net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/busy_poll.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <crypto/hash.h>
  70 #include <linux/scatterlist.h>
  71
  72 #include <trace/events/tcp.h>
  73
  74 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80 static const struct inet_connection_sock_af_ops ipv6_mapped;
  81 static const struct inet_connection_sock_af_ops ipv6_specific;
  82 #ifdef CONFIG_TCP_MD5SIG
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  85 #else
  86 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  87                                                    const struct in6_addr *addr)
  88 {
  89         return NULL;
  90 }
  91 #endif
  92
  93 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  94 {
  95         struct dst_entry *dst = skb_dst(skb);
  96
  97         if (dst && dst_hold_safe(dst)) {
  98                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  99
 100                 sk->sk_rx_dst = dst;
 101                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 103         }
 104 }
 105
 106 static u32 tcp_v6_init_seq(const struct sk_buff *skb)
 107 {
 108         return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
 109                                 ipv6_hdr(skb)->saddr.s6_addr32,
 110                                 tcp_hdr(skb)->dest,
 111                                 tcp_hdr(skb)->source);
 112 }
 113
 114 static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
 115 {
 116         return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
 117                                    ipv6_hdr(skb)->saddr.s6_addr32);
 118 }
 119
 120 static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
 121                               int addr_len)
 122 {
 123         /* This check is replicated from tcp_v6_connect() and intended to
 124          * prevent BPF program called below from accessing bytes that are out
 125          * of the bound specified by user in addr_len.
 126          */
 127         if (addr_len < SIN6_LEN_RFC2133)
 128                 return -EINVAL;
 129
 130         sock_owned_by_me(sk);
 131
 132         return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr);
 133 }
 134
 135 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 136                           int addr_len)
 137 {
 138         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 139         struct inet_sock *inet = inet_sk(sk);
 140         struct inet_connection_sock *icsk = inet_csk(sk);
 141         struct ipv6_pinfo *np = inet6_sk(sk);
 142         struct tcp_sock *tp = tcp_sk(sk);
 143         struct in6_addr *saddr = NULL, *final_p, final;
 144         struct ipv6_txoptions *opt;
 145         struct flowi6 fl6;
 146         struct dst_entry *dst;
 147         int addr_type;
 148         int err;
 149         struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
 150
 151         if (addr_len < SIN6_LEN_RFC2133)
 152                 return -EINVAL;
 153
 154         if (usin->sin6_family != AF_INET6)
 155                 return -EAFNOSUPPORT;
 156
 157         memset(&fl6, 0, sizeof(fl6));
 158
 159         if (np->sndflow) {
 160                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 161                 IP6_ECN_flow_init(fl6.flowlabel);
 162                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 163                         struct ip6_flowlabel *flowlabel;
 164                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 165                         if (!flowlabel)
 166                                 return -EINVAL;
 167                         fl6_sock_release(flowlabel);
 168                 }
 169         }
 170
 171         /*
 172          *      connect() to INADDR_ANY means loopback (BSD'ism).
 173          */
 174
 175         if (ipv6_addr_any(&usin->sin6_addr)) {
 176                 if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
 177                         ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
 178                                                &usin->sin6_addr);
 179                 else
 180                         usin->sin6_addr = in6addr_loopback;
 181         }
 182
 183         addr_type = ipv6_addr_type(&usin->sin6_addr);
 184
 185         if (addr_type & IPV6_ADDR_MULTICAST)
 186                 return -ENETUNREACH;
 187
 188         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 189                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 190                     usin->sin6_scope_id) {
 191                         /* If interface is set while binding, indices
 192                          * must coincide.
 193                          */
 194                         if (!sk_dev_equal_l3scope(sk, usin->sin6_scope_id))
 195                                 return -EINVAL;
 196
 197                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 198                 }
 199
 200                 /* Connect to link-local address requires an interface */
 201                 if (!sk->sk_bound_dev_if)
 202                         return -EINVAL;
 203         }
 204
 205         if (tp->rx_opt.ts_recent_stamp &&
 206             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 207                 tp->rx_opt.ts_recent = 0;
 208                 tp->rx_opt.ts_recent_stamp = 0;
 209                 tp->write_seq = 0;
 210         }
 211
 212         sk->sk_v6_daddr = usin->sin6_addr;
 213         np->flow_label = fl6.flowlabel;
 214
 215         /*
 216          *      TCP over IPv4
 217          */
 218
 219         if (addr_type & IPV6_ADDR_MAPPED) {
 220                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 221                 struct sockaddr_in sin;
 222
 223                 if (__ipv6_only_sock(sk))
 224                         return -ENETUNREACH;
 225
 226                 sin.sin_family = AF_INET;
 227                 sin.sin_port = usin->sin6_port;
 228                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 229
 230                 icsk->icsk_af_ops = &ipv6_mapped;
 231                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 232 #ifdef CONFIG_TCP_MD5SIG
 233                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 234 #endif
 235
 236                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 237
 238                 if (err) {
 239                         icsk->icsk_ext_hdr_len = exthdrlen;
 240                         icsk->icsk_af_ops = &ipv6_specific;
 241                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 242 #ifdef CONFIG_TCP_MD5SIG
 243                         tp->af_specific = &tcp_sock_ipv6_specific;
 244 #endif
 245                         goto failure;
 246                 }
 247                 np->saddr = sk->sk_v6_rcv_saddr;
 248
 249                 return err;
 250         }
 251
 252         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 253                 saddr = &sk->sk_v6_rcv_saddr;
 254
 255         fl6.flowi6_proto = IPPROTO_TCP;
 256         fl6.daddr = sk->sk_v6_daddr;
 257         fl6.saddr = saddr ? *saddr : np->saddr;
 258         fl6.flowi6_oif = sk->sk_bound_dev_if;
 259         fl6.flowi6_mark = sk->sk_mark;
 260         fl6.fl6_dport = usin->sin6_port;
 261         fl6.fl6_sport = inet->inet_sport;
 262         fl6.flowi6_uid = sk->sk_uid;
 263
 264         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 265         final_p = fl6_update_dst(&fl6, opt, &final);
 266
 267         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 268
 269         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 270         if (IS_ERR(dst)) {
 271                 err = PTR_ERR(dst);
 272                 goto failure;
 273         }
 274
 275         if (!saddr) {
 276                 saddr = &fl6.saddr;
 277                 sk->sk_v6_rcv_saddr = *saddr;
 278         }
 279
 280         /* set the source address */
 281         np->saddr = *saddr;
 282         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 283
 284         sk->sk_gso_type = SKB_GSO_TCPV6;
 285         ip6_dst_store(sk, dst, NULL, NULL);
 286
 287         icsk->icsk_ext_hdr_len = 0;
 288         if (opt)
 289                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 290                                          opt->opt_nflen;
 291
 292         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 293
 294         inet->inet_dport = usin->sin6_port;
 295
 296         tcp_set_state(sk, TCP_SYN_SENT);
 297         err = inet6_hash_connect(tcp_death_row, sk);
 298         if (err)
 299                 goto late_failure;
 300
 301         sk_set_txhash(sk);
 302
 303         if (likely(!tp->repair)) {
 304                 if (!tp->write_seq)
 305                         tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
 306                                                          sk->sk_v6_daddr.s6_addr32,
 307                                                          inet->inet_sport,
 308                                                          inet->inet_dport);
 309                 tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
 310                                                    np->saddr.s6_addr32,
 311                                                    sk->sk_v6_daddr.s6_addr32);
 312         }
 313
 314         if (tcp_fastopen_defer_connect(sk, &err))
 315                 return err;
 316         if (err)
 317                 goto late_failure;
 318
 319         err = tcp_connect(sk);
 320         if (err)
 321                 goto late_failure;
 322
 323         return 0;
 324
 325 late_failure:
 326         tcp_set_state(sk, TCP_CLOSE);
 327 failure:
 328         inet->inet_dport = 0;
 329         sk->sk_route_caps = 0;
 330         return err;
 331 }
 332
 333 static void tcp_v6_mtu_reduced(struct sock *sk)
 334 {
 335         struct dst_entry *dst;
 336
 337         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 338                 return;
 339
 340         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 341         if (!dst)
 342                 return;
 343
 344         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 345                 tcp_sync_mss(sk, dst_mtu(dst));
 346                 tcp_simple_retransmit(sk);
