3 * Linux INET6 implementation
6 * Pedro Roque <roque@di.fc.ul.pt>
10 * linux/net/ipv4/tcp_input.c
11 * linux/net/ipv4/tcp_output.c
14 * Hideaki YOSHIFUJI : sin6_scope_id support
15 * YOSHIFUJI Hideaki @USAGI and: Support IPV6_V6ONLY socket option, which
16 * Alexey Kuznetsov allow both IPv4 and IPv6 sockets to bind
17 * a single port at the same time.
18 * YOSHIFUJI Hideaki @USAGI: convert /proc/net/tcp6 to seq_file.
20 * This program is free software; you can redistribute it and/or
21 * modify it under the terms of the GNU General Public License
22 * as published by the Free Software Foundation; either version
23 * 2 of the License, or (at your option) any later version.
26 #include <linux/bottom_half.h>
27 #include <linux/module.h>
28 #include <linux/errno.h>
29 #include <linux/types.h>
30 #include <linux/socket.h>
31 #include <linux/sockios.h>
32 #include <linux/net.h>
33 #include <linux/jiffies.h>
35 #include <linux/in6.h>
36 #include <linux/netdevice.h>
37 #include <linux/init.h>
38 #include <linux/jhash.h>
39 #include <linux/ipsec.h>
40 #include <linux/times.h>
41 #include <linux/slab.h>
43 #include <linux/ipv6.h>
44 #include <linux/icmpv6.h>
45 #include <linux/random.h>
48 #include <net/ndisc.h>
49 #include <net/inet6_hashtables.h>
50 #include <net/inet6_connection_sock.h>
52 #include <net/transp_v6.h>
53 #include <net/addrconf.h>
54 #include <net/ip6_route.h>
55 #include <net/ip6_checksum.h>
56 #include <net/inet_ecn.h>
57 #include <net/protocol.h>
60 #include <net/dsfield.h>
61 #include <net/timewait_sock.h>
62 #include <net/netdma.h>
63 #include <net/inet_common.h>
64 #include <net/secure_seq.h>
65 #include <net/tcp_memcontrol.h>
67 #include <asm/uaccess.h>
69 #include <linux/proc_fs.h>
70 #include <linux/seq_file.h>
72 #include <linux/crypto.h>
73 #include <linux/scatterlist.h>
75 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
76 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
77 struct request_sock *req);
79 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
81 static const struct inet_connection_sock_af_ops ipv6_mapped;
82 static const struct inet_connection_sock_af_ops ipv6_specific;
83 #ifdef CONFIG_TCP_MD5SIG
84 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
85 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
87 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
88 const struct in6_addr *addr)
94 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
96 struct dst_entry *dst = skb_dst(skb);
97 const struct rt6_info *rt = (const struct rt6_info *)dst;
101 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
103 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
106 static void tcp_v6_hash(struct sock *sk)
108 if (sk->sk_state != TCP_CLOSE) {
109 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
114 __inet6_hash(sk, NULL);
119 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
121 return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
122 ipv6_hdr(skb)->saddr.s6_addr32,
124 tcp_hdr(skb)->source);
127 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
130 struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
131 struct inet_sock *inet = inet_sk(sk);
132 struct inet_connection_sock *icsk = inet_csk(sk);
133 struct ipv6_pinfo *np = inet6_sk(sk);
134 struct tcp_sock *tp = tcp_sk(sk);
135 struct in6_addr *saddr = NULL, *final_p, final;
138 struct dst_entry *dst;
142 if (addr_len < SIN6_LEN_RFC2133)
145 if (usin->sin6_family != AF_INET6)
146 return -EAFNOSUPPORT;
148 memset(&fl6, 0, sizeof(fl6));
151 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
152 IP6_ECN_flow_init(fl6.flowlabel);
153 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
154 struct ip6_flowlabel *flowlabel;
155 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
156 if (flowlabel == NULL)
158 usin->sin6_addr = flowlabel->dst;
159 fl6_sock_release(flowlabel);
164 * connect() to INADDR_ANY means loopback (BSD'ism).
167 if(ipv6_addr_any(&usin->sin6_addr))
168 usin->sin6_addr.s6_addr[15] = 0x1;
170 addr_type = ipv6_addr_type(&usin->sin6_addr);
172 if(addr_type & IPV6_ADDR_MULTICAST)
175 if (addr_type&IPV6_ADDR_LINKLOCAL) {
176 if (addr_len >= sizeof(struct sockaddr_in6) &&
177 usin->sin6_scope_id) {
178 /* If interface is set while binding, indices
181 if (sk->sk_bound_dev_if &&
182 sk->sk_bound_dev_if != usin->sin6_scope_id)
185 sk->sk_bound_dev_if = usin->sin6_scope_id;
188 /* Connect to link-local address requires an interface */
189 if (!sk->sk_bound_dev_if)
193 if (tp->rx_opt.ts_recent_stamp &&
194 !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
195 tp->rx_opt.ts_recent = 0;
196 tp->rx_opt.ts_recent_stamp = 0;
200 np->daddr = usin->sin6_addr;
201 np->flow_label = fl6.flowlabel;
207 if (addr_type == IPV6_ADDR_MAPPED) {
208 u32 exthdrlen = icsk->icsk_ext_hdr_len;
209 struct sockaddr_in sin;
211 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
213 if (__ipv6_only_sock(sk))
216 sin.sin_family = AF_INET;
217 sin.sin_port = usin->sin6_port;
218 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
220 icsk->icsk_af_ops = &ipv6_mapped;
221 sk->sk_backlog_rcv = tcp_v4_do_rcv;
222 #ifdef CONFIG_TCP_MD5SIG
223 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
226 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
229 icsk->icsk_ext_hdr_len = exthdrlen;
230 icsk->icsk_af_ops = &ipv6_specific;
231 sk->sk_backlog_rcv = tcp_v6_do_rcv;
232 #ifdef CONFIG_TCP_MD5SIG
233 tp->af_specific = &tcp_sock_ipv6_specific;
237 ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
238 ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
245 if (!ipv6_addr_any(&np->rcv_saddr))
246 saddr = &np->rcv_saddr;
248 fl6.flowi6_proto = IPPROTO_TCP;
249 fl6.daddr = np->daddr;
250 fl6.saddr = saddr ? *saddr : np->saddr;
251 fl6.flowi6_oif = sk->sk_bound_dev_if;
252 fl6.flowi6_mark = sk->sk_mark;
253 fl6.fl6_dport = usin->sin6_port;
254 fl6.fl6_sport = inet->inet_sport;
256 final_p = fl6_update_dst(&fl6, np->opt, &final);
258 security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
260 dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
268 np->rcv_saddr = *saddr;
