net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/busy_poll.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <crypto/hash.h>
  70 #include <linux/scatterlist.h>
  71
  72 #include <trace/events/tcp.h>
  73
  74 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80 static const struct inet_connection_sock_af_ops ipv6_mapped;
  81 static const struct inet_connection_sock_af_ops ipv6_specific;
  82 #ifdef CONFIG_TCP_MD5SIG
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  85 #else
  86 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  87                                                    const struct in6_addr *addr)
  88 {
  89         return NULL;
  90 }
  91 #endif
  92
  93 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  94 {
  95         struct dst_entry *dst = skb_dst(skb);
  96
  97         if (dst && dst_hold_safe(dst)) {
  98                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  99
 100                 sk->sk_rx_dst = dst;
 101                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 103         }
 104 }
 105
 106 static u32 tcp_v6_init_seq(const struct sk_buff *skb)
 107 {
 108         return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
 109                                 ipv6_hdr(skb)->saddr.s6_addr32,
 110                                 tcp_hdr(skb)->dest,
 111                                 tcp_hdr(skb)->source);
 112 }
 113
 114 static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
 115 {
 116         return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
 117                                    ipv6_hdr(skb)->saddr.s6_addr32);
 118 }
 119
 120 static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
 121                               int addr_len)
 122 {
 123         /* This check is replicated from tcp_v6_connect() and intended to
 124          * prevent BPF program called below from accessing bytes that are out
 125          * of the bound specified by user in addr_len.
 126          */
 127         if (addr_len < SIN6_LEN_RFC2133)
 128                 return -EINVAL;
 129
 130         sock_owned_by_me(sk);
 131
 132         return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr);
 133 }
 134
 135 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 136                           int addr_len)
 137 {
 138         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 139         struct inet_sock *inet = inet_sk(sk);
 140         struct inet_connection_sock *icsk = inet_csk(sk);
 141         struct ipv6_pinfo *np = inet6_sk(sk);
 142         struct tcp_sock *tp = tcp_sk(sk);
 143         struct in6_addr *saddr = NULL, *final_p, final;
 144         struct ipv6_txoptions *opt;
 145         struct flowi6 fl6;
 146         struct dst_entry *dst;
 147         int addr_type;
 148         int err;
 149         struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
 150
 151         if (addr_len < SIN6_LEN_RFC2133)
 152                 return -EINVAL;
 153
 154         if (usin->sin6_family != AF_INET6)
 155                 return -EAFNOSUPPORT;
 156
 157         memset(&fl6, 0, sizeof(fl6));
 158
 159         if (np->sndflow) {
 160                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 161                 IP6_ECN_flow_init(fl6.flowlabel);
 162                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 163                         struct ip6_flowlabel *flowlabel;
 164                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 165                         if (!flowlabel)
 166                                 return -EINVAL;
 167                         fl6_sock_release(flowlabel);
 168                 }
 169         }
 170
 171         /*
 172          *      connect() to INADDR_ANY means loopback (BSD'ism).
 173          */
 174
 175         if (ipv6_addr_any(&usin->sin6_addr)) {
 176                 if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
 177                         ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
 178                                                &usin->sin6_addr);
 179                 else
 180                         usin->sin6_addr = in6addr_loopback;
 181         }
 182
 183         addr_type = ipv6_addr_type(&usin->sin6_addr);
 184
 185         if (addr_type & IPV6_ADDR_MULTICAST)
 186                 return -ENETUNREACH;
 187
 188         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 189                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 190                     usin->sin6_scope_id) {
 191                         /* If interface is set while binding, indices
 192                          * must coincide.
 193                          */
 194                         if (!sk_dev_equal_l3scope(sk, usin->sin6_scope_id))
 195                                 return -EINVAL;
 196
 197                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 198                 }
 199
 200                 /* Connect to link-local address requires an interface */
 201                 if (!sk->sk_bound_dev_if)
 202                         return -EINVAL;
 203         }
 204
 205         if (tp->rx_opt.ts_recent_stamp &&
 206             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 207                 tp->rx_opt.ts_recent = 0;
 208                 tp->rx_opt.ts_recent_stamp = 0;
 209                 tp->write_seq = 0;
 210         }
 211
 212         sk->sk_v6_daddr = usin->sin6_addr;
 213         np->flow_label = fl6.flowlabel;
 214
 215         /*
 216          *      TCP over IPv4
 217          */
 218
 219         if (addr_type & IPV6_ADDR_MAPPED) {
 220                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 221                 struct sockaddr_in sin;
 222
 223                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 224
 225                 if (__ipv6_only_sock(sk))
 226                         return -ENETUNREACH;
 227
 228                 sin.sin_family = AF_INET;
 229                 sin.sin_port = usin->sin6_port;
 230                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 231
 232                 icsk->icsk_af_ops = &ipv6_mapped;
 233                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 234 #ifdef CONFIG_TCP_MD5SIG
 235                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 236 #endif
 237
 238                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 239
 240                 if (err) {
 241                         icsk->icsk_ext_hdr_len = exthdrlen;
 242                         icsk->icsk_af_ops = &ipv6_specific;
 243                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 244 #ifdef CONFIG_TCP_MD5SIG
 245                         tp->af_specific = &tcp_sock_ipv6_specific;
 246 #endif
 247                         goto failure;
 248                 }
 249                 np->saddr = sk->sk_v6_rcv_saddr;
 250
 251                 return err;
 252         }
 253
 254         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 255                 saddr = &sk->sk_v6_rcv_saddr;
 256
 257         fl6.flowi6_proto = IPPROTO_TCP;
 258         fl6.daddr = sk->sk_v6_daddr;
 259         fl6.saddr = saddr ? *saddr : np->saddr;
 260         fl6.flowi6_oif = sk->sk_bound_dev_if;
 261         fl6.flowi6_mark = sk->sk_mark;
 262         fl6.fl6_dport = usin->sin6_port;
 263         fl6.fl6_sport = inet->inet_sport;
 264         fl6.flowi6_uid = sk->sk_uid;
 265
 266         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 267         final_p = fl6_update_dst(&fl6, opt, &final);
 268
 269         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 270
 271         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 272         if (IS_ERR(dst)) {
 273                 err = PTR_ERR(dst);
 274                 goto failure;
 275         }
 276
 277         if (!saddr) {
 278                 saddr = &fl6.saddr;
 279                 sk->sk_v6_rcv_saddr = *saddr;
 280         }
 281
 282         /* set the source address */
 283         np->saddr = *saddr;
 284         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 285
 286         sk->sk_gso_type = SKB_GSO_TCPV6;
 287         ip6_dst_store(sk, dst, NULL, NULL);
 288
 289         icsk->icsk_ext_hdr_len = 0;
 290         if (opt)
 291                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 292                                          opt->opt_nflen;
 293
 294         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 295
 296         inet->inet_dport = usin->sin6_port;
 297
 298         tcp_set_state(sk, TCP_SYN_SENT);
 299         err = inet6_hash_connect(tcp_death_row, sk);
 300         if (err)
 301                 goto late_failure;
 302
 303         sk_set_txhash(sk);
 304
 305         if (likely(!tp->repair)) {
 306                 if (!tp->write_seq)
 307                         tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
 308                                                          sk->sk_v6_daddr.s6_addr32,
 309                                                          inet->inet_sport,
 310                                                          inet->inet_dport);
 311                 tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
 312                                                    np->saddr.s6_addr32,
 313                                                    sk->sk_v6_daddr.s6_addr32);
 314         }
 315
 316         if (tcp_fastopen_defer_connect(sk, &err))
 317                 return err;
 318         if (err)
 319                 goto late_failure;
 320
 321         err = tcp_connect(sk);
 322         if (err)
 323                 goto late_failure;
 324
 325         return 0;
 326
 327 late_failure:
 328         tcp_set_state(sk, TCP_CLOSE);
 329 failure:
 330         inet->inet_dport = 0;
 331         sk->sk_route_caps = 0;
 332         return err;
 333 }
 334
 335 static void tcp_v6_mtu_reduced(struct sock *sk)
 336 {
 337         struct dst_entry *dst;
 338
 339         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 340                 return;
 341
 342         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 343         if (!dst)
 344                 return;
 345