 347         }
 348 }
 349
 350 static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 351                 u8 type, u8 code, int offset, __be32 info)
 352 {
 353         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 354         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 355         struct net *net = dev_net(skb->dev);
 356         struct request_sock *fastopen;
 357         struct ipv6_pinfo *np;
 358         struct tcp_sock *tp;
 359         __u32 seq, snd_una;
 360         struct sock *sk;
 361         bool fatal;
 362         int err;
 363
 364         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 365                                         &hdr->daddr, th->dest,
 366                                         &hdr->saddr, ntohs(th->source),
 367                                         skb->dev->ifindex, inet6_sdif(skb));
 368
 369         if (!sk) {
 370                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 371                                   ICMP6_MIB_INERRORS);
 372                 return -ENOENT;
 373         }
 374
 375         if (sk->sk_state == TCP_TIME_WAIT) {
 376                 inet_twsk_put(inet_twsk(sk));
 377                 return 0;
 378         }
 379         seq = ntohl(th->seq);
 380         fatal = icmpv6_err_convert(type, code, &err);
 381         if (sk->sk_state == TCP_NEW_SYN_RECV) {
 382                 tcp_req_err(sk, seq, fatal);
 383                 return 0;
 384         }
 385
 386         bh_lock_sock(sk);
 387         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 388                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 389
 390         if (sk->sk_state == TCP_CLOSE)
 391                 goto out;
 392
 393         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 394                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 395                 goto out;
 396         }
 397
 398         tp = tcp_sk(sk);
 399         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 400         fastopen = tp->fastopen_rsk;
 401         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 402         if (sk->sk_state != TCP_LISTEN &&
 403             !between(seq, snd_una, tp->snd_nxt)) {
 404                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 405                 goto out;
 406         }
 407
 408         np = inet6_sk(sk);
 409
 410         if (type == NDISC_REDIRECT) {
 411                 if (!sock_owned_by_user(sk)) {
 412                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 413
 414                         if (dst)
 415                                 dst->ops->redirect(dst, sk, skb);
 416                 }
 417                 goto out;
 418         }
 419
 420         if (type == ICMPV6_PKT_TOOBIG) {
 421                 /* We are not interested in TCP_LISTEN and open_requests
 422                  * (SYN-ACKs send out by Linux are always <576bytes so
 423                  * they should go through unfragmented).
 424                  */
 425                 if (sk->sk_state == TCP_LISTEN)
 426                         goto out;
 427
 428                 if (!ip6_sk_accept_pmtu(sk))
 429                         goto out;
 430
 431                 tp->mtu_info = ntohl(info);
 432                 if (!sock_owned_by_user(sk))
 433                         tcp_v6_mtu_reduced(sk);
 434                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 435                                            &sk->sk_tsq_flags))
 436                         sock_hold(sk);
 437                 goto out;
 438         }
 439
 440
 441         /* Might be for an request_sock */
 442         switch (sk->sk_state) {
 443         case TCP_SYN_SENT:
 444         case TCP_SYN_RECV:
 445                 /* Only in fast or simultaneous open. If a fast open socket is
 446                  * is already accepted it is treated as a connected one below.
 447                  */
 448                 if (fastopen && !fastopen->sk)
 449                         break;
 450
 451                 if (!sock_owned_by_user(sk)) {
 452                         sk->sk_err = err;
 453                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 454
 455                         tcp_done(sk);
 456                 } else
 457                         sk->sk_err_soft = err;
 458                 goto out;
 459         }
 460
 461         if (!sock_owned_by_user(sk) && np->recverr) {
 462                 sk->sk_err = err;
 463                 sk->sk_error_report(sk);
 464         } else
 465                 sk->sk_err_soft = err;
 466
 467 out:
 468         bh_unlock_sock(sk);
 469         sock_put(sk);
 470         return 0;
 471 }
 472
 473
 474 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 475                               struct flowi *fl,
 476                               struct request_sock *req,
 477                               struct tcp_fastopen_cookie *foc,
 478                               enum tcp_synack_type synack_type)
 479 {
 480         struct inet_request_sock *ireq = inet_rsk(req);
 481         struct ipv6_pinfo *np = inet6_sk(sk);
 482         struct ipv6_txoptions *opt;
 483         struct flowi6 *fl6 = &fl->u.ip6;
 484         struct sk_buff *skb;
 485         int err = -ENOMEM;
 486
 487         /* First, grab a route. */
 488         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 489                                                IPPROTO_TCP)) == NULL)
 490                 goto done;
 491
 492         skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 493
 494         if (skb) {
 495                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 496                                     &ireq->ir_v6_rmt_addr);
 497
 498                 fl6->daddr = ireq->ir_v6_rmt_addr;
 499                 if (np->repflow && ireq->pktopts)
 500                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 501
 502                 rcu_read_lock();
 503                 opt = ireq->ipv6_opt;
 504                 if (!opt)
 505                         opt = rcu_dereference(np->opt);
 506                 err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
 507                 rcu_read_unlock();
 508                 err = net_xmit_eval(err);
 509         }
 510
 511 done:
 512         return err;
 513 }
 514
 515
 516 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 517 {
 518         kfree(inet_rsk(req)->ipv6_opt);
 519         kfree_skb(inet_rsk(req)->pktopts);
 520 }
 521
 522 #ifdef CONFIG_TCP_MD5SIG
 523 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 524                                                    const struct in6_addr *addr)
 525 {
 526         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 527 }
 528
 529 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 530                                                 const struct sock *addr_sk)
 531 {
 532         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 533 }
 534
 535 static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
 536                                  char __user *optval, int optlen)
 537 {
 538         struct tcp_md5sig cmd;
 539         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 540         u8 prefixlen;
 541
 542         if (optlen < sizeof(cmd))
 543                 return -EINVAL;
 544
 545         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 546                 return -EFAULT;
 547
 548         if (sin6->sin6_family != AF_INET6)
 549                 return -EINVAL;
 550
 551         if (optname == TCP_MD5SIG_EXT &&
 552             cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
 553                 prefixlen = cmd.tcpm_prefixlen;
 554                 if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
 555                                         prefixlen > 32))
 556                         return -EINVAL;
 557         } else {
 558                 prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
 559         }
 560
 561         if (!cmd.tcpm_keylen) {
 562                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 563                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 564                                               AF_INET, prefixlen);
 565                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 566                                       AF_INET6, prefixlen);
 567         }
 568
 569         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 570                 return -EINVAL;
 571
 572         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 573                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 574                                       AF_INET, prefixlen, cmd.tcpm_key,
 575                                       cmd.tcpm_keylen, GFP_KERNEL);
 576
 577         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 578                               AF_INET6, prefixlen, cmd.tcpm_key,
 579                               cmd.tcpm_keylen, GFP_KERNEL);
 580 }
 581
 582 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 583                                    const struct in6_addr *daddr,
 584                                    const struct in6_addr *saddr,
 585                                    const struct tcphdr *th, int nbytes)
 586 {
 587         struct tcp6_pseudohdr *bp;
 588         struct scatterlist sg;
 589         struct tcphdr *_th;
 590
 591         bp = hp->scratch;
 592         /* 1. TCP pseudo-header (RFC2460) */
 593         bp->saddr = *saddr;
 594         bp->daddr = *daddr;
 595         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 596         bp->len = cpu_to_be32(nbytes);
 597
 598         _th = (struct tcphdr *)(bp + 1);
 599         memcpy(_th, th, sizeof(*th));
 600         _th->check = 0;
 601
 602         sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 603         ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 604                                 sizeof(*bp) + sizeof(*th));
 605         return crypto_ahash_update(hp->md5_req);
 606 }
 607
 608 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 609                                const struct in6_addr *daddr, struct in6_addr *saddr,
 610                                const struct tcphdr *th)