271 /* set the source address */
273 inet->inet_rcv_saddr = LOOPBACK4_IPV6;
275 sk->sk_gso_type = SKB_GSO_TCPV6;
276 __ip6_dst_store(sk, dst, NULL, NULL);
278 rt = (struct rt6_info *) dst;
279 if (tcp_death_row.sysctl_tw_recycle &&
280 !tp->rx_opt.ts_recent_stamp &&
281 ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr))
282 tcp_fetch_timewait_stamp(sk, dst);
284 icsk->icsk_ext_hdr_len = 0;
286 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
289 tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
291 inet->inet_dport = usin->sin6_port;
293 tcp_set_state(sk, TCP_SYN_SENT);
294 err = inet6_hash_connect(&tcp_death_row, sk);
298 if (!tp->write_seq && likely(!tp->repair))
299 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
304 err = tcp_connect(sk);
311 tcp_set_state(sk, TCP_CLOSE);
314 inet->inet_dport = 0;
315 sk->sk_route_caps = 0;
319 static void tcp_v6_mtu_reduced(struct sock *sk)
321 struct dst_entry *dst;
323 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
326 dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
330 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
331 tcp_sync_mss(sk, dst_mtu(dst));
332 tcp_simple_retransmit(sk);
336 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
337 u8 type, u8 code, int offset, __be32 info)
339 const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
340 const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
341 struct ipv6_pinfo *np;
346 struct net *net = dev_net(skb->dev);
348 sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
349 th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
352 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
357 if (sk->sk_state == TCP_TIME_WAIT) {
358 inet_twsk_put(inet_twsk(sk));
363 if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
364 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
366 if (sk->sk_state == TCP_CLOSE)
369 if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
370 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
375 seq = ntohl(th->seq);
376 if (sk->sk_state != TCP_LISTEN &&
377 !between(seq, tp->snd_una, tp->snd_nxt)) {
378 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
384 if (type == NDISC_REDIRECT) {
385 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
388 dst->ops->redirect(dst, sk, skb);
391 if (type == ICMPV6_PKT_TOOBIG) {
392 /* We are not interested in TCP_LISTEN and open_requests
393 * (SYN-ACKs send out by Linux are always <576bytes so
394 * they should go through unfragmented).
396 if (sk->sk_state == TCP_LISTEN)
399 tp->mtu_info = ntohl(info);
400 if (!sock_owned_by_user(sk))
401 tcp_v6_mtu_reduced(sk);
402 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
408 icmpv6_err_convert(type, code, &err);
410 /* Might be for an request_sock */
411 switch (sk->sk_state) {
412 struct request_sock *req, **prev;
414 if (sock_owned_by_user(sk))
417 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
418 &hdr->saddr, inet6_iif(skb));
422 /* ICMPs are not backlogged, hence we cannot get
423 * an established socket here.
425 WARN_ON(req->sk != NULL);
427 if (seq != tcp_rsk(req)->snt_isn) {
428 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
432 inet_csk_reqsk_queue_drop(sk, req, prev);
433 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
437 case TCP_SYN_RECV: /* Cannot happen.
438 It can, it SYNs are crossed. --ANK */
439 if (!sock_owned_by_user(sk)) {
441 sk->sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */
445 sk->sk_err_soft = err;
449 if (!sock_owned_by_user(sk) && np->recverr) {
451 sk->sk_error_report(sk);
453 sk->sk_err_soft = err;
461 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
463 struct request_sock *req,
464 struct request_values *rvp,
467 struct inet6_request_sock *treq = inet6_rsk(req);
468 struct ipv6_pinfo *np = inet6_sk(sk);
469 struct sk_buff * skb;
472 /* First, grab a route. */
473 if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
476 skb = tcp_make_synack(sk, dst, req, rvp, NULL);
479 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
481 fl6->daddr = treq->rmt_addr;
482 skb_set_queue_mapping(skb, queue_mapping);
483 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
484 err = net_xmit_eval(err);
491 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
492 struct request_values *rvp)
497 res = tcp_v6_send_synack(sk, NULL, &fl6, req, rvp, 0);
499 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
503 static void tcp_v6_reqsk_destructor(struct request_sock *req)
505 kfree_skb(inet6_rsk(req)->pktopts);
508 #ifdef CONFIG_TCP_MD5SIG
509 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
510 const struct in6_addr *addr)
512 return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
515 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
516 struct sock *addr_sk)
518 return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
521 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
522 struct request_sock *req)
524 return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
527 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
530 struct tcp_md5sig cmd;
531 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
533 if (optlen < sizeof(cmd))
536 if (copy_from_user(&cmd, optval, sizeof(cmd)))
539 if (sin6->sin6_family != AF_INET6)
542 if (!cmd.tcpm_keylen) {
543 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
544 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
546 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
550 if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
553 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
554 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
555 AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
557 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
558 AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
561 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
562 const struct in6_addr *daddr,
563 const struct in6_addr *saddr, int nbytes)
565 struct tcp6_pseudohdr *bp;
566 struct scatterlist sg;
568 bp = &hp->md5_blk.ip6;
569 /* 1. TCP pseudo-header (RFC2460) */
