net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65 #include <net/tcp_memcontrol.h>
  66
  67 #include <asm/uaccess.h>
  68
  69 #include <linux/proc_fs.h>
  70 #include <linux/seq_file.h>
  71
  72 #include <linux/crypto.h>
  73 #include <linux/scatterlist.h>
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  77                                       struct request_sock *req);
  78
  79 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  80
  81 static const struct inet_connection_sock_af_ops ipv6_mapped;
  82 static const struct inet_connection_sock_af_ops ipv6_specific;
  83 #ifdef CONFIG_TCP_MD5SIG
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  85 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  86 #else
  87 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  88                                                    const struct in6_addr *addr)
  89 {
  90         return NULL;
  91 }
  92 #endif
  93
  94 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  95 {
  96         struct dst_entry *dst = skb_dst(skb);
  97         const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99         dst_hold(dst);
 100         sk->sk_rx_dst = dst;
 101         inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102         if (rt->rt6i_node)
 103                 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 104 }
 105
 106 static void tcp_v6_hash(struct sock *sk)
 107 {
 108         if (sk->sk_state != TCP_CLOSE) {
 109                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 110                         tcp_prot.hash(sk);
 111                         return;
 112                 }
 113                 local_bh_disable();
 114                 __inet6_hash(sk, NULL);
 115                 local_bh_enable();
 116         }
 117 }
 118
 119 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 120 {
 121         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 122                                             ipv6_hdr(skb)->saddr.s6_addr32,
 123                                             tcp_hdr(skb)->dest,
 124                                             tcp_hdr(skb)->source);
 125 }
 126
 127 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 128                           int addr_len)
 129 {
 130         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 131         struct inet_sock *inet = inet_sk(sk);
 132         struct inet_connection_sock *icsk = inet_csk(sk);
 133         struct ipv6_pinfo *np = inet6_sk(sk);
 134         struct tcp_sock *tp = tcp_sk(sk);
 135         struct in6_addr *saddr = NULL, *final_p, final;
 136         struct rt6_info *rt;
 137         struct flowi6 fl6;
 138         struct dst_entry *dst;
 139         int addr_type;
 140         int err;
 141
 142         if (addr_len < SIN6_LEN_RFC2133)
 143                 return -EINVAL;
 144
 145         if (usin->sin6_family != AF_INET6)
 146                 return -EAFNOSUPPORT;
 147
 148         memset(&fl6, 0, sizeof(fl6));
 149
 150         if (np->sndflow) {
 151                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 152                 IP6_ECN_flow_init(fl6.flowlabel);
 153                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 154                         struct ip6_flowlabel *flowlabel;
 155                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 156                         if (flowlabel == NULL)
 157                                 return -EINVAL;
 158                         usin->sin6_addr = flowlabel->dst;
 159                         fl6_sock_release(flowlabel);
 160                 }
 161         }
 162
 163         /*
 164          *      connect() to INADDR_ANY means loopback (BSD'ism).
 165          */
 166
 167         if(ipv6_addr_any(&usin->sin6_addr))
 168                 usin->sin6_addr.s6_addr[15] = 0x1;
 169
 170         addr_type = ipv6_addr_type(&usin->sin6_addr);
 171
 172         if(addr_type & IPV6_ADDR_MULTICAST)
 173                 return -ENETUNREACH;
 174
 175         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 176                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 177                     usin->sin6_scope_id) {
 178                         /* If interface is set while binding, indices
 179                          * must coincide.
 180                          */
 181                         if (sk->sk_bound_dev_if &&
 182                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 183                                 return -EINVAL;
 184
 185                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 186                 }
 187
 188                 /* Connect to link-local address requires an interface */
 189                 if (!sk->sk_bound_dev_if)
 190                         return -EINVAL;
 191         }
 192
 193         if (tp->rx_opt.ts_recent_stamp &&
 194             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 195                 tp->rx_opt.ts_recent = 0;
 196                 tp->rx_opt.ts_recent_stamp = 0;
 197                 tp->write_seq = 0;
 198         }
 199
 200         np->daddr = usin->sin6_addr;
 201         np->flow_label = fl6.flowlabel;
 202
 203         /*
 204          *      TCP over IPv4
 205          */
 206
 207         if (addr_type == IPV6_ADDR_MAPPED) {
 208                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 209                 struct sockaddr_in sin;
 210
 211                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 212
 213                 if (__ipv6_only_sock(sk))
 214                         return -ENETUNREACH;
 215
 216                 sin.sin_family = AF_INET;
 217                 sin.sin_port = usin->sin6_port;
 218                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 219
 220                 icsk->icsk_af_ops = &ipv6_mapped;
 221                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 224 #endif
 225
 226                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 227
 228                 if (err) {
 229                         icsk->icsk_ext_hdr_len = exthdrlen;
 230                         icsk->icsk_af_ops = &ipv6_specific;
 231                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 232 #ifdef CONFIG_TCP_MD5SIG
 233                         tp->af_specific = &tcp_sock_ipv6_specific;
 234 #endif
 235                         goto failure;
 236                 } else {
 237                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 238                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 239                                                &np->rcv_saddr);
 240                 }
 241
 242                 return err;
 243         }
 244
 245         if (!ipv6_addr_any(&np->rcv_saddr))
 246                 saddr = &np->rcv_saddr;
 247
 248         fl6.flowi6_proto = IPPROTO_TCP;
 249         fl6.daddr = np->daddr;
 250         fl6.saddr = saddr ? *saddr : np->saddr;
 251         fl6.flowi6_oif = sk->sk_bound_dev_if;
 252         fl6.flowi6_mark = sk->sk_mark;
 253         fl6.fl6_dport = usin->sin6_port;
 254         fl6.fl6_sport = inet->inet_sport;
 255
 256         final_p = fl6_update_dst(&fl6, np->opt, &final);
 257
 258         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 259
 260         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 261         if (IS_ERR(dst)) {
 262                 err = PTR_ERR(dst);
 263                 goto failure;
 264         }
 265
 266         if (saddr == NULL) {
 267                 saddr = &fl6.saddr;
 268                 np->rcv_saddr = *saddr;
 269         }
 270
 271         /* set the source address */
 272         np->saddr = *saddr;
 273         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 274
 275         sk->sk_gso_type = SKB_GSO_TCPV6;
 276         __ip6_dst_store(sk, dst, NULL, NULL);
 277
 278         rt = (struct rt6_info *) dst;
 279         if (tcp_death_row.sysctl_tw_recycle &&
 280             !tp->rx_opt.ts_recent_stamp &&
 281             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr))
 282                 tcp_fetch_timewait_stamp(sk, dst);
 283
 284         icsk->icsk_ext_hdr_len = 0;
 285         if (np->opt)
 286                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 287                                           np->opt->opt_nflen);
 288
 289         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 290
 291         inet->inet_dport = usin->sin6_port;
 292
 293         tcp_set_state(sk, TCP_SYN_SENT);
 294         err = inet6_hash_connect(&tcp_death_row, sk);
 295         if (err)
 296                 goto late_failure;
 297
 298         if (!tp->write_seq && likely(!tp->repair))
 299                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 300                                                              np->daddr.s6_addr32,
 301                                                              inet->inet_sport,
 302                                                              inet->inet_dport);
 303
 304         err = tcp_connect(sk);
 305         if (err)
 306                 goto late_failure;
 307
 308         return 0;
 309
 310 late_failure:
 311         tcp_set_state(sk, TCP_CLOSE);
 312         __sk_dst_reset(sk);
 313 failure:
 314         inet->inet_dport = 0;
 315         sk->sk_route_caps = 0;
 316         return err;
 317 }
 318
 319 static void tcp_v6_mtu_reduced(struct sock *sk)
 320 {
 321         struct dst_entry *dst;
 322
 323         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 324                 return;
 325
 326         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 327         if (!dst)
 328                 return;
 329
 330         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 331                 tcp_sync_mss(sk, dst_mtu(dst));
 332                 tcp_simple_retransmit(sk);
 333         }
 334 }
 335
 336 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 337                 u8 type, u8 code, int offset, __be32 info)
 338 {
 339         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 340         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 341         struct ipv6_pinfo *np;
 342         struct sock *sk;
 343         int err;
 344         struct tcp_sock *tp;
 345         __u32 seq;
 346         struct net *net = dev_net(skb->dev);
 347
 348         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 349                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 350
 351         if (sk == NULL) {
 352                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 353                                    ICMP6_MIB_INERRORS);
 354                 return;
 355         }
 356
 357         if (sk->sk_state == TCP_TIME_WAIT) {
 358                 inet_twsk_put(inet_twsk(sk));
 359                 return;
 360         }
 361
 362         bh_lock_sock(sk);
 363         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 364                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 365
 366         if (sk->sk_state == TCP_CLOSE)
 367                 goto out;
 368
 369         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 370                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 371                 goto out;
 372         }
 373
 374         tp = tcp_sk(sk);
 375         seq = ntohl(th->seq);
 376         if (sk->sk_state != TCP_LISTEN &&
 377             !between(seq, tp->snd_una, tp->snd_nxt)) {
 378                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 379                 goto out;
 380         }
 381
 382         np = inet6_sk(sk);
 383
 384         if (type == NDISC_REDIRECT) {
 385                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 386
 387                 if (dst)
 388                         dst->ops->redirect(dst, sk, skb);
 389                 goto out;
 390         }
 391
 392         if (type == ICMPV6_PKT_TOOBIG) {
 393                 /* We are not interested in TCP_LISTEN and open_requests
 394                  * (SYN-ACKs send out by Linux are always <576bytes so
 395                  * they should go through unfragmented).
