net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65 #include <net/tcp_memcontrol.h>
  66
  67 #include <asm/uaccess.h>
  68
  69 #include <linux/proc_fs.h>
  70 #include <linux/seq_file.h>
  71
  72 #include <linux/crypto.h>
  73 #include <linux/scatterlist.h>
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  77                                       struct request_sock *req);
  78
  79 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  80
  81 static const struct inet_connection_sock_af_ops ipv6_mapped;
  82 static const struct inet_connection_sock_af_ops ipv6_specific;
  83 #ifdef CONFIG_TCP_MD5SIG
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  85 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  86 #else
  87 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  88                                                    const struct in6_addr *addr)
  89 {
  90         return NULL;
  91 }
  92 #endif
  93
  94 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  95 {
  96         struct dst_entry *dst = skb_dst(skb);
  97         const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99         dst_hold(dst);
 100         sk->sk_rx_dst = dst;
 101         inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102         if (rt->rt6i_node)
 103                 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 104 }
 105
 106 static void tcp_v6_hash(struct sock *sk)
 107 {
 108         if (sk->sk_state != TCP_CLOSE) {
 109                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 110                         tcp_prot.hash(sk);
 111                         return;
 112                 }
 113                 local_bh_disable();
 114                 __inet6_hash(sk, NULL);
 115                 local_bh_enable();
 116         }
 117 }
 118
 119 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 120 {
 121         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 122                                             ipv6_hdr(skb)->saddr.s6_addr32,
 123                                             tcp_hdr(skb)->dest,
 124                                             tcp_hdr(skb)->source);
 125 }
 126
 127 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 128                           int addr_len)
 129 {
 130         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 131         struct inet_sock *inet = inet_sk(sk);
 132         struct inet_connection_sock *icsk = inet_csk(sk);
 133         struct ipv6_pinfo *np = inet6_sk(sk);
 134         struct tcp_sock *tp = tcp_sk(sk);
 135         struct in6_addr *saddr = NULL, *final_p, final;
 136         struct rt6_info *rt;
 137         struct flowi6 fl6;
 138         struct dst_entry *dst;
 139         int addr_type;
 140         int err;
 141
 142         if (addr_len < SIN6_LEN_RFC2133)
 143                 return -EINVAL;
 144
 145         if (usin->sin6_family != AF_INET6)
 146                 return -EAFNOSUPPORT;
 147
 148         memset(&fl6, 0, sizeof(fl6));
 149
 150         if (np->sndflow) {
 151                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 152                 IP6_ECN_flow_init(fl6.flowlabel);
 153                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 154                         struct ip6_flowlabel *flowlabel;
 155                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 156                         if (flowlabel == NULL)
 157                                 return -EINVAL;
 158                         usin->sin6_addr = flowlabel->dst;
 159                         fl6_sock_release(flowlabel);
 160                 }
 161         }
 162
 163         /*
 164          *      connect() to INADDR_ANY means loopback (BSD'ism).
 165          */
 166
 167         if(ipv6_addr_any(&usin->sin6_addr))
 168                 usin->sin6_addr.s6_addr[15] = 0x1;
 169
 170         addr_type = ipv6_addr_type(&usin->sin6_addr);
 171
 172         if(addr_type & IPV6_ADDR_MULTICAST)
 173                 return -ENETUNREACH;
 174
 175         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 176                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 177                     usin->sin6_scope_id) {
 178                         /* If interface is set while binding, indices
 179                          * must coincide.
 180                          */
 181                         if (sk->sk_bound_dev_if &&
 182                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 183                                 return -EINVAL;
 184
 185                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 186                 }
 187
 188                 /* Connect to link-local address requires an interface */
 189                 if (!sk->sk_bound_dev_if)
 190                         return -EINVAL;
 191         }
 192
 193         if (tp->rx_opt.ts_recent_stamp &&
 194             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 195                 tp->rx_opt.ts_recent = 0;
 196                 tp->rx_opt.ts_recent_stamp = 0;
 197                 tp->write_seq = 0;
 198         }
 199
 200         np->daddr = usin->sin6_addr;
 201         np->flow_label = fl6.flowlabel;
 202
 203         /*
 204          *      TCP over IPv4
 205          */
 206
 207         if (addr_type == IPV6_ADDR_MAPPED) {
 208                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 209                 struct sockaddr_in sin;
 210
 211                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 212
 213                 if (__ipv6_only_sock(sk))
 214                         return -ENETUNREACH;
 215
 216                 sin.sin_family = AF_INET;
 217                 sin.sin_port = usin->sin6_port;
 218                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 219
 220                 icsk->icsk_af_ops = &ipv6_mapped;
 221                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 224 #endif
 225
 226                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 227
 228                 if (err) {
 229                         icsk->icsk_ext_hdr_len = exthdrlen;
 230                         icsk->icsk_af_ops = &ipv6_specific;
 231                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 232 #ifdef CONFIG_TCP_MD5SIG
 233                         tp->af_specific = &tcp_sock_ipv6_specific;
 234 #endif
 235                         goto failure;
 236                 } else {
 237                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 238                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 239                                                &np->rcv_saddr);
 240                 }
 241
 242                 return err;
 243         }
 244
 245         if (!ipv6_addr_any(&np->rcv_saddr))
 246                 saddr = &np->rcv_saddr;
 247
 248         fl6.flowi6_proto = IPPROTO_TCP;
 249         fl6.daddr = np->daddr;
 250         fl6.saddr = saddr ? *saddr : np->saddr;
 251         fl6.flowi6_oif = sk->sk_bound_dev_if;
 252         fl6.flowi6_mark = sk->sk_mark;
 253         fl6.fl6_dport = usin->sin6_port;
 254         fl6.fl6_sport = inet->inet_sport;
 255
 256         final_p = fl6_update_dst(&fl6, np->opt, &final);
 257
 258         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 259
 260         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 261         if (IS_ERR(dst)) {
 262                 err = PTR_ERR(dst);
 263                 goto failure;
 264         }
 265
 266         if (saddr == NULL) {
 267                 saddr = &fl6.saddr;
 268                 np->rcv_saddr = *saddr;
 269         }
 270
 271         /* set the source address */
 272         np->saddr = *saddr;
 273         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 274
 275         sk->sk_gso_type = SKB_GSO_TCPV6;
 276         __ip6_dst_store(sk, dst, NULL, NULL);
 277
 278         rt = (struct rt6_info *) dst;
 279         if (tcp_death_row.sysctl_tw_recycle &&
 280             !tp->rx_opt.ts_recent_stamp &&
 281             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr))
 282                 tcp_fetch_timewait_stamp(sk, dst);
 283
 284         icsk->icsk_ext_hdr_len = 0;
 285         if (np->opt)
 286                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 287                                           np->opt->opt_nflen);
 288
 289         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 290
 291         inet->inet_dport = usin->sin6_port;
 292
 293         tcp_set_state(sk, TCP_SYN_SENT);
 294         err = inet6_hash_connect(&tcp_death_row, sk);
 295         if (err)
 296                 goto late_failure;
 297
 298         if (!tp->write_seq && likely(!tp->repair))
 299                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 300                                                              np->daddr.s6_addr32,
 301                                                              inet->inet_sport,
 302                                                              inet->inet_dport);
 303
 304         err = tcp_connect(sk);
 305         if (err)
 306                 goto late_failure;
 307
 308         return 0;
 309
 310 late_failure:
 311         tcp_set_state(sk, TCP_CLOSE);
 312         __sk_dst_reset(sk);
 313 failure:
 314         inet->inet_dport = 0;
 315         sk->sk_route_caps = 0;
 316         return err;
 317 }
 318
 319 static void tcp_v6_mtu_reduced(struct sock *sk)
 320 {
 321         struct dst_entry *dst;
 322