572 bp->protocol = cpu_to_be32(IPPROTO_TCP);
573 bp->len = cpu_to_be32(nbytes);
575 sg_init_one(&sg, bp, sizeof(*bp));
576 return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
579 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
580 const struct in6_addr *daddr, struct in6_addr *saddr,
581 const struct tcphdr *th)
583 struct tcp_md5sig_pool *hp;
584 struct hash_desc *desc;
586 hp = tcp_get_md5sig_pool();
588 goto clear_hash_noput;
589 desc = &hp->md5_desc;
591 if (crypto_hash_init(desc))
593 if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
595 if (tcp_md5_hash_header(hp, th))
597 if (tcp_md5_hash_key(hp, key))
599 if (crypto_hash_final(desc, md5_hash))
602 tcp_put_md5sig_pool();
606 tcp_put_md5sig_pool();
608 memset(md5_hash, 0, 16);
612 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
613 const struct sock *sk,
614 const struct request_sock *req,
615 const struct sk_buff *skb)
617 const struct in6_addr *saddr, *daddr;
618 struct tcp_md5sig_pool *hp;
619 struct hash_desc *desc;
620 const struct tcphdr *th = tcp_hdr(skb);
623 saddr = &inet6_sk(sk)->saddr;
624 daddr = &inet6_sk(sk)->daddr;
626 saddr = &inet6_rsk(req)->loc_addr;
627 daddr = &inet6_rsk(req)->rmt_addr;
629 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
630 saddr = &ip6h->saddr;
631 daddr = &ip6h->daddr;
634 hp = tcp_get_md5sig_pool();
636 goto clear_hash_noput;
637 desc = &hp->md5_desc;
639 if (crypto_hash_init(desc))
642 if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
644 if (tcp_md5_hash_header(hp, th))
646 if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
648 if (tcp_md5_hash_key(hp, key))
650 if (crypto_hash_final(desc, md5_hash))
653 tcp_put_md5sig_pool();
657 tcp_put_md5sig_pool();
659 memset(md5_hash, 0, 16);
663 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
665 const __u8 *hash_location = NULL;
666 struct tcp_md5sig_key *hash_expected;
667 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
668 const struct tcphdr *th = tcp_hdr(skb);
672 hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
673 hash_location = tcp_parse_md5sig_option(th);
675 /* We've parsed the options - do we have a hash? */
676 if (!hash_expected && !hash_location)
679 if (hash_expected && !hash_location) {
680 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
684 if (!hash_expected && hash_location) {
685 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
689 /* check the signature */
690 genhash = tcp_v6_md5_hash_skb(newhash,
694 if (genhash || memcmp(hash_location, newhash, 16) != 0) {
695 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
696 genhash ? "failed" : "mismatch",
697 &ip6h->saddr, ntohs(th->source),
698 &ip6h->daddr, ntohs(th->dest));
705 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
707 .obj_size = sizeof(struct tcp6_request_sock),
708 .rtx_syn_ack = tcp_v6_rtx_synack,
709 .send_ack = tcp_v6_reqsk_send_ack,
710 .destructor = tcp_v6_reqsk_destructor,
711 .send_reset = tcp_v6_send_reset,
712 .syn_ack_timeout = tcp_syn_ack_timeout,
715 #ifdef CONFIG_TCP_MD5SIG
716 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
717 .md5_lookup = tcp_v6_reqsk_md5_lookup,
718 .calc_md5_hash = tcp_v6_md5_hash_skb,
722 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
723 u32 tsval, u32 tsecr,
724 struct tcp_md5sig_key *key, int rst, u8 tclass)
726 const struct tcphdr *th = tcp_hdr(skb);
728 struct sk_buff *buff;
730 struct net *net = dev_net(skb_dst(skb)->dev);
731 struct sock *ctl_sk = net->ipv6.tcp_sk;
732 unsigned int tot_len = sizeof(struct tcphdr);
733 struct dst_entry *dst;
737 tot_len += TCPOLEN_TSTAMP_ALIGNED;
738 #ifdef CONFIG_TCP_MD5SIG
740 tot_len += TCPOLEN_MD5SIG_ALIGNED;
743 buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
748 skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
750 t1 = (struct tcphdr *) skb_push(buff, tot_len);
751 skb_reset_transport_header(buff);
753 /* Swap the send and the receive. */
754 memset(t1, 0, sizeof(*t1));
755 t1->dest = th->source;
756 t1->source = th->dest;
757 t1->doff = tot_len / 4;
758 t1->seq = htonl(seq);
759 t1->ack_seq = htonl(ack);
760 t1->ack = !rst || !th->ack;
762 t1->window = htons(win);
764 topt = (__be32 *)(t1 + 1);
767 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
768 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
769 *topt++ = htonl(tsval);
770 *topt++ = htonl(tsecr);
773 #ifdef CONFIG_TCP_MD5SIG
775 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
776 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
777 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
778 &ipv6_hdr(skb)->saddr,
779 &ipv6_hdr(skb)->daddr, t1);
783 memset(&fl6, 0, sizeof(fl6));
784 fl6.daddr = ipv6_hdr(skb)->saddr;
785 fl6.saddr = ipv6_hdr(skb)->daddr;
787 buff->ip_summed = CHECKSUM_PARTIAL;
790 __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
792 fl6.flowi6_proto = IPPROTO_TCP;
793 if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
794 fl6.flowi6_oif = inet6_iif(skb);
795 fl6.fl6_dport = t1->dest;
796 fl6.fl6_sport = t1->source;
797 security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
799 /* Pass a socket to ip6_dst_lookup either it is for RST
800 * Underlying function will use this to retrieve the network
803 dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
805 skb_dst_set(buff, dst);
806 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
807 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
809 TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
816 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
818 const struct tcphdr *th = tcp_hdr(skb);
819 u32 seq = 0, ack_seq = 0;
820 struct tcp_md5sig_key *key = NULL;
821 #ifdef CONFIG_TCP_MD5SIG
822 const __u8 *hash_location = NULL;
823 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
824 unsigned char newhash[16];
826 struct sock *sk1 = NULL;
832 if (!ipv6_unicast_destination(skb))
835 #ifdef CONFIG_TCP_MD5SIG
836 hash_location = tcp_parse_md5sig_option(th);
837 if (!sk && hash_location) {
839 * active side is lost. Try to find listening socket through
840 * source port, and then find md5 key through listening socket.