 396                  */
 397                 if (sk->sk_state == TCP_LISTEN)
 398                         goto out;
 399
 400                 tp->mtu_info = ntohl(info);
 401                 if (!sock_owned_by_user(sk))
 402                         tcp_v6_mtu_reduced(sk);
 403                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 404                                            &tp->tsq_flags))
 405                         sock_hold(sk);
 406                 goto out;
 407         }
 408
 409         icmpv6_err_convert(type, code, &err);
 410
 411         /* Might be for an request_sock */
 412         switch (sk->sk_state) {
 413                 struct request_sock *req, **prev;
 414         case TCP_LISTEN:
 415                 if (sock_owned_by_user(sk))
 416                         goto out;
 417
 418                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 419                                            &hdr->saddr, inet6_iif(skb));
 420                 if (!req)
 421                         goto out;
 422
 423                 /* ICMPs are not backlogged, hence we cannot get
 424                  * an established socket here.
 425                  */
 426                 WARN_ON(req->sk != NULL);
 427
 428                 if (seq != tcp_rsk(req)->snt_isn) {
 429                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 430                         goto out;
 431                 }
 432
 433                 inet_csk_reqsk_queue_drop(sk, req, prev);
 434                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 435                 goto out;
 436
 437         case TCP_SYN_SENT:
 438         case TCP_SYN_RECV:  /* Cannot happen.
 439                                It can, it SYNs are crossed. --ANK */
 440                 if (!sock_owned_by_user(sk)) {
 441                         sk->sk_err = err;
 442                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 443
 444                         tcp_done(sk);
 445                 } else
 446                         sk->sk_err_soft = err;
 447                 goto out;
 448         }
 449
 450         if (!sock_owned_by_user(sk) && np->recverr) {
 451                 sk->sk_err = err;
 452                 sk->sk_error_report(sk);
 453         } else
 454                 sk->sk_err_soft = err;
 455
 456 out:
 457         bh_unlock_sock(sk);
 458         sock_put(sk);
 459 }
 460
 461
 462 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 463                               struct flowi6 *fl6,
 464                               struct request_sock *req,
 465                               u16 queue_mapping)
 466 {
 467         struct inet6_request_sock *treq = inet6_rsk(req);
 468         struct ipv6_pinfo *np = inet6_sk(sk);
 469         struct sk_buff * skb;
 470         int err = -ENOMEM;
 471
 472         /* First, grab a route. */
 473         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 474                 goto done;
 475
 476         skb = tcp_make_synack(sk, dst, req, NULL);
 477
 478         if (skb) {
 479                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 480
 481                 fl6->daddr = treq->rmt_addr;
 482                 skb_set_queue_mapping(skb, queue_mapping);
 483                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 484                 err = net_xmit_eval(err);
 485         }
 486
 487 done:
 488         return err;
 489 }
 490
 491 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
 492 {
 493         struct flowi6 fl6;
 494         int res;
 495
 496         res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
 497         if (!res)
 498                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 499         return res;
 500 }
 501
 502 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 503 {
 504         kfree_skb(inet6_rsk(req)->pktopts);
 505 }
 506
 507 #ifdef CONFIG_TCP_MD5SIG
 508 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 509                                                    const struct in6_addr *addr)
 510 {
 511         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 512 }
 513
 514 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 515                                                 struct sock *addr_sk)
 516 {
 517         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 518 }
 519
 520 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 521                                                       struct request_sock *req)
 522 {
 523         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 524 }
 525
 526 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 527                                   int optlen)
 528 {
 529         struct tcp_md5sig cmd;
 530         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 531
 532         if (optlen < sizeof(cmd))
 533                 return -EINVAL;
 534
 535         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 536                 return -EFAULT;
 537
 538         if (sin6->sin6_family != AF_INET6)
 539                 return -EINVAL;
 540
 541         if (!cmd.tcpm_keylen) {
 542                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 543                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 544                                               AF_INET);
 545                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 546                                       AF_INET6);
 547         }
 548
 549         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 550                 return -EINVAL;
 551
 552         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 553                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 554                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 555
 556         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 557                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 558 }
 559
 560 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 561                                         const struct in6_addr *daddr,
 562                                         const struct in6_addr *saddr, int nbytes)
 563 {
 564         struct tcp6_pseudohdr *bp;
 565         struct scatterlist sg;
 566
 567         bp = &hp->md5_blk.ip6;
 568         /* 1. TCP pseudo-header (RFC2460) */
 569         bp->saddr = *saddr;
 570         bp->daddr = *daddr;
 571         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 572         bp->len = cpu_to_be32(nbytes);
 573
 574         sg_init_one(&sg, bp, sizeof(*bp));
 575         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 576 }
 577
 578 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 579                                const struct in6_addr *daddr, struct in6_addr *saddr,
 580                                const struct tcphdr *th)
 581 {
 582         struct tcp_md5sig_pool *hp;
 583         struct hash_desc *desc;
 584
 585         hp = tcp_get_md5sig_pool();
 586         if (!hp)
 587                 goto clear_hash_noput;
 588         desc = &hp->md5_desc;
 589
 590         if (crypto_hash_init(desc))
 591                 goto clear_hash;
 592         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 593                 goto clear_hash;
 594         if (tcp_md5_hash_header(hp, th))
 595                 goto clear_hash;
 596         if (tcp_md5_hash_key(hp, key))
 597                 goto clear_hash;
 598         if (crypto_hash_final(desc, md5_hash))
 599                 goto clear_hash;
 600
 601         tcp_put_md5sig_pool();
 602         return 0;
 603
 604 clear_hash:
 605         tcp_put_md5sig_pool();
 606 clear_hash_noput:
 607         memset(md5_hash, 0, 16);
 608         return 1;
 609 }
 610
 611 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 612                                const struct sock *sk,
 613                                const struct request_sock *req,
 614                                const struct sk_buff *skb)
 615 {
 616         const struct in6_addr *saddr, *daddr;
 617         struct tcp_md5sig_pool *hp;
 618         struct hash_desc *desc;
 619         const struct tcphdr *th = tcp_hdr(skb);
 620
 621         if (sk) {
 622                 saddr = &inet6_sk(sk)->saddr;
 623                 daddr = &inet6_sk(sk)->daddr;
 624         } else if (req) {