 611 {
 612         struct tcp_md5sig_pool *hp;
 613         struct ahash_request *req;
 614
 615         hp = tcp_get_md5sig_pool();
 616         if (!hp)
 617                 goto clear_hash_noput;
 618         req = hp->md5_req;
 619
 620         if (crypto_ahash_init(req))
 621                 goto clear_hash;
 622         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 623                 goto clear_hash;
 624         if (tcp_md5_hash_key(hp, key))
 625                 goto clear_hash;
 626         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 627         if (crypto_ahash_final(req))
 628                 goto clear_hash;
 629
 630         tcp_put_md5sig_pool();
 631         return 0;
 632
 633 clear_hash:
 634         tcp_put_md5sig_pool();
 635 clear_hash_noput:
 636         memset(md5_hash, 0, 16);
 637         return 1;
 638 }
 639
 640 static int tcp_v6_md5_hash_skb(char *md5_hash,
 641                                const struct tcp_md5sig_key *key,
 642                                const struct sock *sk,
 643                                const struct sk_buff *skb)
 644 {
 645         const struct in6_addr *saddr, *daddr;
 646         struct tcp_md5sig_pool *hp;
 647         struct ahash_request *req;
 648         const struct tcphdr *th = tcp_hdr(skb);
 649
 650         if (sk) { /* valid for establish/request sockets */
 651                 saddr = &sk->sk_v6_rcv_saddr;
 652                 daddr = &sk->sk_v6_daddr;
 653         } else {
 654                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 655                 saddr = &ip6h->saddr;
 656                 daddr = &ip6h->daddr;
 657         }
 658
 659         hp = tcp_get_md5sig_pool();
 660         if (!hp)
 661                 goto clear_hash_noput;
 662         req = hp->md5_req;
 663
 664         if (crypto_ahash_init(req))
 665                 goto clear_hash;
 666
 667         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 668                 goto clear_hash;
 669         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 670                 goto clear_hash;
 671         if (tcp_md5_hash_key(hp, key))
 672                 goto clear_hash;
 673         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 674         if (crypto_ahash_final(req))
 675                 goto clear_hash;
 676
 677         tcp_put_md5sig_pool();
 678         return 0;
 679
 680 clear_hash:
 681         tcp_put_md5sig_pool();
 682 clear_hash_noput:
 683         memset(md5_hash, 0, 16);
 684         return 1;
 685 }
 686
 687 #endif
 688
 689 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 690                                     const struct sk_buff *skb)
 691 {
 692 #ifdef CONFIG_TCP_MD5SIG
 693         const __u8 *hash_location = NULL;
 694         struct tcp_md5sig_key *hash_expected;
 695         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 696         const struct tcphdr *th = tcp_hdr(skb);
 697         int genhash;
 698         u8 newhash[16];
 699
 700         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 701         hash_location = tcp_parse_md5sig_option(th);
 702
 703         /* We've parsed the options - do we have a hash? */
 704         if (!hash_expected && !hash_location)
 705                 return false;
 706
 707         if (hash_expected && !hash_location) {
 708                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 709                 return true;
 710         }
 711
 712         if (!hash_expected && hash_location) {
 713                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 714                 return true;
 715         }
 716
 717         /* check the signature */
 718         genhash = tcp_v6_md5_hash_skb(newhash,
 719                                       hash_expected,
 720                                       NULL, skb);
 721
 722         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 723                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 724                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 725                                      genhash ? "failed" : "mismatch",
 726                                      &ip6h->saddr, ntohs(th->source),
 727                                      &ip6h->daddr, ntohs(th->dest));
 728                 return true;
 729         }
 730 #endif
 731         return false;
 732 }
 733
 734 static void tcp_v6_init_req(struct request_sock *req,
 735                             const struct sock *sk_listener,
 736                             struct sk_buff *skb)
 737 {
 738         bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
 739         struct inet_request_sock *ireq = inet_rsk(req);
 740         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 741
 742         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 743         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 744
 745         /* So that link locals have meaning */
 746         if ((!sk_listener->sk_bound_dev_if || l3_slave) &&
 747             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 748                 ireq->ir_iif = tcp_v6_iif(skb);
 749
 750         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 751             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 752              np->rxopt.bits.rxinfo ||
 753              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 754              np->rxopt.bits.rxohlim || np->repflow)) {
 755                 refcount_inc(&skb->users);
 756                 ireq->pktopts = skb;
 757         }
 758 }
 759
 760 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 761                                           struct flowi *fl,
 762                                           const struct request_sock *req)
 763 {
 764         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 765 }
 766
 767 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 768         .family         =       AF_INET6,
 769         .obj_size       =       sizeof(struct tcp6_request_sock),
 770         .rtx_syn_ack    =       tcp_rtx_synack,
 771         .send_ack       =       tcp_v6_reqsk_send_ack,
 772         .destructor     =       tcp_v6_reqsk_destructor,
 773         .send_reset     =       tcp_v6_send_reset,
 774         .syn_ack_timeout =      tcp_syn_ack_timeout,
 775 };
 776
 777 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 778         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 779                                 sizeof(struct ipv6hdr),
 780 #ifdef CONFIG_TCP_MD5SIG
 781         .req_md5_lookup =       tcp_v6_md5_lookup,
 782         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 783 #endif
 784         .init_req       =       tcp_v6_init_req,
 785 #ifdef CONFIG_SYN_COOKIES
 786         .cookie_init_seq =      cookie_v6_init_sequence,
 787 #endif
 788         .route_req      =       tcp_v6_route_req,
 789         .init_seq       =       tcp_v6_init_seq,
 790         .init_ts_off    =       tcp_v6_init_ts_off,
 791         .send_synack    =       tcp_v6_send_synack,
 792 };
 793
 794 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 795                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 796                                  int oif, struct tcp_md5sig_key *key, int rst,
 797                                  u8 tclass, __be32 label)
 798 {
 799         const struct tcphdr *th = tcp_hdr(skb);
 800         struct tcphdr *t1;
 801         struct sk_buff *buff;
 802         struct flowi6 fl6;
 803         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 804         struct sock *ctl_sk = net->ipv6.tcp_sk;
 805         unsigned int tot_len = sizeof(struct tcphdr);
 806         struct dst_entry *dst;
 807         __be32 *topt;
 808         __u32 mark = 0;
 809
 810         if (tsecr)
 811                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 812 #ifdef CONFIG_TCP_MD5SIG
 813         if (key)
 814                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 815 #endif
 816
 817         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 818                          GFP_ATOMIC);
 819         if (!buff)
 820                 return;
 821
 822         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 823
 824         t1 = skb_push(buff, tot_len);
 825         skb_reset_transport_header(buff);
 826
 827         /* Swap the send and the receive. */
 828         memset(t1, 0, sizeof(*t1));
 829         t1->dest = th->source;
 830         t1->source = th->dest;
 831         t1->doff = tot_len / 4;
 832         t1->seq = htonl(seq);
 833         t1->ack_seq = htonl(ack);
 834         t1->ack = !rst || !th->ack;
 835         t1->rst = rst;
 836         t1->window = htons(win);
 837
 838         topt = (__be32 *)(t1 + 1);
 839
 840         if (tsecr) {
 841                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 842                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 843                 *topt++ = htonl(tsval);
 844                 *topt++ = htonl(tsecr);
 845         }
 846
 847 #ifdef CONFIG_TCP_MD5SIG
 848         if (key) {
 849                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 850                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 851                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 852                                     &ipv6_hdr(skb)->saddr,
 853                                     &ipv6_hdr(skb)->daddr, t1);
 854         }
 855 #endif
 856
 857         memset(&fl6, 0, sizeof(fl6));
 858         fl6.daddr = ipv6_hdr(skb)->saddr;
 859         fl6.saddr = ipv6_hdr(skb)->daddr;
 860         fl6.flowlabel = label;
 861
 862         buff->ip_summed = CHECKSUM_PARTIAL;
 863         buff->csum = 0;
 864
 865         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 866
 867         fl6.flowi6_proto = IPPROTO_TCP;
 868         if (rt6_need_strict(&fl6.daddr) && !oif)
 869                 fl6.flowi6_oif = tcp_v6_iif(skb);
 870         else {
 871                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 872                         oif = skb->skb_iif;
 873
 874                 fl6.flowi6_oif = oif;
 875         }
 876
 877         if (sk)
 878                 mark = (sk->sk_state == TCP_TIME_WAIT) ?