841 * we are not loose security here:
842 * Incoming packet is checked with md5 hash with finding key,
843 * no RST generated if md5 hash doesn't match.
845 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
846 &tcp_hashinfo, &ipv6h->saddr,
847 th->source, &ipv6h->daddr,
848 ntohs(th->source), inet6_iif(skb));
853 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
857 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
858 if (genhash || memcmp(hash_location, newhash, 16) != 0)
861 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
866 seq = ntohl(th->ack_seq);
868 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
871 tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0);
873 #ifdef CONFIG_TCP_MD5SIG
882 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
883 u32 win, u32 tsval, u32 tsecr,
884 struct tcp_md5sig_key *key, u8 tclass)
886 tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass);
889 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
891 struct inet_timewait_sock *tw = inet_twsk(sk);
892 struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
894 tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
895 tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
896 tcp_time_stamp + tcptw->tw_ts_offset,
897 tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
903 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
904 struct request_sock *req)
906 tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
907 req->rcv_wnd, tcp_time_stamp, req->ts_recent,
908 tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
912 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
914 struct request_sock *req, **prev;
915 const struct tcphdr *th = tcp_hdr(skb);
918 /* Find possible connection requests. */
919 req = inet6_csk_search_req(sk, &prev, th->source,
920 &ipv6_hdr(skb)->saddr,
921 &ipv6_hdr(skb)->daddr, inet6_iif(skb));
923 return tcp_check_req(sk, skb, req, prev, false);
925 nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
926 &ipv6_hdr(skb)->saddr, th->source,
927 &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
930 if (nsk->sk_state != TCP_TIME_WAIT) {
934 inet_twsk_put(inet_twsk(nsk));
938 #ifdef CONFIG_SYN_COOKIES
940 sk = cookie_v6_check(sk, skb);
945 /* FIXME: this is substantially similar to the ipv4 code.
946 * Can some kind of merge be done? -- erics
948 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
950 struct tcp_extend_values tmp_ext;
951 struct tcp_options_received tmp_opt;
952 const u8 *hash_location;
953 struct request_sock *req;
954 struct inet6_request_sock *treq;
955 struct ipv6_pinfo *np = inet6_sk(sk);
956 struct tcp_sock *tp = tcp_sk(sk);
957 __u32 isn = TCP_SKB_CB(skb)->when;
958 struct dst_entry *dst = NULL;
960 bool want_cookie = false;
962 if (skb->protocol == htons(ETH_P_IP))
963 return tcp_v4_conn_request(sk, skb);
965 if (!ipv6_unicast_destination(skb))
968 if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
969 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
974 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
975 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
979 req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
983 #ifdef CONFIG_TCP_MD5SIG
984 tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
987 tcp_clear_options(&tmp_opt);
988 tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
989 tmp_opt.user_mss = tp->rx_opt.user_mss;
990 tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
992 if (tmp_opt.cookie_plus > 0 &&
993 tmp_opt.saw_tstamp &&
994 !tp->rx_opt.cookie_out_never &&
995 (sysctl_tcp_cookie_size > 0 ||
996 (tp->cookie_values != NULL &&
997 tp->cookie_values->cookie_desired > 0))) {
1000 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1001 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1003 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1006 /* Secret recipe starts with IP addresses */
1007 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1012 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1018 /* plus variable length Initiator Cookie */
1021 *c++ ^= *hash_location++;
1023 want_cookie = false; /* not our kind of cookie */
1024 tmp_ext.cookie_out_never = 0; /* false */
1025 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1026 } else if (!tp->rx_opt.cookie_in_always) {
1027 /* redundant indications, but ensure initialization. */
1028 tmp_ext.cookie_out_never = 1; /* true */
1029 tmp_ext.cookie_plus = 0;
1033 tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1035 if (want_cookie && !tmp_opt.saw_tstamp)
1036 tcp_clear_options(&tmp_opt);
1038 tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1039 tcp_openreq_init(req, &tmp_opt, skb);
1041 treq = inet6_rsk(req);
1042 treq->rmt_addr = ipv6_hdr(skb)->saddr;
1043 treq->loc_addr = ipv6_hdr(skb)->daddr;
1044 if (!want_cookie || tmp_opt.tstamp_ok)
1045 TCP_ECN_create_request(req, skb, sock_net(sk));
1047 treq->iif = sk->sk_bound_dev_if;
1049 /* So that link locals have meaning */
1050 if (!sk->sk_bound_dev_if &&
1051 ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1052 treq->iif = inet6_iif(skb);
1055 if (ipv6_opt_accepted(sk, skb) ||
1056 np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1057 np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1058 atomic_inc(&skb->users);
1059 treq->pktopts = skb;
1063 isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1064 req->cookie_ts = tmp_opt.tstamp_ok;
1068 /* VJ's idea. We save last timestamp seen
1069 * from the destination in peer table, when entering
1070 * state TIME-WAIT, and check against it before
1071 * accepting new connection request.
1073 * If "isn" is not zero, this request hit alive
1074 * timewait bucket, so that all the necessary checks
1075 * are made in the function processing timewait state.
1077 if (tmp_opt.saw_tstamp &&
1078 tcp_death_row.sysctl_tw_recycle &&
1079 (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1080 if (!tcp_peer_is_proven(req, dst, true)) {
1081 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1082 goto drop_and_release;
1085 /* Kill the following clause, if you dislike this way. */
1086 else if (!sysctl_tcp_syncookies &&
1087 (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1088 (sysctl_max_syn_backlog >> 2)) &&
1089 !tcp_peer_is_proven(req, dst, false)) {
1090 /* Without syncookies last quarter of
1091 * backlog is filled with destinations,
1092 * proven to be alive.
1093 * It means that we continue to communicate
1094 * to destinations, already remembered
1095 * to the moment of synflood.