 346         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 347                 tcp_sync_mss(sk, dst_mtu(dst));
 348                 tcp_simple_retransmit(sk);
 349         }
 350 }
 351
 352 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 353                 u8 type, u8 code, int offset, __be32 info)
 354 {
 355         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 356         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 357         struct net *net = dev_net(skb->dev);
 358         struct request_sock *fastopen;
 359         struct ipv6_pinfo *np;
 360         struct tcp_sock *tp;
 361         __u32 seq, snd_una;
 362         struct sock *sk;
 363         bool fatal;
 364         int err;
 365
 366         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 367                                         &hdr->daddr, th->dest,
 368                                         &hdr->saddr, ntohs(th->source),
 369                                         skb->dev->ifindex, inet6_sdif(skb));
 370
 371         if (!sk) {
 372                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 373                                   ICMP6_MIB_INERRORS);
 374                 return;
 375         }
 376
 377         if (sk->sk_state == TCP_TIME_WAIT) {
 378                 inet_twsk_put(inet_twsk(sk));
 379                 return;
 380         }
 381         seq = ntohl(th->seq);
 382         fatal = icmpv6_err_convert(type, code, &err);
 383         if (sk->sk_state == TCP_NEW_SYN_RECV)
 384                 return tcp_req_err(sk, seq, fatal);
 385
 386         bh_lock_sock(sk);
 387         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 388                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 389
 390         if (sk->sk_state == TCP_CLOSE)
 391                 goto out;
 392
 393         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 394                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 395                 goto out;
 396         }
 397
 398         tp = tcp_sk(sk);
 399         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 400         fastopen = tp->fastopen_rsk;
 401         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 402         if (sk->sk_state != TCP_LISTEN &&
 403             !between(seq, snd_una, tp->snd_nxt)) {
 404                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 405                 goto out;
 406         }
 407
 408         np = inet6_sk(sk);
 409
 410         if (type == NDISC_REDIRECT) {
 411                 if (!sock_owned_by_user(sk)) {
 412                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 413
 414                         if (dst)
 415                                 dst->ops->redirect(dst, sk, skb);
 416                 }
 417                 goto out;
 418         }
 419
 420         if (type == ICMPV6_PKT_TOOBIG) {
 421                 /* We are not interested in TCP_LISTEN and open_requests
 422                  * (SYN-ACKs send out by Linux are always <576bytes so
 423                  * they should go through unfragmented).
 424                  */
 425                 if (sk->sk_state == TCP_LISTEN)
 426                         goto out;
 427
 428                 if (!ip6_sk_accept_pmtu(sk))
 429                         goto out;
 430
 431                 tp->mtu_info = ntohl(info);
 432                 if (!sock_owned_by_user(sk))
 433                         tcp_v6_mtu_reduced(sk);
 434                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 435                                            &sk->sk_tsq_flags))
 436                         sock_hold(sk);
 437                 goto out;
 438         }
 439
 440
 441         /* Might be for an request_sock */
 442         switch (sk->sk_state) {
 443         case TCP_SYN_SENT:
 444         case TCP_SYN_RECV:
 445                 /* Only in fast or simultaneous open. If a fast open socket is
 446                  * is already accepted it is treated as a connected one below.
 447                  */
 448                 if (fastopen && !fastopen->sk)
 449                         break;
 450
 451                 if (!sock_owned_by_user(sk)) {
 452                         sk->sk_err = err;
 453                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 454
 455                         tcp_done(sk);
 456                 } else
 457                         sk->sk_err_soft = err;
 458                 goto out;
 459         }
 460
 461         if (!sock_owned_by_user(sk) && np->recverr) {
 462                 sk->sk_err = err;
 463                 sk->sk_error_report(sk);
 464         } else
 465                 sk->sk_err_soft = err;
 466
 467 out:
 468         bh_unlock_sock(sk);
 469         sock_put(sk);
 470 }
 471
 472
 473 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 474                               struct flowi *fl,
 475                               struct request_sock *req,
 476                               struct tcp_fastopen_cookie *foc,
 477                               enum tcp_synack_type synack_type)
 478 {
 479         struct inet_request_sock *ireq = inet_rsk(req);
 480         struct ipv6_pinfo *np = inet6_sk(sk);
 481         struct ipv6_txoptions *opt;
 482         struct flowi6 *fl6 = &fl->u.ip6;
 483         struct sk_buff *skb;
 484         int err = -ENOMEM;
 485
 486         /* First, grab a route. */
 487         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 488                                                IPPROTO_TCP)) == NULL)
 489                 goto done;
 490
 491         skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 492
 493         if (skb) {
 494                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 495                                     &ireq->ir_v6_rmt_addr);
 496
 497                 fl6->daddr = ireq->ir_v6_rmt_addr;
 498                 if (np->repflow && ireq->pktopts)
 499                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 500
 501                 rcu_read_lock();
 502                 opt = ireq->ipv6_opt;
 503                 if (!opt)
 504                         opt = rcu_dereference(np->opt);
 505                 err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
 506                 rcu_read_unlock();
 507                 err = net_xmit_eval(err);
 508         }
 509
 510 done:
 511         return err;
 512 }
 513
 514
 515 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 516 {
 517         kfree(inet_rsk(req)->ipv6_opt);
 518         kfree_skb(inet_rsk(req)->pktopts);
 519 }
 520
 521 #ifdef CONFIG_TCP_MD5SIG
 522 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 523                                                    const struct in6_addr *addr)
 524 {
 525         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 526 }
 527
 528 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 529                                                 const struct sock *addr_sk)
 530 {
 531         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 532 }
 533
 534 static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
 535                                  char __user *optval, int optlen)
 536 {
 537         struct tcp_md5sig cmd;
 538         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 539         u8 prefixlen;
 540
 541         if (optlen < sizeof(cmd))
 542                 return -EINVAL;
 543
 544         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 545                 return -EFAULT;
 546
 547         if (sin6->sin6_family != AF_INET6)
 548                 return -EINVAL;
 549
 550         if (optname == TCP_MD5SIG_EXT &&
 551             cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
 552                 prefixlen = cmd.tcpm_prefixlen;
 553                 if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
 554                                         prefixlen > 32))
 555                         return -EINVAL;
 556         } else {
 557                 prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
 558         }
 559
 560         if (!cmd.tcpm_keylen) {
 561                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 562                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 563                                               AF_INET, prefixlen);
 564                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 565                                       AF_INET6, prefixlen);
 566         }
 567
 568         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 569                 return -EINVAL;
 570
 571         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 572                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 573                                       AF_INET, prefixlen, cmd.tcpm_key,
 574                                       cmd.tcpm_keylen, GFP_KERNEL);
 575
 576         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 577                               AF_INET6, prefixlen, cmd.tcpm_key,
 578                               cmd.tcpm_keylen, GFP_KERNEL);
 579 }
 580
 581 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 582                                    const struct in6_addr *daddr,
 583                                    const struct in6_addr *saddr,
 584                                    const struct tcphdr *th, int nbytes)
 585 {
 586         struct tcp6_pseudohdr *bp;
 587         struct scatterlist sg;
 588         struct tcphdr *_th;
 589
 590         bp = hp->scratch;
 591         /* 1. TCP pseudo-header (RFC2460) */
 592         bp->saddr = *saddr;
 593         bp->daddr = *daddr;
 594         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 595         bp->len = cpu_to_be32(nbytes);
 596
 597         _th = (struct tcphdr *)(bp + 1);
 598         memcpy(_th, th, sizeof(*th));
 599         _th->check = 0;
 600
 601         sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 602         ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 603                                 sizeof(*bp) + sizeof(*th));
 604         return crypto_ahash_update(hp->md5_req);
 605 }
 606
 607 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 608                                const struct in6_addr *daddr, struct in6_addr *saddr,
