net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65 #include <net/tcp_memcontrol.h>
  66
  67 #include <asm/uaccess.h>
  68
  69 #include <linux/proc_fs.h>
  70 #include <linux/seq_file.h>
  71
  72 #include <linux/crypto.h>
  73 #include <linux/scatterlist.h>
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  77                                       struct request_sock *req);
  78
  79 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  80
  81 static const struct inet_connection_sock_af_ops ipv6_mapped;
  82 static const struct inet_connection_sock_af_ops ipv6_specific;
  83 #ifdef CONFIG_TCP_MD5SIG
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  85 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  86 #else
  87 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  88                                                    const struct in6_addr *addr)
  89 {
  90         return NULL;
  91 }
  92 #endif
  93
  94 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  95 {
  96         struct dst_entry *dst = skb_dst(skb);
  97         const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99         dst_hold(dst);
 100         sk->sk_rx_dst = dst;
 101         inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102         if (rt->rt6i_node)
 103                 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 104 }
 105
 106 static void tcp_v6_hash(struct sock *sk)
 107 {
 108         if (sk->sk_state != TCP_CLOSE) {
 109                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 110                         tcp_prot.hash(sk);
 111                         return;
 112                 }
 113                 local_bh_disable();
 114                 __inet6_hash(sk, NULL);
 115                 local_bh_enable();
 116         }
 117 }
 118
 119 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 120 {
 121         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 122                                             ipv6_hdr(skb)->saddr.s6_addr32,
 123                                             tcp_hdr(skb)->dest,
 124                                             tcp_hdr(skb)->source);
 125 }
 126
 127 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 128                           int addr_len)
 129 {
 130         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 131         struct inet_sock *inet = inet_sk(sk);
 132         struct inet_connection_sock *icsk = inet_csk(sk);
 133         struct ipv6_pinfo *np = inet6_sk(sk);
 134         struct tcp_sock *tp = tcp_sk(sk);
 135         struct in6_addr *saddr = NULL, *final_p, final;
 136         struct rt6_info *rt;
 137         struct flowi6 fl6;
 138         struct dst_entry *dst;
 139         int addr_type;
 140         int err;
 141
 142         if (addr_len < SIN6_LEN_RFC2133)
 143                 return -EINVAL;
 144
 145         if (usin->sin6_family != AF_INET6)
 146                 return -EAFNOSUPPORT;
 147
 148         memset(&fl6, 0, sizeof(fl6));
 149
 150         if (np->sndflow) {
 151                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 152                 IP6_ECN_flow_init(fl6.flowlabel);
 153                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 154                         struct ip6_flowlabel *flowlabel;
 155                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 156                         if (flowlabel == NULL)
 157                                 return -EINVAL;
 158                         usin->sin6_addr = flowlabel->dst;
 159                         fl6_sock_release(flowlabel);
 160                 }
 161         }
 162
 163         /*
 164          *      connect() to INADDR_ANY means loopback (BSD'ism).
 165          */
 166
 167         if(ipv6_addr_any(&usin->sin6_addr))
 168                 usin->sin6_addr.s6_addr[15] = 0x1;
 169
 170         addr_type = ipv6_addr_type(&usin->sin6_addr);
 171
 172         if(addr_type & IPV6_ADDR_MULTICAST)
 173                 return -ENETUNREACH;
 174
 175         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 176                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 177                     usin->sin6_scope_id) {
 178                         /* If interface is set while binding, indices
 179                          * must coincide.
 180                          */
 181                         if (sk->sk_bound_dev_if &&
 182                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 183                                 return -EINVAL;
 184
 185                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 186                 }
 187
 188                 /* Connect to link-local address requires an interface */
 189                 if (!sk->sk_bound_dev_if)
 190                         return -EINVAL;
 191         }
 192
 193         if (tp->rx_opt.ts_recent_stamp &&
 194             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 195                 tp->rx_opt.ts_recent = 0;
 196                 tp->rx_opt.ts_recent_stamp = 0;
 197                 tp->write_seq = 0;
 198         }
 199
 200         np->daddr = usin->sin6_addr;
 201         np->flow_label = fl6.flowlabel;
 202
 203         /*
 204          *      TCP over IPv4
 205          */
 206
 207         if (addr_type == IPV6_ADDR_MAPPED) {
 208                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 209                 struct sockaddr_in sin;
 210
 211                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 212
 213                 if (__ipv6_only_sock(sk))
 214                         return -ENETUNREACH;
 215
 216                 sin.sin_family = AF_INET;
 217                 sin.sin_port = usin->sin6_port;
 218                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 219
 220                 icsk->icsk_af_ops = &ipv6_mapped;
 221                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 224 #endif
 225
 226                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 227
 228                 if (err) {
 229                         icsk->icsk_ext_hdr_len = exthdrlen;
 230                         icsk->icsk_af_ops = &ipv6_specific;
 231                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 232 #ifdef CONFIG_TCP_MD5SIG
 233                         tp->af_specific = &tcp_sock_ipv6_specific;
 234 #endif
 235                         goto failure;
 236                 } else {
 237                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 238                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 239                                                &np->rcv_saddr);
 240                 }
 241
 242                 return err;
 243         }
 244
 245         if (!ipv6_addr_any(&np->rcv_saddr))
 246                 saddr = &np->rcv_saddr;
 247
 248         fl6.flowi6_proto = IPPROTO_TCP;
 249         fl6.daddr = np->daddr;
 250         fl6.saddr = saddr ? *saddr : np->saddr;
 251         fl6.flowi6_oif = sk->sk_bound_dev_if;
 252         fl6.flowi6_mark = sk->sk_mark;
 253         fl6.fl6_dport = usin->sin6_port;
 254         fl6.fl6_sport = inet->inet_sport;
 255
 256         final_p = fl6_update_dst(&fl6, np->opt, &final);
 257
 258         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 259
 260         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 261         if (IS_ERR(dst)) {
 262                 err = PTR_ERR(dst);
 263                 goto failure;
 264         }
 265
 266         if (saddr == NULL) {
 267                 saddr = &fl6.saddr;
 268                 np->rcv_saddr = *saddr;
 269         }
 270
 271         /* set the source address */
 272         np->saddr = *saddr;
 273         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 274
 275         sk->sk_gso_type = SKB_GSO_TCPV6;
 276         __ip6_dst_store(sk, dst, NULL, NULL);
 277
 278         rt = (struct rt6_info *) dst;
 279         if (tcp_death_row.sysctl_tw_recycle &&
 280             !tp->rx_opt.ts_recent_stamp &&
 281             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr))
 282                 tcp_fetch_timewait_stamp(sk, dst);
 283
 284         icsk->icsk_ext_hdr_len = 0;
 285         if (np->opt)
 286                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 287                                           np->opt->opt_nflen);
 288
 289         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 290
 291         inet->inet_dport = usin->sin6_port;
 292
 293         tcp_set_state(sk, TCP_SYN_SENT);
 294         err = inet6_hash_connect(&tcp_death_row, sk);
 295         if (err)
 296                 goto late_failure;
 297
 298         if (!tp->write_seq && likely(!tp->repair))
 299                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 300                                                              np->daddr.s6_addr32,
 301                                                              inet->inet_sport,
 302                                                              inet->inet_dport);
 303
 304         err = tcp_connect(sk);
 305         if (err)
 306                 goto late_failure;
 307
 308         return 0;
 309
 310 late_failure:
 311         tcp_set_state(sk, TCP_CLOSE);
 312         __sk_dst_reset(sk);
 313 failure:
 314         inet->inet_dport = 0;
 315         sk->sk_route_caps = 0;
 316         return err;
 317 }
 318
 319 static void tcp_v6_mtu_reduced(struct sock *sk)
 320 {
 321         struct dst_entry *dst;
 322
 323         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 324                 return;
 325
 326         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 327         if (!dst)
 328                 return;
 329
 330         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 331                 tcp_sync_mss(sk, dst_mtu(dst));
 332                 tcp_simple_retransmit(sk);
 333         }
 334 }
 335
 336 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 337                 u8 type, u8 code, int offset, __be32 info)
 338 {
 339         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 340         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 341         struct ipv6_pinfo *np;
 342         struct sock *sk;
 343         int err;
 344         struct tcp_sock *tp;
 345         __u32 seq;
 346         struct net *net = dev_net(skb->dev);
 347
 348         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 349                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 350
 351         if (sk == NULL) {
 352                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 353                                    ICMP6_MIB_INERRORS);
 354                 return;
 355         }
 356
 357         if (sk->sk_state == TCP_TIME_WAIT) {
 358                 inet_twsk_put(inet_twsk(sk));
 359                 return;
 360         }
 361
 362         bh_lock_sock(sk);
 363         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 364                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 365
 366         if (sk->sk_state == TCP_CLOSE)
 367                 goto out;
 368
 369         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 370                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 371                 goto out;
 372         }
 373
 374         tp = tcp_sk(sk);
 375         seq = ntohl(th->seq);
 376         if (sk->sk_state != TCP_LISTEN &&
 377             !between(seq, tp->snd_una, tp->snd_nxt)) {
 378                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 379                 goto out;
 380         }
 381
 382         np = inet6_sk(sk);
 383
 384         if (type == NDISC_REDIRECT) {
 385                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 386
 387                 if (dst)
 388                         dst->ops->redirect(dst, sk, skb);
 389         }
 390
 391         if (type == ICMPV6_PKT_TOOBIG) {
 392                 /* We are not interested in TCP_LISTEN and open_requests
 393                  * (SYN-ACKs send out by Linux are always <576bytes so
 394                  * they should go through unfragmented).