1097 LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1098 &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1099 goto drop_and_release;
1102 isn = tcp_v6_init_sequence(skb);
1105 tcp_rsk(req)->snt_isn = isn;
1107 if (security_inet_conn_request(sk, skb, req))
1108 goto drop_and_release;
1110 if (tcp_v6_send_synack(sk, dst, &fl6, req,
1111 (struct request_values *)&tmp_ext,
1112 skb_get_queue_mapping(skb)) ||
1116 tcp_rsk(req)->snt_synack = tcp_time_stamp;
1117 tcp_rsk(req)->listener = NULL;
1118 inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1126 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1127 return 0; /* don't send reset */
1130 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1131 struct request_sock *req,
1132 struct dst_entry *dst)
1134 struct inet6_request_sock *treq;
1135 struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1136 struct tcp6_sock *newtcp6sk;
1137 struct inet_sock *newinet;
1138 struct tcp_sock *newtp;
1140 #ifdef CONFIG_TCP_MD5SIG
1141 struct tcp_md5sig_key *key;
1145 if (skb->protocol == htons(ETH_P_IP)) {
1150 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1155 newtcp6sk = (struct tcp6_sock *)newsk;
1156 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1158 newinet = inet_sk(newsk);
1159 newnp = inet6_sk(newsk);
1160 newtp = tcp_sk(newsk);
1162 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1164 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1166 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1168 newnp->rcv_saddr = newnp->saddr;
1170 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1171 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1172 #ifdef CONFIG_TCP_MD5SIG
1173 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1176 newnp->ipv6_ac_list = NULL;
1177 newnp->ipv6_fl_list = NULL;
1178 newnp->pktoptions = NULL;
1180 newnp->mcast_oif = inet6_iif(skb);
1181 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1182 newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1185 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1186 * here, tcp_create_openreq_child now does this for us, see the comment in
1187 * that function for the gory details. -acme
1190 /* It is tricky place. Until this moment IPv4 tcp
1191 worked with IPv6 icsk.icsk_af_ops.
1194 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1199 treq = inet6_rsk(req);
1201 if (sk_acceptq_is_full(sk))
1205 dst = inet6_csk_route_req(sk, &fl6, req);
1210 newsk = tcp_create_openreq_child(sk, req, skb);
1215 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1216 * count here, tcp_create_openreq_child now does this for us, see the
1217 * comment in that function for the gory details. -acme
1220 newsk->sk_gso_type = SKB_GSO_TCPV6;
1221 __ip6_dst_store(newsk, dst, NULL, NULL);
1222 inet6_sk_rx_dst_set(newsk, skb);
1224 newtcp6sk = (struct tcp6_sock *)newsk;
1225 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1227 newtp = tcp_sk(newsk);
1228 newinet = inet_sk(newsk);
1229 newnp = inet6_sk(newsk);
1231 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1233 newnp->daddr = treq->rmt_addr;
1234 newnp->saddr = treq->loc_addr;
1235 newnp->rcv_saddr = treq->loc_addr;
1236 newsk->sk_bound_dev_if = treq->iif;
1238 /* Now IPv6 options...
1240 First: no IPv4 options.
1242 newinet->inet_opt = NULL;
1243 newnp->ipv6_ac_list = NULL;
1244 newnp->ipv6_fl_list = NULL;
1247 newnp->rxopt.all = np->rxopt.all;
1249 /* Clone pktoptions received with SYN */
1250 newnp->pktoptions = NULL;
1251 if (treq->pktopts != NULL) {
1252 newnp->pktoptions = skb_clone(treq->pktopts,
1253 sk_gfp_atomic(sk, GFP_ATOMIC));
1254 consume_skb(treq->pktopts);
1255 treq->pktopts = NULL;
1256 if (newnp->pktoptions)
1257 skb_set_owner_r(newnp->pktoptions, newsk);
1260 newnp->mcast_oif = inet6_iif(skb);
1261 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1262 newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1264 /* Clone native IPv6 options from listening socket (if any)
1266 Yes, keeping reference count would be much more clever,
1267 but we make one more one thing there: reattach optmem
1271 newnp->opt = ipv6_dup_options(newsk, np->opt);
1273 inet_csk(newsk)->icsk_ext_hdr_len = 0;
1275 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1276 newnp->opt->opt_flen);
1278 tcp_mtup_init(newsk);
1279 tcp_sync_mss(newsk, dst_mtu(dst));
1280 newtp->advmss = dst_metric_advmss(dst);
1281 if (tcp_sk(sk)->rx_opt.user_mss &&
1282 tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1283 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1285 tcp_initialize_rcv_mss(newsk);
1286 tcp_synack_rtt_meas(newsk, req);
1287 newtp->total_retrans = req->num_retrans;
1289 newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1290 newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1292 #ifdef CONFIG_TCP_MD5SIG
1293 /* Copy over the MD5 key from the original socket */
1294 if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1295 /* We're using one, so create a matching key
1296 * on the newsk structure. If we fail to get
1297 * memory, then we end up not copying the key
1300 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1301 AF_INET6, key->key, key->keylen,
1302 sk_gfp_atomic(sk, GFP_ATOMIC));
1306 if (__inet_inherit_port(sk, newsk) < 0) {
1307 inet_csk_prepare_forced_close(newsk);
1311 __inet6_hash(newsk, NULL);
1316 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1320 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1324 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1326 if (skb->ip_summed == CHECKSUM_COMPLETE) {
1327 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1328 &ipv6_hdr(skb)->daddr, skb->csum)) {
1329 skb->ip_summed = CHECKSUM_UNNECESSARY;
1334 skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1335 &ipv6_hdr(skb)->saddr,
1336 &ipv6_hdr(skb)->daddr, 0));
1338 if (skb->len <= 76) {
1339 return __skb_checksum_complete(skb);
1344 /* The socket must have it's spinlock held when we get
1347 * We have a potential double-lock case here, so even when
1348 * doing backlog processing we use the BH locking scheme.