 879                         inet_twsk(sk)->tw_mark : sk->sk_mark;
 880         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark) ?: mark;
 881         fl6.fl6_dport = t1->dest;
 882         fl6.fl6_sport = t1->source;
 883         fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 884         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 885
 886         /* Pass a socket to ip6_dst_lookup either it is for RST
 887          * Underlying function will use this to retrieve the network
 888          * namespace
 889          */
 890         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 891         if (!IS_ERR(dst)) {
 892                 skb_dst_set(buff, dst);
 893                 ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
 894                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 895                 if (rst)
 896                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 897                 return;
 898         }
 899
 900         kfree_skb(buff);
 901 }
 902
 903 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 904 {
 905         const struct tcphdr *th = tcp_hdr(skb);
 906         u32 seq = 0, ack_seq = 0;
 907         struct tcp_md5sig_key *key = NULL;
 908 #ifdef CONFIG_TCP_MD5SIG
 909         const __u8 *hash_location = NULL;
 910         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 911         unsigned char newhash[16];
 912         int genhash;
 913         struct sock *sk1 = NULL;
 914 #endif
 915         int oif = 0;
 916
 917         if (th->rst)
 918                 return;
 919
 920         /* If sk not NULL, it means we did a successful lookup and incoming
 921          * route had to be correct. prequeue might have dropped our dst.
 922          */
 923         if (!sk && !ipv6_unicast_destination(skb))
 924                 return;
 925
 926 #ifdef CONFIG_TCP_MD5SIG
 927         rcu_read_lock();
 928         hash_location = tcp_parse_md5sig_option(th);
 929         if (sk && sk_fullsock(sk)) {
 930                 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 931         } else if (hash_location) {
 932                 /*
 933                  * active side is lost. Try to find listening socket through
 934                  * source port, and then find md5 key through listening socket.
 935                  * we are not loose security here:
 936                  * Incoming packet is checked with md5 hash with finding key,
 937                  * no RST generated if md5 hash doesn't match.
 938                  */
 939                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 940                                            &tcp_hashinfo, NULL, 0,
 941                                            &ipv6h->saddr,
 942                                            th->source, &ipv6h->daddr,
 943                                            ntohs(th->source),
 944                                            tcp_v6_iif_l3_slave(skb),
 945                                            tcp_v6_sdif(skb));
 946                 if (!sk1)
 947                         goto out;
 948
 949                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 950                 if (!key)
 951                         goto out;
 952
 953                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 954                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 955                         goto out;
 956         }
 957 #endif
 958
 959         if (th->ack)
 960                 seq = ntohl(th->ack_seq);
 961         else
 962                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 963                           (th->doff << 2);
 964
 965         if (sk) {
 966                 oif = sk->sk_bound_dev_if;
 967                 if (sk_fullsock(sk))
 968                         trace_tcp_send_reset(sk, skb);
 969         }
 970
 971         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 972
 973 #ifdef CONFIG_TCP_MD5SIG
 974 out:
 975         rcu_read_unlock();
 976 #endif
 977 }
 978
 979 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 980                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 981                             struct tcp_md5sig_key *key, u8 tclass,
 982                             __be32 label)
 983 {
 984         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 985                              tclass, label);
 986 }
 987
 988 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 989 {
 990         struct inet_timewait_sock *tw = inet_twsk(sk);
 991         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 992
 993         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 994                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 995                         tcp_time_stamp_raw() + tcptw->tw_ts_offset,
 996                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 997                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 998
 999         inet_twsk_put(tw);
1000 }
1001
1002 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
1003                                   struct request_sock *req)
1004 {
1005         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
1006          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
1007          */
1008         /* RFC 7323 2.3
1009          * The window field (SEG.WND) of every outgoing segment, with the
1010          * exception of <SYN> segments, MUST be right-shifted by
1011          * Rcv.Wind.Shift bits:
1012          */
1013         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
1014                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
1015                         tcp_rsk(req)->rcv_nxt,
1016                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1017                         tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1018                         req->ts_recent, sk->sk_bound_dev_if,
1019                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
1020                         0, 0);
1021 }
1022
1023
1024 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
1025 {
1026 #ifdef CONFIG_SYN_COOKIES
1027         const struct tcphdr *th = tcp_hdr(skb);
1028
1029         if (!th->syn)
1030                 sk = cookie_v6_check(sk, skb);
1031 #endif
1032         return sk;
1033 }
1034
1035 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1036 {
1037         if (skb->protocol == htons(ETH_P_IP))
1038                 return tcp_v4_conn_request(sk, skb);
1039
1040         if (!ipv6_unicast_destination(skb))
1041                 goto drop;
1042
1043         return tcp_conn_request(&tcp6_request_sock_ops,
1044                                 &tcp_request_sock_ipv6_ops, sk, skb);
1045
1046 drop:
1047         tcp_listendrop(sk);
1048         return 0; /* don't send reset */
1049 }
1050
1051 static void tcp_v6_restore_cb(struct sk_buff *skb)
1052 {
1053         /* We need to move header back to the beginning if xfrm6_policy_check()
1054          * and tcp_v6_fill_cb() are going to be called again.
1055          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1056          */
1057         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1058                 sizeof(struct inet6_skb_parm));
1059 }
1060
1061 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1062                                          struct request_sock *req,
1063                                          struct dst_entry *dst,
1064                                          struct request_sock *req_unhash,
1065                                          bool *own_req)
1066 {
1067         struct inet_request_sock *ireq;
1068         struct ipv6_pinfo *newnp;
1069         const struct ipv6_pinfo *np = inet6_sk(sk);
1070         struct ipv6_txoptions *opt;
1071         struct tcp6_sock *newtcp6sk;
1072         struct inet_sock *newinet;
1073         struct tcp_sock *newtp;
1074         struct sock *newsk;
1075 #ifdef CONFIG_TCP_MD5SIG
1076         struct tcp_md5sig_key *key;
1077 #endif
1078         struct flowi6 fl6;
1079
1080         if (skb->protocol == htons(ETH_P_IP)) {
1081                 /*
1082                  *      v6 mapped
1083                  */
1084
1085                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1086                                              req_unhash, own_req);
1087
1088                 if (!newsk)
1089                         return NULL;
1090
1091                 newtcp6sk = (struct tcp6_sock *)newsk;
1092                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1093
1094                 newinet = inet_sk(newsk);
1095                 newnp = inet6_sk(newsk);
1096                 newtp = tcp_sk(newsk);
1097
1098                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1099
1100                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1101
1102                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1103                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1104 #ifdef CONFIG_TCP_MD5SIG
1105                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1106 #endif
1107
1108                 newnp->ipv6_mc_list = NULL;
1109                 newnp->ipv6_ac_list = NULL;
1110                 newnp->ipv6_fl_list = NULL;
1111                 newnp->pktoptions  = NULL;
1112                 newnp->opt         = NULL;
1113                 newnp->mcast_oif   = inet_iif(skb);
1114                 newnp->mcast_hops  = ip_hdr(skb)->ttl;
1115                 newnp->rcv_flowinfo = 0;
1116                 if (np->repflow)
1117                         newnp->flow_label = 0;
1118
1119                 /*
1120                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1121                  * here, tcp_create_openreq_child now does this for us, see the comment in
1122                  * that function for the gory details. -acme
1123                  */
1124
1125                 /* It is tricky place. Until this moment IPv4 tcp
1126                    worked with IPv6 icsk.icsk_af_ops.