 625                 saddr = &inet6_rsk(req)->loc_addr;
 626                 daddr = &inet6_rsk(req)->rmt_addr;
 627         } else {
 628                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 629                 saddr = &ip6h->saddr;
 630                 daddr = &ip6h->daddr;
 631         }
 632
 633         hp = tcp_get_md5sig_pool();
 634         if (!hp)
 635                 goto clear_hash_noput;
 636         desc = &hp->md5_desc;
 637
 638         if (crypto_hash_init(desc))
 639                 goto clear_hash;
 640
 641         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 642                 goto clear_hash;
 643         if (tcp_md5_hash_header(hp, th))
 644                 goto clear_hash;
 645         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 646                 goto clear_hash;
 647         if (tcp_md5_hash_key(hp, key))
 648                 goto clear_hash;
 649         if (crypto_hash_final(desc, md5_hash))
 650                 goto clear_hash;
 651
 652         tcp_put_md5sig_pool();
 653         return 0;
 654
 655 clear_hash:
 656         tcp_put_md5sig_pool();
 657 clear_hash_noput:
 658         memset(md5_hash, 0, 16);
 659         return 1;
 660 }
 661
 662 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 663 {
 664         const __u8 *hash_location = NULL;
 665         struct tcp_md5sig_key *hash_expected;
 666         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 667         const struct tcphdr *th = tcp_hdr(skb);
 668         int genhash;
 669         u8 newhash[16];
 670
 671         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 672         hash_location = tcp_parse_md5sig_option(th);
 673
 674         /* We've parsed the options - do we have a hash? */
 675         if (!hash_expected && !hash_location)
 676                 return 0;
 677
 678         if (hash_expected && !hash_location) {
 679                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 680                 return 1;
 681         }
 682
 683         if (!hash_expected && hash_location) {
 684                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 685                 return 1;
 686         }
 687
 688         /* check the signature */
 689         genhash = tcp_v6_md5_hash_skb(newhash,
 690                                       hash_expected,
 691                                       NULL, NULL, skb);
 692
 693         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 694                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 695                                      genhash ? "failed" : "mismatch",
 696                                      &ip6h->saddr, ntohs(th->source),
 697                                      &ip6h->daddr, ntohs(th->dest));
 698                 return 1;
 699         }
 700         return 0;
 701 }
 702 #endif
 703
 704 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 705         .family         =       AF_INET6,
 706         .obj_size       =       sizeof(struct tcp6_request_sock),
 707         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 708         .send_ack       =       tcp_v6_reqsk_send_ack,
 709         .destructor     =       tcp_v6_reqsk_destructor,
 710         .send_reset     =       tcp_v6_send_reset,
 711         .syn_ack_timeout =      tcp_syn_ack_timeout,
 712 };
 713
 714 #ifdef CONFIG_TCP_MD5SIG
 715 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 716         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 717         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 718 };
 719 #endif
 720
 721 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 722                                  u32 tsval, u32 tsecr,
 723                                  struct tcp_md5sig_key *key, int rst, u8 tclass)
 724 {
 725         const struct tcphdr *th = tcp_hdr(skb);
 726         struct tcphdr *t1;
 727         struct sk_buff *buff;
 728         struct flowi6 fl6;
 729         struct net *net = dev_net(skb_dst(skb)->dev);
 730         struct sock *ctl_sk = net->ipv6.tcp_sk;
 731         unsigned int tot_len = sizeof(struct tcphdr);
 732         struct dst_entry *dst;
 733         __be32 *topt;
 734
 735         if (tsecr)
 736                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 737 #ifdef CONFIG_TCP_MD5SIG
 738         if (key)
 739                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 740 #endif
 741
 742         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 743                          GFP_ATOMIC);
 744         if (buff == NULL)
 745                 return;
 746
 747         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 748
 749         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 750         skb_reset_transport_header(buff);
 751
 752         /* Swap the send and the receive. */
 753         memset(t1, 0, sizeof(*t1));
 754         t1->dest = th->source;
 755         t1->source = th->dest;
 756         t1->doff = tot_len / 4;
 757         t1->seq = htonl(seq);
 758         t1->ack_seq = htonl(ack);
 759         t1->ack = !rst || !th->ack;
 760         t1->rst = rst;
 761         t1->window = htons(win);
 762
 763         topt = (__be32 *)(t1 + 1);
 764
 765         if (tsecr) {
 766                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 767                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 768                 *topt++ = htonl(tsval);
 769                 *topt++ = htonl(tsecr);
 770         }
 771
 772 #ifdef CONFIG_TCP_MD5SIG
 773         if (key) {
 774                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 775                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 776                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 777                                     &ipv6_hdr(skb)->saddr,
 778                                     &ipv6_hdr(skb)->daddr, t1);
 779         }
 780 #endif
 781
 782         memset(&fl6, 0, sizeof(fl6));
 783         fl6.daddr = ipv6_hdr(skb)->saddr;
 784         fl6.saddr = ipv6_hdr(skb)->daddr;
 785
 786         buff->ip_summed = CHECKSUM_PARTIAL;
 787         buff->csum = 0;
 788
 789         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 790
 791         fl6.flowi6_proto = IPPROTO_TCP;
 792         if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
 793                 fl6.flowi6_oif = inet6_iif(skb);
 794         fl6.fl6_dport = t1->dest;
 795         fl6.fl6_sport = t1->source;
 796         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 797
 798         /* Pass a socket to ip6_dst_lookup either it is for RST
 799          * Underlying function will use this to retrieve the network
 800          * namespace
 801          */
 802         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
 803         if (!IS_ERR(dst)) {
 804                 skb_dst_set(buff, dst);
 805                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 806                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 807                 if (rst)
 808                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 809                 return;
 810         }
 811
 812         kfree_skb(buff);
 813 }
 814
 815 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 816 {
 817         const struct tcphdr *th = tcp_hdr(skb);
 818         u32 seq = 0, ack_seq = 0;
 819         struct tcp_md5sig_key *key = NULL;
 820 #ifdef CONFIG_TCP_MD5SIG
 821         const __u8 *hash_location = NULL;
 822         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 823         unsigned char newhash[16];
 824         int genhash;
 825         struct sock *sk1 = NULL;
 826 #endif
 827
 828         if (th->rst)
 829                 return;
 830
 831         if (!ipv6_unicast_destination(skb))
 832                 return;
 833
 834 #ifdef CONFIG_TCP_MD5SIG
 835         hash_location = tcp_parse_md5sig_option(th);
 836         if (!sk && hash_location) {
 837                 /*
 838                  * active side is lost. Try to find listening socket through
 839                  * source port, and then find md5 key through listening socket.
 840                  * we are not loose security here:
 841                  * Incoming packet is checked with md5 hash with finding key,
 842                  * no RST generated if md5 hash doesn't match.