 323         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 324                 return;
 325
 326         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 327         if (!dst)
 328                 return;
 329
 330         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 331                 tcp_sync_mss(sk, dst_mtu(dst));
 332                 tcp_simple_retransmit(sk);
 333         }
 334 }
 335
 336 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 337                 u8 type, u8 code, int offset, __be32 info)
 338 {
 339         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 340         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 341         struct ipv6_pinfo *np;
 342         struct sock *sk;
 343         int err;
 344         struct tcp_sock *tp;
 345         __u32 seq;
 346         struct net *net = dev_net(skb->dev);
 347
 348         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 349                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 350
 351         if (sk == NULL) {
 352                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 353                                    ICMP6_MIB_INERRORS);
 354                 return;
 355         }
 356
 357         if (sk->sk_state == TCP_TIME_WAIT) {
 358                 inet_twsk_put(inet_twsk(sk));
 359                 return;
 360         }
 361
 362         bh_lock_sock(sk);
 363         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 364                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 365
 366         if (sk->sk_state == TCP_CLOSE)
 367                 goto out;
 368
 369         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 370                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 371                 goto out;
 372         }
 373
 374         tp = tcp_sk(sk);
 375         seq = ntohl(th->seq);
 376         if (sk->sk_state != TCP_LISTEN &&
 377             !between(seq, tp->snd_una, tp->snd_nxt)) {
 378                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 379                 goto out;
 380         }
 381
 382         np = inet6_sk(sk);
 383
 384         if (type == NDISC_REDIRECT) {
 385                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 386
 387                 if (dst)
 388                         dst->ops->redirect(dst, sk, skb);
 389         }
 390
 391         if (type == ICMPV6_PKT_TOOBIG) {
 392                 tp->mtu_info = ntohl(info);
 393                 if (!sock_owned_by_user(sk))
 394                         tcp_v6_mtu_reduced(sk);
 395                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 396                                            &tp->tsq_flags))
 397                         sock_hold(sk);
 398                 goto out;
 399         }
 400
 401         icmpv6_err_convert(type, code, &err);
 402
 403         /* Might be for an request_sock */
 404         switch (sk->sk_state) {
 405                 struct request_sock *req, **prev;
 406         case TCP_LISTEN:
 407                 if (sock_owned_by_user(sk))
 408                         goto out;
 409
 410                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 411                                            &hdr->saddr, inet6_iif(skb));
 412                 if (!req)
 413                         goto out;
 414
 415                 /* ICMPs are not backlogged, hence we cannot get
 416                  * an established socket here.
 417                  */
 418                 WARN_ON(req->sk != NULL);
 419
 420                 if (seq != tcp_rsk(req)->snt_isn) {
 421                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 422                         goto out;
 423                 }
 424
 425                 inet_csk_reqsk_queue_drop(sk, req, prev);
 426                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 427                 goto out;
 428
 429         case TCP_SYN_SENT:
 430         case TCP_SYN_RECV:  /* Cannot happen.
 431                                It can, it SYNs are crossed. --ANK */
 432                 if (!sock_owned_by_user(sk)) {
 433                         sk->sk_err = err;
 434                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 435
 436                         tcp_done(sk);
 437                 } else
 438                         sk->sk_err_soft = err;
 439                 goto out;
 440         }
 441
 442         if (!sock_owned_by_user(sk) && np->recverr) {
 443                 sk->sk_err = err;
 444                 sk->sk_error_report(sk);
 445         } else
 446                 sk->sk_err_soft = err;
 447
 448 out:
 449         bh_unlock_sock(sk);
 450         sock_put(sk);
 451 }
 452
 453
 454 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 455                               struct flowi6 *fl6,
 456                               struct request_sock *req,
 457                               struct request_values *rvp,
 458                               u16 queue_mapping)
 459 {
 460         struct inet6_request_sock *treq = inet6_rsk(req);
 461         struct ipv6_pinfo *np = inet6_sk(sk);
 462         struct sk_buff * skb;
 463         int err = -ENOMEM;
 464
 465         /* First, grab a route. */
 466         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 467                 goto done;
 468
 469         skb = tcp_make_synack(sk, dst, req, rvp, NULL);
 470
 471         if (skb) {
 472                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 473
 474                 fl6->daddr = treq->rmt_addr;
 475                 skb_set_queue_mapping(skb, queue_mapping);
 476                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 477                 err = net_xmit_eval(err);
 478         }
 479
 480 done:
 481         return err;
 482 }
 483
 484 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 485                              struct request_values *rvp)
 486 {
 487         struct flowi6 fl6;
 488         int res;
 489
 490         res = tcp_v6_send_synack(sk, NULL, &fl6, req, rvp, 0);
 491         if (!res)
 492                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 493         return res;
 494 }
 495
 496 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 497 {
 498         kfree_skb(inet6_rsk(req)->pktopts);
 499 }
 500
 501 #ifdef CONFIG_TCP_MD5SIG
 502 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 503                                                    const struct in6_addr *addr)
 504 {
 505         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 506 }
 507
 508 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 509                                                 struct sock *addr_sk)
 510 {
 511         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 512 }
 513
 514 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 515                                                       struct request_sock *req)
 516 {
 517         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 518 }
 519
 520 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 521                                   int optlen)
 522 {
 523         struct tcp_md5sig cmd;
 524         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 525
 526         if (optlen < sizeof(cmd))
 527                 return -EINVAL;
 528
 529         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 530                 return -EFAULT;
 531
 532         if (sin6->sin6_family != AF_INET6)
 533                 return -EINVAL;
 534
 535         if (!cmd.tcpm_keylen) {
 536                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 537                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 538                                               AF_INET);
 539                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 540                                       AF_INET6);
 541         }
 542
 543         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 544                 return -EINVAL;
 545
 546         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 547                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 548                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 549
 550         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 551                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 552 }
 553
 554 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 555                                         const struct in6_addr *daddr,
 556                                         const struct in6_addr *saddr, int nbytes)
 557 {
 558         struct tcp6_pseudohdr *bp;
 559         struct scatterlist sg;
 560
 561         bp = &hp->md5_blk.ip6;
 562         /* 1. TCP pseudo-header (RFC2460) */
 563         bp->saddr = *saddr;
 564         bp->daddr = *daddr;
 565         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 566         bp->len = cpu_to_be32(nbytes);
 567
 568         sg_init_one(&sg, bp, sizeof(*bp));
 569         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 570 }
 571
 572 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 573                                const struct in6_addr *daddr, struct in6_addr *saddr,
 574                                const struct tcphdr *th)
 575 {
 576         struct tcp_md5sig_pool *hp;
 577         struct hash_desc *desc;
 578
 579         hp = tcp_get_md5sig_pool();
 580         if (!hp)
 581                 goto clear_hash_noput;
 582         desc = &hp->md5_desc;
 583
 584         if (crypto_hash_init(desc))
