net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/tcp_memcontrol.h>
  65 #include <net/busy_poll.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 #include <linux/crypto.h>
  71 #include <linux/scatterlist.h>
  72
  73 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  75                                       struct request_sock *req);
  76
  77 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  78
  79 static const struct inet_connection_sock_af_ops ipv6_mapped;
  80 static const struct inet_connection_sock_af_ops ipv6_specific;
  81 #ifdef CONFIG_TCP_MD5SIG
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  84 #else
  85 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  86                                                    const struct in6_addr *addr)
  87 {
  88         return NULL;
  89 }
  90 #endif
  91
  92 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  93 {
  94         struct dst_entry *dst = skb_dst(skb);
  95
  96         if (dst && dst_hold_safe(dst)) {
  97                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99                 sk->sk_rx_dst = dst;
 100                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 101                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 102         }
 103 }
 104
 105 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 106 {
 107         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 108                                             ipv6_hdr(skb)->saddr.s6_addr32,
 109                                             tcp_hdr(skb)->dest,
 110                                             tcp_hdr(skb)->source);
 111 }
 112
 113 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 114                           int addr_len)
 115 {
 116         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 117         struct inet_sock *inet = inet_sk(sk);
 118         struct inet_connection_sock *icsk = inet_csk(sk);
 119         struct ipv6_pinfo *np = inet6_sk(sk);
 120         struct tcp_sock *tp = tcp_sk(sk);
 121         struct in6_addr *saddr = NULL, *final_p, final;
 122         struct ipv6_txoptions *opt;
 123         struct flowi6 fl6;
 124         struct dst_entry *dst;
 125         int addr_type;
 126         int err;
 127
 128         if (addr_len < SIN6_LEN_RFC2133)
 129                 return -EINVAL;
 130
 131         if (usin->sin6_family != AF_INET6)
 132                 return -EAFNOSUPPORT;
 133
 134         memset(&fl6, 0, sizeof(fl6));
 135
 136         if (np->sndflow) {
 137                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 138                 IP6_ECN_flow_init(fl6.flowlabel);
 139                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 140                         struct ip6_flowlabel *flowlabel;
 141                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 142                         if (!flowlabel)
 143                                 return -EINVAL;
 144                         fl6_sock_release(flowlabel);
 145                 }
 146         }
 147
 148         /*
 149          *      connect() to INADDR_ANY means loopback (BSD'ism).
 150          */
 151
 152         if (ipv6_addr_any(&usin->sin6_addr))
 153                 usin->sin6_addr.s6_addr[15] = 0x1;
 154
 155         addr_type = ipv6_addr_type(&usin->sin6_addr);
 156
 157         if (addr_type & IPV6_ADDR_MULTICAST)
 158                 return -ENETUNREACH;
 159
 160         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 161                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 162                     usin->sin6_scope_id) {
 163                         /* If interface is set while binding, indices
 164                          * must coincide.
 165                          */
 166                         if (sk->sk_bound_dev_if &&
 167                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 168                                 return -EINVAL;
 169
 170                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 171                 }
 172
 173                 /* Connect to link-local address requires an interface */
 174                 if (!sk->sk_bound_dev_if)
 175                         return -EINVAL;
 176         }
 177
 178         if (tp->rx_opt.ts_recent_stamp &&
 179             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 180                 tp->rx_opt.ts_recent = 0;
 181                 tp->rx_opt.ts_recent_stamp = 0;
 182                 tp->write_seq = 0;
 183         }
 184
 185         sk->sk_v6_daddr = usin->sin6_addr;
 186         np->flow_label = fl6.flowlabel;
 187
 188         /*
 189          *      TCP over IPv4
 190          */
 191
 192         if (addr_type == IPV6_ADDR_MAPPED) {
 193                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 194                 struct sockaddr_in sin;
 195
 196                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 197
 198                 if (__ipv6_only_sock(sk))
 199                         return -ENETUNREACH;
 200
 201                 sin.sin_family = AF_INET;
 202                 sin.sin_port = usin->sin6_port;
 203                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 204
 205                 icsk->icsk_af_ops = &ipv6_mapped;
 206                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 207 #ifdef CONFIG_TCP_MD5SIG
 208                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 209 #endif
 210
 211                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 212
 213                 if (err) {
 214                         icsk->icsk_ext_hdr_len = exthdrlen;
 215                         icsk->icsk_af_ops = &ipv6_specific;
 216                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 217 #ifdef CONFIG_TCP_MD5SIG
 218                         tp->af_specific = &tcp_sock_ipv6_specific;
 219 #endif
 220                         goto failure;
 221                 }
 222                 np->saddr = sk->sk_v6_rcv_saddr;
 223
 224                 return err;
 225         }
 226
 227         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 228                 saddr = &sk->sk_v6_rcv_saddr;
 229
 230         fl6.flowi6_proto = IPPROTO_TCP;
 231         fl6.daddr = sk->sk_v6_daddr;
 232         fl6.saddr = saddr ? *saddr : np->saddr;
 233         fl6.flowi6_oif = sk->sk_bound_dev_if;
 234         fl6.flowi6_mark = sk->sk_mark;
 235         fl6.fl6_dport = usin->sin6_port;
 236         fl6.fl6_sport = inet->inet_sport;
 237
 238         opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
 239         final_p = fl6_update_dst(&fl6, opt, &final);
 240
 241         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 242
 243         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 244         if (IS_ERR(dst)) {
 245                 err = PTR_ERR(dst);
 246                 goto failure;
 247         }
 248
 249         if (!saddr) {
 250                 saddr = &fl6.saddr;
 251                 sk->sk_v6_rcv_saddr = *saddr;
 252         }
 253
 254         /* set the source address */
 255         np->saddr = *saddr;
 256         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 257
 258         sk->sk_gso_type = SKB_GSO_TCPV6;
 259         ip6_dst_store(sk, dst, NULL, NULL);
 260
 261         if (tcp_death_row.sysctl_tw_recycle &&
 262             !tp->rx_opt.ts_recent_stamp &&
 263             ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
 264                 tcp_fetch_timewait_stamp(sk, dst);
 265
 266         icsk->icsk_ext_hdr_len = 0;
 267         if (opt)
 268                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 269                                          opt->opt_nflen;
 270
 271         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 272
 273         inet->inet_dport = usin->sin6_port;
 274
 275         tcp_set_state(sk, TCP_SYN_SENT);
 276         err = inet6_hash_connect(&tcp_death_row, sk);
 277         if (err)
 278                 goto late_failure;
 279
 280         sk_set_txhash(sk);
 281
 282         if (!tp->write_seq && likely(!tp->repair))
 283                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 284                                                              sk->sk_v6_daddr.s6_addr32,
 285                                                              inet->inet_sport,
 286                                                              inet->inet_dport);
 287
 288         err = tcp_connect(sk);
 289         if (err)
 290                 goto late_failure;
 291
 292         return 0;
 293
 294 late_failure:
 295         tcp_set_state(sk, TCP_CLOSE);
 296         __sk_dst_reset(sk);
 297 failure:
 298         inet->inet_dport = 0;
 299         sk->sk_route_caps = 0;
 300         return err;
 301 }
 302
 303 static void tcp_v6_mtu_reduced(struct sock *sk)
 304 {
 305         struct dst_entry *dst;
 306
 307         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 308                 return;
 309
 310         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 311         if (!dst)
 312                 return;
 313
 314         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 315                 tcp_sync_mss(sk, dst_mtu(dst));
 316                 tcp_simple_retransmit(sk);
 317         }
 318 }
 319
 320 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 321                 u8 type, u8 code, int offset, __be32 info)
 322 {
 323         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 324         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 325         struct net *net = dev_net(skb->dev);
 326         struct request_sock *fastopen;
 327         struct ipv6_pinfo *np;
 328         struct tcp_sock *tp;
 329         __u32 seq, snd_una;
 330         struct sock *sk;
 331         int err;
 332
 333         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 334                                         &hdr->daddr, th->dest,
 335                                         &hdr->saddr, ntohs(th->source),
 336                                         skb->dev->ifindex);
 337
 338         if (!sk) {
 339                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 340                                    ICMP6_MIB_INERRORS);
 341                 return;
 342         }
 343
 344         if (sk->sk_state == TCP_TIME_WAIT) {
 345                 inet_twsk_put(inet_twsk(sk));
 346                 return;
 347         }
 348         seq = ntohl(th->seq);
 349         if (sk->sk_state == TCP_NEW_SYN_RECV)
 350                 return tcp_req_err(sk, seq);
 351
 352         bh_lock_sock(sk);
 353         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 354                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 355
 356         if (sk->sk_state == TCP_CLOSE)
 357                 goto out;
 358
 359         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 360                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 361                 goto out;
 362         }
 363
 364         tp = tcp_sk(sk);
 365         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 366         fastopen = tp->fastopen_rsk;
 367         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 368         if (sk->sk_state != TCP_LISTEN &&
 369             !between(seq, snd_una, tp->snd_nxt)) {
 370                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 371                 goto out;
 372         }
 373
 374         np = inet6_sk(sk);
 375
 376         if (type == NDISC_REDIRECT) {
 377                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 378
 379                 if (dst)
 380                         dst->ops->redirect(dst, sk, skb);
 381                 goto out;
 382         }
 383
 384         if (type == ICMPV6_PKT_TOOBIG) {
 385                 /* We are not interested in TCP_LISTEN and open_requests
 386                  * (SYN-ACKs send out by Linux are always <576bytes so
 387                  * they should go through unfragmented).