 843                  */
 844                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 845                                            &tcp_hashinfo, &ipv6h->saddr,
 846                                            th->source, &ipv6h->daddr,
 847                                            ntohs(th->source), inet6_iif(skb));
 848                 if (!sk1)
 849                         return;
 850
 851                 rcu_read_lock();
 852                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 853                 if (!key)
 854                         goto release_sk1;
 855
 856                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 857                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 858                         goto release_sk1;
 859         } else {
 860                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 861         }
 862 #endif
 863
 864         if (th->ack)
 865                 seq = ntohl(th->ack_seq);
 866         else
 867                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 868                           (th->doff << 2);
 869
 870         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0);
 871
 872 #ifdef CONFIG_TCP_MD5SIG
 873 release_sk1:
 874         if (sk1) {
 875                 rcu_read_unlock();
 876                 sock_put(sk1);
 877         }
 878 #endif
 879 }
 880
 881 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 882                             u32 win, u32 tsval, u32 tsecr,
 883                             struct tcp_md5sig_key *key, u8 tclass)
 884 {
 885         tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass);
 886 }
 887
 888 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 889 {
 890         struct inet_timewait_sock *tw = inet_twsk(sk);
 891         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 892
 893         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 894                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 895                         tcp_time_stamp + tcptw->tw_ts_offset,
 896                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
 897                         tw->tw_tclass);
 898
 899         inet_twsk_put(tw);
 900 }
 901
 902 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 903                                   struct request_sock *req)
 904 {
 905         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
 906                         req->rcv_wnd, tcp_time_stamp, req->ts_recent,
 907                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 908 }
 909
 910
 911 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 912 {
 913         struct request_sock *req, **prev;
 914         const struct tcphdr *th = tcp_hdr(skb);
 915         struct sock *nsk;
 916
 917         /* Find possible connection requests. */
 918         req = inet6_csk_search_req(sk, &prev, th->source,
 919                                    &ipv6_hdr(skb)->saddr,
 920                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 921         if (req)
 922                 return tcp_check_req(sk, skb, req, prev, false);
 923
 924         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 925                         &ipv6_hdr(skb)->saddr, th->source,
 926                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 927
 928         if (nsk) {
 929                 if (nsk->sk_state != TCP_TIME_WAIT) {
 930                         bh_lock_sock(nsk);
 931                         return nsk;
 932                 }
 933                 inet_twsk_put(inet_twsk(nsk));
 934                 return NULL;
 935         }
 936
 937 #ifdef CONFIG_SYN_COOKIES
 938         if (!th->syn)
 939                 sk = cookie_v6_check(sk, skb);
 940 #endif
 941         return sk;
 942 }
 943
 944 /* FIXME: this is substantially similar to the ipv4 code.
 945  * Can some kind of merge be done? -- erics
 946  */
 947 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 948 {
 949         struct tcp_options_received tmp_opt;
 950         struct request_sock *req;
 951         struct inet6_request_sock *treq;
 952         struct ipv6_pinfo *np = inet6_sk(sk);
 953         struct tcp_sock *tp = tcp_sk(sk);
 954         __u32 isn = TCP_SKB_CB(skb)->when;
 955         struct dst_entry *dst = NULL;
 956         struct flowi6 fl6;
 957         bool want_cookie = false;
 958
 959         if (skb->protocol == htons(ETH_P_IP))
 960                 return tcp_v4_conn_request(sk, skb);
 961
 962         if (!ipv6_unicast_destination(skb))
 963                 goto drop;
 964
 965         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
 966                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
 967                 if (!want_cookie)
 968                         goto drop;
 969         }
 970
 971         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
 972                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 973                 goto drop;
 974         }
 975
 976         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 977         if (req == NULL)
 978                 goto drop;
 979
 980 #ifdef CONFIG_TCP_MD5SIG
 981         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
 982 #endif
 983
 984         tcp_clear_options(&tmp_opt);
 985         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 986         tmp_opt.user_mss = tp->rx_opt.user_mss;
 987         tcp_parse_options(skb, &tmp_opt, 0, NULL);
 988
 989         if (want_cookie && !tmp_opt.saw_tstamp)
 990                 tcp_clear_options(&tmp_opt);
 991
 992         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
 993         tcp_openreq_init(req, &tmp_opt, skb);
 994
 995         treq = inet6_rsk(req);
 996         treq->rmt_addr = ipv6_hdr(skb)->saddr;
 997         treq->loc_addr = ipv6_hdr(skb)->daddr;
 998         if (!want_cookie || tmp_opt.tstamp_ok)
 999                 TCP_ECN_create_request(req, skb, sock_net(sk));
1000
1001         treq->iif = sk->sk_bound_dev_if;
1002
1003         /* So that link locals have meaning */
1004         if (!sk->sk_bound_dev_if &&
1005             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1006                 treq->iif = inet6_iif(skb);
1007
1008         if (!isn) {
1009                 if (ipv6_opt_accepted(sk, skb) ||
1010                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1011                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1012                         atomic_inc(&skb->users);
1013                         treq->pktopts = skb;
1014                 }
1015
1016                 if (want_cookie) {
1017                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1018                         req->cookie_ts = tmp_opt.tstamp_ok;
1019                         goto have_isn;
1020                 }
1021
1022                 /* VJ's idea. We save last timestamp seen
1023                  * from the destination in peer table, when entering
1024                  * state TIME-WAIT, and check against it before
1025                  * accepting new connection request.
1026                  *
1027                  * If "isn" is not zero, this request hit alive
1028                  * timewait bucket, so that all the necessary checks
1029                  * are made in the function processing timewait state.
1030                  */
1031                 if (tmp_opt.saw_tstamp &&
1032                     tcp_death_row.sysctl_tw_recycle &&
1033                     (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1034                         if (!tcp_peer_is_proven(req, dst, true)) {
1035                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1036                                 goto drop_and_release;
1037                         }
1038                 }
1039                 /* Kill the following clause, if you dislike this way. */
1040                 else if (!sysctl_tcp_syncookies &&
1041                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1042                           (sysctl_max_syn_backlog >> 2)) &&
1043                          !tcp_peer_is_proven(req, dst, false)) {
1044                         /* Without syncookies last quarter of
1045                          * backlog is filled with destinations,
1046                          * proven to be alive.
1047                          * It means that we continue to communicate
1048                          * to destinations, already remembered
1049                          * to the moment of synflood.