 585                 goto clear_hash;
 586         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 587                 goto clear_hash;
 588         if (tcp_md5_hash_header(hp, th))
 589                 goto clear_hash;
 590         if (tcp_md5_hash_key(hp, key))
 591                 goto clear_hash;
 592         if (crypto_hash_final(desc, md5_hash))
 593                 goto clear_hash;
 594
 595         tcp_put_md5sig_pool();
 596         return 0;
 597
 598 clear_hash:
 599         tcp_put_md5sig_pool();
 600 clear_hash_noput:
 601         memset(md5_hash, 0, 16);
 602         return 1;
 603 }
 604
 605 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 606                                const struct sock *sk,
 607                                const struct request_sock *req,
 608                                const struct sk_buff *skb)
 609 {
 610         const struct in6_addr *saddr, *daddr;
 611         struct tcp_md5sig_pool *hp;
 612         struct hash_desc *desc;
 613         const struct tcphdr *th = tcp_hdr(skb);
 614
 615         if (sk) {
 616                 saddr = &inet6_sk(sk)->saddr;
 617                 daddr = &inet6_sk(sk)->daddr;
 618         } else if (req) {
 619                 saddr = &inet6_rsk(req)->loc_addr;
 620                 daddr = &inet6_rsk(req)->rmt_addr;
 621         } else {
 622                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 623                 saddr = &ip6h->saddr;
 624                 daddr = &ip6h->daddr;
 625         }
 626
 627         hp = tcp_get_md5sig_pool();
 628         if (!hp)
 629                 goto clear_hash_noput;
 630         desc = &hp->md5_desc;
 631
 632         if (crypto_hash_init(desc))
 633                 goto clear_hash;
 634
 635         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 636                 goto clear_hash;
 637         if (tcp_md5_hash_header(hp, th))
 638                 goto clear_hash;
 639         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 640                 goto clear_hash;
 641         if (tcp_md5_hash_key(hp, key))
 642                 goto clear_hash;
 643         if (crypto_hash_final(desc, md5_hash))
 644                 goto clear_hash;
 645
 646         tcp_put_md5sig_pool();
 647         return 0;
 648
 649 clear_hash:
 650         tcp_put_md5sig_pool();
 651 clear_hash_noput:
 652         memset(md5_hash, 0, 16);
 653         return 1;
 654 }
 655
 656 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 657 {
 658         const __u8 *hash_location = NULL;
 659         struct tcp_md5sig_key *hash_expected;
 660         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 661         const struct tcphdr *th = tcp_hdr(skb);
 662         int genhash;
 663         u8 newhash[16];
 664
 665         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 666         hash_location = tcp_parse_md5sig_option(th);
 667
 668         /* We've parsed the options - do we have a hash? */
 669         if (!hash_expected && !hash_location)
 670                 return 0;
 671
 672         if (hash_expected && !hash_location) {
 673                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 674                 return 1;
 675         }
 676
 677         if (!hash_expected && hash_location) {
 678                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 679                 return 1;
 680         }
 681
 682         /* check the signature */
 683         genhash = tcp_v6_md5_hash_skb(newhash,
 684                                       hash_expected,
 685                                       NULL, NULL, skb);
 686
 687         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 688                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 689                                      genhash ? "failed" : "mismatch",
 690                                      &ip6h->saddr, ntohs(th->source),
 691                                      &ip6h->daddr, ntohs(th->dest));
 692                 return 1;
 693         }
 694         return 0;
 695 }
 696 #endif
 697
 698 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 699         .family         =       AF_INET6,
 700         .obj_size       =       sizeof(struct tcp6_request_sock),
 701         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 702         .send_ack       =       tcp_v6_reqsk_send_ack,
 703         .destructor     =       tcp_v6_reqsk_destructor,
 704         .send_reset     =       tcp_v6_send_reset,
 705         .syn_ack_timeout =      tcp_syn_ack_timeout,
 706 };
 707
 708 #ifdef CONFIG_TCP_MD5SIG
 709 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 710         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 711         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 712 };
 713 #endif
 714
 715 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 716                                  u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
 717 {
 718         const struct tcphdr *th = tcp_hdr(skb);
 719         struct tcphdr *t1;
 720         struct sk_buff *buff;
 721         struct flowi6 fl6;
 722         struct net *net = dev_net(skb_dst(skb)->dev);
 723         struct sock *ctl_sk = net->ipv6.tcp_sk;
 724         unsigned int tot_len = sizeof(struct tcphdr);
 725         struct dst_entry *dst;
 726         __be32 *topt;
 727
 728         if (ts)
 729                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 730 #ifdef CONFIG_TCP_MD5SIG
 731         if (key)
 732                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 733 #endif
 734
 735         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 736                          GFP_ATOMIC);
 737         if (buff == NULL)
 738                 return;
 739
 740         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 741
 742         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 743         skb_reset_transport_header(buff);
 744
 745         /* Swap the send and the receive. */
 746         memset(t1, 0, sizeof(*t1));
 747         t1->dest = th->source;
 748         t1->source = th->dest;
 749         t1->doff = tot_len / 4;
 750         t1->seq = htonl(seq);
 751         t1->ack_seq = htonl(ack);
 752         t1->ack = !rst || !th->ack;
 753         t1->rst = rst;
 754         t1->window = htons(win);
 755
 756         topt = (__be32 *)(t1 + 1);
 757
 758         if (ts) {
 759                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 760                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 761                 *topt++ = htonl(tcp_time_stamp);
 762                 *topt++ = htonl(ts);
 763         }
 764
 765 #ifdef CONFIG_TCP_MD5SIG
 766         if (key) {
 767                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 768                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 769                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 770                                     &ipv6_hdr(skb)->saddr,
 771                                     &ipv6_hdr(skb)->daddr, t1);
 772         }
 773 #endif
 774
 775         memset(&fl6, 0, sizeof(fl6));
 776         fl6.daddr = ipv6_hdr(skb)->saddr;
 777         fl6.saddr = ipv6_hdr(skb)->daddr;
 778
 779         buff->ip_summed = CHECKSUM_PARTIAL;
 780         buff->csum = 0;
 781
 782         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 783
 784         fl6.flowi6_proto = IPPROTO_TCP;
 785         if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
 786                 fl6.flowi6_oif = inet6_iif(skb);
 787         fl6.fl6_dport = t1->dest;
 788         fl6.fl6_sport = t1->source;
 789         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 790
 791         /* Pass a socket to ip6_dst_lookup either it is for RST
 792          * Underlying function will use this to retrieve the network
 793          * namespace
 794          */
 795         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
 796         if (!IS_ERR(dst)) {
 797                 skb_dst_set(buff, dst);
 798                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 799                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 800                 if (rst)
 801                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 802                 return;
 803         }
 804
 805         kfree_skb(buff);
 806 }
 807
 808 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 809 {
 810         const struct tcphdr *th = tcp_hdr(skb);
 811         u32 seq = 0, ack_seq = 0;
 812         struct tcp_md5sig_key *key = NULL;
 813 #ifdef CONFIG_TCP_MD5SIG
 814         const __u8 *hash_location = NULL;
 815         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 816         unsigned char newhash[16];
 817         int genhash;
 818         struct sock *sk1 = NULL;
 819 #endif
 820
 821         if (th->rst)
 822                 return;
 823
 824         if (!ipv6_unicast_destination(skb))
 825                 return;
 826
 827 #ifdef CONFIG_TCP_MD5SIG
 828         hash_location = tcp_parse_md5sig_option(th);
 829         if (!sk && hash_location) {
 830                 /*
 831                  * active side is lost. Try to find listening socket through
 832                  * source port, and then find md5 key through listening socket.
 833                  * we are not loose security here:
 834                  * Incoming packet is checked with md5 hash with finding key,
 835                  * no RST generated if md5 hash doesn't match.
