net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65 #include <net/tcp_memcontrol.h>
  66
  67 #include <asm/uaccess.h>
  68
  69 #include <linux/proc_fs.h>
  70 #include <linux/seq_file.h>
  71
  72 #include <linux/crypto.h>
  73 #include <linux/scatterlist.h>
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  77                                       struct request_sock *req);
  78
  79 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  80 static void     __tcp_v6_send_check(struct sk_buff *skb,
  81                                     const struct in6_addr *saddr,
  82                                     const struct in6_addr *daddr);
  83
  84 static const struct inet_connection_sock_af_ops ipv6_mapped;
  85 static const struct inet_connection_sock_af_ops ipv6_specific;
  86 #ifdef CONFIG_TCP_MD5SIG
  87 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  88 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  89 #else
  90 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  91                                                    const struct in6_addr *addr)
  92 {
  93         return NULL;
  94 }
  95 #endif
  96
  97 static void tcp_v6_hash(struct sock *sk)
  98 {
  99         if (sk->sk_state != TCP_CLOSE) {
 100                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 101                         tcp_prot.hash(sk);
 102                         return;
 103                 }
 104                 local_bh_disable();
 105                 __inet6_hash(sk, NULL);
 106                 local_bh_enable();
 107         }
 108 }
 109
 110 static __inline__ __sum16 tcp_v6_check(int len,
 111                                    const struct in6_addr *saddr,
 112                                    const struct in6_addr *daddr,
 113                                    __wsum base)
 114 {
 115         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 116 }
 117
 118 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 119 {
 120         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 121                                             ipv6_hdr(skb)->saddr.s6_addr32,
 122                                             tcp_hdr(skb)->dest,
 123                                             tcp_hdr(skb)->source);
 124 }
 125
 126 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 127                           int addr_len)
 128 {
 129         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 130         struct inet_sock *inet = inet_sk(sk);
 131         struct inet_connection_sock *icsk = inet_csk(sk);
 132         struct ipv6_pinfo *np = inet6_sk(sk);
 133         struct tcp_sock *tp = tcp_sk(sk);
 134         struct in6_addr *saddr = NULL, *final_p, final;
 135         struct rt6_info *rt;
 136         struct flowi6 fl6;
 137         struct dst_entry *dst;
 138         int addr_type;
 139         int err;
 140
 141         if (addr_len < SIN6_LEN_RFC2133)
 142                 return -EINVAL;
 143
 144         if (usin->sin6_family != AF_INET6)
 145                 return -EAFNOSUPPORT;
 146
 147         memset(&fl6, 0, sizeof(fl6));
 148
 149         if (np->sndflow) {
 150                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 151                 IP6_ECN_flow_init(fl6.flowlabel);
 152                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 153                         struct ip6_flowlabel *flowlabel;
 154                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 155                         if (flowlabel == NULL)
 156                                 return -EINVAL;
 157                         usin->sin6_addr = flowlabel->dst;
 158                         fl6_sock_release(flowlabel);
 159                 }
 160         }
 161
 162         /*
 163          *      connect() to INADDR_ANY means loopback (BSD'ism).
 164          */
 165
 166         if(ipv6_addr_any(&usin->sin6_addr))
 167                 usin->sin6_addr.s6_addr[15] = 0x1;
 168
 169         addr_type = ipv6_addr_type(&usin->sin6_addr);
 170
 171         if(addr_type & IPV6_ADDR_MULTICAST)
 172                 return -ENETUNREACH;
 173
 174         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 175                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 176                     usin->sin6_scope_id) {
 177                         /* If interface is set while binding, indices
 178                          * must coincide.