1050                          */
1051                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1052                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1053                         goto drop_and_release;
1054                 }
1055
1056                 isn = tcp_v6_init_sequence(skb);
1057         }
1058 have_isn:
1059         tcp_rsk(req)->snt_isn = isn;
1060
1061         if (security_inet_conn_request(sk, skb, req))
1062                 goto drop_and_release;
1063
1064         if (tcp_v6_send_synack(sk, dst, &fl6, req,
1065                                skb_get_queue_mapping(skb)) ||
1066             want_cookie)
1067                 goto drop_and_free;
1068
1069         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1070         tcp_rsk(req)->listener = NULL;
1071         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1072         return 0;
1073
1074 drop_and_release:
1075         dst_release(dst);
1076 drop_and_free:
1077         reqsk_free(req);
1078 drop:
1079         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1080         return 0; /* don't send reset */
1081 }
1082
1083 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1084                                           struct request_sock *req,
1085                                           struct dst_entry *dst)
1086 {
1087         struct inet6_request_sock *treq;
1088         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1089         struct tcp6_sock *newtcp6sk;
1090         struct inet_sock *newinet;
1091         struct tcp_sock *newtp;
1092         struct sock *newsk;
1093 #ifdef CONFIG_TCP_MD5SIG
1094         struct tcp_md5sig_key *key;
1095 #endif
1096         struct flowi6 fl6;
1097
1098         if (skb->protocol == htons(ETH_P_IP)) {
1099                 /*
1100                  *      v6 mapped
1101                  */
1102
1103                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1104
1105                 if (newsk == NULL)
1106                         return NULL;
1107
1108                 newtcp6sk = (struct tcp6_sock *)newsk;
1109                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1110
1111                 newinet = inet_sk(newsk);
1112                 newnp = inet6_sk(newsk);
1113                 newtp = tcp_sk(newsk);
1114
1115                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1116
1117                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1118
1119                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1120
1121                 newnp->rcv_saddr = newnp->saddr;
1122
1123                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1124                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1125 #ifdef CONFIG_TCP_MD5SIG
1126                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1127 #endif
1128
1129                 newnp->ipv6_ac_list = NULL;
1130                 newnp->ipv6_fl_list = NULL;
1131                 newnp->pktoptions  = NULL;
1132                 newnp->opt         = NULL;
1133                 newnp->mcast_oif   = inet6_iif(skb);
1134                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1135                 newnp->rcv_tclass  = ipv6_get_dsfield(ipv6_hdr(skb));
1136
1137                 /*
1138                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1139                  * here, tcp_create_openreq_child now does this for us, see the comment in
1140                  * that function for the gory details. -acme
1141                  */
1142
1143                 /* It is tricky place. Until this moment IPv4 tcp
1144                    worked with IPv6 icsk.icsk_af_ops.
1145                    Sync it now.
1146                  */
1147                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1148
1149                 return newsk;
1150         }
1151
1152         treq = inet6_rsk(req);
1153
1154         if (sk_acceptq_is_full(sk))
1155                 goto out_overflow;
1156
1157         if (!dst) {
1158                 dst = inet6_csk_route_req(sk, &fl6, req);
1159                 if (!dst)
1160                         goto out;
1161         }
1162
1163         newsk = tcp_create_openreq_child(sk, req, skb);
1164         if (newsk == NULL)
1165                 goto out_nonewsk;
1166
1167         /*
1168          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1169          * count here, tcp_create_openreq_child now does this for us, see the
1170          * comment in that function for the gory details. -acme
1171          */
1172
1173         newsk->sk_gso_type = SKB_GSO_TCPV6;
1174         __ip6_dst_store(newsk, dst, NULL, NULL);
1175         inet6_sk_rx_dst_set(newsk, skb);
1176
1177         newtcp6sk = (struct tcp6_sock *)newsk;
1178         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1179
1180         newtp = tcp_sk(newsk);
1181         newinet = inet_sk(newsk);
1182         newnp = inet6_sk(newsk);
1183
1184         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1185
1186         newnp->daddr = treq->rmt_addr;
1187         newnp->saddr = treq->loc_addr;
1188         newnp->rcv_saddr = treq->loc_addr;
1189         newsk->sk_bound_dev_if = treq->iif;
1190
1191         /* Now IPv6 options...
1192
1193            First: no IPv4 options.
1194          */
1195         newinet->inet_opt = NULL;
1196         newnp->ipv6_ac_list = NULL;
1197         newnp->ipv6_fl_list = NULL;
1198
1199         /* Clone RX bits */
1200         newnp->rxopt.all = np->rxopt.all;
1201
1202         /* Clone pktoptions received with SYN */
1203         newnp->pktoptions = NULL;
1204         if (treq->pktopts != NULL) {
1205                 newnp->pktoptions = skb_clone(treq->pktopts,
1206                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1207                 consume_skb(treq->pktopts);
1208                 treq->pktopts = NULL;
1209                 if (newnp->pktoptions)
1210                         skb_set_owner_r(newnp->pktoptions, newsk);
1211         }
1212         newnp->opt        = NULL;
1213         newnp->mcast_oif  = inet6_iif(skb);
1214         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1215         newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1216
1217         /* Clone native IPv6 options from listening socket (if any)
1218
1219            Yes, keeping reference count would be much more clever,
1220            but we make one more one thing there: reattach optmem
1221            to newsk.
1222          */
1223         if (np->opt)
1224                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1225
1226         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1227         if (newnp->opt)
1228                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1229                                                      newnp->opt->opt_flen);
1230
1231         tcp_mtup_init(newsk);
1232         tcp_sync_mss(newsk, dst_mtu(dst));
1233         newtp->advmss = dst_metric_advmss(dst);
1234         if (tcp_sk(sk)->rx_opt.user_mss &&
1235             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1236                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1237
1238         tcp_initialize_rcv_mss(newsk);
1239         tcp_synack_rtt_meas(newsk, req);
1240         newtp->total_retrans = req->num_retrans;
1241
1242         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1243         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1244
1245 #ifdef CONFIG_TCP_MD5SIG
1246         /* Copy over the MD5 key from the original socket */
1247         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1248                 /* We're using one, so create a matching key
1249                  * on the newsk structure. If we fail to get
1250                  * memory, then we end up not copying the key
1251                  * across. Shucks.
1252                  */
1253                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1254                                AF_INET6, key->key, key->keylen,
1255                                sk_gfp_atomic(sk, GFP_ATOMIC));
1256         }
1257 #endif
1258
1259         if (__inet_inherit_port(sk, newsk) < 0) {
1260                 inet_csk_prepare_forced_close(newsk);
1261                 tcp_done(newsk);
1262                 goto out;
1263         }
1264         __inet6_hash(newsk, NULL);
1265
1266         return newsk;
1267
1268 out_overflow:
1269         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1270 out_nonewsk:
1271         dst_release(dst);
1272 out:
1273         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1274         return NULL;
1275 }
1276
1277 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1278 {
1279         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1280                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1281                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1282                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1283                         return 0;
1284                 }
1285         }
1286
1287         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1288                                               &ipv6_hdr(skb)->saddr,
1289                                               &ipv6_hdr(skb)->daddr, 0));
1290
1291         if (skb->len <= 76) {
1292                 return __skb_checksum_complete(skb);
1293         }
1294         return 0;
1295 }
1296
1297 /* The socket must have it's spinlock held when we get
1298  * here.
1299  *
1300  * We have a potential double-lock case here, so even when
1301  * doing backlog processing we use the BH locking scheme.
1302  * This is because we cannot sleep with the original spinlock
1303  * held.
1304  */
1305 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1306 {
1307         struct ipv6_pinfo *np = inet6_sk(sk);
1308         struct tcp_sock *tp;
1309         struct sk_buff *opt_skb = NULL;
1310
1311         /* Imagine: socket is IPv6. IPv4 packet arrives,
1312            goes to IPv4 receive handler and backlogged.
1313            From backlog it always goes here. Kerboom...
1314            Fortunately, tcp_rcv_established and rcv_established
1315            handle them correctly, but it is not case with
1316            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1317          */
1318
1319         if (skb->protocol == htons(ETH_P_IP))
1320                 return tcp_v4_do_rcv(sk, skb);
1321
1322 #ifdef CONFIG_TCP_MD5SIG
1323         if (tcp_v6_inbound_md5_hash (sk, skb))
1324                 goto discard;
1325 #endif
1326
1327         if (sk_filter(sk, skb))
1328                 goto discard;
1329
1330         /*
1331          *      socket locking is here for SMP purposes as backlog rcv
1332          *      is currently called with bh processing disabled.
1333          */
1334
1335         /* Do Stevens' IPV6_PKTOPTIONS.
1336
1337            Yes, guys, it is the only place in our code, where we
1338            may make it not affecting IPv4.