 388                  */
 389                 if (sk->sk_state == TCP_LISTEN)
 390                         goto out;
 391
 392                 if (!ip6_sk_accept_pmtu(sk))
 393                         goto out;
 394
 395                 tp->mtu_info = ntohl(info);
 396                 if (!sock_owned_by_user(sk))
 397                         tcp_v6_mtu_reduced(sk);
 398                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 399                                            &tp->tsq_flags))
 400                         sock_hold(sk);
 401                 goto out;
 402         }
 403
 404         icmpv6_err_convert(type, code, &err);
 405
 406         /* Might be for an request_sock */
 407         switch (sk->sk_state) {
 408         case TCP_SYN_SENT:
 409         case TCP_SYN_RECV:
 410                 /* Only in fast or simultaneous open. If a fast open socket is
 411                  * is already accepted it is treated as a connected one below.
 412                  */
 413                 if (fastopen && !fastopen->sk)
 414                         break;
 415
 416                 if (!sock_owned_by_user(sk)) {
 417                         sk->sk_err = err;
 418                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 419
 420                         tcp_done(sk);
 421                 } else
 422                         sk->sk_err_soft = err;
 423                 goto out;
 424         }
 425
 426         if (!sock_owned_by_user(sk) && np->recverr) {
 427                 sk->sk_err = err;
 428                 sk->sk_error_report(sk);
 429         } else
 430                 sk->sk_err_soft = err;
 431
 432 out:
 433         bh_unlock_sock(sk);
 434         sock_put(sk);
 435 }
 436
 437
 438 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 439                               struct flowi *fl,
 440                               struct request_sock *req,
 441                               struct tcp_fastopen_cookie *foc,
 442                               bool attach_req)
 443 {
 444         struct inet_request_sock *ireq = inet_rsk(req);
 445         struct ipv6_pinfo *np = inet6_sk(sk);
 446         struct flowi6 *fl6 = &fl->u.ip6;
 447         struct sk_buff *skb;
 448         int err = -ENOMEM;
 449
 450         /* First, grab a route. */
 451         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 452                                                IPPROTO_TCP)) == NULL)
 453                 goto done;
 454
 455         skb = tcp_make_synack(sk, dst, req, foc, attach_req);
 456
 457         if (skb) {
 458                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 459                                     &ireq->ir_v6_rmt_addr);
 460
 461                 fl6->daddr = ireq->ir_v6_rmt_addr;
 462                 if (np->repflow && ireq->pktopts)
 463                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 464
 465                 err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
 466                                np->tclass);
 467                 err = net_xmit_eval(err);
 468         }
 469
 470 done:
 471         return err;
 472 }
 473
 474
 475 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 476 {
 477         kfree_skb(inet_rsk(req)->pktopts);
 478 }
 479
 480 #ifdef CONFIG_TCP_MD5SIG
 481 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 482                                                    const struct in6_addr *addr)
 483 {
 484         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 485 }
 486
 487 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 488                                                 const struct sock *addr_sk)
 489 {
 490         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 491 }
 492
 493 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 494                                  int optlen)
 495 {
 496         struct tcp_md5sig cmd;
 497         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 498
 499         if (optlen < sizeof(cmd))
 500                 return -EINVAL;
 501
 502         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 503                 return -EFAULT;
 504
 505         if (sin6->sin6_family != AF_INET6)
 506                 return -EINVAL;
 507
 508         if (!cmd.tcpm_keylen) {
 509                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 510                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 511                                               AF_INET);
 512                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 513                                       AF_INET6);
 514         }
 515
 516         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 517                 return -EINVAL;
 518
 519         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 520                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 521                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 522
 523         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 524                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 525 }
 526
 527 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 528                                         const struct in6_addr *daddr,
 529                                         const struct in6_addr *saddr, int nbytes)
 530 {
 531         struct tcp6_pseudohdr *bp;
 532         struct scatterlist sg;
 533
 534         bp = &hp->md5_blk.ip6;
 535         /* 1. TCP pseudo-header (RFC2460) */
 536         bp->saddr = *saddr;
 537         bp->daddr = *daddr;
 538         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 539         bp->len = cpu_to_be32(nbytes);
 540
 541         sg_init_one(&sg, bp, sizeof(*bp));
 542         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 543 }
 544
 545 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 546                                const struct in6_addr *daddr, struct in6_addr *saddr,
 547                                const struct tcphdr *th)
 548 {
 549         struct tcp_md5sig_pool *hp;
 550         struct hash_desc *desc;
 551
 552         hp = tcp_get_md5sig_pool();
 553         if (!hp)
 554                 goto clear_hash_noput;
 555         desc = &hp->md5_desc;
 556
 557         if (crypto_hash_init(desc))
 558                 goto clear_hash;
 559         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 560                 goto clear_hash;
 561         if (tcp_md5_hash_header(hp, th))
 562                 goto clear_hash;
 563         if (tcp_md5_hash_key(hp, key))
 564                 goto clear_hash;
 565         if (crypto_hash_final(desc, md5_hash))
 566                 goto clear_hash;
 567
 568         tcp_put_md5sig_pool();
 569         return 0;
 570
 571 clear_hash:
 572         tcp_put_md5sig_pool();
 573 clear_hash_noput:
 574         memset(md5_hash, 0, 16);
 575         return 1;
 576 }
 577
 578 static int tcp_v6_md5_hash_skb(char *md5_hash,
 579                                const struct tcp_md5sig_key *key,
 580                                const struct sock *sk,
 581                                const struct sk_buff *skb)
 582 {
 583         const struct in6_addr *saddr, *daddr;
 584         struct tcp_md5sig_pool *hp;
 585         struct hash_desc *desc;
 586         const struct tcphdr *th = tcp_hdr(skb);
 587
 588         if (sk) { /* valid for establish/request sockets */
 589                 saddr = &sk->sk_v6_rcv_saddr;
 590                 daddr = &sk->sk_v6_daddr;
 591         } else {
 592                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 593                 saddr = &ip6h->saddr;
 594                 daddr = &ip6h->daddr;
 595         }
 596
 597         hp = tcp_get_md5sig_pool();
 598         if (!hp)
 599                 goto clear_hash_noput;
 600         desc = &hp->md5_desc;
 601
 602         if (crypto_hash_init(desc))
 603                 goto clear_hash;
 604
 605         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 606                 goto clear_hash;
 607         if (tcp_md5_hash_header(hp, th))
 608                 goto clear_hash;
 609         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 610                 goto clear_hash;
 611         if (tcp_md5_hash_key(hp, key))
 612                 goto clear_hash;
 613         if (crypto_hash_final(desc, md5_hash))
 614                 goto clear_hash;
 615
 616         tcp_put_md5sig_pool();
 617         return 0;
 618
 619 clear_hash:
 620         tcp_put_md5sig_pool();
 621 clear_hash_noput:
 622         memset(md5_hash, 0, 16);
 623         return 1;
 624 }
 625
 626 #endif
 627
 628 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 629                                     const struct sk_buff *skb)
 630 {
 631 #ifdef CONFIG_TCP_MD5SIG
