net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/tcp_memcontrol.h>
  65 #include <net/busy_poll.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 #include <linux/crypto.h>
  71 #include <linux/scatterlist.h>
  72
  73 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  75                                       struct request_sock *req);
  76
  77 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  78
  79 static const struct inet_connection_sock_af_ops ipv6_mapped;
  80 static const struct inet_connection_sock_af_ops ipv6_specific;
  81 #ifdef CONFIG_TCP_MD5SIG
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  84 #else
  85 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  86                                                    const struct in6_addr *addr)
  87 {
  88         return NULL;
  89 }
  90 #endif
  91
  92 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  93 {
  94         struct dst_entry *dst = skb_dst(skb);
  95
  96         if (dst && dst_hold_safe(dst)) {
  97                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99                 sk->sk_rx_dst = dst;
 100                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 101                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 102         }
 103 }
 104
 105 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 106 {
 107         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 108                                             ipv6_hdr(skb)->saddr.s6_addr32,
 109                                             tcp_hdr(skb)->dest,
 110                                             tcp_hdr(skb)->source);
 111 }
 112
 113 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 114                           int addr_len)
 115 {
 116         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 117         struct inet_sock *inet = inet_sk(sk);
 118         struct inet_connection_sock *icsk = inet_csk(sk);
 119         struct ipv6_pinfo *np = inet6_sk(sk);
 120         struct tcp_sock *tp = tcp_sk(sk);
 121         struct in6_addr *saddr = NULL, *final_p, final;
 122         struct ipv6_txoptions *opt;
 123         struct flowi6 fl6;
 124         struct dst_entry *dst;
 125         int addr_type;
 126         int err;
 127
 128         if (addr_len < SIN6_LEN_RFC2133)
 129                 return -EINVAL;
 130
 131         if (usin->sin6_family != AF_INET6)
 132                 return -EAFNOSUPPORT;
 133
 134         memset(&fl6, 0, sizeof(fl6));
 135
 136         if (np->sndflow) {
 137                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 138                 IP6_ECN_flow_init(fl6.flowlabel);
 139                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 140                         struct ip6_flowlabel *flowlabel;
 141                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 142                         if (!flowlabel)
 143                                 return -EINVAL;
 144                         fl6_sock_release(flowlabel);
 145                 }
 146         }
 147
 148         /*
 149          *      connect() to INADDR_ANY means loopback (BSD'ism).
 150          */
 151
 152         if (ipv6_addr_any(&usin->sin6_addr))
 153                 usin->sin6_addr.s6_addr[15] = 0x1;
 154
 155         addr_type = ipv6_addr_type(&usin->sin6_addr);
 156
 157         if (addr_type & IPV6_ADDR_MULTICAST)
 158                 return -ENETUNREACH;
 159
 160         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 161                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 162                     usin->sin6_scope_id) {
 163                         /* If interface is set while binding, indices
 164                          * must coincide.
 165                          */
 166                         if (sk->sk_bound_dev_if &&
 167                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 168                                 return -EINVAL;
 169
 170                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 171                 }
 172
 173                 /* Connect to link-local address requires an interface */
 174                 if (!sk->sk_bound_dev_if)
 175                         return -EINVAL;
 176         }
 177
 178         if (tp->rx_opt.ts_recent_stamp &&
 179             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 180                 tp->rx_opt.ts_recent = 0;
 181                 tp->rx_opt.ts_recent_stamp = 0;
 182                 tp->write_seq = 0;
 183         }
 184
 185         sk->sk_v6_daddr = usin->sin6_addr;
 186         np->flow_label = fl6.flowlabel;
 187
 188         /*
 189          *      TCP over IPv4
 190          */
 191
 192         if (addr_type == IPV6_ADDR_MAPPED) {
 193                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 194                 struct sockaddr_in sin;
 195
 196                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 197
 198                 if (__ipv6_only_sock(sk))
 199                         return -ENETUNREACH;
 200
 201                 sin.sin_family = AF_INET;
 202                 sin.sin_port = usin->sin6_port;
 203                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 204
 205                 icsk->icsk_af_ops = &ipv6_mapped;
 206                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 207 #ifdef CONFIG_TCP_MD5SIG
 208                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 209 #endif
 210
 211                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 212
 213                 if (err) {
 214                         icsk->icsk_ext_hdr_len = exthdrlen;
 215                         icsk->icsk_af_ops = &ipv6_specific;
 216                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 217 #ifdef CONFIG_TCP_MD5SIG
 218                         tp->af_specific = &tcp_sock_ipv6_specific;
 219 #endif
 220                         goto failure;
 221                 }
 222                 np->saddr = sk->sk_v6_rcv_saddr;
 223
 224                 return err;
 225         }
 226
 227         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 228                 saddr = &sk->sk_v6_rcv_saddr;
 229
 230         fl6.flowi6_proto = IPPROTO_TCP;
 231         fl6.daddr = sk->sk_v6_daddr;
 232         fl6.saddr = saddr ? *saddr : np->saddr;
 233         fl6.flowi6_oif = sk->sk_bound_dev_if;
 234         fl6.flowi6_mark = sk->sk_mark;
 235         fl6.fl6_dport = usin->sin6_port;
 236         fl6.fl6_sport = inet->inet_sport;
 237         fl6.flowi6_uid = sock_i_uid(sk);
 238
 239         opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
 240         final_p = fl6_update_dst(&fl6, opt, &final);
 241
 242         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 243
 244         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 245         if (IS_ERR(dst)) {
 246                 err = PTR_ERR(dst);
 247                 goto failure;
 248         }
 249
 250         if (!saddr) {
 251                 saddr = &fl6.saddr;
 252                 sk->sk_v6_rcv_saddr = *saddr;
 253         }
 254
 255         /* set the source address */
 256         np->saddr = *saddr;
 257         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 258
 259         sk->sk_gso_type = SKB_GSO_TCPV6;
 260         ip6_dst_store(sk, dst, NULL, NULL);
 261
 262         if (tcp_death_row.sysctl_tw_recycle &&
 263             !tp->rx_opt.ts_recent_stamp &&
 264             ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
 265                 tcp_fetch_timewait_stamp(sk, dst);
 266
 267         icsk->icsk_ext_hdr_len = 0;
 268         if (opt)
 269                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 270                                          opt->opt_nflen;
 271
 272         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 273
 274         inet->inet_dport = usin->sin6_port;
 275
 276         tcp_set_state(sk, TCP_SYN_SENT);
 277         err = inet6_hash_connect(&tcp_death_row, sk);
 278         if (err)
 279                 goto late_failure;
 280
 281         sk_set_txhash(sk);
 282
 283         if (!tp->write_seq && likely(!tp->repair))
 284                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 285                                                              sk->sk_v6_daddr.s6_addr32,
 286                                                              inet->inet_sport,
 287                                                              inet->inet_dport);
 288
 289         err = tcp_connect(sk);
 290         if (err)
 291                 goto late_failure;
 292
 293         return 0;
 294
 295 late_failure:
 296         tcp_set_state(sk, TCP_CLOSE);
 297         __sk_dst_reset(sk);
 298 failure:
 299         inet->inet_dport = 0;
 300         sk->sk_route_caps = 0;
 301         return err;
 302 }
 303
 304 static void tcp_v6_mtu_reduced(struct sock *sk)
 305 {
 306         struct dst_entry *dst;
 307
 308         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 309                 return;
 310
 311         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 312         if (!dst)
 313                 return;
 314
 315         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 316                 tcp_sync_mss(sk, dst_mtu(dst));
 317                 tcp_simple_retransmit(sk);
 318         }
 319 }
 320
 321 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 322                 u8 type, u8 code, int offset, __be32 info)
 323 {
 324         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 325         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 326         struct net *net = dev_net(skb->dev);
 327         struct request_sock *fastopen;
 328         struct ipv6_pinfo *np;
 329         struct tcp_sock *tp;
 330         __u32 seq, snd_una;
 331         struct sock *sk;
 332         bool fatal;
 333         int err;
 334