 395                  */
 396                 if (sk->sk_state == TCP_LISTEN)
 397                         goto out;
 398
 399                 tp->mtu_info = ntohl(info);
 400                 if (!sock_owned_by_user(sk))
 401                         tcp_v6_mtu_reduced(sk);
 402                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 403                                            &tp->tsq_flags))
 404                         sock_hold(sk);
 405                 goto out;
 406         }
 407
 408         icmpv6_err_convert(type, code, &err);
 409
 410         /* Might be for an request_sock */
 411         switch (sk->sk_state) {
 412                 struct request_sock *req, **prev;
 413         case TCP_LISTEN:
 414                 if (sock_owned_by_user(sk))
 415                         goto out;
 416
 417                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 418                                            &hdr->saddr, inet6_iif(skb));
 419                 if (!req)
 420                         goto out;
 421
 422                 /* ICMPs are not backlogged, hence we cannot get
 423                  * an established socket here.
 424                  */
 425                 WARN_ON(req->sk != NULL);
 426
 427                 if (seq != tcp_rsk(req)->snt_isn) {
 428                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 429                         goto out;
 430                 }
 431
 432                 inet_csk_reqsk_queue_drop(sk, req, prev);
 433                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 434                 goto out;
 435
 436         case TCP_SYN_SENT:
 437         case TCP_SYN_RECV:  /* Cannot happen.
 438                                It can, it SYNs are crossed. --ANK */
 439                 if (!sock_owned_by_user(sk)) {
 440                         sk->sk_err = err;
 441                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 442
 443                         tcp_done(sk);
 444                 } else
 445                         sk->sk_err_soft = err;
 446                 goto out;
 447         }
 448
 449         if (!sock_owned_by_user(sk) && np->recverr) {
 450                 sk->sk_err = err;
 451                 sk->sk_error_report(sk);
 452         } else
 453                 sk->sk_err_soft = err;
 454
 455 out:
 456         bh_unlock_sock(sk);
 457         sock_put(sk);
 458 }
 459
 460
 461 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 462                               struct flowi6 *fl6,
 463                               struct request_sock *req,
 464                               struct request_values *rvp,
 465                               u16 queue_mapping)
 466 {
 467         struct inet6_request_sock *treq = inet6_rsk(req);
 468         struct ipv6_pinfo *np = inet6_sk(sk);
 469         struct sk_buff * skb;
 470         int err = -ENOMEM;
 471
 472         /* First, grab a route. */
 473         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 474                 goto done;
 475
 476         skb = tcp_make_synack(sk, dst, req, rvp, NULL);
 477
 478         if (skb) {
 479                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 480
 481                 fl6->daddr = treq->rmt_addr;
 482                 skb_set_queue_mapping(skb, queue_mapping);
 483                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 484                 err = net_xmit_eval(err);
 485         }
 486
 487 done:
 488         return err;
 489 }
 490
 491 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 492                              struct request_values *rvp)
 493 {
 494         struct flowi6 fl6;
 495         int res;
 496
 497         res = tcp_v6_send_synack(sk, NULL, &fl6, req, rvp, 0);
 498         if (!res)
 499                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 500         return res;
 501 }
 502
 503 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 504 {
 505         kfree_skb(inet6_rsk(req)->pktopts);
 506 }
 507
 508 #ifdef CONFIG_TCP_MD5SIG
 509 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 510                                                    const struct in6_addr *addr)
 511 {
 512         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 513 }
 514
 515 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 516                                                 struct sock *addr_sk)
 517 {
 518         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 519 }
 520
 521 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 522                                                       struct request_sock *req)
 523 {
 524         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 525 }
 526
 527 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 528                                   int optlen)
 529 {
 530         struct tcp_md5sig cmd;
 531         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 532
 533         if (optlen < sizeof(cmd))
 534                 return -EINVAL;
 535
 536         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 537                 return -EFAULT;
 538
 539         if (sin6->sin6_family != AF_INET6)
 540                 return -EINVAL;
 541
 542         if (!cmd.tcpm_keylen) {
 543                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 544                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 545                                               AF_INET);
 546                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 547                                       AF_INET6);
 548         }
 549
 550         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 551                 return -EINVAL;
 552
 553         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 554                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 555                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 556
 557         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 558                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 559 }
 560
 561 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 562                                         const struct in6_addr *daddr,
 563                                         const struct in6_addr *saddr, int nbytes)
 564 {
 565         struct tcp6_pseudohdr *bp;
 566         struct scatterlist sg;
 567
 568         bp = &hp->md5_blk.ip6;
 569         /* 1. TCP pseudo-header (RFC2460) */
 570         bp->saddr = *saddr;
 571         bp->daddr = *daddr;
 572         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 573         bp->len = cpu_to_be32(nbytes);
 574
 575         sg_init_one(&sg, bp, sizeof(*bp));
 576         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 577 }
 578
 579 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 580                                const struct in6_addr *daddr, struct in6_addr *saddr,
 581                                const struct tcphdr *th)
 582 {
 583         struct tcp_md5sig_pool *hp;
 584         struct hash_desc *desc;
 585
 586         hp = tcp_get_md5sig_pool();
 587         if (!hp)
 588                 goto clear_hash_noput;
 589         desc = &hp->md5_desc;
 590
 591         if (crypto_hash_init(desc))
 592                 goto clear_hash;
 593         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 594                 goto clear_hash;
 595         if (tcp_md5_hash_header(hp, th))
 596                 goto clear_hash;
 597         if (tcp_md5_hash_key(hp, key))
 598                 goto clear_hash;
 599         if (crypto_hash_final(desc, md5_hash))
 600                 goto clear_hash;
 601
 602         tcp_put_md5sig_pool();
 603         return 0;
 604
 605 clear_hash:
 606         tcp_put_md5sig_pool();
 607 clear_hash_noput:
 608         memset(md5_hash, 0, 16);
 609         return 1;
 610 }
 611
 612 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 613                                const struct sock *sk,
 614                                const struct request_sock *req,
 615                                const struct sk_buff *skb)
 616 {
 617         const struct in6_addr *saddr, *daddr;
 618         struct tcp_md5sig_pool *hp;
 619         struct hash_desc *desc;
 620         const struct tcphdr *th = tcp_hdr(skb);
 621
 622         if (sk) {
 623                 saddr = &inet6_sk(sk)->saddr;