 632         const __u8 *hash_location = NULL;
 633         struct tcp_md5sig_key *hash_expected;
 634         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 635         const struct tcphdr *th = tcp_hdr(skb);
 636         int genhash;
 637         u8 newhash[16];
 638
 639         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 640         hash_location = tcp_parse_md5sig_option(th);
 641
 642         /* We've parsed the options - do we have a hash? */
 643         if (!hash_expected && !hash_location)
 644                 return false;
 645
 646         if (hash_expected && !hash_location) {
 647                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 648                 return true;
 649         }
 650
 651         if (!hash_expected && hash_location) {
 652                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 653                 return true;
 654         }
 655
 656         /* check the signature */
 657         genhash = tcp_v6_md5_hash_skb(newhash,
 658                                       hash_expected,
 659                                       NULL, skb);
 660
 661         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 662                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 663                                      genhash ? "failed" : "mismatch",
 664                                      &ip6h->saddr, ntohs(th->source),
 665                                      &ip6h->daddr, ntohs(th->dest));
 666                 return true;
 667         }
 668 #endif
 669         return false;
 670 }
 671
 672 static void tcp_v6_init_req(struct request_sock *req,
 673                             const struct sock *sk_listener,
 674                             struct sk_buff *skb)
 675 {
 676         struct inet_request_sock *ireq = inet_rsk(req);
 677         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 678
 679         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 680         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 681
 682         /* So that link locals have meaning */
 683         if (!sk_listener->sk_bound_dev_if &&
 684             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 685                 ireq->ir_iif = tcp_v6_iif(skb);
 686
 687         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 688             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 689              np->rxopt.bits.rxinfo ||
 690              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 691              np->rxopt.bits.rxohlim || np->repflow)) {
 692                 atomic_inc(&skb->users);
 693                 ireq->pktopts = skb;
 694         }
 695 }
 696
 697 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 698                                           struct flowi *fl,
 699                                           const struct request_sock *req,
 700                                           bool *strict)
 701 {
 702         if (strict)
 703                 *strict = true;
 704         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 705 }
 706
 707 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 708         .family         =       AF_INET6,
 709         .obj_size       =       sizeof(struct tcp6_request_sock),
 710         .rtx_syn_ack    =       tcp_rtx_synack,
 711         .send_ack       =       tcp_v6_reqsk_send_ack,
 712         .destructor     =       tcp_v6_reqsk_destructor,
 713         .send_reset     =       tcp_v6_send_reset,
 714         .syn_ack_timeout =      tcp_syn_ack_timeout,
 715 };
 716
 717 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 718         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 719                                 sizeof(struct ipv6hdr),
 720 #ifdef CONFIG_TCP_MD5SIG
 721         .req_md5_lookup =       tcp_v6_md5_lookup,
 722         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 723 #endif
 724         .init_req       =       tcp_v6_init_req,
 725 #ifdef CONFIG_SYN_COOKIES
 726         .cookie_init_seq =      cookie_v6_init_sequence,
 727 #endif
 728         .route_req      =       tcp_v6_route_req,
 729         .init_seq       =       tcp_v6_init_sequence,
 730         .send_synack    =       tcp_v6_send_synack,
 731 };
 732
 733 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 734                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 735                                  int oif, struct tcp_md5sig_key *key, int rst,
 736                                  u8 tclass, u32 label)
 737 {
 738         const struct tcphdr *th = tcp_hdr(skb);
 739         struct tcphdr *t1;
 740         struct sk_buff *buff;
 741         struct flowi6 fl6;
 742         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 743         struct sock *ctl_sk = net->ipv6.tcp_sk;
 744         unsigned int tot_len = sizeof(struct tcphdr);
 745         struct dst_entry *dst;
 746         __be32 *topt;
 747
 748         if (tsecr)
 749                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 750 #ifdef CONFIG_TCP_MD5SIG
 751         if (key)
 752                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 753 #endif
 754
 755         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 756                          GFP_ATOMIC);
 757         if (!buff)
 758                 return;
 759
 760         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 761
 762         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 763         skb_reset_transport_header(buff);
 764
 765         /* Swap the send and the receive. */
 766         memset(t1, 0, sizeof(*t1));
 767         t1->dest = th->source;
 768         t1->source = th->dest;
 769         t1->doff = tot_len / 4;
 770         t1->seq = htonl(seq);
 771         t1->ack_seq = htonl(ack);
 772         t1->ack = !rst || !th->ack;
 773         t1->rst = rst;
 774         t1->window = htons(win);
 775
 776         topt = (__be32 *)(t1 + 1);
 777
 778         if (tsecr) {
 779                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 780                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 781                 *topt++ = htonl(tsval);
 782                 *topt++ = htonl(tsecr);
 783         }
 784
 785 #ifdef CONFIG_TCP_MD5SIG
 786         if (key) {
 787                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 788                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 789                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 790                                     &ipv6_hdr(skb)->saddr,
 791                                     &ipv6_hdr(skb)->daddr, t1);
 792         }
 793 #endif
 794
 795         memset(&fl6, 0, sizeof(fl6));
 796         fl6.daddr = ipv6_hdr(skb)->saddr;
 797         fl6.saddr = ipv6_hdr(skb)->daddr;
 798         fl6.flowlabel = label;
 799
 800         buff->ip_summed = CHECKSUM_PARTIAL;
 801         buff->csum = 0;
 802
 803         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 804
 805         fl6.flowi6_proto = IPPROTO_TCP;
 806         if (rt6_need_strict(&fl6.daddr) && !oif)
 807                 fl6.flowi6_oif = tcp_v6_iif(skb);
 808         else
 809                 fl6.flowi6_oif = oif;
 810         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 811         fl6.fl6_dport = t1->dest;
 812         fl6.fl6_sport = t1->source;
 813         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 814
 815         /* Pass a socket to ip6_dst_lookup either it is for RST
 816          * Underlying function will use this to retrieve the network
 817          * namespace
 818          */
 819         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 820         if (!IS_ERR(dst)) {
 821                 skb_dst_set(buff, dst);
 822                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 823                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 824                 if (rst)
 825                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 826                 return;
 827         }
 828
 829         kfree_skb(buff);
 830 }
 831
 832 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 833 {
 834         const struct tcphdr *th = tcp_hdr(skb);
 835         u32 seq = 0, ack_seq = 0;
 836         struct tcp_md5sig_key *key = NULL;
 837 #ifdef CONFIG_TCP_MD5SIG
 838         const __u8 *hash_location = NULL;
 839         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 840         unsigned char newhash[16];
 841         int genhash;
 842         struct sock *sk1 = NULL;
 843 #endif
 844         int oif;
 845
 846         if (th->rst)
 847                 return;
 848
 849         /* If sk not NULL, it means we did a successful lookup and incoming
 850          * route had to be correct. prequeue might have dropped our dst.