 335         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 336                                         &hdr->daddr, th->dest,
 337                                         &hdr->saddr, ntohs(th->source),
 338                                         skb->dev->ifindex);
 339
 340         if (!sk) {
 341                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 342                                    ICMP6_MIB_INERRORS);
 343                 return;
 344         }
 345
 346         if (sk->sk_state == TCP_TIME_WAIT) {
 347                 inet_twsk_put(inet_twsk(sk));
 348                 return;
 349         }
 350         seq = ntohl(th->seq);
 351         fatal = icmpv6_err_convert(type, code, &err);
 352         if (sk->sk_state == TCP_NEW_SYN_RECV)
 353                 return tcp_req_err(sk, seq, fatal);
 354
 355         bh_lock_sock(sk);
 356         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 357                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 358
 359         if (sk->sk_state == TCP_CLOSE)
 360                 goto out;
 361
 362         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 363                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 364                 goto out;
 365         }
 366
 367         tp = tcp_sk(sk);
 368         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 369         fastopen = tp->fastopen_rsk;
 370         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 371         if (sk->sk_state != TCP_LISTEN &&
 372             !between(seq, snd_una, tp->snd_nxt)) {
 373                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 374                 goto out;
 375         }
 376
 377         np = inet6_sk(sk);
 378
 379         if (type == NDISC_REDIRECT) {
 380                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 381
 382                 if (dst)
 383                         dst->ops->redirect(dst, sk, skb);
 384                 goto out;
 385         }
 386
 387         if (type == ICMPV6_PKT_TOOBIG) {
 388                 /* We are not interested in TCP_LISTEN and open_requests
 389                  * (SYN-ACKs send out by Linux are always <576bytes so
 390                  * they should go through unfragmented).
 391                  */
 392                 if (sk->sk_state == TCP_LISTEN)
 393                         goto out;
 394
 395                 if (!ip6_sk_accept_pmtu(sk))
 396                         goto out;
 397
 398                 tp->mtu_info = ntohl(info);
 399                 if (!sock_owned_by_user(sk))
 400                         tcp_v6_mtu_reduced(sk);
 401                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 402                                            &tp->tsq_flags))
 403                         sock_hold(sk);
 404                 goto out;
 405         }
 406
 407
 408         /* Might be for an request_sock */
 409         switch (sk->sk_state) {
 410         case TCP_SYN_SENT:
 411         case TCP_SYN_RECV:
 412                 /* Only in fast or simultaneous open. If a fast open socket is
 413                  * is already accepted it is treated as a connected one below.
 414                  */
 415                 if (fastopen && !fastopen->sk)
 416                         break;
 417
 418                 if (!sock_owned_by_user(sk)) {
 419                         sk->sk_err = err;
 420                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 421
 422                         tcp_done(sk);
 423                 } else
 424                         sk->sk_err_soft = err;
 425                 goto out;
 426         }
 427
 428         if (!sock_owned_by_user(sk) && np->recverr) {
 429                 sk->sk_err = err;
 430                 sk->sk_error_report(sk);
 431         } else
 432                 sk->sk_err_soft = err;
 433
 434 out:
 435         bh_unlock_sock(sk);
 436         sock_put(sk);
 437 }
 438
 439
 440 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 441                               struct flowi *fl,
 442                               struct request_sock *req,
 443                               struct tcp_fastopen_cookie *foc,
 444                               bool attach_req)
 445 {
 446         struct inet_request_sock *ireq = inet_rsk(req);
 447         struct ipv6_pinfo *np = inet6_sk(sk);
 448         struct flowi6 *fl6 = &fl->u.ip6;
 449         struct sk_buff *skb;
 450         int err = -ENOMEM;
 451
 452         /* First, grab a route. */
 453         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 454                                                IPPROTO_TCP)) == NULL)
 455                 goto done;
 456
 457         skb = tcp_make_synack(sk, dst, req, foc, attach_req);
 458
 459         if (skb) {
 460                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 461                                     &ireq->ir_v6_rmt_addr);
 462
 463                 fl6->daddr = ireq->ir_v6_rmt_addr;
 464                 if (np->repflow && ireq->pktopts)
 465                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 466
 467                 rcu_read_lock();
 468                 err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
 469                                np->tclass);
 470                 rcu_read_unlock();
 471                 err = net_xmit_eval(err);
 472         }
 473
 474 done:
 475         return err;
 476 }
 477
 478
 479 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 480 {
 481         kfree_skb(inet_rsk(req)->pktopts);
 482 }
 483
 484 #ifdef CONFIG_TCP_MD5SIG
 485 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 486                                                    const struct in6_addr *addr)
 487 {
 488         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 489 }
 490
 491 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 492                                                 const struct sock *addr_sk)
 493 {
 494         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 495 }
 496
 497 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 498                                  int optlen)
 499 {
 500         struct tcp_md5sig cmd;
 501         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 502
 503         if (optlen < sizeof(cmd))
 504                 return -EINVAL;
 505
 506         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 507                 return -EFAULT;
 508
 509         if (sin6->sin6_family != AF_INET6)
 510                 return -EINVAL;
 511
 512         if (!cmd.tcpm_keylen) {
 513                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 514                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 515                                               AF_INET);
 516                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 517                                       AF_INET6);
 518         }
 519
 520         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 521                 return -EINVAL;
 522
 523         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 524                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 525                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 526
 527         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 528                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 529 }
 530
 531 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 532                                         const struct in6_addr *daddr,
 533                                         const struct in6_addr *saddr, int nbytes)
 534 {
 535         struct tcp6_pseudohdr *bp;
 536         struct scatterlist sg;
 537
 538         bp = &hp->md5_blk.ip6;
 539         /* 1. TCP pseudo-header (RFC2460) */
 540         bp->saddr = *saddr;
 541         bp->daddr = *daddr;
 542         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 543         bp->len = cpu_to_be32(nbytes);
 544
 545         sg_init_one(&sg, bp, sizeof(*bp));
 546         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 547 }
 548
 549 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 550                                const struct in6_addr *daddr, struct in6_addr *saddr,
 551                                const struct tcphdr *th)
 552 {
 553         struct tcp_md5sig_pool *hp;
 554         struct hash_desc *desc;
 555
 556         hp = tcp_get_md5sig_pool();
 557         if (!hp)
 558                 goto clear_hash_noput;
 559         desc = &hp->md5_desc;
 560
 561         if (crypto_hash_init(desc))
 562                 goto clear_hash;
 563         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 564                 goto clear_hash;
 565         if (tcp_md5_hash_header(hp, th))
 566                 goto clear_hash;
 567         if (tcp_md5_hash_key(hp, key))
 568                 goto clear_hash;
 569         if (crypto_hash_final(desc, md5_hash))
 570                 goto clear_hash;
 571
 572         tcp_put_md5sig_pool();
 573         return 0;
 574
 575 clear_hash:
 576         tcp_put_md5sig_pool();
 577 clear_hash_noput:
 578         memset(md5_hash, 0, 16);
 579         return 1;
 580 }
 581
 582 static int tcp_v6_md5_hash_skb(char *md5_hash,
 583                                const struct tcp_md5sig_key *key,
 584                                const struct sock *sk,
 585                                const struct sk_buff *skb)
 586 {
 587         const struct in6_addr *saddr, *daddr;
 588         struct tcp_md5sig_pool *hp;
 589         struct hash_desc *desc;
 590         const struct tcphdr *th = tcp_hdr(skb);
 591
 592         if (sk) { /* valid for establish/request sockets */
 593                 saddr = &sk->sk_v6_rcv_saddr;
 594                 daddr = &sk->sk_v6_daddr;
 595         } else {
 596                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 597                 saddr = &ip6h->saddr;
