Partial MFC r316676 and the required r313045

MFC r316676:

Use estimated RTT for receive buffer auto resizing instead of timestamps.
This is a partial MFC as stable/10 doesn't include the TCP stack
modularisation.

MFC r313045:

Add an mbuf to ipinfo_t translator to finish cleanup of mbuf passing to TCP
probes. This is a partial MFC (missing debug__output & debug__drop changes)
due to the massive amount of additional dtrace changes that would be
required for a full MFC.

Relnotes: Yes
Sponsored by: Multiplay

MFC r306766:
Remove declaration of un-defined function tcp_seq_subtract().

MFC: r292003
Improve tcp duplicate ack processing when SACK is present.

MFC: r290122
Calculate the correct amount of bytes that are in-flight for a connection as
suggested by RFC 6675.

MFC: r292046
r290122 added 4 bytes and removed 8 in struct sackhint. Add a pad entry of 4
bytes to restore the size.

MFC r292706:

Implementation of server-side TCP Fast Open (TFO) [RFC7413].

TFO is disabled by default in the kernel build. See the top comment
in sys/netinet/tcp_fastopen.c for implementation particulars.

Differential Revision: https://reviews.freebsd.org/D4350
Sponsored by: Verisign, Inc.

Fix patch(1) shell injection vulnerability. [SA-15:14]

Fix resource exhaustion in TCP reassembly. [SA-15:15]

Fix OpenSSH multiple vulnerabilities. [SA-15:16]

MFC: r280904, r280990, r281599

r280904:
Use appropriate timeout_t* instead of void* in tcp_timer_activate()

Suggested by: imp
Differential Revision: https://reviews.freebsd.org/D2154
Reviewed by: imp, jhb
Approved by: jhb

r280990:
Provide better debugging information in tcp_timer_activate() and
tcp_timer_active()

Differential Revision: https://reviews.freebsd.org/D2179
Suggested by: bz
Reviewed by: jhb
Approved by: jhb

r281599:
Fix an old and well-documented use-after-free race condition in
TCP timers:
- Add a reference from tcpcb to its inpcb
- Defer tcpcb deletion until TCP timers have finished

Differential Revision: https://reviews.freebsd.org/D2079
Submitted by: jch, Marc De La Gueronniere <mdelagueronniere@verisign.com>
Reviewed by: imp, rrs, adrian, jhb, bz
Approved by: jhb
Sponsored by: Verisign, Inc.

MFC r264321, r264342, r264351, r264356, r273850, r274629:

Currently, the TCP slow timer can starve TCP input processing while it
walks the list of connections in TIME_WAIT closing expired connections
due to contention on the global TCP pcbinfo lock.

To remediate, introduce a new global lock to protect the list of
connections in TIME_WAIT. Only acquire the TCP pcbinfo lock when
closing an expired connection. This limits the window of time when
TCP input processing is stopped to the amount of time needed to close
a single connection.

Approved by: jhb (mentor)

MFC r271946 and r272595:
Improve transmit sending offload, TSO, algorithm in general. This
change allows all HCAs from Mellanox Technologies to function properly
when TSO is enabled. See r271946 and r272595 for more details about
this commit.

Sponsored by: Mellanox Technologies

MFC r272720, 273061, 273062, 273063, 273064

Implement PLPMTUD blackhole detection (RFC 4821), inspired by code
from xnu sources. If we encounter a network where ICMP is blocked
the Needs Frag indicator may not propagate back to us. Attempt to
downshift the mss once to a preconfigured value.

Note, this is turned off by default.

MFC r266618:

Make tcp_twrespond() file local private; this removes it from the
public KPI; it is not used anywhere else and seems it never was.

MFC r266596:

Move the tcp_fields_to_host() and tcp_fields_to_net() (inline)
functions to the tcp_var.h header file in order to avoid further
duplication with upcoming commits.

Reviewed by: np

Fix patch(1) shell injection vulnerability. [SA-15:14]

Fix resource exhaustion in TCP reassembly. [SA-15:15]

Fix OpenSSH multiple vulnerabilities. [SA-15:16]

MFC: r280904, r280990, r281599

r280904:
Use appropriate timeout_t* instead of void* in tcp_timer_activate()

Suggested by: imp
Differential Revision: https://reviews.freebsd.org/D2154
Reviewed by: imp, jhb
Approved by: jhb

r280990:
Provide better debugging information in tcp_timer_activate() and
tcp_timer_active()

Differential Revision: https://reviews.freebsd.org/D2179
Suggested by: bz
Reviewed by: jhb
Approved by: jhb

r281599:
Fix an old and well-documented use-after-free race condition in
TCP timers:
- Add a reference from tcpcb to its inpcb
- Defer tcpcb deletion until TCP timers have finished

Differential Revision: https://reviews.freebsd.org/D2079
Submitted by: jch, Marc De La Gueronniere <mdelagueronniere@verisign.com>
Reviewed by: imp, rrs, adrian, jhb, bz
Approved by: jhb
Sponsored by: Verisign, Inc.

MFC r264321, r264342, r264351, r264356, r273850, r274629:

Currently, the TCP slow timer can starve TCP input processing while it
walks the list of connections in TIME_WAIT closing expired connections
due to contention on the global TCP pcbinfo lock.

To remediate, introduce a new global lock to protect the list of
connections in TIME_WAIT. Only acquire the TCP pcbinfo lock when
closing an expired connection. This limits the window of time when
TCP input processing is stopped to the amount of time needed to close
a single connection.

Approved by: jhb (mentor)

MFC r271946 and r272595:
Improve transmit sending offload, TSO, algorithm in general. This
change allows all HCAs from Mellanox Technologies to function properly
when TSO is enabled. See r271946 and r272595 for more details about
this commit.

Sponsored by: Mellanox Technologies

MFC r272720, 273061, 273062, 273063, 273064

Implement PLPMTUD blackhole detection (RFC 4821), inspired by code
from xnu sources. If we encounter a network where ICMP is blocked
the Needs Frag indicator may not propagate back to us. Attempt to
downshift the mss once to a preconfigured value.

Note, this is turned off by default.

MFC r266618:

Make tcp_twrespond() file local private; this removes it from the
public KPI; it is not used anywhere else and seems it never was.

MFC r266596:

Move the tcp_fields_to_host() and tcp_fields_to_net() (inline)
functions to the tcp_var.h header file in order to avoid further
duplication with upcoming commits.

Reviewed by: np