 851          */
 852         if (!sk && !ipv6_unicast_destination(skb))
 853                 return;
 854
 855 #ifdef CONFIG_TCP_MD5SIG
 856         hash_location = tcp_parse_md5sig_option(th);
 857         if (!sk && hash_location) {
 858                 /*
 859                  * active side is lost. Try to find listening socket through
 860                  * source port, and then find md5 key through listening socket.
 861                  * we are not loose security here:
 862                  * Incoming packet is checked with md5 hash with finding key,
 863                  * no RST generated if md5 hash doesn't match.
 864                  */
 865                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 866                                            &tcp_hashinfo, &ipv6h->saddr,
 867                                            th->source, &ipv6h->daddr,
 868                                            ntohs(th->source), tcp_v6_iif(skb));
 869                 if (!sk1)
 870                         return;
 871
 872                 rcu_read_lock();
 873                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 874                 if (!key)
 875                         goto release_sk1;
 876
 877                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 878                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 879                         goto release_sk1;
 880         } else {
 881                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 882         }
 883 #endif
 884
 885         if (th->ack)
 886                 seq = ntohl(th->ack_seq);
 887         else
 888                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 889                           (th->doff << 2);
 890
 891         oif = sk ? sk->sk_bound_dev_if : 0;
 892         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 893
 894 #ifdef CONFIG_TCP_MD5SIG
 895 release_sk1:
 896         if (sk1) {
 897                 rcu_read_unlock();
 898                 sock_put(sk1);
 899         }
 900 #endif
 901 }
 902
 903 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 904                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 905                             struct tcp_md5sig_key *key, u8 tclass,
 906                             u32 label)
 907 {
 908         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 909                              tclass, label);
 910 }
 911
 912 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 913 {
 914         struct inet_timewait_sock *tw = inet_twsk(sk);
 915         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 916
 917         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 918                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 919                         tcp_time_stamp + tcptw->tw_ts_offset,
 920                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 921                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 922
 923         inet_twsk_put(tw);
 924 }
 925
 926 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 927                                   struct request_sock *req)
 928 {
 929         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 930          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 931          */
 932         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 933                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
 934                         tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
 935                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 936                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 937                         0, 0);
 938 }
 939
 940
 941 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
 942 {
 943 #ifdef CONFIG_SYN_COOKIES
 944         const struct tcphdr *th = tcp_hdr(skb);
 945
 946         if (!th->syn)
 947                 sk = cookie_v6_check(sk, skb);
 948 #endif
 949         return sk;
 950 }
 951
 952 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 953 {
 954         if (skb->protocol == htons(ETH_P_IP))
 955                 return tcp_v4_conn_request(sk, skb);
 956
 957         if (!ipv6_unicast_destination(skb))
 958                 goto drop;
 959
 960         return tcp_conn_request(&tcp6_request_sock_ops,
 961                                 &tcp_request_sock_ipv6_ops, sk, skb);
 962
 963 drop:
 964         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 965         return 0; /* don't send reset */
 966 }
 967
 968 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
 969                                          struct request_sock *req,
 970                                          struct dst_entry *dst,
 971                                          struct request_sock *req_unhash,
 972                                          bool *own_req)
 973 {
 974         struct inet_request_sock *ireq;
 975         struct ipv6_pinfo *newnp;
 976         const struct ipv6_pinfo *np = inet6_sk(sk);
 977         struct ipv6_txoptions *opt;
 978         struct tcp6_sock *newtcp6sk;
 979         struct inet_sock *newinet;
 980         struct tcp_sock *newtp;
 981         struct sock *newsk;
 982 #ifdef CONFIG_TCP_MD5SIG
 983         struct tcp_md5sig_key *key;
 984 #endif
 985         struct flowi6 fl6;
 986
 987         if (skb->protocol == htons(ETH_P_IP)) {
 988                 /*
 989                  *      v6 mapped
 990                  */
 991
 992                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
 993                                              req_unhash, own_req);
 994
 995                 if (!newsk)
 996                         return NULL;
 997
 998                 newtcp6sk = (struct tcp6_sock *)newsk;
 999                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1000
1001                 newinet = inet_sk(newsk);
1002                 newnp = inet6_sk(newsk);
1003                 newtp = tcp_sk(newsk);
1004
1005                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1006
1007                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1008
1009                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1010                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1011 #ifdef CONFIG_TCP_MD5SIG
1012                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1013 #endif
1014
1015                 newnp->ipv6_ac_list = NULL;
1016                 newnp->ipv6_fl_list = NULL;
1017                 newnp->pktoptions  = NULL;
1018                 newnp->opt         = NULL;
1019                 newnp->mcast_oif   = tcp_v6_iif(skb);
1020                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1021                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1022                 if (np->repflow)
1023                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1024
1025                 /*
1026                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1027                  * here, tcp_create_openreq_child now does this for us, see the comment in
1028                  * that function for the gory details. -acme
1029                  */
1030
1031                 /* It is tricky place. Until this moment IPv4 tcp
1032                    worked with IPv6 icsk.icsk_af_ops.
1033                    Sync it now.
1034                  */
1035                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1036
1037                 return newsk;
1038         }
1039
1040         ireq = inet_rsk(req);
1041
1042         if (sk_acceptq_is_full(sk))
1043                 goto out_overflow;
1044
1045         if (!dst) {
1046                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1047                 if (!dst)
1048                         goto out;
1049         }
1050
1051         newsk = tcp_create_openreq_child(sk, req, skb);
1052         if (!newsk)
1053                 goto out_nonewsk;
1054
1055         /*
1056          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1057          * count here, tcp_create_openreq_child now does this for us, see the
1058          * comment in that function for the gory details. -acme
1059          */
1060
1061         newsk->sk_gso_type = SKB_GSO_TCPV6;
1062         ip6_dst_store(newsk, dst, NULL, NULL);
1063         inet6_sk_rx_dst_set(newsk, skb);
1064
1065         newtcp6sk = (struct tcp6_sock *)newsk;
1066         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1067
1068         newtp = tcp_sk(newsk);
1069         newinet = inet_sk(newsk);
1070         newnp = inet6_sk(newsk);
1071
1072         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1073
1074         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1075         newnp->saddr = ireq->ir_v6_loc_addr;
1076         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1077         newsk->sk_bound_dev_if = ireq->ir_iif;
1078
1079         /* Now IPv6 options...