 179                          */
 180                         if (sk->sk_bound_dev_if &&
 181                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 182                                 return -EINVAL;
 183
 184                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 185                 }
 186
 187                 /* Connect to link-local address requires an interface */
 188                 if (!sk->sk_bound_dev_if)
 189                         return -EINVAL;
 190         }
 191
 192         if (tp->rx_opt.ts_recent_stamp &&
 193             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 194                 tp->rx_opt.ts_recent = 0;
 195                 tp->rx_opt.ts_recent_stamp = 0;
 196                 tp->write_seq = 0;
 197         }
 198
 199         np->daddr = usin->sin6_addr;
 200         np->flow_label = fl6.flowlabel;
 201
 202         /*
 203          *      TCP over IPv4
 204          */
 205
 206         if (addr_type == IPV6_ADDR_MAPPED) {
 207                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 208                 struct sockaddr_in sin;
 209
 210                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 211
 212                 if (__ipv6_only_sock(sk))
 213                         return -ENETUNREACH;
 214
 215                 sin.sin_family = AF_INET;
 216                 sin.sin_port = usin->sin6_port;
 217                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 218
 219                 icsk->icsk_af_ops = &ipv6_mapped;
 220                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 221 #ifdef CONFIG_TCP_MD5SIG
 222                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 223 #endif
 224
 225                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 226
 227                 if (err) {
 228                         icsk->icsk_ext_hdr_len = exthdrlen;
 229                         icsk->icsk_af_ops = &ipv6_specific;
 230                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 231 #ifdef CONFIG_TCP_MD5SIG
 232                         tp->af_specific = &tcp_sock_ipv6_specific;
 233 #endif
 234                         goto failure;
 235                 } else {
 236                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 237                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 238                                                &np->rcv_saddr);
 239                 }
 240
 241                 return err;
 242         }
 243
 244         if (!ipv6_addr_any(&np->rcv_saddr))
 245                 saddr = &np->rcv_saddr;
 246
 247         fl6.flowi6_proto = IPPROTO_TCP;
 248         fl6.daddr = np->daddr;
 249         fl6.saddr = saddr ? *saddr : np->saddr;
 250         fl6.flowi6_oif = sk->sk_bound_dev_if;
 251         fl6.flowi6_mark = sk->sk_mark;
 252         fl6.fl6_dport = usin->sin6_port;
 253         fl6.fl6_sport = inet->inet_sport;
 254
 255         final_p = fl6_update_dst(&fl6, np->opt, &final);
 256
 257         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 258
 259         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 260         if (IS_ERR(dst)) {
 261                 err = PTR_ERR(dst);
 262                 goto failure;
 263         }
 264
 265         if (saddr == NULL) {
 266                 saddr = &fl6.saddr;
 267                 np->rcv_saddr = *saddr;
 268         }
 269
 270         /* set the source address */
 271         np->saddr = *saddr;
 272         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 273
 274         sk->sk_gso_type = SKB_GSO_TCPV6;
 275         __ip6_dst_store(sk, dst, NULL, NULL);
 276
 277         rt = (struct rt6_info *) dst;
 278         if (tcp_death_row.sysctl_tw_recycle &&
 279             !tp->rx_opt.ts_recent_stamp &&
 280             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr))
 281                 tcp_fetch_timewait_stamp(sk, dst);
 282
 283         icsk->icsk_ext_hdr_len = 0;
 284         if (np->opt)
 285                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 286                                           np->opt->opt_nflen);
 287
 288         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 289
 290         inet->inet_dport = usin->sin6_port;
 291
 292         tcp_set_state(sk, TCP_SYN_SENT);
 293         err = inet6_hash_connect(&tcp_death_row, sk);
 294         if (err)
 295                 goto late_failure;
 296
 297         if (!tp->write_seq)
 298                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 299                                                              np->daddr.s6_addr32,