1127                    Sync it now.
1128                  */
1129                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1130
1131                 return newsk;
1132         }
1133
1134         ireq = inet_rsk(req);
1135
1136         if (sk_acceptq_is_full(sk))
1137                 goto out_overflow;
1138
1139         if (!dst) {
1140                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1141                 if (!dst)
1142                         goto out;
1143         }
1144
1145         newsk = tcp_create_openreq_child(sk, req, skb);
1146         if (!newsk)
1147                 goto out_nonewsk;
1148
1149         /*
1150          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1151          * count here, tcp_create_openreq_child now does this for us, see the
1152          * comment in that function for the gory details. -acme
1153          */
1154
1155         newsk->sk_gso_type = SKB_GSO_TCPV6;
1156         ip6_dst_store(newsk, dst, NULL, NULL);
1157         inet6_sk_rx_dst_set(newsk, skb);
1158
1159         newtcp6sk = (struct tcp6_sock *)newsk;
1160         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1161
1162         newtp = tcp_sk(newsk);
1163         newinet = inet_sk(newsk);
1164         newnp = inet6_sk(newsk);
1165
1166         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1167
1168         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1169         newnp->saddr = ireq->ir_v6_loc_addr;
1170         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1171         newsk->sk_bound_dev_if = ireq->ir_iif;
1172
1173         /* Now IPv6 options...
1174
1175            First: no IPv4 options.
1176          */
1177         newinet->inet_opt = NULL;
1178         newnp->ipv6_mc_list = NULL;
1179         newnp->ipv6_ac_list = NULL;
1180         newnp->ipv6_fl_list = NULL;
1181
1182         /* Clone RX bits */
1183         newnp->rxopt.all = np->rxopt.all;
1184
1185         newnp->pktoptions = NULL;
1186         newnp->opt        = NULL;
1187         newnp->mcast_oif  = tcp_v6_iif(skb);
1188         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1189         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1190         if (np->repflow)
1191                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1192
1193         /* Clone native IPv6 options from listening socket (if any)
1194
1195            Yes, keeping reference count would be much more clever,
1196            but we make one more one thing there: reattach optmem
1197            to newsk.
1198          */
1199         opt = ireq->ipv6_opt;
1200         if (!opt)
1201                 opt = rcu_dereference(np->opt);
1202         if (opt) {
1203                 opt = ipv6_dup_options(newsk, opt);
1204                 RCU_INIT_POINTER(newnp->opt, opt);
1205         }
1206         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1207         if (opt)
1208                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1209                                                     opt->opt_flen;
1210
1211         tcp_ca_openreq_child(newsk, dst);
1212
1213         tcp_sync_mss(newsk, dst_mtu(dst));
1214         newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
1215
1216         tcp_initialize_rcv_mss(newsk);
1217
1218         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1219         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1220
1221 #ifdef CONFIG_TCP_MD5SIG
1222         /* Copy over the MD5 key from the original socket */
1223         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1224         if (key) {
1225                 /* We're using one, so create a matching key
1226                  * on the newsk structure. If we fail to get
1227                  * memory, then we end up not copying the key
1228                  * across. Shucks.
1229                  */
1230                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1231                                AF_INET6, 128, key->key, key->keylen,
1232                                sk_gfp_mask(sk, GFP_ATOMIC));
1233         }
1234 #endif
1235
1236         if (__inet_inherit_port(sk, newsk) < 0) {
1237                 inet_csk_prepare_forced_close(newsk);
1238                 tcp_done(newsk);
1239                 goto out;
1240         }
1241         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1242         if (*own_req) {
1243                 tcp_move_syn(newtp, req);
1244
1245                 /* Clone pktoptions received with SYN, if we own the req */
1246                 if (ireq->pktopts) {
1247                         newnp->pktoptions = skb_clone(ireq->pktopts,
1248                                                       sk_gfp_mask(sk, GFP_ATOMIC));
1249                         consume_skb(ireq->pktopts);
1250                         ireq->pktopts = NULL;
1251                         if (newnp->pktoptions) {
1252                                 tcp_v6_restore_cb(newnp->pktoptions);
1253                                 skb_set_owner_r(newnp->pktoptions, newsk);
1254                         }
1255                 }
1256         }
1257
1258         return newsk;
1259
1260 out_overflow:
1261         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1262 out_nonewsk:
1263         dst_release(dst);
1264 out:
1265         tcp_listendrop(sk);
1266         return NULL;
1267 }
1268
1269 /* The socket must have it's spinlock held when we get
1270  * here, unless it is a TCP_LISTEN socket.
1271  *
1272  * We have a potential double-lock case here, so even when
1273  * doing backlog processing we use the BH locking scheme.
1274  * This is because we cannot sleep with the original spinlock
1275  * held.
1276  */
1277 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1278 {
1279         struct ipv6_pinfo *np = inet6_sk(sk);
1280         struct tcp_sock *tp;
1281         struct sk_buff *opt_skb = NULL;
1282
1283         /* Imagine: socket is IPv6. IPv4 packet arrives,
1284            goes to IPv4 receive handler and backlogged.
1285            From backlog it always goes here. Kerboom...
1286            Fortunately, tcp_rcv_established and rcv_established
1287            handle them correctly, but it is not case with
1288            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1289          */
1290
1291         if (skb->protocol == htons(ETH_P_IP))
1292                 return tcp_v4_do_rcv(sk, skb);
1293
1294         /*
1295          *      socket locking is here for SMP purposes as backlog rcv
1296          *      is currently called with bh processing disabled.
1297          */
1298
1299         /* Do Stevens' IPV6_PKTOPTIONS.
1300
1301            Yes, guys, it is the only place in our code, where we
1302            may make it not affecting IPv4.
1303            The rest of code is protocol independent,
1304            and I do not like idea to uglify IPv4.
1305
1306            Actually, all the idea behind IPV6_PKTOPTIONS
1307            looks not very well thought. For now we latch
1308            options, received in the last packet, enqueued
1309            by tcp. Feel free to propose better solution.
1310                                                --ANK (980728)
1311          */
1312         if (np->rxopt.all)
1313                 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1314
1315         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1316                 struct dst_entry *dst = sk->sk_rx_dst;
1317
1318                 sock_rps_save_rxhash(sk, skb);
1319                 sk_mark_napi_id(sk, skb);
1320                 if (dst) {
1321                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1322                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1323                                 dst_release(dst);
1324                                 sk->sk_rx_dst = NULL;
1325                         }
1326                 }
1327
1328                 tcp_rcv_established(sk, skb);
1329                 if (opt_skb)
1330                         goto ipv6_pktoptions;
1331                 return 0;
1332         }
1333
1334         if (tcp_checksum_complete(skb))
1335                 goto csum_err;
1336
1337         if (sk->sk_state == TCP_LISTEN) {
1338                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1339
1340                 if (!nsk)
1341                         goto discard;
1342
1343                 if (nsk != sk) {
1344                         if (tcp_child_process(sk, nsk, skb))
1345                                 goto reset;
1346                         if (opt_skb)
1347                                 __kfree_skb(opt_skb);
1348                         return 0;
1349                 }
1350         } else
1351                 sock_rps_save_rxhash(sk, skb);
1352
1353         if (tcp_rcv_state_process(sk, skb))
1354                 goto reset;
1355         if (opt_skb)
1356                 goto ipv6_pktoptions;
1357         return 0;
1358
1359 reset:
1360         tcp_v6_send_reset(sk, skb);
1361 discard:
1362         if (opt_skb)
1363                 __kfree_skb(opt_skb);
1364         kfree_skb(skb);
1365         return 0;
1366 csum_err:
1367         TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1368         TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1369         goto discard;
1370
1371
1372 ipv6_pktoptions:
1373         /* Do you ask, what is it?