1080
1081            First: no IPv4 options.
1082          */
1083         newinet->inet_opt = NULL;
1084         newnp->ipv6_ac_list = NULL;
1085         newnp->ipv6_fl_list = NULL;
1086
1087         /* Clone RX bits */
1088         newnp->rxopt.all = np->rxopt.all;
1089
1090         newnp->pktoptions = NULL;
1091         newnp->opt        = NULL;
1092         newnp->mcast_oif  = tcp_v6_iif(skb);
1093         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1094         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1095         if (np->repflow)
1096                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1097
1098         /* Clone native IPv6 options from listening socket (if any)
1099
1100            Yes, keeping reference count would be much more clever,
1101            but we make one more one thing there: reattach optmem
1102            to newsk.
1103          */
1104         opt = rcu_dereference(np->opt);
1105         if (opt) {
1106                 opt = ipv6_dup_options(newsk, opt);
1107                 RCU_INIT_POINTER(newnp->opt, opt);
1108         }
1109         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1110         if (opt)
1111                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1112                                                     opt->opt_flen;
1113
1114         tcp_ca_openreq_child(newsk, dst);
1115
1116         tcp_sync_mss(newsk, dst_mtu(dst));
1117         newtp->advmss = dst_metric_advmss(dst);
1118         if (tcp_sk(sk)->rx_opt.user_mss &&
1119             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1120                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1121
1122         tcp_initialize_rcv_mss(newsk);
1123
1124         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1125         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1126
1127 #ifdef CONFIG_TCP_MD5SIG
1128         /* Copy over the MD5 key from the original socket */
1129         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1130         if (key) {
1131                 /* We're using one, so create a matching key
1132                  * on the newsk structure. If we fail to get
1133                  * memory, then we end up not copying the key
1134                  * across. Shucks.
1135                  */
1136                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1137                                AF_INET6, key->key, key->keylen,
1138                                sk_gfp_atomic(sk, GFP_ATOMIC));
1139         }
1140 #endif
1141
1142         if (__inet_inherit_port(sk, newsk) < 0) {
1143                 inet_csk_prepare_forced_close(newsk);
1144                 tcp_done(newsk);
1145                 goto out;
1146         }
1147         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1148         if (*own_req) {
1149                 tcp_move_syn(newtp, req);
1150
1151                 /* Clone pktoptions received with SYN, if we own the req */
1152                 if (ireq->pktopts) {
1153                         newnp->pktoptions = skb_clone(ireq->pktopts,
1154                                                       sk_gfp_atomic(sk, GFP_ATOMIC));
1155                         consume_skb(ireq->pktopts);
1156                         ireq->pktopts = NULL;
1157                         if (newnp->pktoptions)
1158                                 skb_set_owner_r(newnp->pktoptions, newsk);
1159                 }
1160         }
1161
1162         return newsk;
1163
1164 out_overflow:
1165         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1166 out_nonewsk:
1167         dst_release(dst);
1168 out:
1169         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1170         return NULL;
1171 }
1172
1173 /* The socket must have it's spinlock held when we get
1174  * here, unless it is a TCP_LISTEN socket.
1175  *
1176  * We have a potential double-lock case here, so even when
1177  * doing backlog processing we use the BH locking scheme.
1178  * This is because we cannot sleep with the original spinlock
1179  * held.
1180  */
1181 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1182 {
1183         struct ipv6_pinfo *np = inet6_sk(sk);
1184         struct tcp_sock *tp;
1185         struct sk_buff *opt_skb = NULL;
1186
1187         /* Imagine: socket is IPv6. IPv4 packet arrives,
1188            goes to IPv4 receive handler and backlogged.
1189            From backlog it always goes here. Kerboom...
1190            Fortunately, tcp_rcv_established and rcv_established
1191            handle them correctly, but it is not case with
1192            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1193          */
1194
1195         if (skb->protocol == htons(ETH_P_IP))
1196                 return tcp_v4_do_rcv(sk, skb);
1197
1198         if (sk_filter(sk, skb))
1199                 goto discard;
1200
1201         /*
1202          *      socket locking is here for SMP purposes as backlog rcv
1203          *      is currently called with bh processing disabled.
1204          */
1205
1206         /* Do Stevens' IPV6_PKTOPTIONS.
1207
1208            Yes, guys, it is the only place in our code, where we
1209            may make it not affecting IPv4.
1210            The rest of code is protocol independent,
1211            and I do not like idea to uglify IPv4.
1212
1213            Actually, all the idea behind IPV6_PKTOPTIONS
1214            looks not very well thought. For now we latch
1215            options, received in the last packet, enqueued
1216            by tcp. Feel free to propose better solution.
1217                                                --ANK (980728)
1218          */
1219         if (np->rxopt.all)
1220                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1221
1222         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1223                 struct dst_entry *dst = sk->sk_rx_dst;
1224
1225                 sock_rps_save_rxhash(sk, skb);
1226                 sk_mark_napi_id(sk, skb);
1227                 if (dst) {
1228                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1229                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1230                                 dst_release(dst);
1231                                 sk->sk_rx_dst = NULL;
1232                         }
1233                 }
1234
1235                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1236                 if (opt_skb)
1237                         goto ipv6_pktoptions;
1238                 return 0;
1239         }
1240
1241         if (tcp_checksum_complete(skb))
1242                 goto csum_err;
1243
1244         if (sk->sk_state == TCP_LISTEN) {
1245                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1246
1247                 if (!nsk)
1248                         goto discard;
1249
1250                 if (nsk != sk) {
1251                         sock_rps_save_rxhash(nsk, skb);
1252                         sk_mark_napi_id(nsk, skb);
1253                         if (tcp_child_process(sk, nsk, skb))
1254                                 goto reset;
1255                         if (opt_skb)
1256                                 __kfree_skb(opt_skb);
1257                         return 0;
1258                 }
1259         } else
1260                 sock_rps_save_rxhash(sk, skb);
1261
1262         if (tcp_rcv_state_process(sk, skb))
1263                 goto reset;
1264         if (opt_skb)
1265                 goto ipv6_pktoptions;
1266         return 0;
1267
1268 reset:
1269         tcp_v6_send_reset(sk, skb);
1270 discard:
1271         if (opt_skb)
1272                 __kfree_skb(opt_skb);
1273         kfree_skb(skb);
1274         return 0;
1275 csum_err:
1276         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1277         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1278         goto discard;
1279
1280
1281 ipv6_pktoptions:
1282         /* Do you ask, what is it?
1283
1284            1. skb was enqueued by tcp.
1285            2. skb is added to tail of read queue, rather than out of order.
1286            3. socket is not in passive state.
1287            4. Finally, it really contains options, which user wants to receive.
1288          */
1289         tp = tcp_sk(sk);
1290         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1291             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1292                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1293                         np->mcast_oif = tcp_v6_iif(opt_skb);
1294                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1295                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1296                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1297                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1298                 if (np->repflow)
1299                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1300                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1301                         skb_set_owner_r(opt_skb, sk);
1302                         opt_skb = xchg(&np->pktoptions, opt_skb);
1303                 } else {
1304                         __kfree_skb(opt_skb);
1305                         opt_skb = xchg(&np->pktoptions, NULL);
1306                 }
1307         }
1308
1309         kfree_skb(opt_skb);
1310         return 0;
1311 }
1312
1313 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1314                            const struct tcphdr *th)
1315 {
1316         /* This is tricky: we move IP6CB at its correct location into
1317          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1318          * _decode_session6() uses IP6CB().