 300                                                              inet->inet_sport,
 301                                                              inet->inet_dport);
 302
 303         err = tcp_connect(sk);
 304         if (err)
 305                 goto late_failure;
 306
 307         return 0;
 308
 309 late_failure:
 310         tcp_set_state(sk, TCP_CLOSE);
 311         __sk_dst_reset(sk);
 312 failure:
 313         inet->inet_dport = 0;
 314         sk->sk_route_caps = 0;
 315         return err;
 316 }
 317
 318 static void tcp_v6_mtu_reduced(struct sock *sk)
 319 {
 320         struct dst_entry *dst;
 321
 322         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 323                 return;
 324
 325         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 326         if (!dst)
 327                 return;
 328
 329         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 330                 tcp_sync_mss(sk, dst_mtu(dst));
 331                 tcp_simple_retransmit(sk);
 332         }
 333 }
 334
 335 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 336                 u8 type, u8 code, int offset, __be32 info)
 337 {
 338         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 339         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 340         struct ipv6_pinfo *np;
 341         struct sock *sk;
 342         int err;
 343         struct tcp_sock *tp;
 344         __u32 seq;
 345         struct net *net = dev_net(skb->dev);
 346
 347         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 348                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 349
 350         if (sk == NULL) {
 351                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 352                                    ICMP6_MIB_INERRORS);
 353                 return;
 354         }
 355
 356         if (sk->sk_state == TCP_TIME_WAIT) {
 357                 inet_twsk_put(inet_twsk(sk));
 358                 return;
 359         }
 360
 361         bh_lock_sock(sk);
 362         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 363                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 364
 365         if (sk->sk_state == TCP_CLOSE)
 366                 goto out;
 367
 368         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 369                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 370                 goto out;
 371         }
 372
 373         tp = tcp_sk(sk);
 374         seq = ntohl(th->seq);
 375         if (sk->sk_state != TCP_LISTEN &&
 376             !between(seq, tp->snd_una, tp->snd_nxt)) {
 377                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 378                 goto out;
 379         }
 380
 381         np = inet6_sk(sk);
 382
 383         if (type == NDISC_REDIRECT) {
 384                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 385
 386                 if (dst)
 387                         dst->ops->redirect(dst, sk, skb);
 388         }
 389
 390         if (type == ICMPV6_PKT_TOOBIG) {
 391                 tp->mtu_info = ntohl(info);
 392                 if (!sock_owned_by_user(sk))
 393                         tcp_v6_mtu_reduced(sk);
 394                 else
 395                         set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags);
 396                 goto out;
 397         }
 398
 399         icmpv6_err_convert(type, code, &err);
 400
 401         /* Might be for an request_sock */
 402         switch (sk->sk_state) {
 403                 struct request_sock *req, **prev;
 404         case TCP_LISTEN:
 405                 if (sock_owned_by_user(sk))
 406                         goto out;
 407
 408                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 409                                            &hdr->saddr, inet6_iif(skb));
 410                 if (!req)
 411                         goto out;
 412
 413                 /* ICMPs are not backlogged, hence we cannot get
 414                  * an established socket here.
 415                  */
 416                 WARN_ON(req->sk != NULL);
 417
 418                 if (seq != tcp_rsk(req)->snt_isn) {
 419                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 420                         goto out;
 421                 }
 422
 423                 inet_csk_reqsk_queue_drop(sk, req, prev);
 424                 goto out;
 425
 426         case TCP_SYN_SENT:
 427         case TCP_SYN_RECV:  /* Cannot happen.