 624                 daddr = &inet6_sk(sk)->daddr;
 625         } else if (req) {
 626                 saddr = &inet6_rsk(req)->loc_addr;
 627                 daddr = &inet6_rsk(req)->rmt_addr;
 628         } else {
 629                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 630                 saddr = &ip6h->saddr;
 631                 daddr = &ip6h->daddr;
 632         }
 633
 634         hp = tcp_get_md5sig_pool();
 635         if (!hp)
 636                 goto clear_hash_noput;
 637         desc = &hp->md5_desc;
 638
 639         if (crypto_hash_init(desc))
 640                 goto clear_hash;
 641
 642         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 643                 goto clear_hash;
 644         if (tcp_md5_hash_header(hp, th))
 645                 goto clear_hash;
 646         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 647                 goto clear_hash;
 648         if (tcp_md5_hash_key(hp, key))
 649                 goto clear_hash;
 650         if (crypto_hash_final(desc, md5_hash))
 651                 goto clear_hash;
 652
 653         tcp_put_md5sig_pool();
 654         return 0;
 655
 656 clear_hash:
 657         tcp_put_md5sig_pool();
 658 clear_hash_noput:
 659         memset(md5_hash, 0, 16);
 660         return 1;
 661 }
 662
 663 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 664 {
 665         const __u8 *hash_location = NULL;
 666         struct tcp_md5sig_key *hash_expected;
 667         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 668         const struct tcphdr *th = tcp_hdr(skb);
 669         int genhash;
 670         u8 newhash[16];
 671
 672         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 673         hash_location = tcp_parse_md5sig_option(th);
 674
 675         /* We've parsed the options - do we have a hash? */
 676         if (!hash_expected && !hash_location)
 677                 return 0;
 678
 679         if (hash_expected && !hash_location) {
 680                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 681                 return 1;
 682         }
 683
 684         if (!hash_expected && hash_location) {
 685                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 686                 return 1;
 687         }
 688
 689         /* check the signature */
 690         genhash = tcp_v6_md5_hash_skb(newhash,
 691                                       hash_expected,
 692                                       NULL, NULL, skb);
 693
 694         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 695                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 696                                      genhash ? "failed" : "mismatch",
 697                                      &ip6h->saddr, ntohs(th->source),
 698                                      &ip6h->daddr, ntohs(th->dest));
 699                 return 1;
 700         }
 701         return 0;
 702 }
 703 #endif
 704
 705 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 706         .family         =       AF_INET6,
 707         .obj_size       =       sizeof(struct tcp6_request_sock),
 708         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 709         .send_ack       =       tcp_v6_reqsk_send_ack,
 710         .destructor     =       tcp_v6_reqsk_destructor,
 711         .send_reset     =       tcp_v6_send_reset,
 712         .syn_ack_timeout =      tcp_syn_ack_timeout,
 713 };
 714
 715 #ifdef CONFIG_TCP_MD5SIG
 716 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 717         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 718         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 719 };
 720 #endif
 721
 722 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 723                                  u32 tsval, u32 tsecr,
 724                                  struct tcp_md5sig_key *key, int rst, u8 tclass)
 725 {
 726         const struct tcphdr *th = tcp_hdr(skb);
 727         struct tcphdr *t1;
 728         struct sk_buff *buff;
 729         struct flowi6 fl6;
 730         struct net *net = dev_net(skb_dst(skb)->dev);
 731         struct sock *ctl_sk = net->ipv6.tcp_sk;
 732         unsigned int tot_len = sizeof(struct tcphdr);
 733         struct dst_entry *dst;
 734         __be32 *topt;
 735
 736         if (tsecr)
 737                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 738 #ifdef CONFIG_TCP_MD5SIG
 739         if (key)
 740                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 741 #endif
 742
 743         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 744                          GFP_ATOMIC);
 745         if (buff == NULL)
 746                 return;
 747
 748         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 749
 750         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 751         skb_reset_transport_header(buff);
 752
 753         /* Swap the send and the receive. */
 754         memset(t1, 0, sizeof(*t1));
 755         t1->dest = th->source;
 756         t1->source = th->dest;
 757         t1->doff = tot_len / 4;
 758         t1->seq = htonl(seq);
 759         t1->ack_seq = htonl(ack);
 760         t1->ack = !rst || !th->ack;
 761         t1->rst = rst;
 762         t1->window = htons(win);
 763
 764         topt = (__be32 *)(t1 + 1);
 765
 766         if (tsecr) {
 767                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 768                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 769                 *topt++ = htonl(tsval);
 770                 *topt++ = htonl(tsecr);
 771         }
 772
 773 #ifdef CONFIG_TCP_MD5SIG
 774         if (key) {
 775                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 776                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 777                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 778                                     &ipv6_hdr(skb)->saddr,
 779                                     &ipv6_hdr(skb)->daddr, t1);
 780         }
 781 #endif
 782
 783         memset(&fl6, 0, sizeof(fl6));
 784         fl6.daddr = ipv6_hdr(skb)->saddr;
 785         fl6.saddr = ipv6_hdr(skb)->daddr;
 786
 787         buff->ip_summed = CHECKSUM_PARTIAL;
 788         buff->csum = 0;
 789
 790         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 791
 792         fl6.flowi6_proto = IPPROTO_TCP;
 793         if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
 794                 fl6.flowi6_oif = inet6_iif(skb);
 795         fl6.fl6_dport = t1->dest;
 796         fl6.fl6_sport = t1->source;
 797         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 798
 799         /* Pass a socket to ip6_dst_lookup either it is for RST
 800          * Underlying function will use this to retrieve the network
 801          * namespace
 802          */
 803         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
 804         if (!IS_ERR(dst)) {
 805                 skb_dst_set(buff, dst);
 806                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 807                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 808                 if (rst)
 809                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 810                 return;
 811         }
 812
 813         kfree_skb(buff);
 814 }
 815
 816 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 817 {
 818         const struct tcphdr *th = tcp_hdr(skb);
 819         u32 seq = 0, ack_seq = 0;
 820         struct tcp_md5sig_key *key = NULL;
 821 #ifdef CONFIG_TCP_MD5SIG
 822         const __u8 *hash_location = NULL;
 823         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 824         unsigned char newhash[16];
 825         int genhash;
 826         struct sock *sk1 = NULL;
 827 #endif
 828
 829         if (th->rst)
 830                 return;
 831
 832         if (!ipv6_unicast_destination(skb))
 833                 return;
 834
 835 #ifdef CONFIG_TCP_MD5SIG
 836         hash_location = tcp_parse_md5sig_option(th);
 837         if (!sk && hash_location) {
 838                 /*
 839                  * active side is lost. Try to find listening socket through
 840                  * source port, and then find md5 key through listening socket.
 841                  * we are not loose security here:
 842                  * Incoming packet is checked with md5 hash with finding key,
 843                  * no RST generated if md5 hash doesn't match.