1374
1375            1. skb was enqueued by tcp.
1376            2. skb is added to tail of read queue, rather than out of order.
1377            3. socket is not in passive state.
1378            4. Finally, it really contains options, which user wants to receive.
1379          */
1380         tp = tcp_sk(sk);
1381         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1382             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1383                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1384                         np->mcast_oif = tcp_v6_iif(opt_skb);
1385                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1386                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1387                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1388                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1389                 if (np->repflow)
1390                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1391                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1392                         skb_set_owner_r(opt_skb, sk);
1393                         tcp_v6_restore_cb(opt_skb);
1394                         opt_skb = xchg(&np->pktoptions, opt_skb);
1395                 } else {
1396                         __kfree_skb(opt_skb);
1397                         opt_skb = xchg(&np->pktoptions, NULL);
1398                 }
1399         }
1400
1401         kfree_skb(opt_skb);
1402         return 0;
1403 }
1404
1405 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1406                            const struct tcphdr *th)
1407 {
1408         /* This is tricky: we move IP6CB at its correct location into
1409          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1410          * _decode_session6() uses IP6CB().
1411          * barrier() makes sure compiler won't play aliasing games.
1412          */
1413         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1414                 sizeof(struct inet6_skb_parm));
1415         barrier();
1416
1417         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1418         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1419                                     skb->len - th->doff*4);
1420         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1421         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1422         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1423         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1424         TCP_SKB_CB(skb)->sacked = 0;
1425         TCP_SKB_CB(skb)->has_rxtstamp =
1426                         skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
1427 }
1428
1429 static int tcp_v6_rcv(struct sk_buff *skb)
1430 {
1431         int sdif = inet6_sdif(skb);
1432         const struct tcphdr *th;
1433         const struct ipv6hdr *hdr;
1434         bool refcounted;
1435         struct sock *sk;
1436         int ret;
1437         struct net *net = dev_net(skb->dev);
1438
1439         if (skb->pkt_type != PACKET_HOST)
1440                 goto discard_it;
1441
1442         /*
1443          *      Count it even if it's bad.
1444          */
1445         __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1446
1447         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1448                 goto discard_it;
1449
1450         th = (const struct tcphdr *)skb->data;
1451
1452         if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1453                 goto bad_packet;
1454         if (!pskb_may_pull(skb, th->doff*4))
1455                 goto discard_it;
1456
1457         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1458                 goto csum_error;
1459
1460         th = (const struct tcphdr *)skb->data;
1461         hdr = ipv6_hdr(skb);
1462
1463 lookup:
1464         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1465                                 th->source, th->dest, inet6_iif(skb), sdif,
1466                                 &refcounted);
1467         if (!sk)
1468                 goto no_tcp_socket;
1469
1470 process:
1471         if (sk->sk_state == TCP_TIME_WAIT)
1472                 goto do_time_wait;
1473
1474         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1475                 struct request_sock *req = inet_reqsk(sk);
1476                 bool req_stolen = false;
1477                 struct sock *nsk;
1478
1479                 sk = req->rsk_listener;
1480                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1481                         sk_drops_add(sk, skb);
1482                         reqsk_put(req);
1483                         goto discard_it;
1484                 }
1485                 if (tcp_checksum_complete(skb)) {
1486                         reqsk_put(req);
1487                         goto csum_error;
1488                 }
1489                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1490                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1491                         goto lookup;
1492                 }
1493                 sock_hold(sk);
1494                 refcounted = true;
1495                 nsk = NULL;
1496                 if (!tcp_filter(sk, skb)) {
1497                         th = (const struct tcphdr *)skb->data;
1498                         hdr = ipv6_hdr(skb);
1499                         tcp_v6_fill_cb(skb, hdr, th);
1500                         nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
1501                 }
1502                 if (!nsk) {
1503                         reqsk_put(req);
1504                         if (req_stolen) {
1505                                 /* Another cpu got exclusive access to req
1506                                  * and created a full blown socket.
1507                                  * Try to feed this packet to this socket
1508                                  * instead of discarding it.
1509                                  */
1510                                 tcp_v6_restore_cb(skb);
1511                                 sock_put(sk);
1512                                 goto lookup;
1513                         }
1514                         goto discard_and_relse;
1515                 }
1516                 if (nsk == sk) {
1517                         reqsk_put(req);
1518                         tcp_v6_restore_cb(skb);
1519                 } else if (tcp_child_process(sk, nsk, skb)) {
1520                         tcp_v6_send_reset(nsk, skb);
1521                         goto discard_and_relse;
1522                 } else {
1523                         sock_put(sk);
1524                         return 0;
1525                 }
1526         }
1527         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1528                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1529                 goto discard_and_relse;
1530         }
1531
1532         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1533                 goto discard_and_relse;
1534
1535         if (tcp_v6_inbound_md5_hash(sk, skb))
1536                 goto discard_and_relse;
1537
1538         if (tcp_filter(sk, skb))
1539                 goto discard_and_relse;
1540         th = (const struct tcphdr *)skb->data;
1541         hdr = ipv6_hdr(skb);
1542         tcp_v6_fill_cb(skb, hdr, th);
1543
1544         skb->dev = NULL;
1545
1546         if (sk->sk_state == TCP_LISTEN) {
1547                 ret = tcp_v6_do_rcv(sk, skb);
1548                 goto put_and_return;
1549         }
1550
1551         sk_incoming_cpu_update(sk);
1552
1553         bh_lock_sock_nested(sk);
1554         tcp_segs_in(tcp_sk(sk), skb);
1555         ret = 0;
1556         if (!sock_owned_by_user(sk)) {
1557                 ret = tcp_v6_do_rcv(sk, skb);
1558         } else if (tcp_add_backlog(sk, skb)) {
1559                 goto discard_and_relse;
1560         }
1561         bh_unlock_sock(sk);
1562
1563 put_and_return:
1564         if (refcounted)
1565                 sock_put(sk);
1566         return ret ? -1 : 0;
1567
1568 no_tcp_socket:
1569         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1570                 goto discard_it;
1571
1572         tcp_v6_fill_cb(skb, hdr, th);
1573
1574         if (tcp_checksum_complete(skb)) {
1575 csum_error:
1576                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1577 bad_packet:
1578                 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1579         } else {
1580                 tcp_v6_send_reset(NULL, skb);
1581         }
1582
1583 discard_it:
1584         kfree_skb(skb);
1585         return 0;
1586
1587 discard_and_relse:
1588         sk_drops_add(sk, skb);
1589         if (refcounted)
1590                 sock_put(sk);
1591         goto discard_it;
1592
1593 do_time_wait:
1594         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1595                 inet_twsk_put(inet_twsk(sk));
1596                 goto discard_it;
1597         }
1598
1599         tcp_v6_fill_cb(skb, hdr, th);
1600
1601         if (tcp_checksum_complete(skb)) {
1602                 inet_twsk_put(inet_twsk(sk));
1603                 goto csum_error;
1604         }
1605
1606         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1607         case TCP_TW_SYN:
1608         {
1609                 struct sock *sk2;
1610
1611                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1612                                             skb, __tcp_hdrlen(th),
1613                                             &ipv6_hdr(skb)->saddr, th->source,
1614                                             &ipv6_hdr(skb)->daddr,
1615                                             ntohs(th->dest),
1616                                             tcp_v6_iif_l3_slave(skb),
1617                                             sdif);
1618                 if (sk2) {
1619                         struct inet_timewait_sock *tw = inet_twsk(sk);
1620                         inet_twsk_deschedule_put(tw);
1621                         sk = sk2;
1622                         tcp_v6_restore_cb(skb);
1623                         refcounted = false;