 836                  */
 837                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 838                                            &tcp_hashinfo, &ipv6h->saddr,
 839                                            th->source, &ipv6h->daddr,
 840                                            ntohs(th->source), inet6_iif(skb));
 841                 if (!sk1)
 842                         return;
 843
 844                 rcu_read_lock();
 845                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 846                 if (!key)
 847                         goto release_sk1;
 848
 849                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 850                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 851                         goto release_sk1;
 852         } else {
 853                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 854         }
 855 #endif
 856
 857         if (th->ack)
 858                 seq = ntohl(th->ack_seq);
 859         else
 860                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 861                           (th->doff << 2);
 862
 863         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
 864
 865 #ifdef CONFIG_TCP_MD5SIG
 866 release_sk1:
 867         if (sk1) {
 868                 rcu_read_unlock();
 869                 sock_put(sk1);
 870         }
 871 #endif
 872 }
 873
 874 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
 875                             struct tcp_md5sig_key *key, u8 tclass)
 876 {
 877         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
 878 }
 879
 880 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 881 {
 882         struct inet_timewait_sock *tw = inet_twsk(sk);
 883         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 884
 885         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 886                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 887                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
 888                         tw->tw_tclass);
 889
 890         inet_twsk_put(tw);
 891 }
 892
 893 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 894                                   struct request_sock *req)
 895 {
 896         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
 897                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 898 }
 899
 900
 901 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 902 {
 903         struct request_sock *req, **prev;
 904         const struct tcphdr *th = tcp_hdr(skb);
 905         struct sock *nsk;
 906
 907         /* Find possible connection requests. */
 908         req = inet6_csk_search_req(sk, &prev, th->source,
 909                                    &ipv6_hdr(skb)->saddr,
 910                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 911         if (req)
 912                 return tcp_check_req(sk, skb, req, prev, false);
 913
 914         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 915                         &ipv6_hdr(skb)->saddr, th->source,
 916                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 917
 918         if (nsk) {
 919                 if (nsk->sk_state != TCP_TIME_WAIT) {
 920                         bh_lock_sock(nsk);
 921                         return nsk;
 922                 }
 923                 inet_twsk_put(inet_twsk(nsk));
 924                 return NULL;
 925         }
 926
 927 #ifdef CONFIG_SYN_COOKIES
 928         if (!th->syn)
 929                 sk = cookie_v6_check(sk, skb);
 930 #endif
 931         return sk;
 932 }
 933
 934 /* FIXME: this is substantially similar to the ipv4 code.
 935  * Can some kind of merge be done? -- erics
 936  */
 937 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 938 {
 939         struct tcp_extend_values tmp_ext;
 940         struct tcp_options_received tmp_opt;
 941         const u8 *hash_location;
 942         struct request_sock *req;
 943         struct inet6_request_sock *treq;
 944         struct ipv6_pinfo *np = inet6_sk(sk);
 945         struct tcp_sock *tp = tcp_sk(sk);
 946         __u32 isn = TCP_SKB_CB(skb)->when;
 947         struct dst_entry *dst = NULL;
 948         struct flowi6 fl6;
 949         bool want_cookie = false;
 950
 951         if (skb->protocol == htons(ETH_P_IP))
 952                 return tcp_v4_conn_request(sk, skb);
 953
 954         if (!ipv6_unicast_destination(skb))
 955                 goto drop;
 956
 957         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
 958                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
 959                 if (!want_cookie)
 960                         goto drop;
 961         }
 962
 963         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
 964                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 965                 goto drop;
 966         }
 967
 968         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 969         if (req == NULL)
 970                 goto drop;
 971
 972 #ifdef CONFIG_TCP_MD5SIG
 973         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
 974 #endif
 975
 976         tcp_clear_options(&tmp_opt);
 977         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 978         tmp_opt.user_mss = tp->rx_opt.user_mss;
 979         tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
 980
 981         if (tmp_opt.cookie_plus > 0 &&
 982             tmp_opt.saw_tstamp &&
 983             !tp->rx_opt.cookie_out_never &&
 984             (sysctl_tcp_cookie_size > 0 ||
 985              (tp->cookie_values != NULL &&
 986               tp->cookie_values->cookie_desired > 0))) {
 987                 u8 *c;
 988                 u32 *d;
 989                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
 990                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
 991
 992                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
 993                         goto drop_and_free;
 994
 995                 /* Secret recipe starts with IP addresses */
 996                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
 997                 *mess++ ^= *d++;
 998                 *mess++ ^= *d++;
 999                 *mess++ ^= *d++;
1000                 *mess++ ^= *d++;
1001                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1002                 *mess++ ^= *d++;
1003                 *mess++ ^= *d++;
1004                 *mess++ ^= *d++;
1005                 *mess++ ^= *d++;
1006
1007                 /* plus variable length Initiator Cookie */
1008                 c = (u8 *)mess;
1009                 while (l-- > 0)
1010                         *c++ ^= *hash_location++;
1011
1012                 want_cookie = false;    /* not our kind of cookie */
1013                 tmp_ext.cookie_out_never = 0; /* false */
1014                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1015         } else if (!tp->rx_opt.cookie_in_always) {
1016                 /* redundant indications, but ensure initialization. */
1017                 tmp_ext.cookie_out_never = 1; /* true */
1018                 tmp_ext.cookie_plus = 0;
1019         } else {
1020                 goto drop_and_free;
1021         }
1022         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1023
1024         if (want_cookie && !tmp_opt.saw_tstamp)
1025                 tcp_clear_options(&tmp_opt);
1026
1027         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1028         tcp_openreq_init(req, &tmp_opt, skb);
1029
1030         treq = inet6_rsk(req);
1031         treq->rmt_addr = ipv6_hdr(skb)->saddr;
1032         treq->loc_addr = ipv6_hdr(skb)->daddr;
1033         if (!want_cookie || tmp_opt.tstamp_ok)
1034                 TCP_ECN_create_request(req, skb, sock_net(sk));
1035
1036         treq->iif = sk->sk_bound_dev_if;
1037
1038         /* So that link locals have meaning */
1039         if (!sk->sk_bound_dev_if &&
1040             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1041                 treq->iif = inet6_iif(skb);
1042
1043         if (!isn) {
1044                 if (ipv6_opt_accepted(sk, skb) ||
1045                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1046                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1047                         atomic_inc(&skb->users);
1048                         treq->pktopts = skb;
1049                 }
1050
1051                 if (want_cookie) {
1052                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1053                         req->cookie_ts = tmp_opt.tstamp_ok;
1054                         goto have_isn;
1055                 }
1056
1057                 /* VJ's idea. We save last timestamp seen
1058                  * from the destination in peer table, when entering
1059                  * state TIME-WAIT, and check against it before
1060                  * accepting new connection request.
1061                  *
1062                  * If "isn" is not zero, this request hit alive
1063                  * timewait bucket, so that all the necessary checks
1064                  * are made in the function processing timewait state.
1065                  */
1066                 if (tmp_opt.saw_tstamp &&
1067                     tcp_death_row.sysctl_tw_recycle &&
1068                     (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1069                         if (!tcp_peer_is_proven(req, dst, true)) {
1070                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1071                                 goto drop_and_release;
1072                         }
1073                 }
1074                 /* Kill the following clause, if you dislike this way. */
1075                 else if (!sysctl_tcp_syncookies &&
1076                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1077                           (sysctl_max_syn_backlog >> 2)) &&
1078                          !tcp_peer_is_proven(req, dst, false)) {
1079                         /* Without syncookies last quarter of
1080                          * backlog is filled with destinations,
1081                          * proven to be alive.
1082                          * It means that we continue to communicate
1083                          * to destinations, already remembered
1084                          * to the moment of synflood.