 598                 daddr = &ip6h->daddr;
 599         }
 600
 601         hp = tcp_get_md5sig_pool();
 602         if (!hp)
 603                 goto clear_hash_noput;
 604         desc = &hp->md5_desc;
 605
 606         if (crypto_hash_init(desc))
 607                 goto clear_hash;
 608
 609         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 610                 goto clear_hash;
 611         if (tcp_md5_hash_header(hp, th))
 612                 goto clear_hash;
 613         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 614                 goto clear_hash;
 615         if (tcp_md5_hash_key(hp, key))
 616                 goto clear_hash;
 617         if (crypto_hash_final(desc, md5_hash))
 618                 goto clear_hash;
 619
 620         tcp_put_md5sig_pool();
 621         return 0;
 622
 623 clear_hash:
 624         tcp_put_md5sig_pool();
 625 clear_hash_noput:
 626         memset(md5_hash, 0, 16);
 627         return 1;
 628 }
 629
 630 #endif
 631
 632 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 633                                     const struct sk_buff *skb)
 634 {
 635 #ifdef CONFIG_TCP_MD5SIG
 636         const __u8 *hash_location = NULL;
 637         struct tcp_md5sig_key *hash_expected;
 638         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 639         const struct tcphdr *th = tcp_hdr(skb);
 640         int genhash;
 641         u8 newhash[16];
 642
 643         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 644         hash_location = tcp_parse_md5sig_option(th);
 645
 646         /* We've parsed the options - do we have a hash? */
 647         if (!hash_expected && !hash_location)
 648                 return false;
 649
 650         if (hash_expected && !hash_location) {
 651                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 652                 return true;
 653         }
 654
 655         if (!hash_expected && hash_location) {
 656                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 657                 return true;
 658         }
 659
 660         /* check the signature */
 661         genhash = tcp_v6_md5_hash_skb(newhash,
 662                                       hash_expected,
 663                                       NULL, skb);
 664
 665         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 666                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 667                                      genhash ? "failed" : "mismatch",
 668                                      &ip6h->saddr, ntohs(th->source),
 669                                      &ip6h->daddr, ntohs(th->dest));
 670                 return true;
 671         }
 672 #endif
 673         return false;
 674 }
 675
 676 static void tcp_v6_init_req(struct request_sock *req,
 677                             const struct sock *sk_listener,
 678                             struct sk_buff *skb)
 679 {
 680         struct inet_request_sock *ireq = inet_rsk(req);
 681         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 682
 683         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 684         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 685
 686         /* So that link locals have meaning */
 687         if (!sk_listener->sk_bound_dev_if &&
 688             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 689                 ireq->ir_iif = tcp_v6_iif(skb);
 690
 691         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 692             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 693              np->rxopt.bits.rxinfo ||
 694              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 695              np->rxopt.bits.rxohlim || np->repflow)) {
 696                 atomic_inc(&skb->users);
 697                 ireq->pktopts = skb;
 698         }
 699 }
 700
 701 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 702                                           struct flowi *fl,
 703                                           const struct request_sock *req,
 704                                           bool *strict)
 705 {
 706         if (strict)
 707                 *strict = true;
 708         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 709 }
 710
 711 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 712         .family         =       AF_INET6,
 713         .obj_size       =       sizeof(struct tcp6_request_sock),
 714         .rtx_syn_ack    =       tcp_rtx_synack,
 715         .send_ack       =       tcp_v6_reqsk_send_ack,
 716         .destructor     =       tcp_v6_reqsk_destructor,
 717         .send_reset     =       tcp_v6_send_reset,
 718         .syn_ack_timeout =      tcp_syn_ack_timeout,
 719 };
 720
 721 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 722         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 723                                 sizeof(struct ipv6hdr),
 724 #ifdef CONFIG_TCP_MD5SIG
 725         .req_md5_lookup =       tcp_v6_md5_lookup,
 726         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 727 #endif
 728         .init_req       =       tcp_v6_init_req,
 729 #ifdef CONFIG_SYN_COOKIES
 730         .cookie_init_seq =      cookie_v6_init_sequence,
 731 #endif
 732         .route_req      =       tcp_v6_route_req,
 733         .init_seq       =       tcp_v6_init_sequence,
 734         .send_synack    =       tcp_v6_send_synack,
 735 };
 736
 737 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 738                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 739                                  int oif, struct tcp_md5sig_key *key, int rst,
 740                                  u8 tclass, u32 label)
 741 {
 742         const struct tcphdr *th = tcp_hdr(skb);
 743         struct tcphdr *t1;
 744         struct sk_buff *buff;
 745         struct flowi6 fl6;
 746         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 747         struct sock *ctl_sk = net->ipv6.tcp_sk;
 748         unsigned int tot_len = sizeof(struct tcphdr);
 749         struct dst_entry *dst;
 750         __be32 *topt;
 751
 752         if (tsecr)
 753                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 754 #ifdef CONFIG_TCP_MD5SIG
 755         if (key)
 756                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 757 #endif
 758
 759         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 760                          GFP_ATOMIC);
 761         if (!buff)
 762                 return;
 763
 764         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 765
 766         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 767         skb_reset_transport_header(buff);
 768
 769         /* Swap the send and the receive. */
 770         memset(t1, 0, sizeof(*t1));
 771         t1->dest = th->source;
 772         t1->source = th->dest;
 773         t1->doff = tot_len / 4;
 774         t1->seq = htonl(seq);
 775         t1->ack_seq = htonl(ack);
 776         t1->ack = !rst || !th->ack;
 777         t1->rst = rst;
 778         t1->window = htons(win);
 779
 780         topt = (__be32 *)(t1 + 1);
 781
 782         if (tsecr) {
 783                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 784                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 785                 *topt++ = htonl(tsval);
 786                 *topt++ = htonl(tsecr);
 787         }
 788
 789 #ifdef CONFIG_TCP_MD5SIG
 790         if (key) {
 791                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 792                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 793                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 794                                     &ipv6_hdr(skb)->saddr,
 795                                     &ipv6_hdr(skb)->daddr, t1);
 796         }
 797 #endif
 798
 799         memset(&fl6, 0, sizeof(fl6));
 800         fl6.daddr = ipv6_hdr(skb)->saddr;
 801         fl6.saddr = ipv6_hdr(skb)->daddr;
 802         fl6.flowlabel = label;
 803
 804         buff->ip_summed = CHECKSUM_PARTIAL;
 805         buff->csum = 0;
 806
 807         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 808
 809         fl6.flowi6_proto = IPPROTO_TCP;
 810         if (rt6_need_strict(&fl6.daddr) && !oif)
 811                 fl6.flowi6_oif = tcp_v6_iif(skb);
 812         else
 813                 fl6.flowi6_oif = oif;
 814         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 815         fl6.fl6_dport = t1->dest;
 816         fl6.fl6_sport = t1->source;
 817         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 818
 819         /* Pass a socket to ip6_dst_lookup either it is for RST
 820          * Underlying function will use this to retrieve the network
 821          * namespace
 822          */
 823         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 824         if (!IS_ERR(dst)) {
 825                 skb_dst_set(buff, dst);
 826                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 827                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 828                 if (rst)
 829                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 830                 return;
 831         }
 832
 833         kfree_skb(buff);
 834 }
 835
 836 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 837 {
 838         const struct tcphdr *th = tcp_hdr(skb);
 839         u32 seq = 0, ack_seq = 0;
 840         struct tcp_md5sig_key *key = NULL;
 841 #ifdef CONFIG_TCP_MD5SIG
 842         const __u8 *hash_location = NULL;
 843         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 844         unsigned char newhash[16];
 845         int genhash;
 846         struct sock *sk1 = NULL;
 847 #endif
 848         int oif;
 849
 850         if (th->rst)
 851                 return;
 852
 853         /* If sk not NULL, it means we did a successful lookup and incoming
 854          * route had to be correct. prequeue might have dropped our dst.