 844                  */
 845                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 846                                            &tcp_hashinfo, &ipv6h->saddr,
 847                                            th->source, &ipv6h->daddr,
 848                                            ntohs(th->source), inet6_iif(skb));
 849                 if (!sk1)
 850                         return;
 851
 852                 rcu_read_lock();
 853                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 854                 if (!key)
 855                         goto release_sk1;
 856
 857                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 858                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 859                         goto release_sk1;
 860         } else {
 861                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 862         }
 863 #endif
 864
 865         if (th->ack)
 866                 seq = ntohl(th->ack_seq);
 867         else
 868                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 869                           (th->doff << 2);
 870
 871         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0);
 872
 873 #ifdef CONFIG_TCP_MD5SIG
 874 release_sk1:
 875         if (sk1) {
 876                 rcu_read_unlock();
 877                 sock_put(sk1);
 878         }
 879 #endif
 880 }
 881
 882 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 883                             u32 win, u32 tsval, u32 tsecr,
 884                             struct tcp_md5sig_key *key, u8 tclass)
 885 {
 886         tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass);
 887 }
 888
 889 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 890 {
 891         struct inet_timewait_sock *tw = inet_twsk(sk);
 892         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 893
 894         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 895                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 896                         tcp_time_stamp + tcptw->tw_ts_offset,
 897                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
 898                         tw->tw_tclass);
 899
 900         inet_twsk_put(tw);
 901 }
 902
 903 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 904                                   struct request_sock *req)
 905 {
 906         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
 907                         req->rcv_wnd, tcp_time_stamp, req->ts_recent,
 908                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 909 }
 910
 911
 912 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 913 {
 914         struct request_sock *req, **prev;
 915         const struct tcphdr *th = tcp_hdr(skb);
 916         struct sock *nsk;
 917
 918         /* Find possible connection requests. */
 919         req = inet6_csk_search_req(sk, &prev, th->source,
 920                                    &ipv6_hdr(skb)->saddr,
 921                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 922         if (req)
 923                 return tcp_check_req(sk, skb, req, prev, false);
 924
 925         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 926                         &ipv6_hdr(skb)->saddr, th->source,
 927                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 928
 929         if (nsk) {
 930                 if (nsk->sk_state != TCP_TIME_WAIT) {
 931                         bh_lock_sock(nsk);
 932                         return nsk;
 933                 }
 934                 inet_twsk_put(inet_twsk(nsk));
 935                 return NULL;
 936         }
 937
 938 #ifdef CONFIG_SYN_COOKIES
 939         if (!th->syn)
 940                 sk = cookie_v6_check(sk, skb);
 941 #endif
 942         return sk;
 943 }
 944
 945 /* FIXME: this is substantially similar to the ipv4 code.
 946  * Can some kind of merge be done? -- erics
 947  */
 948 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 949 {
 950         struct tcp_extend_values tmp_ext;
 951         struct tcp_options_received tmp_opt;
 952         const u8 *hash_location;
 953         struct request_sock *req;
 954         struct inet6_request_sock *treq;
 955         struct ipv6_pinfo *np = inet6_sk(sk);
 956         struct tcp_sock *tp = tcp_sk(sk);
 957         __u32 isn = TCP_SKB_CB(skb)->when;
 958         struct dst_entry *dst = NULL;
 959         struct flowi6 fl6;
 960         bool want_cookie = false;
 961
 962         if (skb->protocol == htons(ETH_P_IP))
 963                 return tcp_v4_conn_request(sk, skb);
 964
 965         if (!ipv6_unicast_destination(skb))
 966                 goto drop;
 967
 968         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
 969                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
 970                 if (!want_cookie)
 971                         goto drop;
 972         }
 973
 974         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
 975                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 976                 goto drop;
 977         }
 978
 979         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 980         if (req == NULL)
 981                 goto drop;
 982
 983 #ifdef CONFIG_TCP_MD5SIG
 984         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
 985 #endif
 986
 987         tcp_clear_options(&tmp_opt);
 988         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 989         tmp_opt.user_mss = tp->rx_opt.user_mss;
 990         tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
 991
 992         if (tmp_opt.cookie_plus > 0 &&
 993             tmp_opt.saw_tstamp &&
 994             !tp->rx_opt.cookie_out_never &&
 995             (sysctl_tcp_cookie_size > 0 ||
 996              (tp->cookie_values != NULL &&
 997               tp->cookie_values->cookie_desired > 0))) {
 998                 u8 *c;
 999                 u32 *d;
1000                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1001                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1002
1003                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1004                         goto drop_and_free;
1005
1006                 /* Secret recipe starts with IP addresses */
1007                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1008                 *mess++ ^= *d++;
1009                 *mess++ ^= *d++;
1010                 *mess++ ^= *d++;
1011                 *mess++ ^= *d++;
1012                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1013                 *mess++ ^= *d++;
1014                 *mess++ ^= *d++;
1015                 *mess++ ^= *d++;
1016                 *mess++ ^= *d++;
1017
1018                 /* plus variable length Initiator Cookie */
1019                 c = (u8 *)mess;
1020                 while (l-- > 0)
1021                         *c++ ^= *hash_location++;
1022
1023                 want_cookie = false;    /* not our kind of cookie */
1024                 tmp_ext.cookie_out_never = 0; /* false */
1025                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1026         } else if (!tp->rx_opt.cookie_in_always) {
1027                 /* redundant indications, but ensure initialization. */
1028                 tmp_ext.cookie_out_never = 1; /* true */
1029                 tmp_ext.cookie_plus = 0;
1030         } else {
1031                 goto drop_and_free;
1032         }
1033         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1034
1035         if (want_cookie && !tmp_opt.saw_tstamp)
1036                 tcp_clear_options(&tmp_opt);
1037
1038         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1039         tcp_openreq_init(req, &tmp_opt, skb);
1040
1041         treq = inet6_rsk(req);
1042         treq->rmt_addr = ipv6_hdr(skb)->saddr;
1043         treq->loc_addr = ipv6_hdr(skb)->daddr;
1044         if (!want_cookie || tmp_opt.tstamp_ok)
1045                 TCP_ECN_create_request(req, skb, sock_net(sk));
1046
1047         treq->iif = sk->sk_bound_dev_if;
1048
1049         /* So that link locals have meaning */
1050         if (!sk->sk_bound_dev_if &&
1051             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1052                 treq->iif = inet6_iif(skb);
1053
1054         if (!isn) {
1055                 if (ipv6_opt_accepted(sk, skb) ||
1056                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1057                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1058                         atomic_inc(&skb->users);
1059                         treq->pktopts = skb;
1060                 }
1061
1062                 if (want_cookie) {
1063                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1064                         req->cookie_ts = tmp_opt.tstamp_ok;
1065                         goto have_isn;
1066                 }
1067
1068                 /* VJ's idea. We save last timestamp seen
1069                  * from the destination in peer table, when entering
1070                  * state TIME-WAIT, and check against it before
1071                  * accepting new connection request.
1072                  *
1073                  * If "isn" is not zero, this request hit alive
1074                  * timewait bucket, so that all the necessary checks
1075                  * are made in the function processing timewait state.
1076                  */
1077                 if (tmp_opt.saw_tstamp &&
1078                     tcp_death_row.sysctl_tw_recycle &&
1079                     (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1080                         if (!tcp_peer_is_proven(req, dst, true)) {
1081                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1082                                 goto drop_and_release;
1083                         }
1084                 }
1085                 /* Kill the following clause, if you dislike this way. */
1086                 else if (!sysctl_tcp_syncookies &&
1087                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1088                           (sysctl_max_syn_backlog >> 2)) &&
1089                          !tcp_peer_is_proven(req, dst, false)) {
1090                         /* Without syncookies last quarter of
1091                          * backlog is filled with destinations,
1092                          * proven to be alive.
1093                          * It means that we continue to communicate
1094                          * to destinations, already remembered
1095                          * to the moment of synflood.