1339            The rest of code is protocol independent,
1340            and I do not like idea to uglify IPv4.
1341
1342            Actually, all the idea behind IPV6_PKTOPTIONS
1343            looks not very well thought. For now we latch
1344            options, received in the last packet, enqueued
1345            by tcp. Feel free to propose better solution.
1346                                                --ANK (980728)
1347          */
1348         if (np->rxopt.all)
1349                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1350
1351         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1352                 struct dst_entry *dst = sk->sk_rx_dst;
1353
1354                 sock_rps_save_rxhash(sk, skb);
1355                 if (dst) {
1356                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1357                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1358                                 dst_release(dst);
1359                                 sk->sk_rx_dst = NULL;
1360                         }
1361                 }
1362
1363                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1364                         goto reset;
1365                 if (opt_skb)
1366                         goto ipv6_pktoptions;
1367                 return 0;
1368         }
1369
1370         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1371                 goto csum_err;
1372
1373         if (sk->sk_state == TCP_LISTEN) {
1374                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1375                 if (!nsk)
1376                         goto discard;
1377
1378                 /*
1379                  * Queue it on the new socket if the new socket is active,
1380                  * otherwise we just shortcircuit this and continue with
1381                  * the new socket..
1382                  */
1383                 if(nsk != sk) {
1384                         sock_rps_save_rxhash(nsk, skb);
1385                         if (tcp_child_process(sk, nsk, skb))
1386                                 goto reset;
1387                         if (opt_skb)
1388                                 __kfree_skb(opt_skb);
1389                         return 0;
1390                 }
1391         } else
1392                 sock_rps_save_rxhash(sk, skb);
1393
1394         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1395                 goto reset;
1396         if (opt_skb)
1397                 goto ipv6_pktoptions;
1398         return 0;
1399
1400 reset:
1401         tcp_v6_send_reset(sk, skb);
1402 discard:
1403         if (opt_skb)
1404                 __kfree_skb(opt_skb);
1405         kfree_skb(skb);
1406         return 0;
1407 csum_err:
1408         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1409         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1410         goto discard;
1411
1412
1413 ipv6_pktoptions:
1414         /* Do you ask, what is it?
1415
1416            1. skb was enqueued by tcp.
1417            2. skb is added to tail of read queue, rather than out of order.
1418            3. socket is not in passive state.
1419            4. Finally, it really contains options, which user wants to receive.
1420          */
1421         tp = tcp_sk(sk);
1422         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1423             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1424                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1425                         np->mcast_oif = inet6_iif(opt_skb);
1426                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1427                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1428                 if (np->rxopt.bits.rxtclass)
1429                         np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1430                 if (ipv6_opt_accepted(sk, opt_skb)) {
1431                         skb_set_owner_r(opt_skb, sk);
1432                         opt_skb = xchg(&np->pktoptions, opt_skb);
1433                 } else {
1434                         __kfree_skb(opt_skb);
1435                         opt_skb = xchg(&np->pktoptions, NULL);
1436                 }
1437         }
1438
1439         kfree_skb(opt_skb);
1440         return 0;
1441 }
1442
1443 static int tcp_v6_rcv(struct sk_buff *skb)
1444 {
1445         const struct tcphdr *th;
1446         const struct ipv6hdr *hdr;
1447         struct sock *sk;
1448         int ret;
1449         struct net *net = dev_net(skb->dev);
1450
1451         if (skb->pkt_type != PACKET_HOST)
1452                 goto discard_it;
1453
1454         /*
1455          *      Count it even if it's bad.
1456          */
1457         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1458
1459         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1460                 goto discard_it;
1461
1462         th = tcp_hdr(skb);
1463
1464         if (th->doff < sizeof(struct tcphdr)/4)
1465                 goto bad_packet;
1466         if (!pskb_may_pull(skb, th->doff*4))
1467                 goto discard_it;
1468
1469         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1470                 goto csum_error;
1471
1472         th = tcp_hdr(skb);
1473         hdr = ipv6_hdr(skb);
1474         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1475         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1476                                     skb->len - th->doff*4);
1477         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1478         TCP_SKB_CB(skb)->when = 0;
1479         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1480         TCP_SKB_CB(skb)->sacked = 0;
1481
1482         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1483         if (!sk)
1484                 goto no_tcp_socket;
1485
1486 process:
1487         if (sk->sk_state == TCP_TIME_WAIT)
1488                 goto do_time_wait;
1489
1490         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1491                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1492                 goto discard_and_relse;
1493         }
1494
1495         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1496                 goto discard_and_relse;
1497
1498         if (sk_filter(sk, skb))
1499                 goto discard_and_relse;
1500
1501         skb->dev = NULL;
1502
1503         bh_lock_sock_nested(sk);
1504         ret = 0;
1505         if (!sock_owned_by_user(sk)) {
1506 #ifdef CONFIG_NET_DMA
1507                 struct tcp_sock *tp = tcp_sk(sk);
1508                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1509                         tp->ucopy.dma_chan = net_dma_find_channel();
1510                 if (tp->ucopy.dma_chan)
1511                         ret = tcp_v6_do_rcv(sk, skb);
1512                 else
1513 #endif
1514                 {
1515                         if (!tcp_prequeue(sk, skb))
1516                                 ret = tcp_v6_do_rcv(sk, skb);
1517                 }
1518         } else if (unlikely(sk_add_backlog(sk, skb,
1519                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1520                 bh_unlock_sock(sk);
1521                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1522                 goto discard_and_relse;
1523         }
1524         bh_unlock_sock(sk);
1525
1526         sock_put(sk);
1527         return ret ? -1 : 0;
1528
1529 no_tcp_socket:
1530         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1531                 goto discard_it;
1532
1533         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1534 csum_error:
1535                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1536 bad_packet:
1537                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1538         } else {
1539                 tcp_v6_send_reset(NULL, skb);
1540         }
1541
1542 discard_it:
1543         kfree_skb(skb);
1544         return 0;
1545
1546 discard_and_relse:
1547         sock_put(sk);
1548         goto discard_it;
1549
1550 do_time_wait:
1551         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1552                 inet_twsk_put(inet_twsk(sk));
1553                 goto discard_it;
1554         }
1555
1556         if (skb->len < (th->doff<<2)) {
1557                 inet_twsk_put(inet_twsk(sk));
1558                 goto bad_packet;
1559         }
1560         if (tcp_checksum_complete(skb)) {
1561                 inet_twsk_put(inet_twsk(sk));
1562                 goto csum_error;
1563         }
1564
1565         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1566         case TCP_TW_SYN:
1567         {
1568                 struct sock *sk2;
1569
1570                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1571                                             &ipv6_hdr(skb)->saddr, th->source,
1572                                             &ipv6_hdr(skb)->daddr,