 609                                const struct tcphdr *th)
 610 {
 611         struct tcp_md5sig_pool *hp;
 612         struct ahash_request *req;
 613
 614         hp = tcp_get_md5sig_pool();
 615         if (!hp)
 616                 goto clear_hash_noput;
 617         req = hp->md5_req;
 618
 619         if (crypto_ahash_init(req))
 620                 goto clear_hash;
 621         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 622                 goto clear_hash;
 623         if (tcp_md5_hash_key(hp, key))
 624                 goto clear_hash;
 625         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 626         if (crypto_ahash_final(req))
 627                 goto clear_hash;
 628
 629         tcp_put_md5sig_pool();
 630         return 0;
 631
 632 clear_hash:
 633         tcp_put_md5sig_pool();
 634 clear_hash_noput:
 635         memset(md5_hash, 0, 16);
 636         return 1;
 637 }
 638
 639 static int tcp_v6_md5_hash_skb(char *md5_hash,
 640                                const struct tcp_md5sig_key *key,
 641                                const struct sock *sk,
 642                                const struct sk_buff *skb)
 643 {
 644         const struct in6_addr *saddr, *daddr;
 645         struct tcp_md5sig_pool *hp;
 646         struct ahash_request *req;
 647         const struct tcphdr *th = tcp_hdr(skb);
 648
 649         if (sk) { /* valid for establish/request sockets */
 650                 saddr = &sk->sk_v6_rcv_saddr;
 651                 daddr = &sk->sk_v6_daddr;
 652         } else {
 653                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 654                 saddr = &ip6h->saddr;
 655                 daddr = &ip6h->daddr;
 656         }
 657
 658         hp = tcp_get_md5sig_pool();
 659         if (!hp)
 660                 goto clear_hash_noput;
 661         req = hp->md5_req;
 662
 663         if (crypto_ahash_init(req))
 664                 goto clear_hash;
 665
 666         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 667                 goto clear_hash;
 668         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 669                 goto clear_hash;
 670         if (tcp_md5_hash_key(hp, key))
 671                 goto clear_hash;
 672         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 673         if (crypto_ahash_final(req))
 674                 goto clear_hash;
 675
 676         tcp_put_md5sig_pool();
 677         return 0;
 678
 679 clear_hash:
 680         tcp_put_md5sig_pool();
 681 clear_hash_noput:
 682         memset(md5_hash, 0, 16);
 683         return 1;
 684 }
 685
 686 #endif
 687
 688 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 689                                     const struct sk_buff *skb)
 690 {
 691 #ifdef CONFIG_TCP_MD5SIG
 692         const __u8 *hash_location = NULL;
 693         struct tcp_md5sig_key *hash_expected;
 694         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 695         const struct tcphdr *th = tcp_hdr(skb);
 696         int genhash;
 697         u8 newhash[16];
 698
 699         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 700         hash_location = tcp_parse_md5sig_option(th);
 701
 702         /* We've parsed the options - do we have a hash? */
 703         if (!hash_expected && !hash_location)
 704                 return false;
 705
 706         if (hash_expected && !hash_location) {
 707                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 708                 return true;
 709         }
 710
 711         if (!hash_expected && hash_location) {
 712                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 713                 return true;
 714         }
 715
 716         /* check the signature */
 717         genhash = tcp_v6_md5_hash_skb(newhash,
 718                                       hash_expected,
 719                                       NULL, skb);
 720
 721         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 722                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 723                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 724                                      genhash ? "failed" : "mismatch",
 725                                      &ip6h->saddr, ntohs(th->source),
 726                                      &ip6h->daddr, ntohs(th->dest));
 727                 return true;
 728         }
 729 #endif
 730         return false;
 731 }
 732
 733 static void tcp_v6_init_req(struct request_sock *req,
 734                             const struct sock *sk_listener,
 735                             struct sk_buff *skb)
 736 {
 737         struct inet_request_sock *ireq = inet_rsk(req);
 738         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 739
 740         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 741         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 742
 743         /* So that link locals have meaning */
 744         if (!sk_listener->sk_bound_dev_if &&
 745             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 746                 ireq->ir_iif = tcp_v6_iif(skb);
 747
 748         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 749             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 750              np->rxopt.bits.rxinfo ||
 751              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 752              np->rxopt.bits.rxohlim || np->repflow)) {
 753                 refcount_inc(&skb->users);
 754                 ireq->pktopts = skb;
 755         }
 756 }
 757
 758 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 759                                           struct flowi *fl,
 760                                           const struct request_sock *req)
 761 {
 762         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 763 }
 764
 765 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 766         .family         =       AF_INET6,
 767         .obj_size       =       sizeof(struct tcp6_request_sock),
 768         .rtx_syn_ack    =       tcp_rtx_synack,
 769         .send_ack       =       tcp_v6_reqsk_send_ack,
 770         .destructor     =       tcp_v6_reqsk_destructor,
 771         .send_reset     =       tcp_v6_send_reset,
 772         .syn_ack_timeout =      tcp_syn_ack_timeout,
 773 };
 774
 775 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 776         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 777                                 sizeof(struct ipv6hdr),
 778 #ifdef CONFIG_TCP_MD5SIG
 779         .req_md5_lookup =       tcp_v6_md5_lookup,
 780         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 781 #endif
 782         .init_req       =       tcp_v6_init_req,
 783 #ifdef CONFIG_SYN_COOKIES
 784         .cookie_init_seq =      cookie_v6_init_sequence,
 785 #endif
 786         .route_req      =       tcp_v6_route_req,
 787         .init_seq       =       tcp_v6_init_seq,
 788         .init_ts_off    =       tcp_v6_init_ts_off,
 789         .send_synack    =       tcp_v6_send_synack,
 790 };
 791
 792 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 793                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 794                                  int oif, struct tcp_md5sig_key *key, int rst,
 795                                  u8 tclass, __be32 label)
 796 {
 797         const struct tcphdr *th = tcp_hdr(skb);
 798         struct tcphdr *t1;
 799         struct sk_buff *buff;
 800         struct flowi6 fl6;
 801         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 802         struct sock *ctl_sk = net->ipv6.tcp_sk;
 803         unsigned int tot_len = sizeof(struct tcphdr);
 804         struct dst_entry *dst;
 805         __be32 *topt;
 806         __u32 mark = 0;
 807
 808         if (tsecr)
 809                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 810 #ifdef CONFIG_TCP_MD5SIG
 811         if (key)
 812                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 813 #endif
 814
 815         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 816                          GFP_ATOMIC);
 817         if (!buff)
 818                 return;
 819
 820         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 821
 822         t1 = skb_push(buff, tot_len);
 823         skb_reset_transport_header(buff);
 824
 825         /* Swap the send and the receive. */
 826         memset(t1, 0, sizeof(*t1));
 827         t1->dest = th->source;
 828         t1->source = th->dest;
 829         t1->doff = tot_len / 4;
 830         t1->seq = htonl(seq);
 831         t1->ack_seq = htonl(ack);
 832         t1->ack = !rst || !th->ack;
 833         t1->rst = rst;
 834         t1->window = htons(win);
 835
 836         topt = (__be32 *)(t1 + 1);
 837
 838         if (tsecr) {
 839                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 840                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 841                 *topt++ = htonl(tsval);
 842                 *topt++ = htonl(tsecr);
 843         }
 844
 845 #ifdef CONFIG_TCP_MD5SIG
 846         if (key) {
 847                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 848                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 849                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 850                                     &ipv6_hdr(skb)->saddr,
 851                                     &ipv6_hdr(skb)->daddr, t1);
 852         }
 853 #endif
 854
 855         memset(&fl6, 0, sizeof(fl6));
 856         fl6.daddr = ipv6_hdr(skb)->saddr;
 857         fl6.saddr = ipv6_hdr(skb)->daddr;
 858         fl6.flowlabel = label;
 859
 860         buff->ip_summed = CHECKSUM_PARTIAL;
 861         buff->csum = 0;
 862
 863         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 864
 865         fl6.flowi6_proto = IPPROTO_TCP;
 866         if (rt6_need_strict(&fl6.daddr) && !oif)
 867                 fl6.flowi6_oif = tcp_v6_iif(skb);
 868         else {
 869                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 870                         oif = skb->skb_iif;
 871
 872                 fl6.flowi6_oif = oif;
 873         }
 874
 875         if (sk)
 876                 mark = (sk->sk_state == TCP_TIME_WAIT) ?