1096                          */
1097                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1098                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1099                         goto drop_and_release;
1100                 }
1101
1102                 isn = tcp_v6_init_sequence(skb);
1103         }
1104 have_isn:
1105         tcp_rsk(req)->snt_isn = isn;
1106
1107         if (security_inet_conn_request(sk, skb, req))
1108                 goto drop_and_release;
1109
1110         if (tcp_v6_send_synack(sk, dst, &fl6, req,
1111                                (struct request_values *)&tmp_ext,
1112                                skb_get_queue_mapping(skb)) ||
1113             want_cookie)
1114                 goto drop_and_free;
1115
1116         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1117         tcp_rsk(req)->listener = NULL;
1118         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1119         return 0;
1120
1121 drop_and_release:
1122         dst_release(dst);
1123 drop_and_free:
1124         reqsk_free(req);
1125 drop:
1126         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1127         return 0; /* don't send reset */
1128 }
1129
1130 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1131                                           struct request_sock *req,
1132                                           struct dst_entry *dst)
1133 {
1134         struct inet6_request_sock *treq;
1135         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1136         struct tcp6_sock *newtcp6sk;
1137         struct inet_sock *newinet;
1138         struct tcp_sock *newtp;
1139         struct sock *newsk;
1140 #ifdef CONFIG_TCP_MD5SIG
1141         struct tcp_md5sig_key *key;
1142 #endif
1143         struct flowi6 fl6;
1144
1145         if (skb->protocol == htons(ETH_P_IP)) {
1146                 /*
1147                  *      v6 mapped
1148                  */
1149
1150                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1151
1152                 if (newsk == NULL)
1153                         return NULL;
1154
1155                 newtcp6sk = (struct tcp6_sock *)newsk;
1156                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1157
1158                 newinet = inet_sk(newsk);
1159                 newnp = inet6_sk(newsk);
1160                 newtp = tcp_sk(newsk);
1161
1162                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1163
1164                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1165
1166                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1167
1168                 newnp->rcv_saddr = newnp->saddr;
1169
1170                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1171                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1172 #ifdef CONFIG_TCP_MD5SIG
1173                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1174 #endif
1175
1176                 newnp->ipv6_ac_list = NULL;
1177                 newnp->ipv6_fl_list = NULL;
1178                 newnp->pktoptions  = NULL;
1179                 newnp->opt         = NULL;
1180                 newnp->mcast_oif   = inet6_iif(skb);
1181                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1182                 newnp->rcv_tclass  = ipv6_get_dsfield(ipv6_hdr(skb));
1183
1184                 /*
1185                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1186                  * here, tcp_create_openreq_child now does this for us, see the comment in
1187                  * that function for the gory details. -acme
1188                  */
1189
1190                 /* It is tricky place. Until this moment IPv4 tcp
1191                    worked with IPv6 icsk.icsk_af_ops.
1192                    Sync it now.
1193                  */
1194                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1195
1196                 return newsk;
1197         }
1198
1199         treq = inet6_rsk(req);
1200
1201         if (sk_acceptq_is_full(sk))
1202                 goto out_overflow;
1203
1204         if (!dst) {
1205                 dst = inet6_csk_route_req(sk, &fl6, req);
1206                 if (!dst)
1207                         goto out;
1208         }
1209
1210         newsk = tcp_create_openreq_child(sk, req, skb);
1211         if (newsk == NULL)
1212                 goto out_nonewsk;
1213
1214         /*
1215          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1216          * count here, tcp_create_openreq_child now does this for us, see the
1217          * comment in that function for the gory details. -acme
1218          */
1219
1220         newsk->sk_gso_type = SKB_GSO_TCPV6;
1221         __ip6_dst_store(newsk, dst, NULL, NULL);
1222         inet6_sk_rx_dst_set(newsk, skb);
1223
1224         newtcp6sk = (struct tcp6_sock *)newsk;
1225         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1226
1227         newtp = tcp_sk(newsk);
1228         newinet = inet_sk(newsk);
1229         newnp = inet6_sk(newsk);
1230
1231         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1232
1233         newnp->daddr = treq->rmt_addr;
1234         newnp->saddr = treq->loc_addr;
1235         newnp->rcv_saddr = treq->loc_addr;
1236         newsk->sk_bound_dev_if = treq->iif;
1237
1238         /* Now IPv6 options...
1239
1240            First: no IPv4 options.
1241          */
1242         newinet->inet_opt = NULL;
1243         newnp->ipv6_ac_list = NULL;
1244         newnp->ipv6_fl_list = NULL;
1245
1246         /* Clone RX bits */
1247         newnp->rxopt.all = np->rxopt.all;
1248
1249         /* Clone pktoptions received with SYN */
1250         newnp->pktoptions = NULL;
1251         if (treq->pktopts != NULL) {
1252                 newnp->pktoptions = skb_clone(treq->pktopts,
1253                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1254                 consume_skb(treq->pktopts);
1255                 treq->pktopts = NULL;
1256                 if (newnp->pktoptions)
1257                         skb_set_owner_r(newnp->pktoptions, newsk);
1258         }
1259         newnp->opt        = NULL;
1260         newnp->mcast_oif  = inet6_iif(skb);
1261         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1262         newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1263
1264         /* Clone native IPv6 options from listening socket (if any)
1265
1266            Yes, keeping reference count would be much more clever,
1267            but we make one more one thing there: reattach optmem
1268            to newsk.
1269          */
1270         if (np->opt)
1271                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1272
1273         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1274         if (newnp->opt)
1275                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1276                                                      newnp->opt->opt_flen);
1277
1278         tcp_mtup_init(newsk);
1279         tcp_sync_mss(newsk, dst_mtu(dst));
1280         newtp->advmss = dst_metric_advmss(dst);
1281         if (tcp_sk(sk)->rx_opt.user_mss &&
1282             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1283                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1284
1285         tcp_initialize_rcv_mss(newsk);
1286         tcp_synack_rtt_meas(newsk, req);
1287         newtp->total_retrans = req->num_retrans;
1288
1289         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1290         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1291
1292 #ifdef CONFIG_TCP_MD5SIG
1293         /* Copy over the MD5 key from the original socket */
1294         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1295                 /* We're using one, so create a matching key
1296                  * on the newsk structure. If we fail to get
1297                  * memory, then we end up not copying the key
1298                  * across. Shucks.
1299                  */
1300                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1301                                AF_INET6, key->key, key->keylen,
1302                                sk_gfp_atomic(sk, GFP_ATOMIC));
1303         }
1304 #endif
1305
1306         if (__inet_inherit_port(sk, newsk) < 0) {
1307                 inet_csk_prepare_forced_close(newsk);
1308                 tcp_done(newsk);
1309                 goto out;
1310         }
1311         __inet6_hash(newsk, NULL);
1312
1313         return newsk;
1314
1315 out_overflow:
1316         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1317 out_nonewsk:
1318         dst_release(dst);
1319 out:
1320         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1321         return NULL;
1322 }
1323
1324 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1325 {
1326         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1327                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1328                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1329                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1330                         return 0;
1331                 }
1332         }
1333
1334         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1335                                               &ipv6_hdr(skb)->saddr,
1336                                               &ipv6_hdr(skb)->daddr, 0));
1337
1338         if (skb->len <= 76) {
1339                 return __skb_checksum_complete(skb);
1340         }
1341         return 0;
1342 }
1343
1344 /* The socket must have it's spinlock held when we get
1345  * here.
1346  *
1347  * We have a potential double-lock case here, so even when
1348  * doing backlog processing we use the BH locking scheme.
1349  * This is because we cannot sleep with the original spinlock
1350  * held.
1351  */
1352 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1353 {
1354         struct ipv6_pinfo *np = inet6_sk(sk);
1355         struct tcp_sock *tp;
1356         struct sk_buff *opt_skb = NULL;
1357
1358         /* Imagine: socket is IPv6. IPv4 packet arrives,
1359            goes to IPv4 receive handler and backlogged.