 855          */
 856         if (!sk && !ipv6_unicast_destination(skb))
 857                 return;
 858
 859 #ifdef CONFIG_TCP_MD5SIG
 860         hash_location = tcp_parse_md5sig_option(th);
 861         if (!sk && hash_location) {
 862                 /*
 863                  * active side is lost. Try to find listening socket through
 864                  * source port, and then find md5 key through listening socket.
 865                  * we are not loose security here:
 866                  * Incoming packet is checked with md5 hash with finding key,
 867                  * no RST generated if md5 hash doesn't match.
 868                  */
 869                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 870                                            &tcp_hashinfo, &ipv6h->saddr,
 871                                            th->source, &ipv6h->daddr,
 872                                            ntohs(th->source), tcp_v6_iif(skb));
 873                 if (!sk1)
 874                         return;
 875
 876                 rcu_read_lock();
 877                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 878                 if (!key)
 879                         goto release_sk1;
 880
 881                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 882                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 883                         goto release_sk1;
 884         } else {
 885                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 886         }
 887 #endif
 888
 889         if (th->ack)
 890                 seq = ntohl(th->ack_seq);
 891         else
 892                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 893                           (th->doff << 2);
 894
 895         oif = sk ? sk->sk_bound_dev_if : 0;
 896         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 897
 898 #ifdef CONFIG_TCP_MD5SIG
 899 release_sk1:
 900         if (sk1) {
 901                 rcu_read_unlock();
 902                 sock_put(sk1);
 903         }
 904 #endif
 905 }
 906
 907 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 908                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 909                             struct tcp_md5sig_key *key, u8 tclass,
 910                             u32 label)
 911 {
 912         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 913                              tclass, label);
 914 }
 915
 916 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 917 {
 918         struct inet_timewait_sock *tw = inet_twsk(sk);
 919         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 920
 921         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 922                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 923                         tcp_time_stamp + tcptw->tw_ts_offset,
 924                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 925                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 926
 927         inet_twsk_put(tw);
 928 }
 929
 930 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 931                                   struct request_sock *req)
 932 {
 933         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 934          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 935          */
 936         /* RFC 7323 2.3
 937          * The window field (SEG.WND) of every outgoing segment, with the
 938          * exception of <SYN> segments, MUST be right-shifted by
 939          * Rcv.Wind.Shift bits:
 940          */
 941         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 942                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
 943                         tcp_rsk(req)->rcv_nxt,
 944                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
 945                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 946                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 947                         0, 0);
 948 }
 949
 950
 951 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
 952 {
 953 #ifdef CONFIG_SYN_COOKIES
 954         const struct tcphdr *th = tcp_hdr(skb);
 955
 956         if (!th->syn)
 957                 sk = cookie_v6_check(sk, skb);
 958 #endif
 959         return sk;
 960 }
 961
 962 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 963 {
 964         if (skb->protocol == htons(ETH_P_IP))
 965                 return tcp_v4_conn_request(sk, skb);
 966
 967         if (!ipv6_unicast_destination(skb))
 968                 goto drop;
 969
 970         return tcp_conn_request(&tcp6_request_sock_ops,
 971                                 &tcp_request_sock_ipv6_ops, sk, skb);
 972
 973 drop:
 974         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 975         return 0; /* don't send reset */
 976 }
 977
 978 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
 979                                          struct request_sock *req,
 980                                          struct dst_entry *dst,
 981                                          struct request_sock *req_unhash,
 982                                          bool *own_req)
 983 {
 984         struct inet_request_sock *ireq;
 985         struct ipv6_pinfo *newnp;
 986         const struct ipv6_pinfo *np = inet6_sk(sk);
 987         struct ipv6_txoptions *opt;
 988         struct tcp6_sock *newtcp6sk;
 989         struct inet_sock *newinet;
 990         struct tcp_sock *newtp;
 991         struct sock *newsk;
 992 #ifdef CONFIG_TCP_MD5SIG
 993         struct tcp_md5sig_key *key;
 994 #endif
 995         struct flowi6 fl6;
 996
 997         if (skb->protocol == htons(ETH_P_IP)) {
 998                 /*
 999                  *      v6 mapped
1000                  */
1001
1002                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1003                                              req_unhash, own_req);
1004
1005                 if (!newsk)
1006                         return NULL;
1007
1008                 newtcp6sk = (struct tcp6_sock *)newsk;
1009                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1010
1011                 newinet = inet_sk(newsk);
1012                 newnp = inet6_sk(newsk);
1013                 newtp = tcp_sk(newsk);
1014
1015                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1016
1017                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1018
1019                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1020                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1021 #ifdef CONFIG_TCP_MD5SIG
1022                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1023 #endif
1024
1025                 newnp->ipv6_ac_list = NULL;
1026                 newnp->ipv6_fl_list = NULL;
1027                 newnp->pktoptions  = NULL;
1028                 newnp->opt         = NULL;
1029                 newnp->mcast_oif   = tcp_v6_iif(skb);
1030                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1031                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1032                 if (np->repflow)
1033                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1034
1035                 /*
1036                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1037                  * here, tcp_create_openreq_child now does this for us, see the comment in
1038                  * that function for the gory details. -acme
1039                  */
1040
1041                 /* It is tricky place. Until this moment IPv4 tcp
1042                    worked with IPv6 icsk.icsk_af_ops.
1043                    Sync it now.
1044                  */
1045                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1046
1047                 return newsk;
1048         }
1049
1050         ireq = inet_rsk(req);
1051
1052         if (sk_acceptq_is_full(sk))
1053                 goto out_overflow;
1054
1055         if (!dst) {
1056                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1057                 if (!dst)
1058                         goto out;
1059         }
1060
1061         newsk = tcp_create_openreq_child(sk, req, skb);
1062         if (!newsk)
1063                 goto out_nonewsk;
1064
1065         /*
1066          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1067          * count here, tcp_create_openreq_child now does this for us, see the
1068          * comment in that function for the gory details. -acme
1069          */
1070
1071         newsk->sk_gso_type = SKB_GSO_TCPV6;
1072         ip6_dst_store(newsk, dst, NULL, NULL);
1073         inet6_sk_rx_dst_set(newsk, skb);
1074
1075         newtcp6sk = (struct tcp6_sock *)newsk;
1076         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1077
1078         newtp = tcp_sk(newsk);
1079         newinet = inet_sk(newsk);
1080         newnp = inet6_sk(newsk);
1081
1082         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1083
1084         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1085         newnp->saddr = ireq->ir_v6_loc_addr;
1086         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1087         newsk->sk_bound_dev_if = ireq->ir_iif;
1088
1089         /* Now IPv6 options...