 877                         inet_twsk(sk)->tw_mark : sk->sk_mark;
 878         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark) ?: mark;
 879         fl6.fl6_dport = t1->dest;
 880         fl6.fl6_sport = t1->source;
 881         fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 882         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 883
 884         /* Pass a socket to ip6_dst_lookup either it is for RST
 885          * Underlying function will use this to retrieve the network
 886          * namespace
 887          */
 888         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 889         if (!IS_ERR(dst)) {
 890                 skb_dst_set(buff, dst);
 891                 ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
 892                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 893                 if (rst)
 894                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 895                 return;
 896         }
 897
 898         kfree_skb(buff);
 899 }
 900
 901 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 902 {
 903         const struct tcphdr *th = tcp_hdr(skb);
 904         u32 seq = 0, ack_seq = 0;
 905         struct tcp_md5sig_key *key = NULL;
 906 #ifdef CONFIG_TCP_MD5SIG
 907         const __u8 *hash_location = NULL;
 908         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 909         unsigned char newhash[16];
 910         int genhash;
 911         struct sock *sk1 = NULL;
 912 #endif
 913         int oif = 0;
 914
 915         if (th->rst)
 916                 return;
 917
 918         /* If sk not NULL, it means we did a successful lookup and incoming
 919          * route had to be correct. prequeue might have dropped our dst.
 920          */
 921         if (!sk && !ipv6_unicast_destination(skb))
 922                 return;
 923
 924 #ifdef CONFIG_TCP_MD5SIG
 925         rcu_read_lock();
 926         hash_location = tcp_parse_md5sig_option(th);
 927         if (sk && sk_fullsock(sk)) {
 928                 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 929         } else if (hash_location) {
 930                 /*
 931                  * active side is lost. Try to find listening socket through
 932                  * source port, and then find md5 key through listening socket.
 933                  * we are not loose security here:
 934                  * Incoming packet is checked with md5 hash with finding key,
 935                  * no RST generated if md5 hash doesn't match.
 936                  */
 937                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 938                                            &tcp_hashinfo, NULL, 0,
 939                                            &ipv6h->saddr,
 940                                            th->source, &ipv6h->daddr,
 941                                            ntohs(th->source),
 942                                            tcp_v6_iif_l3_slave(skb),
 943                                            tcp_v6_sdif(skb));
 944                 if (!sk1)
 945                         goto out;
 946
 947                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 948                 if (!key)
 949                         goto out;
 950
 951                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 952                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 953                         goto out;
 954         }
 955 #endif
 956
 957         if (th->ack)
 958                 seq = ntohl(th->ack_seq);
 959         else
 960                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 961                           (th->doff << 2);
 962
 963         if (sk) {
 964                 oif = sk->sk_bound_dev_if;
 965                 if (sk_fullsock(sk))
 966                         trace_tcp_send_reset(sk, skb);
 967         }
 968
 969         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 970
 971 #ifdef CONFIG_TCP_MD5SIG
 972 out:
 973         rcu_read_unlock();
 974 #endif
 975 }
 976
 977 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 978                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 979                             struct tcp_md5sig_key *key, u8 tclass,
 980                             __be32 label)
 981 {
 982         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 983                              tclass, label);
 984 }
 985
 986 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 987 {
 988         struct inet_timewait_sock *tw = inet_twsk(sk);
 989         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 990
 991         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 992                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 993                         tcp_time_stamp_raw() + tcptw->tw_ts_offset,
 994                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 995                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 996
 997         inet_twsk_put(tw);
 998 }
 999
1000 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
1001                                   struct request_sock *req)
1002 {
1003         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
1004          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
1005          */
1006         /* RFC 7323 2.3
1007          * The window field (SEG.WND) of every outgoing segment, with the
1008          * exception of <SYN> segments, MUST be right-shifted by
1009          * Rcv.Wind.Shift bits:
1010          */
1011         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
1012                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
1013                         tcp_rsk(req)->rcv_nxt,
1014                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1015                         tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1016                         req->ts_recent, sk->sk_bound_dev_if,
1017                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
1018                         0, 0);
1019 }
1020
1021
1022 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
1023 {
1024 #ifdef CONFIG_SYN_COOKIES
1025         const struct tcphdr *th = tcp_hdr(skb);
1026
1027         if (!th->syn)
1028                 sk = cookie_v6_check(sk, skb);
1029 #endif
1030         return sk;
1031 }
1032
1033 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1034 {
1035         if (skb->protocol == htons(ETH_P_IP))
1036                 return tcp_v4_conn_request(sk, skb);
1037
1038         if (!ipv6_unicast_destination(skb))
1039                 goto drop;
1040
1041         return tcp_conn_request(&tcp6_request_sock_ops,
1042                                 &tcp_request_sock_ipv6_ops, sk, skb);
1043
1044 drop:
1045         tcp_listendrop(sk);
1046         return 0; /* don't send reset */
1047 }
1048
1049 static void tcp_v6_restore_cb(struct sk_buff *skb)
1050 {
1051         /* We need to move header back to the beginning if xfrm6_policy_check()
1052          * and tcp_v6_fill_cb() are going to be called again.
1053          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1054          */
1055         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1056                 sizeof(struct inet6_skb_parm));
1057 }
1058
1059 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1060                                          struct request_sock *req,
1061                                          struct dst_entry *dst,
1062                                          struct request_sock *req_unhash,
1063                                          bool *own_req)
1064 {
1065         struct inet_request_sock *ireq;
1066         struct ipv6_pinfo *newnp;
1067         const struct ipv6_pinfo *np = inet6_sk(sk);
1068         struct ipv6_txoptions *opt;
1069         struct tcp6_sock *newtcp6sk;
1070         struct inet_sock *newinet;
1071         struct tcp_sock *newtp;
1072         struct sock *newsk;
1073 #ifdef CONFIG_TCP_MD5SIG
1074         struct tcp_md5sig_key *key;
1075 #endif
1076         struct flowi6 fl6;
1077
1078         if (skb->protocol == htons(ETH_P_IP)) {
1079                 /*
1080                  *      v6 mapped
1081                  */
1082
1083                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1084                                              req_unhash, own_req);
1085
1086                 if (!newsk)
1087                         return NULL;
1088
1089                 newtcp6sk = (struct tcp6_sock *)newsk;
1090                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1091
1092                 newinet = inet_sk(newsk);
1093                 newnp = inet6_sk(newsk);
1094                 newtp = tcp_sk(newsk);
1095
1096                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1097
1098                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1099
1100                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1101                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1102 #ifdef CONFIG_TCP_MD5SIG
1103                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1104 #endif
1105
1106                 newnp->ipv6_mc_list = NULL;
1107                 newnp->ipv6_ac_list = NULL;
1108                 newnp->ipv6_fl_list = NULL;
1109                 newnp->pktoptions  = NULL;
1110                 newnp->opt         = NULL;
1111                 newnp->mcast_oif   = tcp_v6_iif(skb);
1112                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1113                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1114                 if (np->repflow)
1115                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1116
1117                 /*
1118                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1119                  * here, tcp_create_openreq_child now does this for us, see the comment in
1120                  * that function for the gory details. -acme
1121                  */
1122
1123                 /* It is tricky place. Until this moment IPv4 tcp
1124                    worked with IPv6 icsk.icsk_af_ops.