1319          * barrier() makes sure compiler won't play aliasing games.
1320          */
1321         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1322                 sizeof(struct inet6_skb_parm));
1323         barrier();
1324
1325         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1326         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1327                                     skb->len - th->doff*4);
1328         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1329         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1330         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1331         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1332         TCP_SKB_CB(skb)->sacked = 0;
1333 }
1334
1335 static void tcp_v6_restore_cb(struct sk_buff *skb)
1336 {
1337         /* We need to move header back to the beginning if xfrm6_policy_check()
1338          * and tcp_v6_fill_cb() are going to be called again.
1339          */
1340         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1341                 sizeof(struct inet6_skb_parm));
1342 }
1343
1344 static int tcp_v6_rcv(struct sk_buff *skb)
1345 {
1346         const struct tcphdr *th;
1347         const struct ipv6hdr *hdr;
1348         struct sock *sk;
1349         int ret;
1350         struct net *net = dev_net(skb->dev);
1351
1352         if (skb->pkt_type != PACKET_HOST)
1353                 goto discard_it;
1354
1355         /*
1356          *      Count it even if it's bad.
1357          */
1358         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1359
1360         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1361                 goto discard_it;
1362
1363         th = tcp_hdr(skb);
1364
1365         if (th->doff < sizeof(struct tcphdr)/4)
1366                 goto bad_packet;
1367         if (!pskb_may_pull(skb, th->doff*4))
1368                 goto discard_it;
1369
1370         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1371                 goto csum_error;
1372
1373         th = tcp_hdr(skb);
1374         hdr = ipv6_hdr(skb);
1375
1376 lookup:
1377         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1378                                 inet6_iif(skb));
1379         if (!sk)
1380                 goto no_tcp_socket;
1381
1382 process:
1383         if (sk->sk_state == TCP_TIME_WAIT)
1384                 goto do_time_wait;
1385
1386         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1387                 struct request_sock *req = inet_reqsk(sk);
1388                 struct sock *nsk = NULL;
1389
1390                 sk = req->rsk_listener;
1391                 tcp_v6_fill_cb(skb, hdr, th);
1392                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1393                         reqsk_put(req);
1394                         goto discard_it;
1395                 }
1396                 if (likely(sk->sk_state == TCP_LISTEN)) {
1397                         nsk = tcp_check_req(sk, skb, req, false);
1398                 } else {
1399                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1400                         goto lookup;
1401                 }
1402                 if (!nsk) {
1403                         reqsk_put(req);
1404                         goto discard_it;
1405                 }
1406                 if (nsk == sk) {
1407                         sock_hold(sk);
1408                         reqsk_put(req);
1409                         tcp_v6_restore_cb(skb);
1410                 } else if (tcp_child_process(sk, nsk, skb)) {
1411                         tcp_v6_send_reset(nsk, skb);
1412                         goto discard_it;
1413                 } else {
1414                         return 0;
1415                 }
1416         }
1417         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1418                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1419                 goto discard_and_relse;
1420         }
1421
1422         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1423                 goto discard_and_relse;
1424
1425         tcp_v6_fill_cb(skb, hdr, th);
1426
1427         if (tcp_v6_inbound_md5_hash(sk, skb))
1428                 goto discard_and_relse;
1429
1430         if (sk_filter(sk, skb))
1431                 goto discard_and_relse;
1432
1433         skb->dev = NULL;
1434
1435         if (sk->sk_state == TCP_LISTEN) {
1436                 ret = tcp_v6_do_rcv(sk, skb);
1437                 goto put_and_return;
1438         }
1439
1440         sk_incoming_cpu_update(sk);
1441
1442         bh_lock_sock_nested(sk);
1443         tcp_sk(sk)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
1444         ret = 0;
1445         if (!sock_owned_by_user(sk)) {
1446                 if (!tcp_prequeue(sk, skb))
1447                         ret = tcp_v6_do_rcv(sk, skb);
1448         } else if (unlikely(sk_add_backlog(sk, skb,
1449                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1450                 bh_unlock_sock(sk);
1451                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1452                 goto discard_and_relse;
1453         }
1454         bh_unlock_sock(sk);
1455
1456 put_and_return:
1457         sock_put(sk);
1458         return ret ? -1 : 0;
1459
1460 no_tcp_socket:
1461         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1462                 goto discard_it;
1463
1464         tcp_v6_fill_cb(skb, hdr, th);
1465
1466         if (tcp_checksum_complete(skb)) {
1467 csum_error:
1468                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1469 bad_packet:
1470                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1471         } else {
1472                 tcp_v6_send_reset(NULL, skb);
1473         }
1474
1475 discard_it:
1476         kfree_skb(skb);
1477         return 0;
1478
1479 discard_and_relse:
1480         sock_put(sk);
1481         goto discard_it;
1482
1483 do_time_wait:
1484         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1485                 inet_twsk_put(inet_twsk(sk));
1486                 goto discard_it;
1487         }
1488
1489         tcp_v6_fill_cb(skb, hdr, th);
1490
1491         if (tcp_checksum_complete(skb)) {
1492                 inet_twsk_put(inet_twsk(sk));
1493                 goto csum_error;
1494         }
1495
1496         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1497         case TCP_TW_SYN:
1498         {
1499                 struct sock *sk2;
1500
1501                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1502                                             &ipv6_hdr(skb)->saddr, th->source,
1503                                             &ipv6_hdr(skb)->daddr,
1504                                             ntohs(th->dest), tcp_v6_iif(skb));
1505                 if (sk2) {
1506                         struct inet_timewait_sock *tw = inet_twsk(sk);
1507                         inet_twsk_deschedule_put(tw);
1508                         sk = sk2;
1509                         tcp_v6_restore_cb(skb);
1510                         goto process;
1511                 }
1512                 /* Fall through to ACK */
1513         }
1514         case TCP_TW_ACK:
1515                 tcp_v6_timewait_ack(sk, skb);
1516                 break;
1517         case TCP_TW_RST:
1518                 tcp_v6_restore_cb(skb);
1519                 goto no_tcp_socket;
1520         case TCP_TW_SUCCESS:
1521                 ;
1522         }
1523         goto discard_it;
1524 }
1525
1526 static void tcp_v6_early_demux(struct sk_buff *skb)
1527 {
1528         const struct ipv6hdr *hdr;
1529         const struct tcphdr *th;
1530         struct sock *sk;
1531
1532         if (skb->pkt_type != PACKET_HOST)
1533                 return;
1534
1535         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1536                 return;
1537
1538         hdr = ipv6_hdr(skb);
1539         th = tcp_hdr(skb);
1540
1541         if (th->doff < sizeof(struct tcphdr) / 4)
1542                 return;
1543
1544         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1545         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1546                                         &hdr->saddr, th->source,
1547                                         &hdr->daddr, ntohs(th->dest),
1548                                         inet6_iif(skb));
1549         if (sk) {
1550                 skb->sk = sk;
1551                 skb->destructor = sock_edemux;
1552                 if (sk_fullsock(sk)) {