1090
1091            First: no IPv4 options.
1092          */
1093         newinet->inet_opt = NULL;
1094         newnp->ipv6_ac_list = NULL;
1095         newnp->ipv6_fl_list = NULL;
1096
1097         /* Clone RX bits */
1098         newnp->rxopt.all = np->rxopt.all;
1099
1100         newnp->pktoptions = NULL;
1101         newnp->opt        = NULL;
1102         newnp->mcast_oif  = tcp_v6_iif(skb);
1103         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1104         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1105         if (np->repflow)
1106                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1107
1108         /* Clone native IPv6 options from listening socket (if any)
1109
1110            Yes, keeping reference count would be much more clever,
1111            but we make one more one thing there: reattach optmem
1112            to newsk.
1113          */
1114         opt = rcu_dereference(np->opt);
1115         if (opt) {
1116                 opt = ipv6_dup_options(newsk, opt);
1117                 RCU_INIT_POINTER(newnp->opt, opt);
1118         }
1119         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1120         if (opt)
1121                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1122                                                     opt->opt_flen;
1123
1124         tcp_ca_openreq_child(newsk, dst);
1125
1126         tcp_sync_mss(newsk, dst_mtu(dst));
1127         newtp->advmss = dst_metric_advmss(dst);
1128         if (tcp_sk(sk)->rx_opt.user_mss &&
1129             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1130                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1131
1132         tcp_initialize_rcv_mss(newsk);
1133
1134         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1135         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1136
1137 #ifdef CONFIG_TCP_MD5SIG
1138         /* Copy over the MD5 key from the original socket */
1139         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1140         if (key) {
1141                 /* We're using one, so create a matching key
1142                  * on the newsk structure. If we fail to get
1143                  * memory, then we end up not copying the key
1144                  * across. Shucks.
1145                  */
1146                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1147                                AF_INET6, key->key, key->keylen,
1148                                sk_gfp_atomic(sk, GFP_ATOMIC));
1149         }
1150 #endif
1151
1152         if (__inet_inherit_port(sk, newsk) < 0) {
1153                 inet_csk_prepare_forced_close(newsk);
1154                 tcp_done(newsk);
1155                 goto out;
1156         }
1157         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1158         if (*own_req) {
1159                 tcp_move_syn(newtp, req);
1160
1161                 /* Clone pktoptions received with SYN, if we own the req */
1162                 if (ireq->pktopts) {
1163                         newnp->pktoptions = skb_clone(ireq->pktopts,
1164                                                       sk_gfp_atomic(sk, GFP_ATOMIC));
1165                         consume_skb(ireq->pktopts);
1166                         ireq->pktopts = NULL;
1167                         if (newnp->pktoptions)
1168                                 skb_set_owner_r(newnp->pktoptions, newsk);
1169                 }
1170         }
1171
1172         return newsk;
1173
1174 out_overflow:
1175         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1176 out_nonewsk:
1177         dst_release(dst);
1178 out:
1179         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1180         return NULL;
1181 }
1182
1183 /* The socket must have it's spinlock held when we get
1184  * here, unless it is a TCP_LISTEN socket.
1185  *
1186  * We have a potential double-lock case here, so even when
1187  * doing backlog processing we use the BH locking scheme.
1188  * This is because we cannot sleep with the original spinlock
1189  * held.
1190  */
1191 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1192 {
1193         struct ipv6_pinfo *np = inet6_sk(sk);
1194         struct tcp_sock *tp;
1195         struct sk_buff *opt_skb = NULL;
1196
1197         /* Imagine: socket is IPv6. IPv4 packet arrives,
1198            goes to IPv4 receive handler and backlogged.
1199            From backlog it always goes here. Kerboom...
1200            Fortunately, tcp_rcv_established and rcv_established
1201            handle them correctly, but it is not case with
1202            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1203          */
1204
1205         if (skb->protocol == htons(ETH_P_IP))
1206                 return tcp_v4_do_rcv(sk, skb);
1207
1208         if (sk_filter(sk, skb))
1209                 goto discard;
1210
1211         /*
1212          *      socket locking is here for SMP purposes as backlog rcv
1213          *      is currently called with bh processing disabled.
1214          */
1215
1216         /* Do Stevens' IPV6_PKTOPTIONS.
1217
1218            Yes, guys, it is the only place in our code, where we
1219            may make it not affecting IPv4.
1220            The rest of code is protocol independent,
1221            and I do not like idea to uglify IPv4.
1222
1223            Actually, all the idea behind IPV6_PKTOPTIONS
1224            looks not very well thought. For now we latch
1225            options, received in the last packet, enqueued
1226            by tcp. Feel free to propose better solution.
1227                                                --ANK (980728)
1228          */
1229         if (np->rxopt.all)
1230                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1231
1232         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1233                 struct dst_entry *dst = sk->sk_rx_dst;
1234
1235                 sock_rps_save_rxhash(sk, skb);
1236                 sk_mark_napi_id(sk, skb);
1237                 if (dst) {
1238                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1239                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1240                                 dst_release(dst);
1241                                 sk->sk_rx_dst = NULL;
1242                         }
1243                 }
1244
1245                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1246                 if (opt_skb)
1247                         goto ipv6_pktoptions;
1248                 return 0;
1249         }
1250
1251         if (tcp_checksum_complete(skb))
1252                 goto csum_err;
1253
1254         if (sk->sk_state == TCP_LISTEN) {
1255                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1256
1257                 if (!nsk)
1258                         goto discard;
1259
1260                 if (nsk != sk) {
1261                         sock_rps_save_rxhash(nsk, skb);
1262                         sk_mark_napi_id(nsk, skb);
1263                         if (tcp_child_process(sk, nsk, skb))
1264                                 goto reset;
1265                         if (opt_skb)
1266                                 __kfree_skb(opt_skb);
1267                         return 0;
1268                 }
1269         } else
1270                 sock_rps_save_rxhash(sk, skb);
1271
1272         if (tcp_rcv_state_process(sk, skb))
1273                 goto reset;
1274         if (opt_skb)
1275                 goto ipv6_pktoptions;
1276         return 0;
1277
1278 reset:
1279         tcp_v6_send_reset(sk, skb);
1280 discard:
1281         if (opt_skb)
1282                 __kfree_skb(opt_skb);
1283         kfree_skb(skb);
1284         return 0;
1285 csum_err:
1286         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1287         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1288         goto discard;
1289
1290
1291 ipv6_pktoptions:
1292         /* Do you ask, what is it?
1293
1294            1. skb was enqueued by tcp.
1295            2. skb is added to tail of read queue, rather than out of order.
1296            3. socket is not in passive state.
1297            4. Finally, it really contains options, which user wants to receive.