1085                          */
1086                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1087                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1088                         goto drop_and_release;
1089                 }
1090
1091                 isn = tcp_v6_init_sequence(skb);
1092         }
1093 have_isn:
1094         tcp_rsk(req)->snt_isn = isn;
1095
1096         if (security_inet_conn_request(sk, skb, req))
1097                 goto drop_and_release;
1098
1099         if (tcp_v6_send_synack(sk, dst, &fl6, req,
1100                                (struct request_values *)&tmp_ext,
1101                                skb_get_queue_mapping(skb)) ||
1102             want_cookie)
1103                 goto drop_and_free;
1104
1105         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1106         tcp_rsk(req)->listener = NULL;
1107         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1108         return 0;
1109
1110 drop_and_release:
1111         dst_release(dst);
1112 drop_and_free:
1113         reqsk_free(req);
1114 drop:
1115         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1116         return 0; /* don't send reset */
1117 }
1118
1119 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1120                                           struct request_sock *req,
1121                                           struct dst_entry *dst)
1122 {
1123         struct inet6_request_sock *treq;
1124         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1125         struct tcp6_sock *newtcp6sk;
1126         struct inet_sock *newinet;
1127         struct tcp_sock *newtp;
1128         struct sock *newsk;
1129 #ifdef CONFIG_TCP_MD5SIG
1130         struct tcp_md5sig_key *key;
1131 #endif
1132         struct flowi6 fl6;
1133
1134         if (skb->protocol == htons(ETH_P_IP)) {
1135                 /*
1136                  *      v6 mapped
1137                  */
1138
1139                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1140
1141                 if (newsk == NULL)
1142                         return NULL;
1143
1144                 newtcp6sk = (struct tcp6_sock *)newsk;
1145                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1146
1147                 newinet = inet_sk(newsk);
1148                 newnp = inet6_sk(newsk);
1149                 newtp = tcp_sk(newsk);
1150
1151                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1152
1153                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1154
1155                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1156
1157                 newnp->rcv_saddr = newnp->saddr;
1158
1159                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1160                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1161 #ifdef CONFIG_TCP_MD5SIG
1162                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1163 #endif
1164
1165                 newnp->ipv6_ac_list = NULL;
1166                 newnp->ipv6_fl_list = NULL;
1167                 newnp->pktoptions  = NULL;
1168                 newnp->opt         = NULL;
1169                 newnp->mcast_oif   = inet6_iif(skb);
1170                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1171                 newnp->rcv_tclass  = ipv6_get_dsfield(ipv6_hdr(skb));
1172
1173                 /*
1174                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1175                  * here, tcp_create_openreq_child now does this for us, see the comment in
1176                  * that function for the gory details. -acme
1177                  */
1178
1179                 /* It is tricky place. Until this moment IPv4 tcp
1180                    worked with IPv6 icsk.icsk_af_ops.
1181                    Sync it now.
1182                  */
1183                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1184
1185                 return newsk;
1186         }
1187
1188         treq = inet6_rsk(req);
1189
1190         if (sk_acceptq_is_full(sk))
1191                 goto out_overflow;
1192
1193         if (!dst) {
1194                 dst = inet6_csk_route_req(sk, &fl6, req);
1195                 if (!dst)
1196                         goto out;
1197         }
1198
1199         newsk = tcp_create_openreq_child(sk, req, skb);
1200         if (newsk == NULL)
1201                 goto out_nonewsk;
1202
1203         /*
1204          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1205          * count here, tcp_create_openreq_child now does this for us, see the
1206          * comment in that function for the gory details. -acme
1207          */
1208
1209         newsk->sk_gso_type = SKB_GSO_TCPV6;
1210         __ip6_dst_store(newsk, dst, NULL, NULL);
1211         inet6_sk_rx_dst_set(newsk, skb);
1212
1213         newtcp6sk = (struct tcp6_sock *)newsk;
1214         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1215
1216         newtp = tcp_sk(newsk);
1217         newinet = inet_sk(newsk);
1218         newnp = inet6_sk(newsk);
1219
1220         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1221
1222         newnp->daddr = treq->rmt_addr;
1223         newnp->saddr = treq->loc_addr;
1224         newnp->rcv_saddr = treq->loc_addr;
1225         newsk->sk_bound_dev_if = treq->iif;
1226
1227         /* Now IPv6 options...
1228
1229            First: no IPv4 options.
1230          */
1231         newinet->inet_opt = NULL;
1232         newnp->ipv6_ac_list = NULL;
1233         newnp->ipv6_fl_list = NULL;
1234
1235         /* Clone RX bits */
1236         newnp->rxopt.all = np->rxopt.all;
1237
1238         /* Clone pktoptions received with SYN */
1239         newnp->pktoptions = NULL;
1240         if (treq->pktopts != NULL) {
1241                 newnp->pktoptions = skb_clone(treq->pktopts,
1242                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1243                 consume_skb(treq->pktopts);
1244                 treq->pktopts = NULL;
1245                 if (newnp->pktoptions)
1246                         skb_set_owner_r(newnp->pktoptions, newsk);
1247         }
1248         newnp->opt        = NULL;
1249         newnp->mcast_oif  = inet6_iif(skb);
1250         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1251         newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1252
1253         /* Clone native IPv6 options from listening socket (if any)
1254
1255            Yes, keeping reference count would be much more clever,
1256            but we make one more one thing there: reattach optmem
1257            to newsk.
1258          */
1259         if (np->opt)
1260                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1261
1262         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1263         if (newnp->opt)
1264                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1265                                                      newnp->opt->opt_flen);
1266
1267         tcp_mtup_init(newsk);
1268         tcp_sync_mss(newsk, dst_mtu(dst));
1269         newtp->advmss = dst_metric_advmss(dst);
1270         if (tcp_sk(sk)->rx_opt.user_mss &&
1271             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1272                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1273
1274         tcp_initialize_rcv_mss(newsk);
1275         tcp_synack_rtt_meas(newsk, req);
1276         newtp->total_retrans = req->num_retrans;
1277
1278         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1279         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1280
1281 #ifdef CONFIG_TCP_MD5SIG
1282         /* Copy over the MD5 key from the original socket */
1283         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1284                 /* We're using one, so create a matching key
1285                  * on the newsk structure. If we fail to get
1286                  * memory, then we end up not copying the key
1287                  * across. Shucks.
1288                  */
1289                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1290                                AF_INET6, key->key, key->keylen,
1291                                sk_gfp_atomic(sk, GFP_ATOMIC));
1292         }
1293 #endif
1294
1295         if (__inet_inherit_port(sk, newsk) < 0) {
1296                 inet_csk_prepare_forced_close(newsk);
1297                 tcp_done(newsk);
1298                 goto out;
1299         }
1300         __inet6_hash(newsk, NULL);
1301
1302         return newsk;
1303
1304 out_overflow:
1305         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1306 out_nonewsk:
1307         dst_release(dst);
1308 out:
1309         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1310         return NULL;
1311 }
1312
1313 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1314 {
1315         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1316                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1317                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1318                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1319                         return 0;
1320                 }
1321         }
1322
1323         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1324                                               &ipv6_hdr(skb)->saddr,
1325                                               &ipv6_hdr(skb)->daddr, 0));
1326
1327         if (skb->len <= 76) {
1328                 return __skb_checksum_complete(skb);
1329         }
1330         return 0;
1331 }
1332
1333 /* The socket must have it's spinlock held when we get
1334  * here.
1335  *
1336  * We have a potential double-lock case here, so even when
1337  * doing backlog processing we use the BH locking scheme.
1338  * This is because we cannot sleep with the original spinlock
1339  * held.
1340  */
1341 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1342 {
1343         struct ipv6_pinfo *np = inet6_sk(sk);
1344         struct tcp_sock *tp;
1345         struct sk_buff *opt_skb = NULL;
1346
1347         /* Imagine: socket is IPv6. IPv4 packet arrives,
1348            goes to IPv4 receive handler and backlogged.