1349 * This is because we cannot sleep with the original spinlock
1352 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1354 struct ipv6_pinfo *np = inet6_sk(sk);
1355 struct tcp_sock *tp;
1356 struct sk_buff *opt_skb = NULL;
1358 /* Imagine: socket is IPv6. IPv4 packet arrives,
1359 goes to IPv4 receive handler and backlogged.
1360 From backlog it always goes here. Kerboom...
1361 Fortunately, tcp_rcv_established and rcv_established
1362 handle them correctly, but it is not case with
1363 tcp_v6_hnd_req and tcp_v6_send_reset(). --ANK
1366 if (skb->protocol == htons(ETH_P_IP))
1367 return tcp_v4_do_rcv(sk, skb);
1369 #ifdef CONFIG_TCP_MD5SIG
1370 if (tcp_v6_inbound_md5_hash (sk, skb))
1374 if (sk_filter(sk, skb))
1378 * socket locking is here for SMP purposes as backlog rcv
1379 * is currently called with bh processing disabled.
1382 /* Do Stevens' IPV6_PKTOPTIONS.
1384 Yes, guys, it is the only place in our code, where we
1385 may make it not affecting IPv4.
1386 The rest of code is protocol independent,
1387 and I do not like idea to uglify IPv4.
1389 Actually, all the idea behind IPV6_PKTOPTIONS
1390 looks not very well thought. For now we latch
1391 options, received in the last packet, enqueued
1392 by tcp. Feel free to propose better solution.
1396 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1398 if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1399 struct dst_entry *dst = sk->sk_rx_dst;
1401 sock_rps_save_rxhash(sk, skb);
1403 if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1404 dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1406 sk->sk_rx_dst = NULL;
1410 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1413 goto ipv6_pktoptions;
1417 if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1420 if (sk->sk_state == TCP_LISTEN) {
1421 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1426 * Queue it on the new socket if the new socket is active,
1427 * otherwise we just shortcircuit this and continue with
1431 sock_rps_save_rxhash(nsk, skb);
1432 if (tcp_child_process(sk, nsk, skb))
1435 __kfree_skb(opt_skb);
1439 sock_rps_save_rxhash(sk, skb);
1441 if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1444 goto ipv6_pktoptions;
1448 tcp_v6_send_reset(sk, skb);
1451 __kfree_skb(opt_skb);
1455 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1460 /* Do you ask, what is it?
1462 1. skb was enqueued by tcp.
1463 2. skb is added to tail of read queue, rather than out of order.
1464 3. socket is not in passive state.
1465 4. Finally, it really contains options, which user wants to receive.
1468 if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1469 !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1470 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1471 np->mcast_oif = inet6_iif(opt_skb);
1472 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1473 np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1474 if (np->rxopt.bits.rxtclass)
1475 np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1476 if (ipv6_opt_accepted(sk, opt_skb)) {
1477 skb_set_owner_r(opt_skb, sk);
1478 opt_skb = xchg(&np->pktoptions, opt_skb);
1480 __kfree_skb(opt_skb);
1481 opt_skb = xchg(&np->pktoptions, NULL);
1489 static int tcp_v6_rcv(struct sk_buff *skb)
1491 const struct tcphdr *th;
1492 const struct ipv6hdr *hdr;
1495 struct net *net = dev_net(skb->dev);
1497 if (skb->pkt_type != PACKET_HOST)
1501 * Count it even if it's bad.
1503 TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1505 if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1510 if (th->doff < sizeof(struct tcphdr)/4)
1512 if (!pskb_may_pull(skb, th->doff*4))
1515 if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1519 hdr = ipv6_hdr(skb);
1520 TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1521 TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1522 skb->len - th->doff*4);
1523 TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1524 TCP_SKB_CB(skb)->when = 0;
1525 TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1526 TCP_SKB_CB(skb)->sacked = 0;
1528 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1533 if (sk->sk_state == TCP_TIME_WAIT)
1536 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1537 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1538 goto discard_and_relse;
1541 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1542 goto discard_and_relse;
1544 if (sk_filter(sk, skb))
1545 goto discard_and_relse;
1549 bh_lock_sock_nested(sk);
1551 if (!sock_owned_by_user(sk)) {
1552 #ifdef CONFIG_NET_DMA
1553 struct tcp_sock *tp = tcp_sk(sk);
1554 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1555 tp->ucopy.dma_chan = net_dma_find_channel();
1556 if (tp->ucopy.dma_chan)
1557 ret = tcp_v6_do_rcv(sk, skb);
1561 if (!tcp_prequeue(sk, skb))
1562 ret = tcp_v6_do_rcv(sk, skb);
1564 } else if (unlikely(sk_add_backlog(sk, skb,
1565 sk->sk_rcvbuf + sk->sk_sndbuf))) {
1567 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1568 goto discard_and_relse;
1573 return ret ? -1 : 0;
1576 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1579 if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1581 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1583 tcp_v6_send_reset(NULL, skb);
1600 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1601 inet_twsk_put(inet_twsk(sk));
1605 if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1606 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1607 inet_twsk_put(inet_twsk(sk));