1298          */
1299         tp = tcp_sk(sk);
1300         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1301             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1302                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1303                         np->mcast_oif = tcp_v6_iif(opt_skb);
1304                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1305                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1306                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1307                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1308                 if (np->repflow)
1309                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1310                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1311                         skb_set_owner_r(opt_skb, sk);
1312                         opt_skb = xchg(&np->pktoptions, opt_skb);
1313                 } else {
1314                         __kfree_skb(opt_skb);
1315                         opt_skb = xchg(&np->pktoptions, NULL);
1316                 }
1317         }
1318
1319         kfree_skb(opt_skb);
1320         return 0;
1321 }
1322
1323 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1324                            const struct tcphdr *th)
1325 {
1326         /* This is tricky: we move IP6CB at its correct location into
1327          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1328          * _decode_session6() uses IP6CB().
1329          * barrier() makes sure compiler won't play aliasing games.
1330          */
1331         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1332                 sizeof(struct inet6_skb_parm));
1333         barrier();
1334
1335         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1336         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1337                                     skb->len - th->doff*4);
1338         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1339         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1340         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1341         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1342         TCP_SKB_CB(skb)->sacked = 0;
1343 }
1344
1345 static void tcp_v6_restore_cb(struct sk_buff *skb)
1346 {
1347         /* We need to move header back to the beginning if xfrm6_policy_check()
1348          * and tcp_v6_fill_cb() are going to be called again.
1349          */
1350         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1351                 sizeof(struct inet6_skb_parm));
1352 }
1353
1354 static int tcp_v6_rcv(struct sk_buff *skb)
1355 {
1356         const struct tcphdr *th;
1357         const struct ipv6hdr *hdr;
1358         struct sock *sk;
1359         int ret;
1360         struct net *net = dev_net(skb->dev);
1361
1362         if (skb->pkt_type != PACKET_HOST)
1363                 goto discard_it;
1364
1365         /*
1366          *      Count it even if it's bad.
1367          */
1368         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1369
1370         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1371                 goto discard_it;
1372
1373         th = tcp_hdr(skb);
1374
1375         if (th->doff < sizeof(struct tcphdr)/4)
1376                 goto bad_packet;
1377         if (!pskb_may_pull(skb, th->doff*4))
1378                 goto discard_it;
1379
1380         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1381                 goto csum_error;
1382
1383         th = tcp_hdr(skb);
1384         hdr = ipv6_hdr(skb);
1385
1386 lookup:
1387         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1388                                 inet6_iif(skb));
1389         if (!sk)
1390                 goto no_tcp_socket;
1391
1392 process:
1393         if (sk->sk_state == TCP_TIME_WAIT)
1394                 goto do_time_wait;
1395
1396         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1397                 struct request_sock *req = inet_reqsk(sk);
1398                 struct sock *nsk;
1399
1400                 sk = req->rsk_listener;
1401                 tcp_v6_fill_cb(skb, hdr, th);
1402                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1403                         reqsk_put(req);
1404                         goto discard_it;
1405                 }
1406                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1407                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1408                         goto lookup;
1409                 }
1410                 sock_hold(sk);
1411                 nsk = tcp_check_req(sk, skb, req, false);
1412                 if (!nsk) {
1413                         reqsk_put(req);
1414                         goto discard_and_relse;
1415                 }
1416                 if (nsk == sk) {
1417                         reqsk_put(req);
1418                         tcp_v6_restore_cb(skb);
1419                 } else if (tcp_child_process(sk, nsk, skb)) {
1420                         tcp_v6_send_reset(nsk, skb);
1421                         goto discard_and_relse;
1422                 } else {
1423                         sock_put(sk);
1424                         return 0;
1425                 }
1426         }
1427         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1428                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1429                 goto discard_and_relse;
1430         }
1431
1432         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1433                 goto discard_and_relse;
1434
1435         tcp_v6_fill_cb(skb, hdr, th);
1436
1437         if (tcp_v6_inbound_md5_hash(sk, skb))
1438                 goto discard_and_relse;
1439
1440         if (sk_filter(sk, skb))
1441                 goto discard_and_relse;
1442
1443         skb->dev = NULL;
1444
1445         if (sk->sk_state == TCP_LISTEN) {
1446                 ret = tcp_v6_do_rcv(sk, skb);
1447                 goto put_and_return;
1448         }
1449
1450         sk_incoming_cpu_update(sk);
1451
1452         bh_lock_sock_nested(sk);
1453         tcp_sk(sk)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
1454         ret = 0;
1455         if (!sock_owned_by_user(sk)) {
1456                 if (!tcp_prequeue(sk, skb))
1457                         ret = tcp_v6_do_rcv(sk, skb);
1458         } else if (unlikely(sk_add_backlog(sk, skb,
1459                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1460                 bh_unlock_sock(sk);
1461                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1462                 goto discard_and_relse;
1463         }
1464         bh_unlock_sock(sk);
1465
1466 put_and_return:
1467         sock_put(sk);
1468         return ret ? -1 : 0;
1469
1470 no_tcp_socket:
1471         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1472                 goto discard_it;
1473
1474         tcp_v6_fill_cb(skb, hdr, th);
1475
1476         if (tcp_checksum_complete(skb)) {
1477 csum_error:
1478                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1479 bad_packet:
1480                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1481         } else {
1482                 tcp_v6_send_reset(NULL, skb);
1483         }
1484
1485 discard_it:
1486         kfree_skb(skb);
1487         return 0;
1488
1489 discard_and_relse:
1490         sock_put(sk);
1491         goto discard_it;
1492
1493 do_time_wait:
1494         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1495                 inet_twsk_put(inet_twsk(sk));
1496                 goto discard_it;
1497         }
1498
1499         tcp_v6_fill_cb(skb, hdr, th);
1500
1501         if (tcp_checksum_complete(skb)) {
1502                 inet_twsk_put(inet_twsk(sk));
1503                 goto csum_error;
1504         }
1505
1506         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1507         case TCP_TW_SYN:
1508         {
1509                 struct sock *sk2;
1510
1511                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1512                                             &ipv6_hdr(skb)->saddr, th->source,
1513                                             &ipv6_hdr(skb)->daddr,
1514                                             ntohs(th->dest), tcp_v6_iif(skb));
1515                 if (sk2) {
1516                         struct inet_timewait_sock *tw = inet_twsk(sk);
1517                         inet_twsk_deschedule_put(tw);
1518                         sk = sk2;
1519                         tcp_v6_restore_cb(skb);
1520                         goto process;
1521                 }
1522                 /* Fall through to ACK */
1523         }
1524         case TCP_TW_ACK:
1525                 tcp_v6_timewait_ack(sk, skb);
1526                 break;
1527         case TCP_TW_RST:
1528                 tcp_v6_restore_cb(skb);
1529                 goto no_tcp_socket;
1530         case TCP_TW_SUCCESS:
1531                 ;
1532         }
1533         goto discard_it;
1534 }
1535
1536 static void tcp_v6_early_demux(struct sk_buff *skb)
1537 {
1538         const struct ipv6hdr *hdr;
1539         const struct tcphdr *th;
1540         struct sock *sk;
1541
1542         if (skb->pkt_type != PACKET_HOST)
1543                 return;
1544