1125                    Sync it now.
1126                  */
1127                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1128
1129                 return newsk;
1130         }
1131
1132         ireq = inet_rsk(req);
1133
1134         if (sk_acceptq_is_full(sk))
1135                 goto out_overflow;
1136
1137         if (!dst) {
1138                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1139                 if (!dst)
1140                         goto out;
1141         }
1142
1143         newsk = tcp_create_openreq_child(sk, req, skb);
1144         if (!newsk)
1145                 goto out_nonewsk;
1146
1147         /*
1148          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1149          * count here, tcp_create_openreq_child now does this for us, see the
1150          * comment in that function for the gory details. -acme
1151          */
1152
1153         newsk->sk_gso_type = SKB_GSO_TCPV6;
1154         ip6_dst_store(newsk, dst, NULL, NULL);
1155         inet6_sk_rx_dst_set(newsk, skb);
1156
1157         newtcp6sk = (struct tcp6_sock *)newsk;
1158         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1159
1160         newtp = tcp_sk(newsk);
1161         newinet = inet_sk(newsk);
1162         newnp = inet6_sk(newsk);
1163
1164         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1165
1166         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1167         newnp->saddr = ireq->ir_v6_loc_addr;
1168         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1169         newsk->sk_bound_dev_if = ireq->ir_iif;
1170
1171         /* Now IPv6 options...
1172
1173            First: no IPv4 options.
1174          */
1175         newinet->inet_opt = NULL;
1176         newnp->ipv6_mc_list = NULL;
1177         newnp->ipv6_ac_list = NULL;
1178         newnp->ipv6_fl_list = NULL;
1179
1180         /* Clone RX bits */
1181         newnp->rxopt.all = np->rxopt.all;
1182
1183         newnp->pktoptions = NULL;
1184         newnp->opt        = NULL;
1185         newnp->mcast_oif  = tcp_v6_iif(skb);
1186         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1187         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1188         if (np->repflow)
1189                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1190
1191         /* Clone native IPv6 options from listening socket (if any)
1192
1193            Yes, keeping reference count would be much more clever,
1194            but we make one more one thing there: reattach optmem
1195            to newsk.
1196          */
1197         opt = ireq->ipv6_opt;
1198         if (!opt)
1199                 opt = rcu_dereference(np->opt);
1200         if (opt) {
1201                 opt = ipv6_dup_options(newsk, opt);
1202                 RCU_INIT_POINTER(newnp->opt, opt);
1203         }
1204         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1205         if (opt)
1206                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1207                                                     opt->opt_flen;
1208
1209         tcp_ca_openreq_child(newsk, dst);
1210
1211         tcp_sync_mss(newsk, dst_mtu(dst));
1212         newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
1213
1214         tcp_initialize_rcv_mss(newsk);
1215
1216         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1217         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1218
1219 #ifdef CONFIG_TCP_MD5SIG
1220         /* Copy over the MD5 key from the original socket */
1221         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1222         if (key) {
1223                 /* We're using one, so create a matching key
1224                  * on the newsk structure. If we fail to get
1225                  * memory, then we end up not copying the key
1226                  * across. Shucks.
1227                  */
1228                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1229                                AF_INET6, 128, key->key, key->keylen,
1230                                sk_gfp_mask(sk, GFP_ATOMIC));
1231         }
1232 #endif
1233
1234         if (__inet_inherit_port(sk, newsk) < 0) {
1235                 inet_csk_prepare_forced_close(newsk);
1236                 tcp_done(newsk);
1237                 goto out;
1238         }
1239         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1240         if (*own_req) {
1241                 tcp_move_syn(newtp, req);
1242
1243                 /* Clone pktoptions received with SYN, if we own the req */
1244                 if (ireq->pktopts) {
1245                         newnp->pktoptions = skb_clone(ireq->pktopts,
1246                                                       sk_gfp_mask(sk, GFP_ATOMIC));
1247                         consume_skb(ireq->pktopts);
1248                         ireq->pktopts = NULL;
1249                         if (newnp->pktoptions) {
1250                                 tcp_v6_restore_cb(newnp->pktoptions);
1251                                 skb_set_owner_r(newnp->pktoptions, newsk);
1252                         }
1253                 }
1254         }
1255
1256         return newsk;
1257
1258 out_overflow:
1259         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1260 out_nonewsk:
1261         dst_release(dst);
1262 out:
1263         tcp_listendrop(sk);
1264         return NULL;
1265 }
1266
1267 /* The socket must have it's spinlock held when we get
1268  * here, unless it is a TCP_LISTEN socket.
1269  *
1270  * We have a potential double-lock case here, so even when
1271  * doing backlog processing we use the BH locking scheme.
1272  * This is because we cannot sleep with the original spinlock
1273  * held.
1274  */
1275 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1276 {
1277         struct ipv6_pinfo *np = inet6_sk(sk);
1278         struct tcp_sock *tp;
1279         struct sk_buff *opt_skb = NULL;
1280
1281         /* Imagine: socket is IPv6. IPv4 packet arrives,
1282            goes to IPv4 receive handler and backlogged.
1283            From backlog it always goes here. Kerboom...
1284            Fortunately, tcp_rcv_established and rcv_established
1285            handle them correctly, but it is not case with
1286            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1287          */
1288
1289         if (skb->protocol == htons(ETH_P_IP))
1290                 return tcp_v4_do_rcv(sk, skb);
1291
1292         /*
1293          *      socket locking is here for SMP purposes as backlog rcv
1294          *      is currently called with bh processing disabled.
1295          */
1296
1297         /* Do Stevens' IPV6_PKTOPTIONS.
1298
1299            Yes, guys, it is the only place in our code, where we
1300            may make it not affecting IPv4.
1301            The rest of code is protocol independent,
1302            and I do not like idea to uglify IPv4.
1303
1304            Actually, all the idea behind IPV6_PKTOPTIONS
1305            looks not very well thought. For now we latch
1306            options, received in the last packet, enqueued
1307            by tcp. Feel free to propose better solution.
1308                                                --ANK (980728)
1309          */
1310         if (np->rxopt.all)
1311                 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1312
1313         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1314                 struct dst_entry *dst = sk->sk_rx_dst;
1315
1316                 sock_rps_save_rxhash(sk, skb);
1317                 sk_mark_napi_id(sk, skb);
1318                 if (dst) {
1319                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1320                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1321                                 dst_release(dst);
1322                                 sk->sk_rx_dst = NULL;
1323                         }
1324                 }
1325
1326                 tcp_rcv_established(sk, skb);
1327                 if (opt_skb)
1328                         goto ipv6_pktoptions;
1329                 return 0;
1330         }
1331
1332         if (tcp_checksum_complete(skb))
1333                 goto csum_err;
1334
1335         if (sk->sk_state == TCP_LISTEN) {
1336                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1337
1338                 if (!nsk)
1339                         goto discard;
1340
1341                 if (nsk != sk) {
1342                         if (tcp_child_process(sk, nsk, skb))
1343                                 goto reset;
1344                         if (opt_skb)
1345                                 __kfree_skb(opt_skb);
1346                         return 0;
1347                 }
1348         } else
1349                 sock_rps_save_rxhash(sk, skb);
1350
1351         if (tcp_rcv_state_process(sk, skb))
1352                 goto reset;
1353         if (opt_skb)
1354                 goto ipv6_pktoptions;
1355         return 0;
1356
1357 reset:
1358         tcp_v6_send_reset(sk, skb);
1359 discard:
1360         if (opt_skb)
1361                 __kfree_skb(opt_skb);
1362         kfree_skb(skb);
1363         return 0;
1364 csum_err:
1365         TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1366         TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1367         goto discard;
1368
1369
1370 ipv6_pktoptions:
1371         /* Do you ask, what is it?