1611 switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1616 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1617 &ipv6_hdr(skb)->saddr, th->source,
1618 &ipv6_hdr(skb)->daddr,
1619 ntohs(th->dest), inet6_iif(skb));
1621 struct inet_timewait_sock *tw = inet_twsk(sk);
1622 inet_twsk_deschedule(tw, &tcp_death_row);
1627 /* Fall through to ACK */
1630 tcp_v6_timewait_ack(sk, skb);
1634 case TCP_TW_SUCCESS:;
1639 static void tcp_v6_early_demux(struct sk_buff *skb)
1641 const struct ipv6hdr *hdr;
1642 const struct tcphdr *th;
1645 if (skb->pkt_type != PACKET_HOST)
1648 if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1651 hdr = ipv6_hdr(skb);
1654 if (th->doff < sizeof(struct tcphdr) / 4)
1657 sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1658 &hdr->saddr, th->source,
1659 &hdr->daddr, ntohs(th->dest),
1663 skb->destructor = sock_edemux;
1664 if (sk->sk_state != TCP_TIME_WAIT) {
1665 struct dst_entry *dst = sk->sk_rx_dst;
1668 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1670 inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1671 skb_dst_set_noref(skb, dst);
1676 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1677 .twsk_obj_size = sizeof(struct tcp6_timewait_sock),
1678 .twsk_unique = tcp_twsk_unique,
1679 .twsk_destructor= tcp_twsk_destructor,
1682 static const struct inet_connection_sock_af_ops ipv6_specific = {
1683 .queue_xmit = inet6_csk_xmit,
1684 .send_check = tcp_v6_send_check,
1685 .rebuild_header = inet6_sk_rebuild_header,
1686 .sk_rx_dst_set = inet6_sk_rx_dst_set,
1687 .conn_request = tcp_v6_conn_request,
1688 .syn_recv_sock = tcp_v6_syn_recv_sock,
1689 .net_header_len = sizeof(struct ipv6hdr),
1690 .net_frag_header_len = sizeof(struct frag_hdr),
1691 .setsockopt = ipv6_setsockopt,
1692 .getsockopt = ipv6_getsockopt,
1693 .addr2sockaddr = inet6_csk_addr2sockaddr,
1694 .sockaddr_len = sizeof(struct sockaddr_in6),
1695 .bind_conflict = inet6_csk_bind_conflict,
1696 #ifdef CONFIG_COMPAT
1697 .compat_setsockopt = compat_ipv6_setsockopt,
1698 .compat_getsockopt = compat_ipv6_getsockopt,
1702 #ifdef CONFIG_TCP_MD5SIG
1703 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1704 .md5_lookup = tcp_v6_md5_lookup,
1705 .calc_md5_hash = tcp_v6_md5_hash_skb,
1706 .md5_parse = tcp_v6_parse_md5_keys,
1711 * TCP over IPv4 via INET6 API
1714 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1715 .queue_xmit = ip_queue_xmit,
1716 .send_check = tcp_v4_send_check,
1717 .rebuild_header = inet_sk_rebuild_header,
1718 .sk_rx_dst_set = inet_sk_rx_dst_set,
1719 .conn_request = tcp_v6_conn_request,
1720 .syn_recv_sock = tcp_v6_syn_recv_sock,
1721 .net_header_len = sizeof(struct iphdr),
1722 .setsockopt = ipv6_setsockopt,
1723 .getsockopt = ipv6_getsockopt,
1724 .addr2sockaddr = inet6_csk_addr2sockaddr,
1725 .sockaddr_len = sizeof(struct sockaddr_in6),
1726 .bind_conflict = inet6_csk_bind_conflict,
1727 #ifdef CONFIG_COMPAT
1728 .compat_setsockopt = compat_ipv6_setsockopt,
1729 .compat_getsockopt = compat_ipv6_getsockopt,
1733 #ifdef CONFIG_TCP_MD5SIG
1734 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1735 .md5_lookup = tcp_v4_md5_lookup,
1736 .calc_md5_hash = tcp_v4_md5_hash_skb,
1737 .md5_parse = tcp_v6_parse_md5_keys,
1741 /* NOTE: A lot of things set to zero explicitly by call to
1742 * sk_alloc() so need not be done here.
1744 static int tcp_v6_init_sock(struct sock *sk)
1746 struct inet_connection_sock *icsk = inet_csk(sk);
1750 icsk->icsk_af_ops = &ipv6_specific;
1752 #ifdef CONFIG_TCP_MD5SIG
1753 tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1759 static void tcp_v6_destroy_sock(struct sock *sk)
1761 tcp_v4_destroy_sock(sk);
1762 inet6_destroy_sock(sk);
1765 #ifdef CONFIG_PROC_FS
1766 /* Proc filesystem TCPv6 sock list dumping. */
1767 static void get_openreq6(struct seq_file *seq,
1768 const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1770 int ttd = req->expires - jiffies;
1771 const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1772 const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1778 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1779 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1781 src->s6_addr32[0], src->s6_addr32[1],
1782 src->s6_addr32[2], src->s6_addr32[3],
1783 ntohs(inet_rsk(req)->loc_port),
1784 dest->s6_addr32[0], dest->s6_addr32[1],
1785 dest->s6_addr32[2], dest->s6_addr32[3],
1786 ntohs(inet_rsk(req)->rmt_port),
1788 0,0, /* could print option size, but that is af dependent. */
1789 1, /* timers active (only the expire timer) */
1790 jiffies_to_clock_t(ttd),
1792 from_kuid_munged(seq_user_ns(seq), uid),
1793 0, /* non standard timer */
1794 0, /* open_requests have no inode */
1798 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1800 const struct in6_addr *dest, *src;
1803 unsigned long timer_expires;
1804 const struct inet_sock *inet = inet_sk(sp);
1805 const struct tcp_sock *tp = tcp_sk(sp);
1806 const struct inet_connection_sock *icsk = inet_csk(sp);
1807 const struct ipv6_pinfo *np = inet6_sk(sp);
1810 src = &np->rcv_saddr;
1811 destp = ntohs(inet->inet_dport);
1812 srcp = ntohs(inet->inet_sport);
1814 if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1816 timer_expires = icsk->icsk_timeout;
1817 } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1819 timer_expires = icsk->icsk_timeout;
1820 } else if (timer_pending(&sp->sk_timer)) {
1822 timer_expires = sp->sk_timer.expires;
1825 timer_expires = jiffies;
1829 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1830 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