1545         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1546                 return;
1547
1548         hdr = ipv6_hdr(skb);
1549         th = tcp_hdr(skb);
1550
1551         if (th->doff < sizeof(struct tcphdr) / 4)
1552                 return;
1553
1554         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1555         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1556                                         &hdr->saddr, th->source,
1557                                         &hdr->daddr, ntohs(th->dest),
1558                                         inet6_iif(skb));
1559         if (sk) {
1560                 skb->sk = sk;
1561                 skb->destructor = sock_edemux;
1562                 if (sk_fullsock(sk)) {
1563                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1564
1565                         if (dst)
1566                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1567                         if (dst &&
1568                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1569                                 skb_dst_set_noref(skb, dst);
1570                 }
1571         }
1572 }
1573
1574 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1575         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1576         .twsk_unique    = tcp_twsk_unique,
1577         .twsk_destructor = tcp_twsk_destructor,
1578 };
1579
1580 static const struct inet_connection_sock_af_ops ipv6_specific = {
1581         .queue_xmit        = inet6_csk_xmit,
1582         .send_check        = tcp_v6_send_check,
1583         .rebuild_header    = inet6_sk_rebuild_header,
1584         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1585         .conn_request      = tcp_v6_conn_request,
1586         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1587         .net_header_len    = sizeof(struct ipv6hdr),
1588         .net_frag_header_len = sizeof(struct frag_hdr),
1589         .setsockopt        = ipv6_setsockopt,
1590         .getsockopt        = ipv6_getsockopt,
1591         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1592         .sockaddr_len      = sizeof(struct sockaddr_in6),
1593         .bind_conflict     = inet6_csk_bind_conflict,
1594 #ifdef CONFIG_COMPAT
1595         .compat_setsockopt = compat_ipv6_setsockopt,
1596         .compat_getsockopt = compat_ipv6_getsockopt,
1597 #endif
1598         .mtu_reduced       = tcp_v6_mtu_reduced,
1599 };
1600
1601 #ifdef CONFIG_TCP_MD5SIG
1602 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1603         .md5_lookup     =       tcp_v6_md5_lookup,
1604         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1605         .md5_parse      =       tcp_v6_parse_md5_keys,
1606 };
1607 #endif
1608
1609 /*
1610  *      TCP over IPv4 via INET6 API
1611  */
1612 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1613         .queue_xmit        = ip_queue_xmit,
1614         .send_check        = tcp_v4_send_check,
1615         .rebuild_header    = inet_sk_rebuild_header,
1616         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1617         .conn_request      = tcp_v6_conn_request,
1618         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1619         .net_header_len    = sizeof(struct iphdr),
1620         .setsockopt        = ipv6_setsockopt,
1621         .getsockopt        = ipv6_getsockopt,
1622         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1623         .sockaddr_len      = sizeof(struct sockaddr_in6),
1624         .bind_conflict     = inet6_csk_bind_conflict,
1625 #ifdef CONFIG_COMPAT
1626         .compat_setsockopt = compat_ipv6_setsockopt,
1627         .compat_getsockopt = compat_ipv6_getsockopt,
1628 #endif
1629         .mtu_reduced       = tcp_v4_mtu_reduced,
1630 };
1631
1632 #ifdef CONFIG_TCP_MD5SIG
1633 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1634         .md5_lookup     =       tcp_v4_md5_lookup,
1635         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1636         .md5_parse      =       tcp_v6_parse_md5_keys,
1637 };
1638 #endif
1639
1640 /* NOTE: A lot of things set to zero explicitly by call to
1641  *       sk_alloc() so need not be done here.
1642  */
1643 static int tcp_v6_init_sock(struct sock *sk)
1644 {
1645         struct inet_connection_sock *icsk = inet_csk(sk);
1646
1647         tcp_init_sock(sk);
1648
1649         icsk->icsk_af_ops = &ipv6_specific;
1650
1651 #ifdef CONFIG_TCP_MD5SIG
1652         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1653 #endif
1654
1655         return 0;
1656 }
1657
1658 static void tcp_v6_destroy_sock(struct sock *sk)
1659 {
1660         tcp_v4_destroy_sock(sk);
1661         inet6_destroy_sock(sk);
1662 }
1663
1664 #ifdef CONFIG_PROC_FS
1665 /* Proc filesystem TCPv6 sock list dumping. */
1666 static void get_openreq6(struct seq_file *seq,
1667                          const struct request_sock *req, int i)
1668 {
1669         long ttd = req->rsk_timer.expires - jiffies;
1670         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1671         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1672
1673         if (ttd < 0)
1674                 ttd = 0;
1675
1676         seq_printf(seq,
1677                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1678                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1679                    i,
1680                    src->s6_addr32[0], src->s6_addr32[1],
1681                    src->s6_addr32[2], src->s6_addr32[3],
1682                    inet_rsk(req)->ir_num,
1683                    dest->s6_addr32[0], dest->s6_addr32[1],
1684                    dest->s6_addr32[2], dest->s6_addr32[3],
1685                    ntohs(inet_rsk(req)->ir_rmt_port),
1686                    TCP_SYN_RECV,
1687                    0, 0, /* could print option size, but that is af dependent. */
1688                    1,   /* timers active (only the expire timer) */
1689                    jiffies_to_clock_t(ttd),
1690                    req->num_timeout,
1691                    from_kuid_munged(seq_user_ns(seq),
1692                                     sock_i_uid(req->rsk_listener)),
1693                    0,  /* non standard timer */
1694                    0, /* open_requests have no inode */
1695                    0, req);
1696 }
1697
1698 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1699 {
1700         const struct in6_addr *dest, *src;
1701         __u16 destp, srcp;
1702         int timer_active;
1703         unsigned long timer_expires;
1704         const struct inet_sock *inet = inet_sk(sp);
1705         const struct tcp_sock *tp = tcp_sk(sp);
1706         const struct inet_connection_sock *icsk = inet_csk(sp);
1707         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1708         int rx_queue;
1709         int state;
1710
1711         dest  = &sp->sk_v6_daddr;
1712         src   = &sp->sk_v6_rcv_saddr;
1713         destp = ntohs(inet->inet_dport);
1714         srcp  = ntohs(inet->inet_sport);
1715
1716         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1717             icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
1718             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1719                 timer_active    = 1;
1720                 timer_expires   = icsk->icsk_timeout;
1721         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1722                 timer_active    = 4;
1723                 timer_expires   = icsk->icsk_timeout;
1724         } else if (timer_pending(&sp->sk_timer)) {
1725                 timer_active    = 2;
1726                 timer_expires   = sp->sk_timer.expires;
1727         } else {
1728                 timer_active    = 0;
1729                 timer_expires = jiffies;
1730         }
1731
1732         state = sk_state_load(sp);
1733         if (state == TCP_LISTEN)
1734                 rx_queue = sp->sk_ack_backlog;
1735         else
1736                 /* Because we don't lock the socket,
1737                  * we might find a transient negative value.
1738                  */
1739                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1740
1741         seq_printf(seq,
1742                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1743                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1744                    i,
1745                    src->s6_addr32[0], src->s6_addr32[1],
1746                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1747                    dest->s6_addr32[0], dest->s6_addr32[1],
1748                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1749                    state,
1750                    tp->write_seq - tp->snd_una,
1751                    rx_queue,
1752                    timer_active,
1753                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1754                    icsk->icsk_retransmits,
1755                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1756                    icsk->icsk_probes_out,
1757                    sock_i_ino(sp),
1758                    atomic_read(&sp->sk_refcnt), sp,
1759                    jiffies_to_clock_t(icsk->icsk_rto),
1760                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1761                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1762                    tp->snd_cwnd,
1763                    state == TCP_LISTEN ?