1372
1373            1. skb was enqueued by tcp.
1374            2. skb is added to tail of read queue, rather than out of order.
1375            3. socket is not in passive state.
1376            4. Finally, it really contains options, which user wants to receive.
1377          */
1378         tp = tcp_sk(sk);
1379         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1380             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1381                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1382                         np->mcast_oif = tcp_v6_iif(opt_skb);
1383                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1384                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1385                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1386                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1387                 if (np->repflow)
1388                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1389                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1390                         skb_set_owner_r(opt_skb, sk);
1391                         tcp_v6_restore_cb(opt_skb);
1392                         opt_skb = xchg(&np->pktoptions, opt_skb);
1393                 } else {
1394                         __kfree_skb(opt_skb);
1395                         opt_skb = xchg(&np->pktoptions, NULL);
1396                 }
1397         }
1398
1399         kfree_skb(opt_skb);
1400         return 0;
1401 }
1402
1403 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1404                            const struct tcphdr *th)
1405 {
1406         /* This is tricky: we move IP6CB at its correct location into
1407          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1408          * _decode_session6() uses IP6CB().
1409          * barrier() makes sure compiler won't play aliasing games.
1410          */
1411         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1412                 sizeof(struct inet6_skb_parm));
1413         barrier();
1414
1415         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1416         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1417                                     skb->len - th->doff*4);
1418         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1419         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1420         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1421         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1422         TCP_SKB_CB(skb)->sacked = 0;
1423         TCP_SKB_CB(skb)->has_rxtstamp =
1424                         skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
1425 }
1426
1427 static int tcp_v6_rcv(struct sk_buff *skb)
1428 {
1429         int sdif = inet6_sdif(skb);
1430         const struct tcphdr *th;
1431         const struct ipv6hdr *hdr;
1432         bool refcounted;
1433         struct sock *sk;
1434         int ret;
1435         struct net *net = dev_net(skb->dev);
1436
1437         if (skb->pkt_type != PACKET_HOST)
1438                 goto discard_it;
1439
1440         /*
1441          *      Count it even if it's bad.
1442          */
1443         __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1444
1445         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1446                 goto discard_it;
1447
1448         th = (const struct tcphdr *)skb->data;
1449
1450         if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1451                 goto bad_packet;
1452         if (!pskb_may_pull(skb, th->doff*4))
1453                 goto discard_it;
1454
1455         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1456                 goto csum_error;
1457
1458         th = (const struct tcphdr *)skb->data;
1459         hdr = ipv6_hdr(skb);
1460
1461 lookup:
1462         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1463                                 th->source, th->dest, inet6_iif(skb), sdif,
1464                                 &refcounted);
1465         if (!sk)
1466                 goto no_tcp_socket;
1467
1468 process:
1469         if (sk->sk_state == TCP_TIME_WAIT)
1470                 goto do_time_wait;
1471
1472         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1473                 struct request_sock *req = inet_reqsk(sk);
1474                 bool req_stolen = false;
1475                 struct sock *nsk;
1476
1477                 sk = req->rsk_listener;
1478                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1479                         sk_drops_add(sk, skb);
1480                         reqsk_put(req);
1481                         goto discard_it;
1482                 }
1483                 if (tcp_checksum_complete(skb)) {
1484                         reqsk_put(req);
1485                         goto csum_error;
1486                 }
1487                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1488                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1489                         goto lookup;
1490                 }
1491                 sock_hold(sk);
1492                 refcounted = true;
1493                 nsk = NULL;
1494                 if (!tcp_filter(sk, skb)) {
1495                         th = (const struct tcphdr *)skb->data;
1496                         hdr = ipv6_hdr(skb);
1497                         tcp_v6_fill_cb(skb, hdr, th);
1498                         nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
1499                 }
1500                 if (!nsk) {
1501                         reqsk_put(req);
1502                         if (req_stolen) {
1503                                 /* Another cpu got exclusive access to req
1504                                  * and created a full blown socket.
1505                                  * Try to feed this packet to this socket
1506                                  * instead of discarding it.
1507                                  */
1508                                 tcp_v6_restore_cb(skb);
1509                                 sock_put(sk);
1510                                 goto lookup;
1511                         }
1512                         goto discard_and_relse;
1513                 }
1514                 if (nsk == sk) {
1515                         reqsk_put(req);
1516                         tcp_v6_restore_cb(skb);
1517                 } else if (tcp_child_process(sk, nsk, skb)) {
1518                         tcp_v6_send_reset(nsk, skb);
1519                         goto discard_and_relse;
1520                 } else {
1521                         sock_put(sk);
1522                         return 0;
1523                 }
1524         }
1525         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1526                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1527                 goto discard_and_relse;
1528         }
1529
1530         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1531                 goto discard_and_relse;
1532
1533         if (tcp_v6_inbound_md5_hash(sk, skb))
1534                 goto discard_and_relse;
1535
1536         if (tcp_filter(sk, skb))
1537                 goto discard_and_relse;
1538         th = (const struct tcphdr *)skb->data;
1539         hdr = ipv6_hdr(skb);
1540         tcp_v6_fill_cb(skb, hdr, th);
1541
1542         skb->dev = NULL;
1543
1544         if (sk->sk_state == TCP_LISTEN) {
1545                 ret = tcp_v6_do_rcv(sk, skb);
1546                 goto put_and_return;
1547         }
1548
1549         sk_incoming_cpu_update(sk);
1550
1551         bh_lock_sock_nested(sk);
1552         tcp_segs_in(tcp_sk(sk), skb);
1553         ret = 0;
1554         if (!sock_owned_by_user(sk)) {
1555                 ret = tcp_v6_do_rcv(sk, skb);
1556         } else if (tcp_add_backlog(sk, skb)) {
1557                 goto discard_and_relse;
1558         }
1559         bh_unlock_sock(sk);
1560
1561 put_and_return:
1562         if (refcounted)
1563                 sock_put(sk);
1564         return ret ? -1 : 0;
1565
1566 no_tcp_socket:
1567         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1568                 goto discard_it;
1569
1570         tcp_v6_fill_cb(skb, hdr, th);
1571
1572         if (tcp_checksum_complete(skb)) {
1573 csum_error:
1574                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1575 bad_packet:
1576                 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1577         } else {
1578                 tcp_v6_send_reset(NULL, skb);
1579         }
1580
1581 discard_it:
1582         kfree_skb(skb);
1583         return 0;
1584
1585 discard_and_relse:
1586         sk_drops_add(sk, skb);
1587         if (refcounted)
1588                 sock_put(sk);
1589         goto discard_it;
1590
1591 do_time_wait:
1592         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1593                 inet_twsk_put(inet_twsk(sk));
1594                 goto discard_it;
1595         }
1596
1597         tcp_v6_fill_cb(skb, hdr, th);
1598
1599         if (tcp_checksum_complete(skb)) {
1600                 inet_twsk_put(inet_twsk(sk));
1601                 goto csum_error;
1602         }
1603
1604         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1605         case TCP_TW_SYN:
1606         {
1607                 struct sock *sk2;
1608
1609                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1610                                             skb, __tcp_hdrlen(th),
1611                                             &ipv6_hdr(skb)->saddr, th->source,
1612                                             &ipv6_hdr(skb)->daddr,
1613                                             ntohs(th->dest),
1614                                             tcp_v6_iif_l3_slave(skb),
1615                                             sdif);
1616                 if (sk2) {
1617                         struct inet_timewait_sock *tw = inet_twsk(sk);
1618                         inet_twsk_deschedule_put(tw);
1619                         sk = sk2;
1620                         tcp_v6_restore_cb(skb);
1621                         refcounted = false;