1553                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1554
1555                         if (dst)
1556                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1557                         if (dst &&
1558                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1559                                 skb_dst_set_noref(skb, dst);
1560                 }
1561         }
1562 }
1563
1564 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1565         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1566         .twsk_unique    = tcp_twsk_unique,
1567         .twsk_destructor = tcp_twsk_destructor,
1568 };
1569
1570 static const struct inet_connection_sock_af_ops ipv6_specific = {
1571         .queue_xmit        = inet6_csk_xmit,
1572         .send_check        = tcp_v6_send_check,
1573         .rebuild_header    = inet6_sk_rebuild_header,
1574         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1575         .conn_request      = tcp_v6_conn_request,
1576         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1577         .net_header_len    = sizeof(struct ipv6hdr),
1578         .net_frag_header_len = sizeof(struct frag_hdr),
1579         .setsockopt        = ipv6_setsockopt,
1580         .getsockopt        = ipv6_getsockopt,
1581         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1582         .sockaddr_len      = sizeof(struct sockaddr_in6),
1583         .bind_conflict     = inet6_csk_bind_conflict,
1584 #ifdef CONFIG_COMPAT
1585         .compat_setsockopt = compat_ipv6_setsockopt,
1586         .compat_getsockopt = compat_ipv6_getsockopt,
1587 #endif
1588         .mtu_reduced       = tcp_v6_mtu_reduced,
1589 };
1590
1591 #ifdef CONFIG_TCP_MD5SIG
1592 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1593         .md5_lookup     =       tcp_v6_md5_lookup,
1594         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1595         .md5_parse      =       tcp_v6_parse_md5_keys,
1596 };
1597 #endif
1598
1599 /*
1600  *      TCP over IPv4 via INET6 API
1601  */
1602 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1603         .queue_xmit        = ip_queue_xmit,
1604         .send_check        = tcp_v4_send_check,
1605         .rebuild_header    = inet_sk_rebuild_header,
1606         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1607         .conn_request      = tcp_v6_conn_request,
1608         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1609         .net_header_len    = sizeof(struct iphdr),
1610         .setsockopt        = ipv6_setsockopt,
1611         .getsockopt        = ipv6_getsockopt,
1612         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1613         .sockaddr_len      = sizeof(struct sockaddr_in6),
1614         .bind_conflict     = inet6_csk_bind_conflict,
1615 #ifdef CONFIG_COMPAT
1616         .compat_setsockopt = compat_ipv6_setsockopt,
1617         .compat_getsockopt = compat_ipv6_getsockopt,
1618 #endif
1619         .mtu_reduced       = tcp_v4_mtu_reduced,
1620 };
1621
1622 #ifdef CONFIG_TCP_MD5SIG
1623 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1624         .md5_lookup     =       tcp_v4_md5_lookup,
1625         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1626         .md5_parse      =       tcp_v6_parse_md5_keys,
1627 };
1628 #endif
1629
1630 /* NOTE: A lot of things set to zero explicitly by call to
1631  *       sk_alloc() so need not be done here.
1632  */
1633 static int tcp_v6_init_sock(struct sock *sk)
1634 {
1635         struct inet_connection_sock *icsk = inet_csk(sk);
1636
1637         tcp_init_sock(sk);
1638
1639         icsk->icsk_af_ops = &ipv6_specific;
1640
1641 #ifdef CONFIG_TCP_MD5SIG
1642         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1643 #endif
1644
1645         return 0;
1646 }
1647
1648 static void tcp_v6_destroy_sock(struct sock *sk)
1649 {
1650         tcp_v4_destroy_sock(sk);
1651         inet6_destroy_sock(sk);
1652 }
1653
1654 #ifdef CONFIG_PROC_FS
1655 /* Proc filesystem TCPv6 sock list dumping. */
1656 static void get_openreq6(struct seq_file *seq,
1657                          const struct request_sock *req, int i)
1658 {
1659         long ttd = req->rsk_timer.expires - jiffies;
1660         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1661         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1662
1663         if (ttd < 0)
1664                 ttd = 0;
1665
1666         seq_printf(seq,
1667                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1668                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1669                    i,
1670                    src->s6_addr32[0], src->s6_addr32[1],
1671                    src->s6_addr32[2], src->s6_addr32[3],
1672                    inet_rsk(req)->ir_num,
1673                    dest->s6_addr32[0], dest->s6_addr32[1],
1674                    dest->s6_addr32[2], dest->s6_addr32[3],
1675                    ntohs(inet_rsk(req)->ir_rmt_port),
1676                    TCP_SYN_RECV,
1677                    0, 0, /* could print option size, but that is af dependent. */
1678                    1,   /* timers active (only the expire timer) */
1679                    jiffies_to_clock_t(ttd),
1680                    req->num_timeout,
1681                    from_kuid_munged(seq_user_ns(seq),
1682                                     sock_i_uid(req->rsk_listener)),
1683                    0,  /* non standard timer */
1684                    0, /* open_requests have no inode */
1685                    0, req);
1686 }
1687
1688 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1689 {
1690         const struct in6_addr *dest, *src;
1691         __u16 destp, srcp;
1692         int timer_active;
1693         unsigned long timer_expires;
1694         const struct inet_sock *inet = inet_sk(sp);
1695         const struct tcp_sock *tp = tcp_sk(sp);
1696         const struct inet_connection_sock *icsk = inet_csk(sp);
1697         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1698         int rx_queue;
1699         int state;
1700
1701         dest  = &sp->sk_v6_daddr;
1702         src   = &sp->sk_v6_rcv_saddr;
1703         destp = ntohs(inet->inet_dport);
1704         srcp  = ntohs(inet->inet_sport);
1705
1706         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1707                 timer_active    = 1;
1708                 timer_expires   = icsk->icsk_timeout;
1709         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1710                 timer_active    = 4;
1711                 timer_expires   = icsk->icsk_timeout;
1712         } else if (timer_pending(&sp->sk_timer)) {
1713                 timer_active    = 2;
1714                 timer_expires   = sp->sk_timer.expires;
1715         } else {
1716                 timer_active    = 0;
1717                 timer_expires = jiffies;
1718         }
1719
1720         state = sk_state_load(sp);
1721         if (state == TCP_LISTEN)
1722                 rx_queue = sp->sk_ack_backlog;
1723         else
1724                 /* Because we don't lock the socket,
1725                  * we might find a transient negative value.
1726                  */
1727                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1728
1729         seq_printf(seq,
1730                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1731                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1732                    i,
1733                    src->s6_addr32[0], src->s6_addr32[1],
1734                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1735                    dest->s6_addr32[0], dest->s6_addr32[1],
1736                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1737                    state,
1738                    tp->write_seq - tp->snd_una,
1739                    rx_queue,
1740                    timer_active,
1741                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1742                    icsk->icsk_retransmits,
1743                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1744                    icsk->icsk_probes_out,
1745                    sock_i_ino(sp),
1746                    atomic_read(&sp->sk_refcnt), sp,
1747                    jiffies_to_clock_t(icsk->icsk_rto),
1748                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1749                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1750                    tp->snd_cwnd,
1751                    state == TCP_LISTEN ?