1764                         fastopenq->max_qlen :
1765                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1766                    );
1767 }
1768
1769 static void get_timewait6_sock(struct seq_file *seq,
1770                                struct inet_timewait_sock *tw, int i)
1771 {
1772         long delta = tw->tw_timer.expires - jiffies;
1773         const struct in6_addr *dest, *src;
1774         __u16 destp, srcp;
1775
1776         dest = &tw->tw_v6_daddr;
1777         src  = &tw->tw_v6_rcv_saddr;
1778         destp = ntohs(tw->tw_dport);
1779         srcp  = ntohs(tw->tw_sport);
1780
1781         seq_printf(seq,
1782                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1783                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1784                    i,
1785                    src->s6_addr32[0], src->s6_addr32[1],
1786                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1787                    dest->s6_addr32[0], dest->s6_addr32[1],
1788                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1789                    tw->tw_substate, 0, 0,
1790                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1791                    atomic_read(&tw->tw_refcnt), tw);
1792 }
1793
1794 static int tcp6_seq_show(struct seq_file *seq, void *v)
1795 {
1796         struct tcp_iter_state *st;
1797         struct sock *sk = v;
1798
1799         if (v == SEQ_START_TOKEN) {
1800                 seq_puts(seq,
1801                          "  sl  "
1802                          "local_address                         "
1803                          "remote_address                        "
1804                          "st tx_queue rx_queue tr tm->when retrnsmt"
1805                          "   uid  timeout inode\n");
1806                 goto out;
1807         }
1808         st = seq->private;
1809
1810         if (sk->sk_state == TCP_TIME_WAIT)
1811                 get_timewait6_sock(seq, v, st->num);
1812         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1813                 get_openreq6(seq, v, st->num);
1814         else
1815                 get_tcp6_sock(seq, v, st->num);
1816 out:
1817         return 0;
1818 }
1819
1820 static const struct file_operations tcp6_afinfo_seq_fops = {
1821         .owner   = THIS_MODULE,
1822         .open    = tcp_seq_open,
1823         .read    = seq_read,
1824         .llseek  = seq_lseek,
1825         .release = seq_release_net
1826 };
1827
1828 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1829         .name           = "tcp6",
1830         .family         = AF_INET6,
1831         .seq_fops       = &tcp6_afinfo_seq_fops,
1832         .seq_ops        = {
1833                 .show           = tcp6_seq_show,
1834         },
1835 };
1836
1837 int __net_init tcp6_proc_init(struct net *net)
1838 {
1839         return tcp_proc_register(net, &tcp6_seq_afinfo);
1840 }
1841
1842 void tcp6_proc_exit(struct net *net)
1843 {
1844         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1845 }
1846 #endif
1847
1848 static void tcp_v6_clear_sk(struct sock *sk, int size)
1849 {
1850         struct inet_sock *inet = inet_sk(sk);
1851
1852         /* we do not want to clear pinet6 field, because of RCU lookups */
1853         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1854
1855         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1856         memset(&inet->pinet6 + 1, 0, size);
1857 }
1858
1859 struct proto tcpv6_prot = {
1860         .name                   = "TCPv6",
1861         .owner                  = THIS_MODULE,
1862         .close                  = tcp_close,
1863         .connect                = tcp_v6_connect,
1864         .disconnect             = tcp_disconnect,
1865         .accept                 = inet_csk_accept,
1866         .ioctl                  = tcp_ioctl,
1867         .init                   = tcp_v6_init_sock,
1868         .destroy                = tcp_v6_destroy_sock,
1869         .shutdown               = tcp_shutdown,
1870         .setsockopt             = tcp_setsockopt,
1871         .getsockopt             = tcp_getsockopt,
1872         .recvmsg                = tcp_recvmsg,
1873         .sendmsg                = tcp_sendmsg,
1874         .sendpage               = tcp_sendpage,
1875         .backlog_rcv            = tcp_v6_do_rcv,
1876         .release_cb             = tcp_release_cb,
1877         .hash                   = inet_hash,
1878         .unhash                 = inet_unhash,
1879         .get_port               = inet_csk_get_port,
1880         .enter_memory_pressure  = tcp_enter_memory_pressure,
1881         .stream_memory_free     = tcp_stream_memory_free,
1882         .sockets_allocated      = &tcp_sockets_allocated,
1883         .memory_allocated       = &tcp_memory_allocated,
1884         .memory_pressure        = &tcp_memory_pressure,
1885         .orphan_count           = &tcp_orphan_count,
1886         .sysctl_mem             = sysctl_tcp_mem,
1887         .sysctl_wmem            = sysctl_tcp_wmem,
1888         .sysctl_rmem            = sysctl_tcp_rmem,
1889         .max_header             = MAX_TCP_HEADER,
1890         .obj_size               = sizeof(struct tcp6_sock),
1891         .slab_flags             = SLAB_DESTROY_BY_RCU,
1892         .twsk_prot              = &tcp6_timewait_sock_ops,
1893         .rsk_prot               = &tcp6_request_sock_ops,
1894         .h.hashinfo             = &tcp_hashinfo,
1895         .no_autobind            = true,
1896 #ifdef CONFIG_COMPAT
1897         .compat_setsockopt      = compat_tcp_setsockopt,
1898         .compat_getsockopt      = compat_tcp_getsockopt,
1899 #endif
1900 #ifdef CONFIG_MEMCG_KMEM
1901         .proto_cgroup           = tcp_proto_cgroup,
1902 #endif
1903         .clear_sk               = tcp_v6_clear_sk,
1904         .diag_destroy           = tcp_abort,
1905 };
1906
1907 static const struct inet6_protocol tcpv6_protocol = {
1908         .early_demux    =       tcp_v6_early_demux,
1909         .handler        =       tcp_v6_rcv,
1910         .err_handler    =       tcp_v6_err,
1911         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1912 };
1913
1914 static struct inet_protosw tcpv6_protosw = {
1915         .type           =       SOCK_STREAM,
1916         .protocol       =       IPPROTO_TCP,
1917         .prot           =       &tcpv6_prot,
1918         .ops            =       &inet6_stream_ops,
1919         .flags          =       INET_PROTOSW_PERMANENT |
1920                                 INET_PROTOSW_ICSK,
1921 };
1922
1923 static int __net_init tcpv6_net_init(struct net *net)
1924 {
1925         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1926                                     SOCK_RAW, IPPROTO_TCP, net);
1927 }
1928
1929 static void __net_exit tcpv6_net_exit(struct net *net)
1930 {
1931         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1932 }
1933
1934 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1935 {
1936         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1937 }
1938
1939 static struct pernet_operations tcpv6_net_ops = {
1940         .init       = tcpv6_net_init,
1941         .exit       = tcpv6_net_exit,
1942         .exit_batch = tcpv6_net_exit_batch,
1943 };
1944
1945 int __init tcpv6_init(void)
1946 {
1947         int ret;
1948
1949         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1950         if (ret)
1951                 goto out;
1952
1953         /* register inet6 protocol */
1954         ret = inet6_register_protosw(&tcpv6_protosw);
1955         if (ret)
1956                 goto out_tcpv6_protocol;
1957
1958         ret = register_pernet_subsys(&tcpv6_net_ops);
1959         if (ret)
1960                 goto out_tcpv6_protosw;
1961 out:
1962         return ret;
1963
1964 out_tcpv6_protosw:
1965         inet6_unregister_protosw(&tcpv6_protosw);
1966 out_tcpv6_protocol:
1967         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1968         goto out;
1969 }
1970
1971 void tcpv6_exit(void)
1972 {
1973         unregister_pernet_subsys(&tcpv6_net_ops);
1974         inet6_unregister_protosw(&tcpv6_protosw);
1975         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1976 }