1349            From backlog it always goes here. Kerboom...
1350            Fortunately, tcp_rcv_established and rcv_established
1351            handle them correctly, but it is not case with
1352            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1353          */
1354
1355         if (skb->protocol == htons(ETH_P_IP))
1356                 return tcp_v4_do_rcv(sk, skb);
1357
1358 #ifdef CONFIG_TCP_MD5SIG
1359         if (tcp_v6_inbound_md5_hash (sk, skb))
1360                 goto discard;
1361 #endif
1362
1363         if (sk_filter(sk, skb))
1364                 goto discard;
1365
1366         /*
1367          *      socket locking is here for SMP purposes as backlog rcv
1368          *      is currently called with bh processing disabled.
1369          */
1370
1371         /* Do Stevens' IPV6_PKTOPTIONS.
1372
1373            Yes, guys, it is the only place in our code, where we
1374            may make it not affecting IPv4.
1375            The rest of code is protocol independent,
1376            and I do not like idea to uglify IPv4.
1377
1378            Actually, all the idea behind IPV6_PKTOPTIONS
1379            looks not very well thought. For now we latch
1380            options, received in the last packet, enqueued
1381            by tcp. Feel free to propose better solution.
1382                                                --ANK (980728)
1383          */
1384         if (np->rxopt.all)
1385                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1386
1387         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1388                 struct dst_entry *dst = sk->sk_rx_dst;
1389
1390                 sock_rps_save_rxhash(sk, skb);
1391                 if (dst) {
1392                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1393                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1394                                 dst_release(dst);
1395                                 sk->sk_rx_dst = NULL;
1396                         }
1397                 }
1398
1399                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1400                         goto reset;
1401                 if (opt_skb)
1402                         goto ipv6_pktoptions;
1403                 return 0;
1404         }
1405
1406         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1407                 goto csum_err;
1408
1409         if (sk->sk_state == TCP_LISTEN) {
1410                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1411                 if (!nsk)
1412                         goto discard;
1413
1414                 /*
1415                  * Queue it on the new socket if the new socket is active,
1416                  * otherwise we just shortcircuit this and continue with
1417                  * the new socket..
1418                  */
1419                 if(nsk != sk) {
1420                         sock_rps_save_rxhash(nsk, skb);
1421                         if (tcp_child_process(sk, nsk, skb))
1422                                 goto reset;
1423                         if (opt_skb)
1424                                 __kfree_skb(opt_skb);
1425                         return 0;
1426                 }
1427         } else
1428                 sock_rps_save_rxhash(sk, skb);
1429
1430         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1431                 goto reset;
1432         if (opt_skb)
1433                 goto ipv6_pktoptions;
1434         return 0;
1435
1436 reset:
1437         tcp_v6_send_reset(sk, skb);
1438 discard:
1439         if (opt_skb)
1440                 __kfree_skb(opt_skb);
1441         kfree_skb(skb);
1442         return 0;
1443 csum_err:
1444         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1445         goto discard;
1446
1447
1448 ipv6_pktoptions:
1449         /* Do you ask, what is it?
1450
1451            1. skb was enqueued by tcp.
1452            2. skb is added to tail of read queue, rather than out of order.
1453            3. socket is not in passive state.
1454            4. Finally, it really contains options, which user wants to receive.
1455          */
1456         tp = tcp_sk(sk);
1457         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1458             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1459                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1460                         np->mcast_oif = inet6_iif(opt_skb);
1461                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1462                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1463                 if (np->rxopt.bits.rxtclass)
1464                         np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1465                 if (ipv6_opt_accepted(sk, opt_skb)) {
1466                         skb_set_owner_r(opt_skb, sk);
1467                         opt_skb = xchg(&np->pktoptions, opt_skb);
1468                 } else {
1469                         __kfree_skb(opt_skb);
1470                         opt_skb = xchg(&np->pktoptions, NULL);
1471                 }
1472         }
1473
1474         kfree_skb(opt_skb);
1475         return 0;
1476 }
1477
1478 static int tcp_v6_rcv(struct sk_buff *skb)
1479 {
1480         const struct tcphdr *th;
1481         const struct ipv6hdr *hdr;
1482         struct sock *sk;
1483         int ret;
1484         struct net *net = dev_net(skb->dev);
1485
1486         if (skb->pkt_type != PACKET_HOST)
1487                 goto discard_it;
1488
1489         /*
1490          *      Count it even if it's bad.
1491          */
1492         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1493
1494         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1495                 goto discard_it;
1496
1497         th = tcp_hdr(skb);
1498
1499         if (th->doff < sizeof(struct tcphdr)/4)
1500                 goto bad_packet;
1501         if (!pskb_may_pull(skb, th->doff*4))
1502                 goto discard_it;
1503
1504         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1505                 goto bad_packet;
1506
1507         th = tcp_hdr(skb);
1508         hdr = ipv6_hdr(skb);
1509         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1510         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1511                                     skb->len - th->doff*4);
1512         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1513         TCP_SKB_CB(skb)->when = 0;
1514         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1515         TCP_SKB_CB(skb)->sacked = 0;
1516
1517         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1518         if (!sk)
1519                 goto no_tcp_socket;
1520
1521 process:
1522         if (sk->sk_state == TCP_TIME_WAIT)
1523                 goto do_time_wait;
1524
1525         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1526                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1527                 goto discard_and_relse;
1528         }
1529
1530         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1531                 goto discard_and_relse;
1532
1533         if (sk_filter(sk, skb))
1534                 goto discard_and_relse;
1535
1536         skb->dev = NULL;
1537
1538         bh_lock_sock_nested(sk);
1539         ret = 0;
1540         if (!sock_owned_by_user(sk)) {
1541 #ifdef CONFIG_NET_DMA
1542                 struct tcp_sock *tp = tcp_sk(sk);
1543                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1544                         tp->ucopy.dma_chan = net_dma_find_channel();
1545                 if (tp->ucopy.dma_chan)
1546                         ret = tcp_v6_do_rcv(sk, skb);
1547                 else
1548 #endif
1549                 {
1550                         if (!tcp_prequeue(sk, skb))
1551                                 ret = tcp_v6_do_rcv(sk, skb);
1552                 }
1553         } else if (unlikely(sk_add_backlog(sk, skb,
1554                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1555                 bh_unlock_sock(sk);
1556                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1557                 goto discard_and_relse;
1558         }
1559         bh_unlock_sock(sk);
1560
1561         sock_put(sk);
1562         return ret ? -1 : 0;
1563
1564 no_tcp_socket:
1565         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1566                 goto discard_it;
1567
1568         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1569 bad_packet:
1570                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1571         } else {
1572                 tcp_v6_send_reset(NULL, skb);
1573         }
1574
1575 discard_it:
1576
1577         /*
1578          *      Discard frame
1579          */
1580
1581         kfree_skb(skb);
1582         return 0;
1583
1584 discard_and_relse:
1585         sock_put(sk);
1586         goto discard_it;
1587
1588 do_time_wait:
1589         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1590                 inet_twsk_put(inet_twsk(sk));
