

tp = tcp_close(tp);

1916

KASSERT(tp != NULL,do { } while (0)

1917

("tcp_disconnect: tcp_close() returned NULL"))do { } while (0);

1918

} else if ((so->so_options & SO_LINGER0x0080) && so->so_linger == 0) {

1919

tp = tcp_drop(tp, 0);

1920

KASSERT(tp != NULL,do { } while (0)

1921

("tcp_disconnect: tcp_drop() returned NULL"))do { } while (0);

1922

} else {

1923

soisdisconnecting(so);

1924

sbflush(&so->so_rcv);

1925

tcp_usrclosed(tp);

1926

if (!(inp->inp_flags & INP_DROPPED0x04000000))

1927

tp->t_fb->tfb_tcp_output(tp);

1928

}

1929

}

1930

1931

1932

* User issued close, and wish to trail through shutdown states:

1933

* if never received SYN, just forget it. If got a SYN from peer,

1934

* but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN.

1935

* If already got a FIN from peer, then almost done; go to LAST_ACK

1936

* state. In all other cases, have already sent FIN to peer (e.g.

1937

* after PRU_SHUTDOWN), and just have to play tedious game waiting

1938

* for peer to send FIN or not respond to keep-alives, etc.

1939

* We can let the user exit from the close as soon as the FIN is acked.

1940

1941

static void

1942

tcp_usrclosed(struct tcpcb *tp)

1943

{

1944

1945

INP_INFO_RLOCK_ASSERT(&V_tcbinfo);

1946

INP_WLOCK_ASSERT(tp->t_inpcb);

1947

1948

switch (tp->t_state) {

1949

case TCPS_LISTEN1:

1950

#ifdef TCP_OFFLOAD1

1951

tcp_offload_listen_stop(tp);

1952

#endif

1953

tcp_state_change(tp, TCPS_CLOSED0);

1954

/* FALLTHROUGH */

1955

case TCPS_CLOSED0:

1956

tp = tcp_close(tp);

1957

1958

* tcp_close() should never return NULL here as the socket is

1959

* still open.

1960

1961

KASSERT(tp != NULL,do { } while (0)

1962

("tcp_usrclosed: tcp_close() returned NULL"))do { } while (0);

1963

break;

1964

1965

case TCPS_SYN_SENT2:

1966

case TCPS_SYN_RECEIVED3:

1967

tp->t_flags |= TF_NEEDFIN0x000800;

1968

break;

1969

1970

case TCPS_ESTABLISHED4:

1971

tcp_state_change(tp, TCPS_FIN_WAIT_16);

1972

break;

1973

1974

case TCPS_CLOSE_WAIT5:

1975

tcp_state_change(tp, TCPS_LAST_ACK8);

1976

break;

1977

}

1978

if (tp->t_state >= TCPS_FIN_WAIT_29) {

1979

soisdisconnected(tp->t_inpcb->inp_socket);

1980

/* Prevent the connection hanging in FIN_WAIT_2 forever. */

1981

if (tp->t_state == TCPS_FIN_WAIT_29) {

1982

int timeout;

1983

1984

timeout = (tcp_fast_finwait2_recycle) ?

1985

tcp_finwait2_timeout : TP_MAXIDLE(tp)(((tp)->t_keepcnt ? (tp)->t_keepcnt : tcp_keepcnt) * ((
tp)->t_keepintvl ? (tp)->t_keepintvl : tcp_keepintvl));

1986

tcp_timer_activate(tp, TT_2MSL0x0010, timeout);

1987

}

1988

}

1989

}

1990

1991

#ifdef DDB

1992

static void

1993

db_print_indent(int indent)

1994

{

1995

int i;

1996

1997

for (i = 0; i < indent; i++)

1998

db_printf(" ");

1999

}

2000

2001

static void

2002

db_print_tstate(int t_state)

2003

{

2004

2005

switch (t_state) {

2006

case TCPS_CLOSED0:

2007

db_printf("TCPS_CLOSED");

2008

return;

2009

2010

case TCPS_LISTEN1:

2011

db_printf("TCPS_LISTEN");

2012

return;

2013

2014

case TCPS_SYN_SENT2:

2015

db_printf("TCPS_SYN_SENT");

2016

return;

2017

2018

case TCPS_SYN_RECEIVED3:

2019

db_printf("TCPS_SYN_RECEIVED");

2020

return;

2021

2022

case TCPS_ESTABLISHED4:

2023

db_printf("TCPS_ESTABLISHED");

2024

return;

2025

2026

case TCPS_CLOSE_WAIT5:

2027

db_printf("TCPS_CLOSE_WAIT");

2028

return;

2029

2030

case TCPS_FIN_WAIT_16:

2031

db_printf("TCPS_FIN_WAIT_1");

2032

return;

2033

2034

case TCPS_CLOSING7:

2035

db_printf("TCPS_CLOSING");

2036

return;

2037

2038

case TCPS_LAST_ACK8:

2039

db_printf("TCPS_LAST_ACK");

2040

return;

2041

2042

case TCPS_FIN_WAIT_29:

2043

db_printf("TCPS_FIN_WAIT_2");

2044

return;

2045

2046

case TCPS_TIME_WAIT10:

2047

db_printf("TCPS_TIME_WAIT");

2048

return;

2049

2050

default:

2051

db_printf("unknown");

2052

return;

2053

}

2054

}

2055

2056

static void

2057

db_print_tflags(u_int t_flags)

2058

{

2059

int comma;

2060

2061

comma = 0;

2062

if (t_flags & TF_ACKNOW0x000001) {

2063

db_printf("%sTF_ACKNOW", comma ? ", " : "");

2064

comma = 1;

2065

}

2066

if (t_flags & TF_DELACK0x000002) {

2067

db_printf("%sTF_DELACK", comma ? ", " : "");

2068

comma = 1;

2069

}

2070

if (t_flags & TF_NODELAY0x000004) {

2071

db_printf("%sTF_NODELAY", comma ? ", " : "");

2072

comma = 1;

2073

}

2074

if (t_flags & TF_NOOPT0x000008) {

2075

db_printf("%sTF_NOOPT", comma ? ", " : "");

2076

comma = 1;

2077

}

2078

if (t_flags & TF_SENTFIN0x000010) {

2079

db_printf("%sTF_SENTFIN", comma ? ", " : "");

2080

comma = 1;

2081

}

2082

if (t_flags & TF_REQ_SCALE0x000020) {

2083

db_printf("%sTF_REQ_SCALE", comma ? ", " : "");

2084

comma = 1;

2085

}

2086

if (t_flags & TF_RCVD_SCALE0x000040) {

2087

db_printf("%sTF_RECVD_SCALE", comma ? ", " : "");

2088

comma = 1;

2089

}

2090

if (t_flags & TF_REQ_TSTMP0x000080) {

2091

db_printf("%sTF_REQ_TSTMP", comma ? ", " : "");

2092

comma = 1;

2093

}

2094

if (t_flags & TF_RCVD_TSTMP0x000100) {

2095

db_printf("%sTF_RCVD_TSTMP", comma ? ", " : "");

2096

comma = 1;

2097

}

2098

if (t_flags & TF_SACK_PERMIT0x000200) {

2099

db_printf("%sTF_SACK_PERMIT", comma ? ", " : "");

2100

comma = 1;

2101

}

2102

if (t_flags & TF_NEEDSYN0x000400) {

2103

db_printf("%sTF_NEEDSYN", comma ? ", " : "");

2104

comma = 1;

2105

}

2106

if (t_flags & TF_NEEDFIN0x000800) {

2107

db_printf("%sTF_NEEDFIN", comma ? ", " : "");

2108

comma = 1;

2109

}

2110

if (t_flags & TF_NOPUSH0x001000) {

2111

db_printf("%sTF_NOPUSH", comma ? ", " : "");

2112

comma = 1;

2113

}

2114

if (t_flags & TF_MORETOCOME0x010000) {

2115

db_printf("%sTF_MORETOCOME", comma ? ", " : "");

2116

comma = 1;

2117

}

2118

if (t_flags & TF_LQ_OVERFLOW0x020000) {

2119

db_printf("%sTF_LQ_OVERFLOW", comma ? ", " : "");

2120

comma = 1;

2121

}

2122

if (t_flags & TF_LASTIDLE0x040000) {

2123

db_printf("%sTF_LASTIDLE", comma ? ", " : "");

2124

comma = 1;

2125

}

2126

if (t_flags & TF_RXWIN0SENT0x080000) {

2127

db_printf("%sTF_RXWIN0SENT", comma ? ", " : "");