1622                         goto process;
1623                 }
1624         }
1625                 /* to ACK */
1626                 /* fall through */
1627         case TCP_TW_ACK:
1628                 tcp_v6_timewait_ack(sk, skb);
1629                 break;
1630         case TCP_TW_RST:
1631                 tcp_v6_send_reset(sk, skb);
1632                 inet_twsk_deschedule_put(inet_twsk(sk));
1633                 goto discard_it;
1634         case TCP_TW_SUCCESS:
1635                 ;
1636         }
1637         goto discard_it;
1638 }
1639
1640 static void tcp_v6_early_demux(struct sk_buff *skb)
1641 {
1642         const struct ipv6hdr *hdr;
1643         const struct tcphdr *th;
1644         struct sock *sk;
1645
1646         if (skb->pkt_type != PACKET_HOST)
1647                 return;
1648
1649         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1650                 return;
1651
1652         hdr = ipv6_hdr(skb);
1653         th = tcp_hdr(skb);
1654
1655         if (th->doff < sizeof(struct tcphdr) / 4)
1656                 return;
1657
1658         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1659         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1660                                         &hdr->saddr, th->source,
1661                                         &hdr->daddr, ntohs(th->dest),
1662                                         inet6_iif(skb), inet6_sdif(skb));
1663         if (sk) {
1664                 skb->sk = sk;
1665                 skb->destructor = sock_edemux;
1666                 if (sk_fullsock(sk)) {
1667                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1668
1669                         if (dst)
1670                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1671                         if (dst &&
1672                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1673                                 skb_dst_set_noref(skb, dst);
1674                 }
1675         }
1676 }
1677
1678 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1679         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1680         .twsk_unique    = tcp_twsk_unique,
1681         .twsk_destructor = tcp_twsk_destructor,
1682 };
1683
1684 static const struct inet_connection_sock_af_ops ipv6_specific = {
1685         .queue_xmit        = inet6_csk_xmit,
1686         .send_check        = tcp_v6_send_check,
1687         .rebuild_header    = inet6_sk_rebuild_header,
1688         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1689         .conn_request      = tcp_v6_conn_request,
1690         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1691         .net_header_len    = sizeof(struct ipv6hdr),
1692         .net_frag_header_len = sizeof(struct frag_hdr),
1693         .setsockopt        = ipv6_setsockopt,
1694         .getsockopt        = ipv6_getsockopt,
1695         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1696         .sockaddr_len      = sizeof(struct sockaddr_in6),
1697 #ifdef CONFIG_COMPAT
1698         .compat_setsockopt = compat_ipv6_setsockopt,
1699         .compat_getsockopt = compat_ipv6_getsockopt,
1700 #endif
1701         .mtu_reduced       = tcp_v6_mtu_reduced,
1702 };
1703
1704 #ifdef CONFIG_TCP_MD5SIG
1705 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1706         .md5_lookup     =       tcp_v6_md5_lookup,
1707         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1708         .md5_parse      =       tcp_v6_parse_md5_keys,
1709 };
1710 #endif
1711
1712 /*
1713  *      TCP over IPv4 via INET6 API
1714  */
1715 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1716         .queue_xmit        = ip_queue_xmit,
1717         .send_check        = tcp_v4_send_check,
1718         .rebuild_header    = inet_sk_rebuild_header,
1719         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1720         .conn_request      = tcp_v6_conn_request,
1721         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1722         .net_header_len    = sizeof(struct iphdr),
1723         .setsockopt        = ipv6_setsockopt,
1724         .getsockopt        = ipv6_getsockopt,
1725         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1726         .sockaddr_len      = sizeof(struct sockaddr_in6),
1727 #ifdef CONFIG_COMPAT
1728         .compat_setsockopt = compat_ipv6_setsockopt,
1729         .compat_getsockopt = compat_ipv6_getsockopt,
1730 #endif
1731         .mtu_reduced       = tcp_v4_mtu_reduced,
1732 };
1733
1734 #ifdef CONFIG_TCP_MD5SIG
1735 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1736         .md5_lookup     =       tcp_v4_md5_lookup,
1737         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1738         .md5_parse      =       tcp_v6_parse_md5_keys,
1739 };
1740 #endif
1741
1742 /* NOTE: A lot of things set to zero explicitly by call to
1743  *       sk_alloc() so need not be done here.
1744  */
1745 static int tcp_v6_init_sock(struct sock *sk)
1746 {
1747         struct inet_connection_sock *icsk = inet_csk(sk);
1748
1749         tcp_init_sock(sk);
1750
1751         icsk->icsk_af_ops = &ipv6_specific;
1752
1753 #ifdef CONFIG_TCP_MD5SIG
1754         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1755 #endif
1756
1757         return 0;
1758 }
1759
1760 static void tcp_v6_destroy_sock(struct sock *sk)
1761 {
1762         tcp_v4_destroy_sock(sk);
1763         inet6_destroy_sock(sk);
1764 }
1765
1766 #ifdef CONFIG_PROC_FS
1767 /* Proc filesystem TCPv6 sock list dumping. */
1768 static void get_openreq6(struct seq_file *seq,
1769                          const struct request_sock *req, int i)
1770 {
1771         long ttd = req->rsk_timer.expires - jiffies;
1772         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1773         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1774
1775         if (ttd < 0)
1776                 ttd = 0;
1777
1778         seq_printf(seq,
1779                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1780                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1781                    i,
1782                    src->s6_addr32[0], src->s6_addr32[1],
1783                    src->s6_addr32[2], src->s6_addr32[3],
1784                    inet_rsk(req)->ir_num,
1785                    dest->s6_addr32[0], dest->s6_addr32[1],
1786                    dest->s6_addr32[2], dest->s6_addr32[3],
1787                    ntohs(inet_rsk(req)->ir_rmt_port),
1788                    TCP_SYN_RECV,
1789                    0, 0, /* could print option size, but that is af dependent. */
1790                    1,   /* timers active (only the expire timer) */
1791                    jiffies_to_clock_t(ttd),
1792                    req->num_timeout,
1793                    from_kuid_munged(seq_user_ns(seq),
1794                                     sock_i_uid(req->rsk_listener)),
1795                    0,  /* non standard timer */
1796                    0, /* open_requests have no inode */
1797                    0, req);
1798 }
1799
1800 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1801 {
1802         const struct in6_addr *dest, *src;
1803         __u16 destp, srcp;
1804         int timer_active;
1805         unsigned long timer_expires;
1806         const struct inet_sock *inet = inet_sk(sp);
1807         const struct tcp_sock *tp = tcp_sk(sp);
1808         const struct inet_connection_sock *icsk = inet_csk(sp);
1809         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1810         int rx_queue;
1811         int state;
1812
1813         dest  = &sp->sk_v6_daddr;
1814         src   = &sp->sk_v6_rcv_saddr;
1815         destp = ntohs(inet->inet_dport);
1816         srcp  = ntohs(inet->inet_sport);
1817
1818         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1819             icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1820             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1821                 timer_active    = 1;
1822                 timer_expires   = icsk->icsk_timeout;
1823         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1824                 timer_active    = 4;
1825                 timer_expires   = icsk->icsk_timeout;
1826         } else if (timer_pending(&sp->sk_timer)) {
1827                 timer_active    = 2;
1828                 timer_expires   = sp->sk_timer.expires;
1829         } else {
1830                 timer_active    = 0;
1831                 timer_expires = jiffies;
1832         }
1833
1834         state = inet_sk_state_load(sp);
1835         if (state == TCP_LISTEN)
1836                 rx_queue = sp->sk_ack_backlog;
1837         else
1838                 /* Because we don't lock the socket,
1839                  * we might find a transient negative value.
1840                  */
1841                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1842
1843         seq_printf(seq,
1844                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1845                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1846                    i,
1847                    src->s6_addr32[0], src->s6_addr32[1],
1848                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1849                    dest->s6_addr32[0], dest->s6_addr32[1],
1850                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1851                    state,
1852                    tp->write_seq - tp->snd_una,
1853                    rx_queue,
1854                    timer_active,
1855                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1856                    icsk->icsk_retransmits,
1857                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1858                    icsk->icsk_probes_out,
1859                    sock_i_ino(sp),
1860                    refcount_read(&sp->sk_refcnt), sp,
1861                    jiffies_to_clock_t(icsk->icsk_rto),
1862                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1863                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1864                    tp->snd_cwnd,
1865                    state == TCP_LISTEN ?