1591                 goto discard_it;
1592         }
1593
1594         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1595                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1596                 inet_twsk_put(inet_twsk(sk));
1597                 goto discard_it;
1598         }
1599
1600         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1601         case TCP_TW_SYN:
1602         {
1603                 struct sock *sk2;
1604
1605                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1606                                             &ipv6_hdr(skb)->saddr, th->source,
1607                                             &ipv6_hdr(skb)->daddr,
1608                                             ntohs(th->dest), inet6_iif(skb));
1609                 if (sk2 != NULL) {
1610                         struct inet_timewait_sock *tw = inet_twsk(sk);
1611                         inet_twsk_deschedule(tw, &tcp_death_row);
1612                         inet_twsk_put(tw);
1613                         sk = sk2;
1614                         goto process;
1615                 }
1616                 /* Fall through to ACK */
1617         }
1618         case TCP_TW_ACK:
1619                 tcp_v6_timewait_ack(sk, skb);
1620                 break;
1621         case TCP_TW_RST:
1622                 goto no_tcp_socket;
1623         case TCP_TW_SUCCESS:;
1624         }
1625         goto discard_it;
1626 }
1627
1628 static void tcp_v6_early_demux(struct sk_buff *skb)
1629 {
1630         const struct ipv6hdr *hdr;
1631         const struct tcphdr *th;
1632         struct sock *sk;
1633
1634         if (skb->pkt_type != PACKET_HOST)
1635                 return;
1636
1637         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1638                 return;
1639
1640         hdr = ipv6_hdr(skb);
1641         th = tcp_hdr(skb);
1642
1643         if (th->doff < sizeof(struct tcphdr) / 4)
1644                 return;
1645
1646         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1647                                         &hdr->saddr, th->source,
1648                                         &hdr->daddr, ntohs(th->dest),
1649                                         inet6_iif(skb));
1650         if (sk) {
1651                 skb->sk = sk;
1652                 skb->destructor = sock_edemux;
1653                 if (sk->sk_state != TCP_TIME_WAIT) {
1654                         struct dst_entry *dst = sk->sk_rx_dst;
1655
1656                         if (dst)
1657                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1658                         if (dst &&
1659                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1660                                 skb_dst_set_noref(skb, dst);
1661                 }
1662         }
1663 }
1664
1665 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1666         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1667         .twsk_unique    = tcp_twsk_unique,
1668         .twsk_destructor= tcp_twsk_destructor,
1669 };
1670
1671 static const struct inet_connection_sock_af_ops ipv6_specific = {
1672         .queue_xmit        = inet6_csk_xmit,
1673         .send_check        = tcp_v6_send_check,
1674         .rebuild_header    = inet6_sk_rebuild_header,
1675         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1676         .conn_request      = tcp_v6_conn_request,
1677         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1678         .net_header_len    = sizeof(struct ipv6hdr),
1679         .net_frag_header_len = sizeof(struct frag_hdr),
1680         .setsockopt        = ipv6_setsockopt,
1681         .getsockopt        = ipv6_getsockopt,
1682         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1683         .sockaddr_len      = sizeof(struct sockaddr_in6),
1684         .bind_conflict     = inet6_csk_bind_conflict,
1685 #ifdef CONFIG_COMPAT
1686         .compat_setsockopt = compat_ipv6_setsockopt,
1687         .compat_getsockopt = compat_ipv6_getsockopt,
1688 #endif
1689 };
1690
1691 #ifdef CONFIG_TCP_MD5SIG
1692 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1693         .md5_lookup     =       tcp_v6_md5_lookup,
1694         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1695         .md5_parse      =       tcp_v6_parse_md5_keys,
1696 };
1697 #endif
1698
1699 /*
1700  *      TCP over IPv4 via INET6 API
1701  */
1702
1703 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1704         .queue_xmit        = ip_queue_xmit,
1705         .send_check        = tcp_v4_send_check,
1706         .rebuild_header    = inet_sk_rebuild_header,
1707         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1708         .conn_request      = tcp_v6_conn_request,
1709         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1710         .net_header_len    = sizeof(struct iphdr),
1711         .setsockopt        = ipv6_setsockopt,
1712         .getsockopt        = ipv6_getsockopt,
1713         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1714         .sockaddr_len      = sizeof(struct sockaddr_in6),
1715         .bind_conflict     = inet6_csk_bind_conflict,
1716 #ifdef CONFIG_COMPAT
1717         .compat_setsockopt = compat_ipv6_setsockopt,
1718         .compat_getsockopt = compat_ipv6_getsockopt,
1719 #endif
1720 };
1721
1722 #ifdef CONFIG_TCP_MD5SIG
1723 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1724         .md5_lookup     =       tcp_v4_md5_lookup,
1725         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1726         .md5_parse      =       tcp_v6_parse_md5_keys,
1727 };
1728 #endif
1729
1730 /* NOTE: A lot of things set to zero explicitly by call to
1731  *       sk_alloc() so need not be done here.
1732  */
1733 static int tcp_v6_init_sock(struct sock *sk)
1734 {
1735         struct inet_connection_sock *icsk = inet_csk(sk);
1736
1737         tcp_init_sock(sk);
1738
1739         icsk->icsk_af_ops = &ipv6_specific;
1740
1741 #ifdef CONFIG_TCP_MD5SIG
1742         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1743 #endif
1744
1745         return 0;
1746 }
1747
1748 static void tcp_v6_destroy_sock(struct sock *sk)
1749 {
1750         tcp_v4_destroy_sock(sk);
1751         inet6_destroy_sock(sk);
1752 }
1753
1754 #ifdef CONFIG_PROC_FS
1755 /* Proc filesystem TCPv6 sock list dumping. */
1756 static void get_openreq6(struct seq_file *seq,
1757                          const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1758 {
1759         int ttd = req->expires - jiffies;
1760         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1761         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1762
1763         if (ttd < 0)
1764                 ttd = 0;
1765
1766         seq_printf(seq,
1767                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1768                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1769                    i,
1770                    src->s6_addr32[0], src->s6_addr32[1],
1771                    src->s6_addr32[2], src->s6_addr32[3],
1772                    ntohs(inet_rsk(req)->loc_port),
1773                    dest->s6_addr32[0], dest->s6_addr32[1],
1774                    dest->s6_addr32[2], dest->s6_addr32[3],
1775                    ntohs(inet_rsk(req)->rmt_port),
1776                    TCP_SYN_RECV,
1777                    0,0, /* could print option size, but that is af dependent. */
1778                    1,   /* timers active (only the expire timer) */
1779                    jiffies_to_clock_t(ttd),
1780                    req->num_timeout,
1781                    from_kuid_munged(seq_user_ns(seq), uid),
1782                    0,  /* non standard timer */
1783                    0, /* open_requests have no inode */
1784                    0, req);
1785 }
1786
1787 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1788 {
1789         const struct in6_addr *dest, *src;
1790         __u16 destp, srcp;
1791         int timer_active;
1792         unsigned long timer_expires;
1793         const struct inet_sock *inet = inet_sk(sp);
1794         const struct tcp_sock *tp = tcp_sk(sp);
1795         const struct inet_connection_sock *icsk = inet_csk(sp);
1796         const struct ipv6_pinfo *np = inet6_sk(sp);
1797
1798         dest  = &np->daddr;
1799         src   = &np->rcv_saddr;
1800         destp = ntohs(inet->inet_dport);
1801         srcp  = ntohs(inet->inet_sport);
1802
1803         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1804                 timer_active    = 1;
1805                 timer_expires   = icsk->icsk_timeout;
1806         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1807                 timer_active    = 4;
1808                 timer_expires   = icsk->icsk_timeout;
1809         } else if (timer_pending(&sp->sk_timer)) {
1810                 timer_active    = 2;
1811                 timer_expires   = sp->sk_timer.expires;
1812         } else {
1813                 timer_active    = 0;
1814                 timer_expires = jiffies;
1815         }
1816
1817         seq_printf(seq,