2128

comma = 1;

2129

}

2130

if (t_flags & TF_FASTRECOVERY0x100000) {

2131

db_printf("%sTF_FASTRECOVERY", comma ? ", " : "");

2132

comma = 1;

2133

}

2134

if (t_flags & TF_CONGRECOVERY0x20000000) {

2135

db_printf("%sTF_CONGRECOVERY", comma ? ", " : "");

2136

comma = 1;

2137

}

2138

if (t_flags & TF_WASFRECOVERY0x200000) {

2139

db_printf("%sTF_WASFRECOVERY", comma ? ", " : "");

2140

comma = 1;

2141

}

2142

if (t_flags & TF_SIGNATURE0x400000) {

2143

db_printf("%sTF_SIGNATURE", comma ? ", " : "");

2144

comma = 1;

2145

}

2146

if (t_flags & TF_FORCEDATA0x800000) {

2147

db_printf("%sTF_FORCEDATA", comma ? ", " : "");

2148

comma = 1;

2149

}

2150

if (t_flags & TF_TSO0x1000000) {

2151

db_printf("%sTF_TSO", comma ? ", " : "");

2152

comma = 1;

2153

}

2154

if (t_flags & TF_ECN_PERMIT0x4000000) {

2155

db_printf("%sTF_ECN_PERMIT", comma ? ", " : "");

2156

comma = 1;

2157

}

2158

if (t_flags & TF_FASTOPEN0x80000000) {

2159

db_printf("%sTF_FASTOPEN", comma ? ", " : "");

2160

comma = 1;

2161

}

2162

}

2163

2164

static void

2165

db_print_toobflags(char t_oobflags)

2166

{

2167

int comma;

2168

2169

comma = 0;

2170

if (t_oobflags & TCPOOB_HAVEDATA0x01) {

2171

db_printf("%sTCPOOB_HAVEDATA", comma ? ", " : "");

2172

comma = 1;

2173

}

2174

if (t_oobflags & TCPOOB_HADDATA0x02) {

2175

db_printf("%sTCPOOB_HADDATA", comma ? ", " : "");

2176

comma = 1;

2177

}

2178

}

2179

2180

static void

2181

db_print_tcpcb(struct tcpcb *tp, const char *name, int indent)

2182

{

2183

2184

db_print_indent(indent);

2185

db_printf("%s at %p\n", name, tp);

2186

2187

indent += 2;

2188

2189

db_print_indent(indent);

2190

db_printf("t_segq first: %p t_segqlen: %d t_dupacks: %d\n",

2191

LIST_FIRST(&tp->t_segq)((&tp->t_segq)->lh_first), tp->t_segqlen, tp->t_dupacks);

2192

2193

db_print_indent(indent);

2194

db_printf("tt_rexmt: %p tt_persist: %p tt_keep: %p\n",

2195

&tp->t_timers->tt_rexmt, &tp->t_timers->tt_persist, &tp->t_timers->tt_keep);

2196

2197

db_print_indent(indent);

2198

db_printf("tt_2msl: %p tt_delack: %p t_inpcb: %p\n", &tp->t_timers->tt_2msl,

2199

&tp->t_timers->tt_delack, tp->t_inpcb);

2200

2201

db_print_indent(indent);

2202

db_printf("t_state: %d (", tp->t_state);

2203

db_print_tstate(tp->t_state);

2204

db_printf(")\n");

2205

2206

db_print_indent(indent);

2207

db_printf("t_flags: 0x%x (", tp->t_flags);

2208

db_print_tflags(tp->t_flags);

2209

db_printf(")\n");

2210

2211

db_print_indent(indent);

2212

db_printf("snd_una: 0x%08x snd_max: 0x%08x snd_nxt: x0%08x\n",

2213

tp->snd_una, tp->snd_max, tp->snd_nxt);

2214

2215

db_print_indent(indent);

2216

db_printf("snd_up: 0x%08x snd_wl1: 0x%08x snd_wl2: 0x%08x\n",

2217

tp->snd_up, tp->snd_wl1, tp->snd_wl2);

2218

2219

db_print_indent(indent);

2220

db_printf("iss: 0x%08x irs: 0x%08x rcv_nxt: 0x%08x\n",

2221

tp->iss, tp->irs, tp->rcv_nxt);