1866                         fastopenq->max_qlen :
1867                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1868                    );
1869 }
1870
1871 static void get_timewait6_sock(struct seq_file *seq,
1872                                struct inet_timewait_sock *tw, int i)
1873 {
1874         long delta = tw->tw_timer.expires - jiffies;
1875         const struct in6_addr *dest, *src;
1876         __u16 destp, srcp;
1877
1878         dest = &tw->tw_v6_daddr;
1879         src  = &tw->tw_v6_rcv_saddr;
1880         destp = ntohs(tw->tw_dport);
1881         srcp  = ntohs(tw->tw_sport);
1882
1883         seq_printf(seq,
1884                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1885                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1886                    i,
1887                    src->s6_addr32[0], src->s6_addr32[1],
1888                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1889                    dest->s6_addr32[0], dest->s6_addr32[1],
1890                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1891                    tw->tw_substate, 0, 0,
1892                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1893                    refcount_read(&tw->tw_refcnt), tw);
1894 }
1895
1896 static int tcp6_seq_show(struct seq_file *seq, void *v)
1897 {
1898         struct tcp_iter_state *st;
1899         struct sock *sk = v;
1900
1901         if (v == SEQ_START_TOKEN) {
1902                 seq_puts(seq,
1903                          "  sl  "
1904                          "local_address                         "
1905                          "remote_address                        "
1906                          "st tx_queue rx_queue tr tm->when retrnsmt"
1907                          "   uid  timeout inode\n");
1908                 goto out;
1909         }
1910         st = seq->private;
1911
1912         if (sk->sk_state == TCP_TIME_WAIT)
1913                 get_timewait6_sock(seq, v, st->num);
1914         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1915                 get_openreq6(seq, v, st->num);
1916         else
1917                 get_tcp6_sock(seq, v, st->num);
1918 out:
1919         return 0;
1920 }
1921
1922 static const struct seq_operations tcp6_seq_ops = {
1923         .show           = tcp6_seq_show,
1924         .start          = tcp_seq_start,
1925         .next           = tcp_seq_next,
1926         .stop           = tcp_seq_stop,
1927 };
1928
1929 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1930         .family         = AF_INET6,
1931 };
1932
1933 int __net_init tcp6_proc_init(struct net *net)
1934 {
1935         if (!proc_create_net_data("tcp6", 0444, net->proc_net, &tcp6_seq_ops,
1936                         sizeof(struct tcp_iter_state), &tcp6_seq_afinfo))
1937                 return -ENOMEM;
1938         return 0;
1939 }
1940
1941 void tcp6_proc_exit(struct net *net)
1942 {
1943         remove_proc_entry("tcp6", net->proc_net);
1944 }
1945 #endif
1946
1947 struct proto tcpv6_prot = {
1948         .name                   = "TCPv6",
1949         .owner                  = THIS_MODULE,
1950         .close                  = tcp_close,
1951         .pre_connect            = tcp_v6_pre_connect,
1952         .connect                = tcp_v6_connect,
1953         .disconnect             = tcp_disconnect,
1954         .accept                 = inet_csk_accept,
1955         .ioctl                  = tcp_ioctl,
1956         .init                   = tcp_v6_init_sock,
1957         .destroy                = tcp_v6_destroy_sock,
1958         .shutdown               = tcp_shutdown,
1959         .setsockopt             = tcp_setsockopt,
1960         .getsockopt             = tcp_getsockopt,
1961         .keepalive              = tcp_set_keepalive,
1962         .recvmsg                = tcp_recvmsg,
1963         .sendmsg                = tcp_sendmsg,
1964         .sendpage               = tcp_sendpage,
1965         .backlog_rcv            = tcp_v6_do_rcv,
1966         .release_cb             = tcp_release_cb,
1967         .hash                   = inet6_hash,
1968         .unhash                 = inet_unhash,
1969         .get_port               = inet_csk_get_port,
1970         .enter_memory_pressure  = tcp_enter_memory_pressure,
1971         .leave_memory_pressure  = tcp_leave_memory_pressure,
1972         .stream_memory_free     = tcp_stream_memory_free,
1973         .sockets_allocated      = &tcp_sockets_allocated,
1974         .memory_allocated       = &tcp_memory_allocated,
1975         .memory_pressure        = &tcp_memory_pressure,
1976         .orphan_count           = &tcp_orphan_count,
1977         .sysctl_mem             = sysctl_tcp_mem,
1978         .sysctl_wmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_wmem),
1979         .sysctl_rmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_rmem),
1980         .max_header             = MAX_TCP_HEADER,
1981         .obj_size               = sizeof(struct tcp6_sock),
1982         .slab_flags             = SLAB_TYPESAFE_BY_RCU,
1983         .twsk_prot              = &tcp6_timewait_sock_ops,
1984         .rsk_prot               = &tcp6_request_sock_ops,
1985         .h.hashinfo             = &tcp_hashinfo,
1986         .no_autobind            = true,
1987 #ifdef CONFIG_COMPAT
1988         .compat_setsockopt      = compat_tcp_setsockopt,
1989         .compat_getsockopt      = compat_tcp_getsockopt,
1990 #endif
1991         .diag_destroy           = tcp_abort,
1992 };
1993
1994 /* thinking of making this const? Don't.
1995  * early_demux can change based on sysctl.
1996  */
1997 static struct inet6_protocol tcpv6_protocol = {
1998         .early_demux    =       tcp_v6_early_demux,
1999         .early_demux_handler =  tcp_v6_early_demux,
2000         .handler        =       tcp_v6_rcv,
2001         .err_handler    =       tcp_v6_err,
2002         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2003 };
2004
2005 static struct inet_protosw tcpv6_protosw = {
2006         .type           =       SOCK_STREAM,
2007         .protocol       =       IPPROTO_TCP,
2008         .prot           =       &tcpv6_prot,
2009         .ops            =       &inet6_stream_ops,
2010         .flags          =       INET_PROTOSW_PERMANENT |
2011                                 INET_PROTOSW_ICSK,
2012 };
2013
2014 static int __net_init tcpv6_net_init(struct net *net)
2015 {
2016         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2017                                     SOCK_RAW, IPPROTO_TCP, net);
2018 }
2019
2020 static void __net_exit tcpv6_net_exit(struct net *net)
2021 {
2022         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2023 }
2024
2025 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2026 {
2027         inet_twsk_purge(&tcp_hashinfo, AF_INET6);
2028 }
2029
2030 static struct pernet_operations tcpv6_net_ops = {
2031         .init       = tcpv6_net_init,
2032         .exit       = tcpv6_net_exit,
2033         .exit_batch = tcpv6_net_exit_batch,
2034 };
2035
2036 int __init tcpv6_init(void)
2037 {
2038         int ret;
2039
2040         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2041         if (ret)
2042                 goto out;
2043
2044         /* register inet6 protocol */
2045         ret = inet6_register_protosw(&tcpv6_protosw);
2046         if (ret)
2047                 goto out_tcpv6_protocol;
2048
2049         ret = register_pernet_subsys(&tcpv6_net_ops);
2050         if (ret)
2051                 goto out_tcpv6_protosw;
2052 out:
2053         return ret;
2054
2055 out_tcpv6_protosw:
2056         inet6_unregister_protosw(&tcpv6_protosw);
2057 out_tcpv6_protocol:
2058         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2059         goto out;
2060 }
2061
2062 void tcpv6_exit(void)
2063 {
2064         unregister_pernet_subsys(&tcpv6_net_ops);
2065         inet6_unregister_protosw(&tcpv6_protosw);
2066         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2067 }