1832 src->s6_addr32[0], src->s6_addr32[1],
1833 src->s6_addr32[2], src->s6_addr32[3], srcp,
1834 dest->s6_addr32[0], dest->s6_addr32[1],
1835 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1837 tp->write_seq-tp->snd_una,
1838 (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1840 jiffies_delta_to_clock_t(timer_expires - jiffies),
1841 icsk->icsk_retransmits,
1842 from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1843 icsk->icsk_probes_out,
1845 atomic_read(&sp->sk_refcnt), sp,
1846 jiffies_to_clock_t(icsk->icsk_rto),
1847 jiffies_to_clock_t(icsk->icsk_ack.ato),
1848 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1850 tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1854 static void get_timewait6_sock(struct seq_file *seq,
1855 struct inet_timewait_sock *tw, int i)
1857 const struct in6_addr *dest, *src;
1859 const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1860 long delta = tw->tw_ttd - jiffies;
1862 dest = &tw6->tw_v6_daddr;
1863 src = &tw6->tw_v6_rcv_saddr;
1864 destp = ntohs(tw->tw_dport);
1865 srcp = ntohs(tw->tw_sport);
1868 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1869 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1871 src->s6_addr32[0], src->s6_addr32[1],
1872 src->s6_addr32[2], src->s6_addr32[3], srcp,
1873 dest->s6_addr32[0], dest->s6_addr32[1],
1874 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1875 tw->tw_substate, 0, 0,
1876 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1877 atomic_read(&tw->tw_refcnt), tw);
1880 static int tcp6_seq_show(struct seq_file *seq, void *v)
1882 struct tcp_iter_state *st;
1884 if (v == SEQ_START_TOKEN) {
1889 "st tx_queue rx_queue tr tm->when retrnsmt"
1890 " uid timeout inode\n");
1895 switch (st->state) {
1896 case TCP_SEQ_STATE_LISTENING:
1897 case TCP_SEQ_STATE_ESTABLISHED:
1898 get_tcp6_sock(seq, v, st->num);
1900 case TCP_SEQ_STATE_OPENREQ:
1901 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1903 case TCP_SEQ_STATE_TIME_WAIT:
1904 get_timewait6_sock(seq, v, st->num);
1911 static const struct file_operations tcp6_afinfo_seq_fops = {
1912 .owner = THIS_MODULE,
1913 .open = tcp_seq_open,
1915 .llseek = seq_lseek,
1916 .release = seq_release_net
1919 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1922 .seq_fops = &tcp6_afinfo_seq_fops,
1924 .show = tcp6_seq_show,
1928 int __net_init tcp6_proc_init(struct net *net)
1930 return tcp_proc_register(net, &tcp6_seq_afinfo);
1933 void tcp6_proc_exit(struct net *net)
1935 tcp_proc_unregister(net, &tcp6_seq_afinfo);
1939 struct proto tcpv6_prot = {
1941 .owner = THIS_MODULE,
1943 .connect = tcp_v6_connect,
1944 .disconnect = tcp_disconnect,
1945 .accept = inet_csk_accept,
1947 .init = tcp_v6_init_sock,
1948 .destroy = tcp_v6_destroy_sock,
1949 .shutdown = tcp_shutdown,
1950 .setsockopt = tcp_setsockopt,
1951 .getsockopt = tcp_getsockopt,
1952 .recvmsg = tcp_recvmsg,
1953 .sendmsg = tcp_sendmsg,
1954 .sendpage = tcp_sendpage,
1955 .backlog_rcv = tcp_v6_do_rcv,
1956 .release_cb = tcp_release_cb,
1957 .mtu_reduced = tcp_v6_mtu_reduced,
1958 .hash = tcp_v6_hash,
1959 .unhash = inet_unhash,
1960 .get_port = inet_csk_get_port,
1961 .enter_memory_pressure = tcp_enter_memory_pressure,
1962 .sockets_allocated = &tcp_sockets_allocated,
1963 .memory_allocated = &tcp_memory_allocated,
1964 .memory_pressure = &tcp_memory_pressure,
1965 .orphan_count = &tcp_orphan_count,
1966 .sysctl_wmem = sysctl_tcp_wmem,
1967 .sysctl_rmem = sysctl_tcp_rmem,
1968 .max_header = MAX_TCP_HEADER,
1969 .obj_size = sizeof(struct tcp6_sock),
1970 .slab_flags = SLAB_DESTROY_BY_RCU,
1971 .twsk_prot = &tcp6_timewait_sock_ops,
1972 .rsk_prot = &tcp6_request_sock_ops,
1973 .h.hashinfo = &tcp_hashinfo,
1974 .no_autobind = true,
1975 #ifdef CONFIG_COMPAT
1976 .compat_setsockopt = compat_tcp_setsockopt,
1977 .compat_getsockopt = compat_tcp_getsockopt,
1979 #ifdef CONFIG_MEMCG_KMEM
1980 .proto_cgroup = tcp_proto_cgroup,
1984 static const struct inet6_protocol tcpv6_protocol = {
1985 .early_demux = tcp_v6_early_demux,
1986 .handler = tcp_v6_rcv,
1987 .err_handler = tcp_v6_err,
1988 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1991 static struct inet_protosw tcpv6_protosw = {
1992 .type = SOCK_STREAM,
1993 .protocol = IPPROTO_TCP,
1994 .prot = &tcpv6_prot,
1995 .ops = &inet6_stream_ops,
1997 .flags = INET_PROTOSW_PERMANENT |
2001 static int __net_init tcpv6_net_init(struct net *net)
2003 return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2004 SOCK_RAW, IPPROTO_TCP, net);
2007 static void __net_exit tcpv6_net_exit(struct net *net)
2009 inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2012 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2014 inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2017 static struct pernet_operations tcpv6_net_ops = {
2018 .init = tcpv6_net_init,
2019 .exit = tcpv6_net_exit,
2020 .exit_batch = tcpv6_net_exit_batch,
2023 int __init tcpv6_init(void)
2027 ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2031 /* register inet6 protocol */
2032 ret = inet6_register_protosw(&tcpv6_protosw);
2034 goto out_tcpv6_protocol;
2036 ret = register_pernet_subsys(&tcpv6_net_ops);
2038 goto out_tcpv6_protosw;
2043 inet6_unregister_protosw(&tcpv6_protosw);
2045 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2049 void tcpv6_exit(void)
2051 unregister_pernet_subsys(&tcpv6_net_ops);
2052 inet6_unregister_protosw(&tcpv6_protosw);
2053 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);