1360            From backlog it always goes here. Kerboom...
1361            Fortunately, tcp_rcv_established and rcv_established
1362            handle them correctly, but it is not case with
1363            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1364          */
1365
1366         if (skb->protocol == htons(ETH_P_IP))
1367                 return tcp_v4_do_rcv(sk, skb);
1368
1369 #ifdef CONFIG_TCP_MD5SIG
1370         if (tcp_v6_inbound_md5_hash (sk, skb))
1371                 goto discard;
1372 #endif
1373
1374         if (sk_filter(sk, skb))
1375                 goto discard;
1376
1377         /*
1378          *      socket locking is here for SMP purposes as backlog rcv
1379          *      is currently called with bh processing disabled.
1380          */
1381
1382         /* Do Stevens' IPV6_PKTOPTIONS.
1383
1384            Yes, guys, it is the only place in our code, where we
1385            may make it not affecting IPv4.
1386            The rest of code is protocol independent,
1387            and I do not like idea to uglify IPv4.
1388
1389            Actually, all the idea behind IPV6_PKTOPTIONS
1390            looks not very well thought. For now we latch
1391            options, received in the last packet, enqueued
1392            by tcp. Feel free to propose better solution.
1393                                                --ANK (980728)
1394          */
1395         if (np->rxopt.all)
1396                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1397
1398         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1399                 struct dst_entry *dst = sk->sk_rx_dst;
1400
1401                 sock_rps_save_rxhash(sk, skb);
1402                 if (dst) {
1403                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1404                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1405                                 dst_release(dst);
1406                                 sk->sk_rx_dst = NULL;
1407                         }
1408                 }
1409
1410                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1411                         goto reset;
1412                 if (opt_skb)
1413                         goto ipv6_pktoptions;
1414                 return 0;
1415         }
1416
1417         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1418                 goto csum_err;
1419
1420         if (sk->sk_state == TCP_LISTEN) {
1421                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1422                 if (!nsk)
1423                         goto discard;
1424
1425                 /*
1426                  * Queue it on the new socket if the new socket is active,
1427                  * otherwise we just shortcircuit this and continue with
1428                  * the new socket..
1429                  */
1430                 if(nsk != sk) {
1431                         sock_rps_save_rxhash(nsk, skb);
1432                         if (tcp_child_process(sk, nsk, skb))
1433                                 goto reset;
1434                         if (opt_skb)
1435                                 __kfree_skb(opt_skb);
1436                         return 0;
1437                 }
1438         } else
1439                 sock_rps_save_rxhash(sk, skb);
1440
1441         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1442                 goto reset;
1443         if (opt_skb)
1444                 goto ipv6_pktoptions;
1445         return 0;
1446
1447 reset:
1448         tcp_v6_send_reset(sk, skb);
1449 discard:
1450         if (opt_skb)
1451                 __kfree_skb(opt_skb);
1452         kfree_skb(skb);
1453         return 0;
1454 csum_err:
1455         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1456         goto discard;
1457
1458
1459 ipv6_pktoptions:
1460         /* Do you ask, what is it?
1461
1462            1. skb was enqueued by tcp.
1463            2. skb is added to tail of read queue, rather than out of order.
1464            3. socket is not in passive state.
1465            4. Finally, it really contains options, which user wants to receive.
1466          */
1467         tp = tcp_sk(sk);
1468         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1469             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1470                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1471                         np->mcast_oif = inet6_iif(opt_skb);
1472                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1473                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1474                 if (np->rxopt.bits.rxtclass)
1475                         np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1476                 if (ipv6_opt_accepted(sk, opt_skb)) {
1477                         skb_set_owner_r(opt_skb, sk);
1478                         opt_skb = xchg(&np->pktoptions, opt_skb);
1479                 } else {
1480                         __kfree_skb(opt_skb);
1481                         opt_skb = xchg(&np->pktoptions, NULL);
1482                 }
1483         }
1484
1485         kfree_skb(opt_skb);
1486         return 0;
1487 }
1488
1489 static int tcp_v6_rcv(struct sk_buff *skb)
1490 {
1491         const struct tcphdr *th;
1492         const struct ipv6hdr *hdr;
1493         struct sock *sk;
1494         int ret;
1495         struct net *net = dev_net(skb->dev);
1496
1497         if (skb->pkt_type != PACKET_HOST)
1498                 goto discard_it;
1499
1500         /*
1501          *      Count it even if it's bad.
1502          */
1503         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1504
1505         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1506                 goto discard_it;
1507
1508         th = tcp_hdr(skb);
1509
1510         if (th->doff < sizeof(struct tcphdr)/4)
1511                 goto bad_packet;
1512         if (!pskb_may_pull(skb, th->doff*4))
1513                 goto discard_it;
1514
1515         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1516                 goto bad_packet;
1517
1518         th = tcp_hdr(skb);
1519         hdr = ipv6_hdr(skb);
1520         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1521         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1522                                     skb->len - th->doff*4);
1523         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1524         TCP_SKB_CB(skb)->when = 0;
1525         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1526         TCP_SKB_CB(skb)->sacked = 0;
1527
1528         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1529         if (!sk)
1530                 goto no_tcp_socket;
1531
1532 process:
1533         if (sk->sk_state == TCP_TIME_WAIT)
1534                 goto do_time_wait;
1535
1536         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1537                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1538                 goto discard_and_relse;
1539         }
1540
1541         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1542                 goto discard_and_relse;
1543
1544         if (sk_filter(sk, skb))
1545                 goto discard_and_relse;
1546
1547         skb->dev = NULL;
1548
1549         bh_lock_sock_nested(sk);
1550         ret = 0;
1551         if (!sock_owned_by_user(sk)) {
1552 #ifdef CONFIG_NET_DMA
1553                 struct tcp_sock *tp = tcp_sk(sk);
1554                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1555                         tp->ucopy.dma_chan = net_dma_find_channel();
1556                 if (tp->ucopy.dma_chan)
1557                         ret = tcp_v6_do_rcv(sk, skb);
1558                 else
1559 #endif
1560                 {
1561                         if (!tcp_prequeue(sk, skb))
1562                                 ret = tcp_v6_do_rcv(sk, skb);
1563                 }
1564         } else if (unlikely(sk_add_backlog(sk, skb,
1565                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1566                 bh_unlock_sock(sk);
1567                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1568                 goto discard_and_relse;
1569         }
1570         bh_unlock_sock(sk);
1571
1572         sock_put(sk);
1573         return ret ? -1 : 0;
1574
1575 no_tcp_socket:
1576         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1577                 goto discard_it;
1578
1579         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1580 bad_packet:
1581                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1582         } else {
1583                 tcp_v6_send_reset(NULL, skb);
1584         }
1585
1586 discard_it:
1587
1588         /*
1589          *      Discard frame
1590          */
1591
1592         kfree_skb(skb);
1593         return 0;
1594
1595 discard_and_relse:
1596         sock_put(sk);
1597         goto discard_it;
1598
1599 do_time_wait:
1600         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1601                 inet_twsk_put(inet_twsk(sk));