1818                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1819                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
1820                    i,
1821                    src->s6_addr32[0], src->s6_addr32[1],
1822                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1823                    dest->s6_addr32[0], dest->s6_addr32[1],
1824                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1825                    sp->sk_state,
1826                    tp->write_seq-tp->snd_una,
1827                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1828                    timer_active,
1829                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1830                    icsk->icsk_retransmits,
1831                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1832                    icsk->icsk_probes_out,
1833                    sock_i_ino(sp),
1834                    atomic_read(&sp->sk_refcnt), sp,
1835                    jiffies_to_clock_t(icsk->icsk_rto),
1836                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1837                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1838                    tp->snd_cwnd,
1839                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1840                    );
1841 }
1842
1843 static void get_timewait6_sock(struct seq_file *seq,
1844                                struct inet_timewait_sock *tw, int i)
1845 {
1846         const struct in6_addr *dest, *src;
1847         __u16 destp, srcp;
1848         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1849         long delta = tw->tw_ttd - jiffies;
1850
1851         dest = &tw6->tw_v6_daddr;
1852         src  = &tw6->tw_v6_rcv_saddr;
1853         destp = ntohs(tw->tw_dport);
1854         srcp  = ntohs(tw->tw_sport);
1855
1856         seq_printf(seq,
1857                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1858                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1859                    i,
1860                    src->s6_addr32[0], src->s6_addr32[1],
1861                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1862                    dest->s6_addr32[0], dest->s6_addr32[1],
1863                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1864                    tw->tw_substate, 0, 0,
1865                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1866                    atomic_read(&tw->tw_refcnt), tw);
1867 }
1868
1869 static int tcp6_seq_show(struct seq_file *seq, void *v)
1870 {
1871         struct tcp_iter_state *st;
1872
1873         if (v == SEQ_START_TOKEN) {
1874                 seq_puts(seq,
1875                          "  sl  "
1876                          "local_address                         "
1877                          "remote_address                        "
1878                          "st tx_queue rx_queue tr tm->when retrnsmt"
1879                          "   uid  timeout inode\n");
1880                 goto out;
1881         }
1882         st = seq->private;
1883
1884         switch (st->state) {
1885         case TCP_SEQ_STATE_LISTENING:
1886         case TCP_SEQ_STATE_ESTABLISHED:
1887                 get_tcp6_sock(seq, v, st->num);
1888                 break;
1889         case TCP_SEQ_STATE_OPENREQ:
1890                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1891                 break;
1892         case TCP_SEQ_STATE_TIME_WAIT:
1893                 get_timewait6_sock(seq, v, st->num);
1894                 break;
1895         }
1896 out:
1897         return 0;
1898 }
1899
1900 static const struct file_operations tcp6_afinfo_seq_fops = {
1901         .owner   = THIS_MODULE,
1902         .open    = tcp_seq_open,
1903         .read    = seq_read,
1904         .llseek  = seq_lseek,
1905         .release = seq_release_net
1906 };
1907
1908 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1909         .name           = "tcp6",
1910         .family         = AF_INET6,
1911         .seq_fops       = &tcp6_afinfo_seq_fops,
1912         .seq_ops        = {
1913                 .show           = tcp6_seq_show,
1914         },
1915 };
1916
1917 int __net_init tcp6_proc_init(struct net *net)
1918 {
1919         return tcp_proc_register(net, &tcp6_seq_afinfo);
1920 }
1921
1922 void tcp6_proc_exit(struct net *net)
1923 {
1924         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1925 }
1926 #endif
1927
1928 struct proto tcpv6_prot = {
1929         .name                   = "TCPv6",
1930         .owner                  = THIS_MODULE,
1931         .close                  = tcp_close,
1932         .connect                = tcp_v6_connect,
1933         .disconnect             = tcp_disconnect,
1934         .accept                 = inet_csk_accept,
1935         .ioctl                  = tcp_ioctl,
1936         .init                   = tcp_v6_init_sock,
1937         .destroy                = tcp_v6_destroy_sock,
1938         .shutdown               = tcp_shutdown,
1939         .setsockopt             = tcp_setsockopt,
1940         .getsockopt             = tcp_getsockopt,
1941         .recvmsg                = tcp_recvmsg,
1942         .sendmsg                = tcp_sendmsg,
1943         .sendpage               = tcp_sendpage,
1944         .backlog_rcv            = tcp_v6_do_rcv,
1945         .release_cb             = tcp_release_cb,
1946         .mtu_reduced            = tcp_v6_mtu_reduced,
1947         .hash                   = tcp_v6_hash,
1948         .unhash                 = inet_unhash,
1949         .get_port               = inet_csk_get_port,
1950         .enter_memory_pressure  = tcp_enter_memory_pressure,
1951         .sockets_allocated      = &tcp_sockets_allocated,
1952         .memory_allocated       = &tcp_memory_allocated,
1953         .memory_pressure        = &tcp_memory_pressure,
1954         .orphan_count           = &tcp_orphan_count,
1955         .sysctl_wmem            = sysctl_tcp_wmem,
1956         .sysctl_rmem            = sysctl_tcp_rmem,
1957         .max_header             = MAX_TCP_HEADER,
1958         .obj_size               = sizeof(struct tcp6_sock),
1959         .slab_flags             = SLAB_DESTROY_BY_RCU,
1960         .twsk_prot              = &tcp6_timewait_sock_ops,
1961         .rsk_prot               = &tcp6_request_sock_ops,
1962         .h.hashinfo             = &tcp_hashinfo,
1963         .no_autobind            = true,
1964 #ifdef CONFIG_COMPAT
1965         .compat_setsockopt      = compat_tcp_setsockopt,
1966         .compat_getsockopt      = compat_tcp_getsockopt,
1967 #endif
1968 #ifdef CONFIG_MEMCG_KMEM
1969         .proto_cgroup           = tcp_proto_cgroup,
1970 #endif
1971 };
1972
1973 static const struct inet6_protocol tcpv6_protocol = {
1974         .early_demux    =       tcp_v6_early_demux,
1975         .handler        =       tcp_v6_rcv,
1976         .err_handler    =       tcp_v6_err,
1977         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1978 };
1979
1980 static struct inet_protosw tcpv6_protosw = {
1981         .type           =       SOCK_STREAM,
1982         .protocol       =       IPPROTO_TCP,
1983         .prot           =       &tcpv6_prot,
1984         .ops            =       &inet6_stream_ops,
1985         .no_check       =       0,
1986         .flags          =       INET_PROTOSW_PERMANENT |
1987                                 INET_PROTOSW_ICSK,
1988 };
1989
1990 static int __net_init tcpv6_net_init(struct net *net)
1991 {
1992         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1993                                     SOCK_RAW, IPPROTO_TCP, net);
1994 }
1995
1996 static void __net_exit tcpv6_net_exit(struct net *net)
1997 {
1998         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1999 }
2000
2001 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2002 {
2003         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2004 }
2005
2006 static struct pernet_operations tcpv6_net_ops = {
2007         .init       = tcpv6_net_init,
2008         .exit       = tcpv6_net_exit,
2009         .exit_batch = tcpv6_net_exit_batch,
2010 };
2011
2012 int __init tcpv6_init(void)
2013 {
2014         int ret;
2015
2016         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2017         if (ret)
2018                 goto out;
2019
2020         /* register inet6 protocol */
2021         ret = inet6_register_protosw(&tcpv6_protosw);
2022         if (ret)
2023                 goto out_tcpv6_protocol;
2024
2025         ret = register_pernet_subsys(&tcpv6_net_ops);
2026         if (ret)
2027                 goto out_tcpv6_protosw;
2028 out:
2029         return ret;
2030
2031 out_tcpv6_protosw:
2032         inet6_unregister_protosw(&tcpv6_protosw);
2033 out_tcpv6_protocol:
2034         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2035         goto out;
2036 }
2037
2038 void tcpv6_exit(void)
2039 {
2040         unregister_pernet_subsys(&tcpv6_net_ops);
2041         inet6_unregister_protosw(&tcpv6_protosw);
2042         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2043 }