1573                                             ntohs(th->dest), inet6_iif(skb));
1574                 if (sk2 != NULL) {
1575                         struct inet_timewait_sock *tw = inet_twsk(sk);
1576                         inet_twsk_deschedule(tw, &tcp_death_row);
1577                         inet_twsk_put(tw);
1578                         sk = sk2;
1579                         goto process;
1580                 }
1581                 /* Fall through to ACK */
1582         }
1583         case TCP_TW_ACK:
1584                 tcp_v6_timewait_ack(sk, skb);
1585                 break;
1586         case TCP_TW_RST:
1587                 goto no_tcp_socket;
1588         case TCP_TW_SUCCESS:;
1589         }
1590         goto discard_it;
1591 }
1592
1593 static void tcp_v6_early_demux(struct sk_buff *skb)
1594 {
1595         const struct ipv6hdr *hdr;
1596         const struct tcphdr *th;
1597         struct sock *sk;
1598
1599         if (skb->pkt_type != PACKET_HOST)
1600                 return;
1601
1602         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1603                 return;
1604
1605         hdr = ipv6_hdr(skb);
1606         th = tcp_hdr(skb);
1607
1608         if (th->doff < sizeof(struct tcphdr) / 4)
1609                 return;
1610
1611         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1612                                         &hdr->saddr, th->source,
1613                                         &hdr->daddr, ntohs(th->dest),
1614                                         inet6_iif(skb));
1615         if (sk) {
1616                 skb->sk = sk;
1617                 skb->destructor = sock_edemux;
1618                 if (sk->sk_state != TCP_TIME_WAIT) {
1619                         struct dst_entry *dst = sk->sk_rx_dst;
1620
1621                         if (dst)
1622                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1623                         if (dst &&
1624                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1625                                 skb_dst_set_noref(skb, dst);
1626                 }
1627         }
1628 }
1629
1630 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1631         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1632         .twsk_unique    = tcp_twsk_unique,
1633         .twsk_destructor= tcp_twsk_destructor,
1634 };
1635
1636 static const struct inet_connection_sock_af_ops ipv6_specific = {
1637         .queue_xmit        = inet6_csk_xmit,
1638         .send_check        = tcp_v6_send_check,
1639         .rebuild_header    = inet6_sk_rebuild_header,
1640         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1641         .conn_request      = tcp_v6_conn_request,
1642         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1643         .net_header_len    = sizeof(struct ipv6hdr),
1644         .net_frag_header_len = sizeof(struct frag_hdr),
1645         .setsockopt        = ipv6_setsockopt,
1646         .getsockopt        = ipv6_getsockopt,
1647         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1648         .sockaddr_len      = sizeof(struct sockaddr_in6),
1649         .bind_conflict     = inet6_csk_bind_conflict,
1650 #ifdef CONFIG_COMPAT
1651         .compat_setsockopt = compat_ipv6_setsockopt,
1652         .compat_getsockopt = compat_ipv6_getsockopt,
1653 #endif
1654 };
1655
1656 #ifdef CONFIG_TCP_MD5SIG
1657 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1658         .md5_lookup     =       tcp_v6_md5_lookup,
1659         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1660         .md5_parse      =       tcp_v6_parse_md5_keys,
1661 };
1662 #endif
1663
1664 /*
1665  *      TCP over IPv4 via INET6 API
1666  */
1667
1668 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1669         .queue_xmit        = ip_queue_xmit,
1670         .send_check        = tcp_v4_send_check,
1671         .rebuild_header    = inet_sk_rebuild_header,
1672         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1673         .conn_request      = tcp_v6_conn_request,
1674         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1675         .net_header_len    = sizeof(struct iphdr),
1676         .setsockopt        = ipv6_setsockopt,
1677         .getsockopt        = ipv6_getsockopt,
1678         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1679         .sockaddr_len      = sizeof(struct sockaddr_in6),
1680         .bind_conflict     = inet6_csk_bind_conflict,
1681 #ifdef CONFIG_COMPAT
1682         .compat_setsockopt = compat_ipv6_setsockopt,
1683         .compat_getsockopt = compat_ipv6_getsockopt,
1684 #endif
1685 };
1686
1687 #ifdef CONFIG_TCP_MD5SIG
1688 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1689         .md5_lookup     =       tcp_v4_md5_lookup,
1690         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1691         .md5_parse      =       tcp_v6_parse_md5_keys,
1692 };
1693 #endif
1694
1695 /* NOTE: A lot of things set to zero explicitly by call to
1696  *       sk_alloc() so need not be done here.
1697  */
1698 static int tcp_v6_init_sock(struct sock *sk)
1699 {
1700         struct inet_connection_sock *icsk = inet_csk(sk);
1701
1702         tcp_init_sock(sk);
1703
1704         icsk->icsk_af_ops = &ipv6_specific;
1705
1706 #ifdef CONFIG_TCP_MD5SIG
1707         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1708 #endif
1709
1710         return 0;
1711 }
1712
1713 static void tcp_v6_destroy_sock(struct sock *sk)
1714 {
1715         tcp_v4_destroy_sock(sk);
1716         inet6_destroy_sock(sk);
1717 }
1718
1719 #ifdef CONFIG_PROC_FS
1720 /* Proc filesystem TCPv6 sock list dumping. */
1721 static void get_openreq6(struct seq_file *seq,
1722                          const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1723 {
1724         int ttd = req->expires - jiffies;
1725         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1726         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1727
1728         if (ttd < 0)
1729                 ttd = 0;
1730
1731         seq_printf(seq,
1732                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1733                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1734                    i,
1735                    src->s6_addr32[0], src->s6_addr32[1],
1736                    src->s6_addr32[2], src->s6_addr32[3],
1737                    ntohs(inet_rsk(req)->loc_port),
1738                    dest->s6_addr32[0], dest->s6_addr32[1],
1739                    dest->s6_addr32[2], dest->s6_addr32[3],
1740                    ntohs(inet_rsk(req)->rmt_port),
1741                    TCP_SYN_RECV,
1742                    0,0, /* could print option size, but that is af dependent. */
1743                    1,   /* timers active (only the expire timer) */
1744                    jiffies_to_clock_t(ttd),
1745                    req->num_timeout,
1746                    from_kuid_munged(seq_user_ns(seq), uid),
1747                    0,  /* non standard timer */
1748                    0, /* open_requests have no inode */
1749                    0, req);
1750 }
1751
1752 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1753 {
1754         const struct in6_addr *dest, *src;
1755         __u16 destp, srcp;
1756         int timer_active;
1757         unsigned long timer_expires;
1758         const struct inet_sock *inet = inet_sk(sp);
1759         const struct tcp_sock *tp = tcp_sk(sp);
1760         const struct inet_connection_sock *icsk = inet_csk(sp);
1761         const struct ipv6_pinfo *np = inet6_sk(sp);
1762
1763         dest  = &np->daddr;
1764         src   = &np->rcv_saddr;
1765         destp = ntohs(inet->inet_dport);
1766         srcp  = ntohs(inet->inet_sport);
1767
1768         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1769                 timer_active    = 1;
1770                 timer_expires   = icsk->icsk_timeout;
1771         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1772                 timer_active    = 4;
1773                 timer_expires   = icsk->icsk_timeout;
1774         } else if (timer_pending(&sp->sk_timer)) {
1775                 timer_active    = 2;
1776                 timer_expires   = sp->sk_timer.expires;
1777         } else {
1778                 timer_active    = 0;
1779                 timer_expires = jiffies;
1780         }
1781
1782         seq_printf(seq,
1783                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1784                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
1785                    i,
1786                    src->s6_addr32[0], src->s6_addr32[1],
1787                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1788                    dest->s6_addr32[0], dest->s6_addr32[1],
1789                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1790                    sp->sk_state,
1791                    tp->write_seq-tp->snd_una,
1792                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1793                    timer_active,