1602                 goto discard_it;
1603         }
1604
1605         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1606                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1607                 inet_twsk_put(inet_twsk(sk));
1608                 goto discard_it;
1609         }
1610
1611         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1612         case TCP_TW_SYN:
1613         {
1614                 struct sock *sk2;
1615
1616                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1617                                             &ipv6_hdr(skb)->saddr, th->source,
1618                                             &ipv6_hdr(skb)->daddr,
1619                                             ntohs(th->dest), inet6_iif(skb));
1620                 if (sk2 != NULL) {
1621                         struct inet_timewait_sock *tw = inet_twsk(sk);
1622                         inet_twsk_deschedule(tw, &tcp_death_row);
1623                         inet_twsk_put(tw);
1624                         sk = sk2;
1625                         goto process;
1626                 }
1627                 /* Fall through to ACK */
1628         }
1629         case TCP_TW_ACK:
1630                 tcp_v6_timewait_ack(sk, skb);
1631                 break;
1632         case TCP_TW_RST:
1633                 goto no_tcp_socket;
1634         case TCP_TW_SUCCESS:;
1635         }
1636         goto discard_it;
1637 }
1638
1639 static void tcp_v6_early_demux(struct sk_buff *skb)
1640 {
1641         const struct ipv6hdr *hdr;
1642         const struct tcphdr *th;
1643         struct sock *sk;
1644
1645         if (skb->pkt_type != PACKET_HOST)
1646                 return;
1647
1648         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1649                 return;
1650
1651         hdr = ipv6_hdr(skb);
1652         th = tcp_hdr(skb);
1653
1654         if (th->doff < sizeof(struct tcphdr) / 4)
1655                 return;
1656
1657         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1658                                         &hdr->saddr, th->source,
1659                                         &hdr->daddr, ntohs(th->dest),
1660                                         inet6_iif(skb));
1661         if (sk) {
1662                 skb->sk = sk;
1663                 skb->destructor = sock_edemux;
1664                 if (sk->sk_state != TCP_TIME_WAIT) {
1665                         struct dst_entry *dst = sk->sk_rx_dst;
1666
1667                         if (dst)
1668                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1669                         if (dst &&
1670                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1671                                 skb_dst_set_noref(skb, dst);
1672                 }
1673         }
1674 }
1675
1676 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1677         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1678         .twsk_unique    = tcp_twsk_unique,
1679         .twsk_destructor= tcp_twsk_destructor,
1680 };
1681
1682 static const struct inet_connection_sock_af_ops ipv6_specific = {
1683         .queue_xmit        = inet6_csk_xmit,
1684         .send_check        = tcp_v6_send_check,
1685         .rebuild_header    = inet6_sk_rebuild_header,
1686         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1687         .conn_request      = tcp_v6_conn_request,
1688         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1689         .net_header_len    = sizeof(struct ipv6hdr),
1690         .net_frag_header_len = sizeof(struct frag_hdr),
1691         .setsockopt        = ipv6_setsockopt,
1692         .getsockopt        = ipv6_getsockopt,
1693         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1694         .sockaddr_len      = sizeof(struct sockaddr_in6),
1695         .bind_conflict     = inet6_csk_bind_conflict,
1696 #ifdef CONFIG_COMPAT
1697         .compat_setsockopt = compat_ipv6_setsockopt,
1698         .compat_getsockopt = compat_ipv6_getsockopt,
1699 #endif
1700 };
1701
1702 #ifdef CONFIG_TCP_MD5SIG
1703 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1704         .md5_lookup     =       tcp_v6_md5_lookup,
1705         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1706         .md5_parse      =       tcp_v6_parse_md5_keys,
1707 };
1708 #endif
1709
1710 /*
1711  *      TCP over IPv4 via INET6 API
1712  */
1713
1714 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1715         .queue_xmit        = ip_queue_xmit,
1716         .send_check        = tcp_v4_send_check,
1717         .rebuild_header    = inet_sk_rebuild_header,
1718         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1719         .conn_request      = tcp_v6_conn_request,
1720         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1721         .net_header_len    = sizeof(struct iphdr),
1722         .setsockopt        = ipv6_setsockopt,
1723         .getsockopt        = ipv6_getsockopt,
1724         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1725         .sockaddr_len      = sizeof(struct sockaddr_in6),
1726         .bind_conflict     = inet6_csk_bind_conflict,
1727 #ifdef CONFIG_COMPAT
1728         .compat_setsockopt = compat_ipv6_setsockopt,
1729         .compat_getsockopt = compat_ipv6_getsockopt,
1730 #endif
1731 };
1732
1733 #ifdef CONFIG_TCP_MD5SIG
1734 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1735         .md5_lookup     =       tcp_v4_md5_lookup,
1736         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1737         .md5_parse      =       tcp_v6_parse_md5_keys,
1738 };
1739 #endif
1740
1741 /* NOTE: A lot of things set to zero explicitly by call to
1742  *       sk_alloc() so need not be done here.
1743  */
1744 static int tcp_v6_init_sock(struct sock *sk)
1745 {
1746         struct inet_connection_sock *icsk = inet_csk(sk);
1747
1748         tcp_init_sock(sk);
1749
1750         icsk->icsk_af_ops = &ipv6_specific;
1751
1752 #ifdef CONFIG_TCP_MD5SIG
1753         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1754 #endif
1755
1756         return 0;
1757 }
1758
1759 static void tcp_v6_destroy_sock(struct sock *sk)
1760 {
1761         tcp_v4_destroy_sock(sk);
1762         inet6_destroy_sock(sk);
1763 }
1764
1765 #ifdef CONFIG_PROC_FS
1766 /* Proc filesystem TCPv6 sock list dumping. */
1767 static void get_openreq6(struct seq_file *seq,
1768                          const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1769 {
1770         int ttd = req->expires - jiffies;
1771         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1772         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1773
1774         if (ttd < 0)
1775                 ttd = 0;
1776
1777         seq_printf(seq,
1778                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1779                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1780                    i,
1781                    src->s6_addr32[0], src->s6_addr32[1],
1782                    src->s6_addr32[2], src->s6_addr32[3],
1783                    ntohs(inet_rsk(req)->loc_port),
1784                    dest->s6_addr32[0], dest->s6_addr32[1],
1785                    dest->s6_addr32[2], dest->s6_addr32[3],
1786                    ntohs(inet_rsk(req)->rmt_port),
1787                    TCP_SYN_RECV,
1788                    0,0, /* could print option size, but that is af dependent. */
1789                    1,   /* timers active (only the expire timer) */
1790                    jiffies_to_clock_t(ttd),
1791                    req->num_timeout,
1792                    from_kuid_munged(seq_user_ns(seq), uid),
1793                    0,  /* non standard timer */
1794                    0, /* open_requests have no inode */
1795                    0, req);
1796 }
1797
1798 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1799 {
1800         const struct in6_addr *dest, *src;
1801         __u16 destp, srcp;
1802         int timer_active;
1803         unsigned long timer_expires;
1804         const struct inet_sock *inet = inet_sk(sp);
1805         const struct tcp_sock *tp = tcp_sk(sp);
1806         const struct inet_connection_sock *icsk = inet_csk(sp);
1807         const struct ipv6_pinfo *np = inet6_sk(sp);
1808
1809         dest  = &np->daddr;
1810         src   = &np->rcv_saddr;
1811         destp = ntohs(inet->inet_dport);
1812         srcp  = ntohs(inet->inet_sport);
1813
1814         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1815                 timer_active    = 1;
1816                 timer_expires   = icsk->icsk_timeout;
1817         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1818                 timer_active    = 4;
1819                 timer_expires   = icsk->icsk_timeout;
1820         } else if (timer_pending(&sp->sk_timer)) {
1821                 timer_active    = 2;
1822                 timer_expires   = sp->sk_timer.expires;
1823         } else {
1824                 timer_active    = 0;
1825                 timer_expires = jiffies;
1826         }
1827
1828         seq_printf(seq,