1752                         fastopenq->max_qlen :
1753                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1754                    );
1755 }
1756
1757 static void get_timewait6_sock(struct seq_file *seq,
1758                                struct inet_timewait_sock *tw, int i)
1759 {
1760         long delta = tw->tw_timer.expires - jiffies;
1761         const struct in6_addr *dest, *src;
1762         __u16 destp, srcp;
1763
1764         dest = &tw->tw_v6_daddr;
1765         src  = &tw->tw_v6_rcv_saddr;
1766         destp = ntohs(tw->tw_dport);
1767         srcp  = ntohs(tw->tw_sport);
1768
1769         seq_printf(seq,
1770                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1771                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1772                    i,
1773                    src->s6_addr32[0], src->s6_addr32[1],
1774                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1775                    dest->s6_addr32[0], dest->s6_addr32[1],
1776                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1777                    tw->tw_substate, 0, 0,
1778                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1779                    atomic_read(&tw->tw_refcnt), tw);
1780 }
1781
1782 static int tcp6_seq_show(struct seq_file *seq, void *v)
1783 {
1784         struct tcp_iter_state *st;
1785         struct sock *sk = v;
1786
1787         if (v == SEQ_START_TOKEN) {
1788                 seq_puts(seq,
1789                          "  sl  "
1790                          "local_address                         "
1791                          "remote_address                        "
1792                          "st tx_queue rx_queue tr tm->when retrnsmt"
1793                          "   uid  timeout inode\n");
1794                 goto out;
1795         }
1796         st = seq->private;
1797
1798         if (sk->sk_state == TCP_TIME_WAIT)
1799                 get_timewait6_sock(seq, v, st->num);
1800         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1801                 get_openreq6(seq, v, st->num);
1802         else
1803                 get_tcp6_sock(seq, v, st->num);
1804 out:
1805         return 0;
1806 }
1807
1808 static const struct file_operations tcp6_afinfo_seq_fops = {
1809         .owner   = THIS_MODULE,
1810         .open    = tcp_seq_open,
1811         .read    = seq_read,
1812         .llseek  = seq_lseek,
1813         .release = seq_release_net
1814 };
1815
1816 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1817         .name           = "tcp6",
1818         .family         = AF_INET6,
1819         .seq_fops       = &tcp6_afinfo_seq_fops,
1820         .seq_ops        = {
1821                 .show           = tcp6_seq_show,
1822         },
1823 };
1824
1825 int __net_init tcp6_proc_init(struct net *net)
1826 {
1827         return tcp_proc_register(net, &tcp6_seq_afinfo);
1828 }
1829
1830 void tcp6_proc_exit(struct net *net)
1831 {
1832         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1833 }
1834 #endif
1835
1836 static void tcp_v6_clear_sk(struct sock *sk, int size)
1837 {
1838         struct inet_sock *inet = inet_sk(sk);
1839
1840         /* we do not want to clear pinet6 field, because of RCU lookups */
1841         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1842
1843         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1844         memset(&inet->pinet6 + 1, 0, size);
1845 }
1846
1847 struct proto tcpv6_prot = {
1848         .name                   = "TCPv6",
1849         .owner                  = THIS_MODULE,
1850         .close                  = tcp_close,
1851         .connect                = tcp_v6_connect,
1852         .disconnect             = tcp_disconnect,
1853         .accept                 = inet_csk_accept,
1854         .ioctl                  = tcp_ioctl,
1855         .init                   = tcp_v6_init_sock,
1856         .destroy                = tcp_v6_destroy_sock,
1857         .shutdown               = tcp_shutdown,
1858         .setsockopt             = tcp_setsockopt,
1859         .getsockopt             = tcp_getsockopt,
1860         .recvmsg                = tcp_recvmsg,
1861         .sendmsg                = tcp_sendmsg,
1862         .sendpage               = tcp_sendpage,
1863         .backlog_rcv            = tcp_v6_do_rcv,
1864         .release_cb             = tcp_release_cb,
1865         .hash                   = inet_hash,
1866         .unhash                 = inet_unhash,
1867         .get_port               = inet_csk_get_port,
1868         .enter_memory_pressure  = tcp_enter_memory_pressure,
1869         .stream_memory_free     = tcp_stream_memory_free,
1870         .sockets_allocated      = &tcp_sockets_allocated,
1871         .memory_allocated       = &tcp_memory_allocated,
1872         .memory_pressure        = &tcp_memory_pressure,
1873         .orphan_count           = &tcp_orphan_count,
1874         .sysctl_mem             = sysctl_tcp_mem,
1875         .sysctl_wmem            = sysctl_tcp_wmem,
1876         .sysctl_rmem            = sysctl_tcp_rmem,
1877         .max_header             = MAX_TCP_HEADER,
1878         .obj_size               = sizeof(struct tcp6_sock),
1879         .slab_flags             = SLAB_DESTROY_BY_RCU,
1880         .twsk_prot              = &tcp6_timewait_sock_ops,
1881         .rsk_prot               = &tcp6_request_sock_ops,
1882         .h.hashinfo             = &tcp_hashinfo,
1883         .no_autobind            = true,
1884 #ifdef CONFIG_COMPAT
1885         .compat_setsockopt      = compat_tcp_setsockopt,
1886         .compat_getsockopt      = compat_tcp_getsockopt,
1887 #endif
1888 #ifdef CONFIG_MEMCG_KMEM
1889         .proto_cgroup           = tcp_proto_cgroup,
1890 #endif
1891         .clear_sk               = tcp_v6_clear_sk,
1892 };
1893
1894 static const struct inet6_protocol tcpv6_protocol = {
1895         .early_demux    =       tcp_v6_early_demux,
1896         .handler        =       tcp_v6_rcv,
1897         .err_handler    =       tcp_v6_err,
1898         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1899 };
1900
1901 static struct inet_protosw tcpv6_protosw = {
1902         .type           =       SOCK_STREAM,
1903         .protocol       =       IPPROTO_TCP,
1904         .prot           =       &tcpv6_prot,
1905         .ops            =       &inet6_stream_ops,
1906         .flags          =       INET_PROTOSW_PERMANENT |
1907                                 INET_PROTOSW_ICSK,
1908 };
1909
1910 static int __net_init tcpv6_net_init(struct net *net)
1911 {
1912         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1913                                     SOCK_RAW, IPPROTO_TCP, net);
1914 }
1915
1916 static void __net_exit tcpv6_net_exit(struct net *net)
1917 {
1918         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1919 }
1920
1921 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1922 {
1923         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1924 }
1925
1926 static struct pernet_operations tcpv6_net_ops = {
1927         .init       = tcpv6_net_init,
1928         .exit       = tcpv6_net_exit,
1929         .exit_batch = tcpv6_net_exit_batch,
1930 };
1931
1932 int __init tcpv6_init(void)
1933 {
1934         int ret;
1935
1936         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1937         if (ret)
1938                 goto out;
1939
1940         /* register inet6 protocol */
1941         ret = inet6_register_protosw(&tcpv6_protosw);
1942         if (ret)
1943                 goto out_tcpv6_protocol;
1944
1945         ret = register_pernet_subsys(&tcpv6_net_ops);
1946         if (ret)
1947                 goto out_tcpv6_protosw;
1948 out:
1949         return ret;
1950
1951 out_tcpv6_protosw:
1952         inet6_unregister_protosw(&tcpv6_protosw);
1953 out_tcpv6_protocol:
1954         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1955         goto out;
1956 }
1957
1958 void tcpv6_exit(void)
1959 {
1960         unregister_pernet_subsys(&tcpv6_net_ops);
1961         inet6_unregister_protosw(&tcpv6_protosw);
1962         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1963 }