1794                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1795                    icsk->icsk_retransmits,
1796                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1797                    icsk->icsk_probes_out,
1798                    sock_i_ino(sp),
1799                    atomic_read(&sp->sk_refcnt), sp,
1800                    jiffies_to_clock_t(icsk->icsk_rto),
1801                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1802                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1803                    tp->snd_cwnd,
1804                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1805                    );
1806 }
1807
1808 static void get_timewait6_sock(struct seq_file *seq,
1809                                struct inet_timewait_sock *tw, int i)
1810 {
1811         const struct in6_addr *dest, *src;
1812         __u16 destp, srcp;
1813         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1814         long delta = tw->tw_ttd - jiffies;
1815
1816         dest = &tw6->tw_v6_daddr;
1817         src  = &tw6->tw_v6_rcv_saddr;
1818         destp = ntohs(tw->tw_dport);
1819         srcp  = ntohs(tw->tw_sport);
1820
1821         seq_printf(seq,
1822                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1823                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1824                    i,
1825                    src->s6_addr32[0], src->s6_addr32[1],
1826                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1827                    dest->s6_addr32[0], dest->s6_addr32[1],
1828                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1829                    tw->tw_substate, 0, 0,
1830                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1831                    atomic_read(&tw->tw_refcnt), tw);
1832 }
1833
1834 static int tcp6_seq_show(struct seq_file *seq, void *v)
1835 {
1836         struct tcp_iter_state *st;
1837
1838         if (v == SEQ_START_TOKEN) {
1839                 seq_puts(seq,
1840                          "  sl  "
1841                          "local_address                         "
1842                          "remote_address                        "
1843                          "st tx_queue rx_queue tr tm->when retrnsmt"
1844                          "   uid  timeout inode\n");
1845                 goto out;
1846         }
1847         st = seq->private;
1848
1849         switch (st->state) {
1850         case TCP_SEQ_STATE_LISTENING:
1851         case TCP_SEQ_STATE_ESTABLISHED:
1852                 get_tcp6_sock(seq, v, st->num);
1853                 break;
1854         case TCP_SEQ_STATE_OPENREQ:
1855                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1856                 break;
1857         case TCP_SEQ_STATE_TIME_WAIT:
1858                 get_timewait6_sock(seq, v, st->num);
1859                 break;
1860         }
1861 out:
1862         return 0;
1863 }
1864
1865 static const struct file_operations tcp6_afinfo_seq_fops = {
1866         .owner   = THIS_MODULE,
1867         .open    = tcp_seq_open,
1868         .read    = seq_read,
1869         .llseek  = seq_lseek,
1870         .release = seq_release_net
1871 };
1872
1873 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1874         .name           = "tcp6",
1875         .family         = AF_INET6,
1876         .seq_fops       = &tcp6_afinfo_seq_fops,
1877         .seq_ops        = {
1878                 .show           = tcp6_seq_show,
1879         },
1880 };
1881
1882 int __net_init tcp6_proc_init(struct net *net)
1883 {
1884         return tcp_proc_register(net, &tcp6_seq_afinfo);
1885 }
1886
1887 void tcp6_proc_exit(struct net *net)
1888 {
1889         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1890 }
1891 #endif
1892
1893 static void tcp_v6_clear_sk(struct sock *sk, int size)
1894 {
1895         struct inet_sock *inet = inet_sk(sk);
1896
1897         /* we do not want to clear pinet6 field, because of RCU lookups */
1898         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1899
1900         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1901         memset(&inet->pinet6 + 1, 0, size);
1902 }
1903
1904 struct proto tcpv6_prot = {
1905         .name                   = "TCPv6",
1906         .owner                  = THIS_MODULE,
1907         .close                  = tcp_close,
1908         .connect                = tcp_v6_connect,
1909         .disconnect             = tcp_disconnect,
1910         .accept                 = inet_csk_accept,
1911         .ioctl                  = tcp_ioctl,
1912         .init                   = tcp_v6_init_sock,
1913         .destroy                = tcp_v6_destroy_sock,
1914         .shutdown               = tcp_shutdown,
1915         .setsockopt             = tcp_setsockopt,
1916         .getsockopt             = tcp_getsockopt,
1917         .recvmsg                = tcp_recvmsg,
1918         .sendmsg                = tcp_sendmsg,
1919         .sendpage               = tcp_sendpage,
1920         .backlog_rcv            = tcp_v6_do_rcv,
1921         .release_cb             = tcp_release_cb,
1922         .mtu_reduced            = tcp_v6_mtu_reduced,
1923         .hash                   = tcp_v6_hash,
1924         .unhash                 = inet_unhash,
1925         .get_port               = inet_csk_get_port,
1926         .enter_memory_pressure  = tcp_enter_memory_pressure,
1927         .sockets_allocated      = &tcp_sockets_allocated,
1928         .memory_allocated       = &tcp_memory_allocated,
1929         .memory_pressure        = &tcp_memory_pressure,
1930         .orphan_count           = &tcp_orphan_count,
1931         .sysctl_wmem            = sysctl_tcp_wmem,
1932         .sysctl_rmem            = sysctl_tcp_rmem,
1933         .max_header             = MAX_TCP_HEADER,
1934         .obj_size               = sizeof(struct tcp6_sock),
1935         .slab_flags             = SLAB_DESTROY_BY_RCU,
1936         .twsk_prot              = &tcp6_timewait_sock_ops,
1937         .rsk_prot               = &tcp6_request_sock_ops,
1938         .h.hashinfo             = &tcp_hashinfo,
1939         .no_autobind            = true,
1940 #ifdef CONFIG_COMPAT
1941         .compat_setsockopt      = compat_tcp_setsockopt,
1942         .compat_getsockopt      = compat_tcp_getsockopt,
1943 #endif
1944 #ifdef CONFIG_MEMCG_KMEM
1945         .proto_cgroup           = tcp_proto_cgroup,
1946 #endif
1947         .clear_sk               = tcp_v6_clear_sk,
1948 };
1949
1950 static const struct inet6_protocol tcpv6_protocol = {
1951         .early_demux    =       tcp_v6_early_demux,
1952         .handler        =       tcp_v6_rcv,
1953         .err_handler    =       tcp_v6_err,
1954         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1955 };
1956
1957 static struct inet_protosw tcpv6_protosw = {
1958         .type           =       SOCK_STREAM,
1959         .protocol       =       IPPROTO_TCP,
1960         .prot           =       &tcpv6_prot,
1961         .ops            =       &inet6_stream_ops,
1962         .no_check       =       0,
1963         .flags          =       INET_PROTOSW_PERMANENT |
1964                                 INET_PROTOSW_ICSK,
1965 };
1966
1967 static int __net_init tcpv6_net_init(struct net *net)
1968 {
1969         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1970                                     SOCK_RAW, IPPROTO_TCP, net);
1971 }
1972
1973 static void __net_exit tcpv6_net_exit(struct net *net)
1974 {
1975         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1976 }
1977
1978 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1979 {
1980         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1981 }
1982
1983 static struct pernet_operations tcpv6_net_ops = {
1984         .init       = tcpv6_net_init,
1985         .exit       = tcpv6_net_exit,
1986         .exit_batch = tcpv6_net_exit_batch,
1987 };
1988
1989 int __init tcpv6_init(void)
1990 {
1991         int ret;
1992
1993         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1994         if (ret)
1995                 goto out;
1996
1997         /* register inet6 protocol */
1998         ret = inet6_register_protosw(&tcpv6_protosw);
1999         if (ret)
2000                 goto out_tcpv6_protocol;
2001
2002         ret = register_pernet_subsys(&tcpv6_net_ops);
2003         if (ret)
2004                 goto out_tcpv6_protosw;
2005 out:
2006         return ret;
2007
2008 out_tcpv6_protosw:
2009         inet6_unregister_protosw(&tcpv6_protosw);
2010 out_tcpv6_protocol:
2011         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2012         goto out;
2013 }
2014
2015 void tcpv6_exit(void)
2016 {
2017         unregister_pernet_subsys(&tcpv6_net_ops);
2018         inet6_unregister_protosw(&tcpv6_protosw);
2019         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2020 }