1829                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1830                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
1831                    i,
1832                    src->s6_addr32[0], src->s6_addr32[1],
1833                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1834                    dest->s6_addr32[0], dest->s6_addr32[1],
1835                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1836                    sp->sk_state,
1837                    tp->write_seq-tp->snd_una,
1838                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1839                    timer_active,
1840                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1841                    icsk->icsk_retransmits,
1842                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1843                    icsk->icsk_probes_out,
1844                    sock_i_ino(sp),
1845                    atomic_read(&sp->sk_refcnt), sp,
1846                    jiffies_to_clock_t(icsk->icsk_rto),
1847                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1848                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1849                    tp->snd_cwnd,
1850                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1851                    );
1852 }
1853
1854 static void get_timewait6_sock(struct seq_file *seq,
1855                                struct inet_timewait_sock *tw, int i)
1856 {
1857         const struct in6_addr *dest, *src;
1858         __u16 destp, srcp;
1859         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1860         long delta = tw->tw_ttd - jiffies;
1861
1862         dest = &tw6->tw_v6_daddr;
1863         src  = &tw6->tw_v6_rcv_saddr;
1864         destp = ntohs(tw->tw_dport);
1865         srcp  = ntohs(tw->tw_sport);
1866
1867         seq_printf(seq,
1868                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1869                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1870                    i,
1871                    src->s6_addr32[0], src->s6_addr32[1],
1872                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1873                    dest->s6_addr32[0], dest->s6_addr32[1],
1874                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1875                    tw->tw_substate, 0, 0,
1876                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1877                    atomic_read(&tw->tw_refcnt), tw);
1878 }
1879
1880 static int tcp6_seq_show(struct seq_file *seq, void *v)
1881 {
1882         struct tcp_iter_state *st;
1883
1884         if (v == SEQ_START_TOKEN) {
1885                 seq_puts(seq,
1886                          "  sl  "
1887                          "local_address                         "
1888                          "remote_address                        "
1889                          "st tx_queue rx_queue tr tm->when retrnsmt"
1890                          "   uid  timeout inode\n");
1891                 goto out;
1892         }
1893         st = seq->private;
1894
1895         switch (st->state) {
1896         case TCP_SEQ_STATE_LISTENING:
1897         case TCP_SEQ_STATE_ESTABLISHED:
1898                 get_tcp6_sock(seq, v, st->num);
1899                 break;
1900         case TCP_SEQ_STATE_OPENREQ:
1901                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1902                 break;
1903         case TCP_SEQ_STATE_TIME_WAIT:
1904                 get_timewait6_sock(seq, v, st->num);
1905                 break;
1906         }
1907 out:
1908         return 0;
1909 }
1910
1911 static const struct file_operations tcp6_afinfo_seq_fops = {
1912         .owner   = THIS_MODULE,
1913         .open    = tcp_seq_open,
1914         .read    = seq_read,
1915         .llseek  = seq_lseek,
1916         .release = seq_release_net
1917 };
1918
1919 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1920         .name           = "tcp6",
1921         .family         = AF_INET6,
1922         .seq_fops       = &tcp6_afinfo_seq_fops,
1923         .seq_ops        = {
1924                 .show           = tcp6_seq_show,
1925         },
1926 };
1927
1928 int __net_init tcp6_proc_init(struct net *net)
1929 {
1930         return tcp_proc_register(net, &tcp6_seq_afinfo);
1931 }
1932
1933 void tcp6_proc_exit(struct net *net)
1934 {
1935         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1936 }
1937 #endif
1938
1939 struct proto tcpv6_prot = {
1940         .name                   = "TCPv6",
1941         .owner                  = THIS_MODULE,
1942         .close                  = tcp_close,
1943         .connect                = tcp_v6_connect,
1944         .disconnect             = tcp_disconnect,
1945         .accept                 = inet_csk_accept,
1946         .ioctl                  = tcp_ioctl,
1947         .init                   = tcp_v6_init_sock,
1948         .destroy                = tcp_v6_destroy_sock,
1949         .shutdown               = tcp_shutdown,
1950         .setsockopt             = tcp_setsockopt,
1951         .getsockopt             = tcp_getsockopt,
1952         .recvmsg                = tcp_recvmsg,
1953         .sendmsg                = tcp_sendmsg,
1954         .sendpage               = tcp_sendpage,
1955         .backlog_rcv            = tcp_v6_do_rcv,
1956         .release_cb             = tcp_release_cb,
1957         .mtu_reduced            = tcp_v6_mtu_reduced,
1958         .hash                   = tcp_v6_hash,
1959         .unhash                 = inet_unhash,
1960         .get_port               = inet_csk_get_port,
1961         .enter_memory_pressure  = tcp_enter_memory_pressure,
1962         .sockets_allocated      = &tcp_sockets_allocated,
1963         .memory_allocated       = &tcp_memory_allocated,
1964         .memory_pressure        = &tcp_memory_pressure,
1965         .orphan_count           = &tcp_orphan_count,
1966         .sysctl_wmem            = sysctl_tcp_wmem,
1967         .sysctl_rmem            = sysctl_tcp_rmem,
1968         .max_header             = MAX_TCP_HEADER,
1969         .obj_size               = sizeof(struct tcp6_sock),
1970         .slab_flags             = SLAB_DESTROY_BY_RCU,
1971         .twsk_prot              = &tcp6_timewait_sock_ops,
1972         .rsk_prot               = &tcp6_request_sock_ops,
1973         .h.hashinfo             = &tcp_hashinfo,
1974         .no_autobind            = true,
1975 #ifdef CONFIG_COMPAT
1976         .compat_setsockopt      = compat_tcp_setsockopt,
1977         .compat_getsockopt      = compat_tcp_getsockopt,
1978 #endif
1979 #ifdef CONFIG_MEMCG_KMEM
1980         .proto_cgroup           = tcp_proto_cgroup,
1981 #endif
1982 };
1983
1984 static const struct inet6_protocol tcpv6_protocol = {
1985         .early_demux    =       tcp_v6_early_demux,
1986         .handler        =       tcp_v6_rcv,
1987         .err_handler    =       tcp_v6_err,
1988         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1989 };
1990
1991 static struct inet_protosw tcpv6_protosw = {
1992         .type           =       SOCK_STREAM,
1993         .protocol       =       IPPROTO_TCP,
1994         .prot           =       &tcpv6_prot,
1995         .ops            =       &inet6_stream_ops,
1996         .no_check       =       0,
1997         .flags          =       INET_PROTOSW_PERMANENT |
1998                                 INET_PROTOSW_ICSK,
1999 };
2000
2001 static int __net_init tcpv6_net_init(struct net *net)
2002 {
2003         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2004                                     SOCK_RAW, IPPROTO_TCP, net);
2005 }
2006
2007 static void __net_exit tcpv6_net_exit(struct net *net)
2008 {
2009         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2010 }
2011
2012 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2013 {
2014         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2015 }
2016
2017 static struct pernet_operations tcpv6_net_ops = {
2018         .init       = tcpv6_net_init,
2019         .exit       = tcpv6_net_exit,
2020         .exit_batch = tcpv6_net_exit_batch,
2021 };
2022
2023 int __init tcpv6_init(void)
2024 {
2025         int ret;
2026
2027         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2028         if (ret)
2029                 goto out;
2030
2031         /* register inet6 protocol */
2032         ret = inet6_register_protosw(&tcpv6_protosw);
2033         if (ret)
2034                 goto out_tcpv6_protocol;
2035
2036         ret = register_pernet_subsys(&tcpv6_net_ops);
2037         if (ret)
2038                 goto out_tcpv6_protosw;
2039 out:
2040         return ret;
2041
2042 out_tcpv6_protosw:
2043         inet6_unregister_protosw(&tcpv6_protosw);
2044 out_tcpv6_protocol:
2045         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2046         goto out;
2047 }
2048
2049 void tcpv6_exit(void)
2050 {
2051         unregister_pernet_subsys(&tcpv6_net_ops);
2052         inet6_unregister_protosw(&tcpv6_protosw);
2053         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2054 }