2222

2223

db_print_indent(indent);

2224

db_printf("rcv_adv: 0x%08x rcv_wnd: %lu rcv_up: 0x%08x\n",

2225

tp->rcv_adv, tp->rcv_wnd, tp->rcv_up);

2226

2227

db_print_indent(indent);

2228

db_printf("snd_wnd: %lu snd_cwnd: %lu\n",

2229

tp->snd_wnd, tp->snd_cwnd);

2230

2231

db_print_indent(indent);

2232

db_printf("snd_ssthresh: %lu snd_recover: "

2233

"0x%08x\n", tp->snd_ssthresh, tp->snd_recover);

2234

2235

db_print_indent(indent);

2236

db_printf("t_rcvtime: %u t_startime: %u\n",

2237

tp->t_rcvtime, tp->t_starttime);

2238

2239

db_print_indent(indent);

2240

db_printf("t_rttime: %u t_rtsq: 0x%08x\n",

2241

tp->t_rtttime, tp->t_rtseq);

2242

2243

db_print_indent(indent);

2244

db_printf("t_rxtcur: %d t_maxseg: %u t_srtt: %d\n",

2245

tp->t_rxtcur, tp->t_maxseg, tp->t_srtt);

2246

2247

db_print_indent(indent);

2248

db_printf("t_rttvar: %d t_rxtshift: %d t_rttmin: %u "

2249

"t_rttbest: %u\n", tp->t_rttvar, tp->t_rxtshift, tp->t_rttmin,

2250

tp->t_rttbest);

2251

2252

db_print_indent(indent);

2253

db_printf("t_rttupdated: %lu max_sndwnd: %lu t_softerror: %d\n",

2254

tp->t_rttupdated, tp->max_sndwnd, tp->t_softerror);

2255

2256

db_print_indent(indent);

2257

db_printf("t_oobflags: 0x%x (", tp->t_oobflags);

2258

db_print_toobflags(tp->t_oobflags);

2259

db_printf(") t_iobc: 0x%02x\n", tp->t_iobc);

2260

2261

db_print_indent(indent);

2262

db_printf("snd_scale: %u rcv_scale: %u request_r_scale: %u\n",

2263

tp->snd_scale, tp->rcv_scale, tp->request_r_scale);

2264

2265

db_print_indent(indent);

2266

db_printf("ts_recent: %u ts_recent_age: %u\n",

2267

tp->ts_recent, tp->ts_recent_age);

2268

2269

db_print_indent(indent);

2270

db_printf("ts_offset: %u last_ack_sent: 0x%08x snd_cwnd_prev: "

2271

"%lu\n", tp->ts_offset, tp->last_ack_sent, tp->snd_cwnd_prev);

2272

2273

db_print_indent(indent);

2274

db_printf("snd_ssthresh_prev: %lu snd_recover_prev: 0x%08x "

2275

"t_badrxtwin: %u\n", tp->snd_ssthresh_prev,

2276

tp->snd_recover_prev, tp->t_badrxtwin);

2277

2278

db_print_indent(indent);

2279

db_printf("snd_numholes: %d snd_holes first: %p\n",

2280

tp->snd_numholes, TAILQ_FIRST(&tp->snd_holes)((&tp->snd_holes)->tqh_first));

2281

2282

db_print_indent(indent);

2283

db_printf("snd_fack: 0x%08x rcv_numsacks: %d sack_newdata: "

2284

"0x%08x\n", tp->snd_fack, tp->rcv_numsacks, tp->sack_newdata);

2285

2286

/* Skip sackblks, sackhint. */

2287

2288

db_print_indent(indent);

2289

db_printf("t_rttlow: %d rfbuf_ts: %u rfbuf_cnt: %d\n",

2290

tp->t_rttlow, tp->rfbuf_ts, tp->rfbuf_cnt);

2291

}

2292

2293

DB_SHOW_COMMAND(tcpcb, db_show_tcpcb)

2294

{

2295

struct tcpcb *tp;

2296

2297

if (!have_addr) {

2298

db_printf("usage: show tcpcb <addr>\n");

2299

return;

2300

}

2301

tp = (struct tcpcb *)addr;

2302

2303

db_print_tcpcb(tp, "tcpcb", 0);

2304

}

2305

#endif