1624                         goto process;
1625                 }
1626         }
1627                 /* to ACK */
1628                 /* fall through */
1629         case TCP_TW_ACK:
1630                 tcp_v6_timewait_ack(sk, skb);
1631                 break;
1632         case TCP_TW_RST:
1633                 tcp_v6_send_reset(sk, skb);
1634                 inet_twsk_deschedule_put(inet_twsk(sk));
1635                 goto discard_it;
1636         case TCP_TW_SUCCESS:
1637                 ;
1638         }
1639         goto discard_it;
1640 }
1641
1642 static void tcp_v6_early_demux(struct sk_buff *skb)
1643 {
1644         const struct ipv6hdr *hdr;
1645         const struct tcphdr *th;
1646         struct sock *sk;
1647
1648         if (skb->pkt_type != PACKET_HOST)
1649                 return;
1650
1651         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1652                 return;
1653
1654         hdr = ipv6_hdr(skb);
1655         th = tcp_hdr(skb);
1656
1657         if (th->doff < sizeof(struct tcphdr) / 4)
1658                 return;
1659
1660         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1661         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1662                                         &hdr->saddr, th->source,
1663                                         &hdr->daddr, ntohs(th->dest),
1664                                         inet6_iif(skb), inet6_sdif(skb));
1665         if (sk) {
1666                 skb->sk = sk;
1667                 skb->destructor = sock_edemux;
1668                 if (sk_fullsock(sk)) {
1669                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1670
1671                         if (dst)
1672                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1673                         if (dst &&
1674                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1675                                 skb_dst_set_noref(skb, dst);
1676                 }
1677         }
1678 }
1679
1680 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1681         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1682         .twsk_unique    = tcp_twsk_unique,
1683         .twsk_destructor = tcp_twsk_destructor,
1684 };
1685
1686 static const struct inet_connection_sock_af_ops ipv6_specific = {
1687         .queue_xmit        = inet6_csk_xmit,
1688         .send_check        = tcp_v6_send_check,
1689         .rebuild_header    = inet6_sk_rebuild_header,
1690         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1691         .conn_request      = tcp_v6_conn_request,
1692         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1693         .net_header_len    = sizeof(struct ipv6hdr),
1694         .net_frag_header_len = sizeof(struct frag_hdr),
1695         .setsockopt        = ipv6_setsockopt,
1696         .getsockopt        = ipv6_getsockopt,
1697         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1698         .sockaddr_len      = sizeof(struct sockaddr_in6),
1699 #ifdef CONFIG_COMPAT
1700         .compat_setsockopt = compat_ipv6_setsockopt,
1701         .compat_getsockopt = compat_ipv6_getsockopt,
1702 #endif
1703         .mtu_reduced       = tcp_v6_mtu_reduced,
1704 };
1705
1706 #ifdef CONFIG_TCP_MD5SIG
1707 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1708         .md5_lookup     =       tcp_v6_md5_lookup,
1709         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1710         .md5_parse      =       tcp_v6_parse_md5_keys,
1711 };
1712 #endif
1713
1714 /*
1715  *      TCP over IPv4 via INET6 API
1716  */
1717 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1718         .queue_xmit        = ip_queue_xmit,
1719         .send_check        = tcp_v4_send_check,
1720         .rebuild_header    = inet_sk_rebuild_header,
1721         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1722         .conn_request      = tcp_v6_conn_request,
1723         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1724         .net_header_len    = sizeof(struct iphdr),
1725         .setsockopt        = ipv6_setsockopt,
1726         .getsockopt        = ipv6_getsockopt,
1727         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1728         .sockaddr_len      = sizeof(struct sockaddr_in6),
1729 #ifdef CONFIG_COMPAT
1730         .compat_setsockopt = compat_ipv6_setsockopt,
1731         .compat_getsockopt = compat_ipv6_getsockopt,
1732 #endif
1733         .mtu_reduced       = tcp_v4_mtu_reduced,
1734 };
1735
1736 #ifdef CONFIG_TCP_MD5SIG
1737 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1738         .md5_lookup     =       tcp_v4_md5_lookup,
1739         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1740         .md5_parse      =       tcp_v6_parse_md5_keys,
1741 };
1742 #endif
1743
1744 /* NOTE: A lot of things set to zero explicitly by call to
1745  *       sk_alloc() so need not be done here.
1746  */
1747 static int tcp_v6_init_sock(struct sock *sk)
1748 {
1749         struct inet_connection_sock *icsk = inet_csk(sk);
1750
1751         tcp_init_sock(sk);
1752
1753         icsk->icsk_af_ops = &ipv6_specific;
1754
1755 #ifdef CONFIG_TCP_MD5SIG
1756         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1757 #endif
1758
1759         return 0;
1760 }
1761
1762 static void tcp_v6_destroy_sock(struct sock *sk)
1763 {
1764         tcp_v4_destroy_sock(sk);
1765         inet6_destroy_sock(sk);
1766 }
1767
1768 #ifdef CONFIG_PROC_FS
1769 /* Proc filesystem TCPv6 sock list dumping. */
1770 static void get_openreq6(struct seq_file *seq,
1771                          const struct request_sock *req, int i)
1772 {
1773         long ttd = req->rsk_timer.expires - jiffies;
1774         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1775         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1776
1777         if (ttd < 0)
1778                 ttd = 0;
1779
1780         seq_printf(seq,
1781                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1782                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1783                    i,
1784                    src->s6_addr32[0], src->s6_addr32[1],
1785                    src->s6_addr32[2], src->s6_addr32[3],
1786                    inet_rsk(req)->ir_num,
1787                    dest->s6_addr32[0], dest->s6_addr32[1],
1788                    dest->s6_addr32[2], dest->s6_addr32[3],
1789                    ntohs(inet_rsk(req)->ir_rmt_port),
1790                    TCP_SYN_RECV,
1791                    0, 0, /* could print option size, but that is af dependent. */
1792                    1,   /* timers active (only the expire timer) */
1793                    jiffies_to_clock_t(ttd),
1794                    req->num_timeout,
1795                    from_kuid_munged(seq_user_ns(seq),
1796                                     sock_i_uid(req->rsk_listener)),
1797                    0,  /* non standard timer */
1798                    0, /* open_requests have no inode */
1799                    0, req);
1800 }
1801
1802 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1803 {
1804         const struct in6_addr *dest, *src;
1805         __u16 destp, srcp;
1806         int timer_active;
1807         unsigned long timer_expires;
1808         const struct inet_sock *inet = inet_sk(sp);
1809         const struct tcp_sock *tp = tcp_sk(sp);
1810         const struct inet_connection_sock *icsk = inet_csk(sp);
1811         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1812         int rx_queue;
1813         int state;
1814
1815         dest  = &sp->sk_v6_daddr;
1816         src   = &sp->sk_v6_rcv_saddr;
1817         destp = ntohs(inet->inet_dport);
1818         srcp  = ntohs(inet->inet_sport);
1819
1820         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1821             icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1822             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1823                 timer_active    = 1;
1824                 timer_expires   = icsk->icsk_timeout;
1825         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1826                 timer_active    = 4;
1827                 timer_expires   = icsk->icsk_timeout;
1828         } else if (timer_pending(&sp->sk_timer)) {
1829                 timer_active    = 2;
1830                 timer_expires   = sp->sk_timer.expires;
1831         } else {
1832                 timer_active    = 0;
1833                 timer_expires = jiffies;
1834         }
1835
1836         state = inet_sk_state_load(sp);
1837         if (state == TCP_LISTEN)
1838                 rx_queue = sp->sk_ack_backlog;
1839         else
1840                 /* Because we don't lock the socket,
1841                  * we might find a transient negative value.
1842                  */
1843                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1844
1845         seq_printf(seq,
1846                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1847                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1848                    i,
1849                    src->s6_addr32[0], src->s6_addr32[1],
1850                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1851                    dest->s6_addr32[0], dest->s6_addr32[1],
1852                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1853                    state,
1854                    tp->write_seq - tp->snd_una,
1855                    rx_queue,
1856                    timer_active,
1857                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1858                    icsk->icsk_retransmits,
1859                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1860                    icsk->icsk_probes_out,
1861                    sock_i_ino(sp),
1862                    refcount_read(&sp->sk_refcnt), sp,
1863                    jiffies_to_clock_t(icsk->icsk_rto),
1864                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1865                    (icsk->icsk_ack.quick << 1) | inet_csk_in_pingpong_mode(sp),
1866                    tp->snd_cwnd,
1867                    state == TCP_LISTEN ?
1868                         fastopenq->max_qlen :
1869                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1870                    );
1871 }
1872
1873 static void get_timewait6_sock(struct seq_file *seq,
1874                                struct inet_timewait_sock *tw, int i)
1875 {
1876         long delta = tw->tw_timer.expires - jiffies;
1877         const struct in6_addr *dest, *src;
1878         __u16 destp, srcp;
1879
1880         dest = &tw->tw_v6_daddr;
1881         src  = &tw->tw_v6_rcv_saddr;
1882         destp = ntohs(tw->tw_dport);
1883         srcp  = ntohs(tw->tw_sport);
1884
1885         seq_printf(seq,
1886                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1887                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1888                    i,
1889                    src->s6_addr32[0], src->s6_addr32[1],
1890                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1891                    dest->s6_addr32[0], dest->s6_addr32[1],
1892                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1893                    tw->tw_substate, 0, 0,
1894                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1895                    refcount_read(&tw->tw_refcnt), tw);
1896 }
1897
1898 static int tcp6_seq_show(struct seq_file *seq, void *v)
1899 {
1900         struct tcp_iter_state *st;
1901         struct sock *sk = v;
1902
1903         if (v == SEQ_START_TOKEN) {
1904                 seq_puts(seq,
1905                          "  sl  "
1906                          "local_address                         "
1907                          "remote_address                        "
1908                          "st tx_queue rx_queue tr tm->when retrnsmt"
1909                          "   uid  timeout inode\n");
1910                 goto out;
1911         }
1912         st = seq->private;
1913
1914         if (sk->sk_state == TCP_TIME_WAIT)
1915                 get_timewait6_sock(seq, v, st->num);
1916         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1917                 get_openreq6(seq, v, st->num);
1918         else
1919                 get_tcp6_sock(seq, v, st->num);
1920 out:
1921         return 0;
1922 }
1923
1924 static const struct seq_operations tcp6_seq_ops = {
1925         .show           = tcp6_seq_show,
1926         .start          = tcp_seq_start,
1927         .next           = tcp_seq_next,
1928         .stop           = tcp_seq_stop,
1929 };
1930
1931 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1932         .family         = AF_INET6,
1933 };
1934
1935 int __net_init tcp6_proc_init(struct net *net)
1936 {
1937         if (!proc_create_net_data("tcp6", 0444, net->proc_net, &tcp6_seq_ops,
1938                         sizeof(struct tcp_iter_state), &tcp6_seq_afinfo))
1939                 return -ENOMEM;
1940         return 0;
1941 }
1942
1943 void tcp6_proc_exit(struct net *net)
1944 {
1945         remove_proc_entry("tcp6", net->proc_net);
1946 }
1947 #endif
1948
1949 struct proto tcpv6_prot = {
1950         .name                   = "TCPv6",
1951         .owner                  = THIS_MODULE,
1952         .close                  = tcp_close,
1953         .pre_connect            = tcp_v6_pre_connect,
1954         .connect                = tcp_v6_connect,
1955         .disconnect             = tcp_disconnect,
1956         .accept                 = inet_csk_accept,
1957         .ioctl                  = tcp_ioctl,
1958         .init                   = tcp_v6_init_sock,
1959         .destroy                = tcp_v6_destroy_sock,
1960         .shutdown               = tcp_shutdown,
1961         .setsockopt             = tcp_setsockopt,
1962         .getsockopt             = tcp_getsockopt,
1963         .keepalive              = tcp_set_keepalive,
1964         .recvmsg                = tcp_recvmsg,
1965         .sendmsg                = tcp_sendmsg,
1966         .sendpage               = tcp_sendpage,
1967         .backlog_rcv            = tcp_v6_do_rcv,
1968         .release_cb             = tcp_release_cb,
1969         .hash                   = inet6_hash,
1970         .unhash                 = inet_unhash,
1971         .get_port               = inet_csk_get_port,
1972         .enter_memory_pressure  = tcp_enter_memory_pressure,
1973         .leave_memory_pressure  = tcp_leave_memory_pressure,
1974         .stream_memory_free     = tcp_stream_memory_free,
1975         .sockets_allocated      = &tcp_sockets_allocated,
1976         .memory_allocated       = &tcp_memory_allocated,
1977         .memory_pressure        = &tcp_memory_pressure,
1978         .orphan_count           = &tcp_orphan_count,
1979         .sysctl_mem             = sysctl_tcp_mem,
1980         .sysctl_wmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_wmem),
1981         .sysctl_rmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_rmem),
1982         .max_header             = MAX_TCP_HEADER,
1983         .obj_size               = sizeof(struct tcp6_sock),
1984         .slab_flags             = SLAB_TYPESAFE_BY_RCU,
1985         .twsk_prot              = &tcp6_timewait_sock_ops,
1986         .rsk_prot               = &tcp6_request_sock_ops,
1987         .h.hashinfo             = &tcp_hashinfo,
1988         .no_autobind            = true,
1989 #ifdef CONFIG_COMPAT
1990         .compat_setsockopt      = compat_tcp_setsockopt,
1991         .compat_getsockopt      = compat_tcp_getsockopt,
1992 #endif
1993         .diag_destroy           = tcp_abort,
1994 };
1995
1996 /* thinking of making this const? Don't.
1997  * early_demux can change based on sysctl.
1998  */
1999 static struct inet6_protocol tcpv6_protocol = {
2000         .early_demux    =       tcp_v6_early_demux,
2001         .early_demux_handler =  tcp_v6_early_demux,
2002         .handler        =       tcp_v6_rcv,
2003         .err_handler    =       tcp_v6_err,
2004         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2005 };
2006
2007 static struct inet_protosw tcpv6_protosw = {
2008         .type           =       SOCK_STREAM,
2009         .protocol       =       IPPROTO_TCP,
2010         .prot           =       &tcpv6_prot,
2011         .ops            =       &inet6_stream_ops,
2012         .flags          =       INET_PROTOSW_PERMANENT |
2013                                 INET_PROTOSW_ICSK,
2014 };
2015
2016 static int __net_init tcpv6_net_init(struct net *net)
2017 {
2018         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2019                                     SOCK_RAW, IPPROTO_TCP, net);
2020 }
2021
2022 static void __net_exit tcpv6_net_exit(struct net *net)
2023 {
2024         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2025 }
2026
2027 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2028 {
2029         inet_twsk_purge(&tcp_hashinfo, AF_INET6);
2030 }
2031
2032 static struct pernet_operations tcpv6_net_ops = {
2033         .init       = tcpv6_net_init,
2034         .exit       = tcpv6_net_exit,
2035         .exit_batch = tcpv6_net_exit_batch,
2036 };
2037
2038 int __init tcpv6_init(void)
2039 {
2040         int ret;
2041
2042         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2043         if (ret)
2044                 goto out;
2045
2046         /* register inet6 protocol */
2047         ret = inet6_register_protosw(&tcpv6_protosw);
2048         if (ret)
2049                 goto out_tcpv6_protocol;
2050
2051         ret = register_pernet_subsys(&tcpv6_net_ops);
2052         if (ret)
2053                 goto out_tcpv6_protosw;
2054 out:
2055         return ret;
2056
2057 out_tcpv6_protosw:
2058         inet6_unregister_protosw(&tcpv6_protosw);
2059 out_tcpv6_protocol:
2060         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2061         goto out;
2062 }
2063
2064 void tcpv6_exit(void)
2065 {
2066         unregister_pernet_subsys(&tcpv6_net_ops);
2067         inet6_unregister_protosw(&tcpv6_protosw);
2068         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2069 }