 428                                It can, it SYNs are crossed. --ANK */
 429                 if (!sock_owned_by_user(sk)) {
 430                         sk->sk_err = err;
 431                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 432
 433                         tcp_done(sk);
 434                 } else
 435                         sk->sk_err_soft = err;
 436                 goto out;
 437         }
 438
 439         if (!sock_owned_by_user(sk) && np->recverr) {
 440                 sk->sk_err = err;
 441                 sk->sk_error_report(sk);
 442         } else
 443                 sk->sk_err_soft = err;
 444
 445 out:
 446         bh_unlock_sock(sk);
 447         sock_put(sk);
 448 }
 449
 450
 451 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 452                               struct flowi6 *fl6,
 453                               struct request_sock *req,
 454                               struct request_values *rvp,
 455                               u16 queue_mapping)
 456 {
 457         struct inet6_request_sock *treq = inet6_rsk(req);
 458         struct ipv6_pinfo *np = inet6_sk(sk);
 459         struct sk_buff * skb;
 460         int err = -ENOMEM;
 461
 462         /* First, grab a route. */
 463         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 464                 goto done;
 465
 466         skb = tcp_make_synack(sk, dst, req, rvp);
 467
 468         if (skb) {
 469                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 470
 471                 fl6->daddr = treq->rmt_addr;
 472                 skb_set_queue_mapping(skb, queue_mapping);
 473                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 474                 err = net_xmit_eval(err);
 475         }
 476
 477 done:
 478         return err;
 479 }
 480
 481 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 482                              struct request_values *rvp)
 483 {
 484         struct flowi6 fl6;
 485
 486         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 487         return tcp_v6_send_synack(sk, NULL, &fl6, req, rvp, 0);
 488 }
 489
 490 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 491 {
 492         kfree_skb(inet6_rsk(req)->pktopts);
 493 }
 494
 495 #ifdef CONFIG_TCP_MD5SIG
 496 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 497                                                    const struct in6_addr *addr)
 498 {
 499         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 500 }
 501
 502 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 503                                                 struct sock *addr_sk)
 504 {
 505         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 506 }
 507
 508 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 509                                                       struct request_sock *req)
 510 {
 511         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 512 }
 513
 514 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 515                                   int optlen)
 516 {
 517         struct tcp_md5sig cmd;
 518         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 519
 520         if (optlen < sizeof(cmd))
 521                 return -EINVAL;
 522
 523         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 524                 return -EFAULT;
 525
 526         if (sin6->sin6_family != AF_INET6)
 527                 return -EINVAL;
 528
 529         if (!cmd.tcpm_keylen) {
 530                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 531                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 532                                               AF_INET);
 533                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 534                                       AF_INET6);
 535         }
 536
 537         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 538                 return -EINVAL;
 539
 540         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 541                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 542                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 543
 544         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 545                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 546 }
 547
 548 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 549                                         const struct in6_addr *daddr,
 550                                         const struct in6_addr *saddr, int nbytes)
 551 {
 552         struct tcp6_pseudohdr *bp;
 553         struct scatterlist sg;
 554
 555         bp = &hp->md5_blk.ip6;
 556         /* 1. TCP pseudo-header (RFC2460) */
 557         bp->saddr = *saddr;
 558         bp->daddr = *daddr;
 559         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 560         bp->len = cpu_to_be32(nbytes);
 561
 562         sg_init_one(&sg, bp, sizeof(*bp));
 563         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 564 }
 565
 566 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 567                                const struct in6_addr *daddr, struct in6_addr *saddr,
 568                                const struct tcphdr *th)
 569 {
 570         struct tcp_md5sig_pool *hp;
 571         struct hash_desc *desc;
 572
 573         hp = tcp_get_md5sig_pool();
 574         if (!hp)
 575                 goto clear_hash_noput;
 576         desc = &hp->md5_desc;
 577
 578         if (crypto_hash_init(desc))
 579                 goto clear_hash;
 580         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 581                 goto clear_hash;
 582         if (tcp_md5_hash_header(hp, th))
 583                 goto clear_hash;
 584         if (tcp_md5_hash_key(hp, key))
 585                 goto clear_hash;
 586         if (crypto_hash_final(desc, md5_hash))
 587                 goto clear_hash;
 588
 589         tcp_put_md5sig_pool();
 590         return 0;
 591
 592 clear_hash:
 593         tcp_put_md5sig_pool();
 594 clear_hash_noput:
 595         memset(md5_hash, 0, 16);
 596         return 1;
 597 }
 598
 599 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 600                                const struct sock *sk,
 601                                const struct request_sock *req,
 602                                const struct sk_buff *skb)
 603 {
 604         const struct in6_addr *saddr, *daddr;
 605         struct tcp_md5sig_pool *hp;
 606         struct hash_desc *desc;
 607         const struct tcphdr *th = tcp_hdr(skb);
 608
 609         if (sk) {
 610                 saddr = &inet6_sk(sk)->saddr;
 611                 daddr = &inet6_sk(sk)->daddr;
 612         } else if (req) {
 613                 saddr = &inet6_rsk(req)->loc_addr;
 614                 daddr = &inet6_rsk(req)->rmt_addr;
 615         } else {
 616                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 617                 saddr = &ip6h->saddr;
 618                 daddr = &ip6h->daddr;
 619         }
 620
 621         hp = tcp_get_md5sig_pool();
 622         if (!hp)
 623                 goto clear_hash_noput;
 624         desc = &hp->md5_desc;
 625
 626         if (crypto_hash_init(desc))
 627                 goto clear_hash;
 628
 629         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 630                 goto clear_hash;
 631         if (tcp_md5_hash_header(hp, th))
 632                 goto clear_hash;
 633         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 634                 goto clear_hash;
 635         if (tcp_md5_hash_key(hp, key))
 636                 goto clear_hash;
 637         if (crypto_hash_final(desc, md5_hash))
 638                 goto clear_hash;
 639
 640         tcp_put_md5sig_pool();
 641         return 0;
 642
 643 clear_hash:
 644         tcp_put_md5sig_pool();
 645 clear_hash_noput:
 646         memset(md5_hash, 0, 16);
 647         return 1;
 648 }
 649
 650 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 651 {
 652         const __u8 *hash_location = NULL;
 653         struct tcp_md5sig_key *hash_expected;
 654         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 655         const struct tcphdr *th = tcp_hdr(skb);
 656         int genhash;
 657         u8 newhash[16];
 658
 659         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 660         hash_location = tcp_parse_md5sig_option(th);
 661
 662         /* We've parsed the options - do we have a hash? */
 663         if (!hash_expected && !hash_location)
 664                 return 0;
 665
 666         if (hash_expected && !hash_location) {
 667                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 668                 return 1;
 669         }
 670
 671         if (!hash_expected && hash_location) {
 672                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 673                 return 1;
 674         }
 675
 676         /* check the signature */
 677         genhash = tcp_v6_md5_hash_skb(newhash,
 678                                       hash_expected,
 679                                       NULL, NULL, skb);
 680
 681         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 682                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 683                                      genhash ? "failed" : "mismatch",
 684                                      &ip6h->saddr, ntohs(th->source),
 685                                      &ip6h->daddr, ntohs(th->dest));
 686                 return 1;
 687         }
 688         return 0;
 689 }
 690 #endif
 691
 692 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 693         .family         =       AF_INET6,
 694         .obj_size       =       sizeof(struct tcp6_request_sock),
 695         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 696         .send_ack       =       tcp_v6_reqsk_send_ack,
 697         .destructor     =       tcp_v6_reqsk_destructor,
 698         .send_reset     =       tcp_v6_send_reset,
 699         .syn_ack_timeout =      tcp_syn_ack_timeout,
 700 };
 701
 702 #ifdef CONFIG_TCP_MD5SIG
 703 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 704         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 705         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 706 };
 707 #endif
 708
 709 static void __tcp_v6_send_check(struct sk_buff *skb,
 710                                 const struct in6_addr *saddr, const struct in6_addr *daddr)
 711 {
 712         struct tcphdr *th = tcp_hdr(skb);
 713
 714         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 715                 th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
 716                 skb->csum_start = skb_transport_header(skb) - skb->head;
 717                 skb->csum_offset = offsetof(struct tcphdr, check);
 718         } else {
 719                 th->check = tcp_v6_check(skb->len, saddr, daddr,
 720                                          csum_partial(th, th->doff << 2,
 721                                                       skb->csum));
 722         }
 723 }
 724
 725 static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 726 {
 727         struct ipv6_pinfo *np = inet6_sk(sk);
 728
 729         __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
 730 }
 731
 732 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 733 {
 734         const struct ipv6hdr *ipv6h;
 735         struct tcphdr *th;
 736
 737         if (!pskb_may_pull(skb, sizeof(*th)))
 738                 return -EINVAL;
 739
 740         ipv6h = ipv6_hdr(skb);
 741         th = tcp_hdr(skb);
 742
 743         th->check = 0;
 744         skb->ip_summed = CHECKSUM_PARTIAL;
 745         __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
 746         return 0;
 747 }
 748
 749 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 750                                          struct sk_buff *skb)
 751 {
 752         const struct ipv6hdr *iph = skb_gro_network_header(skb);
 753
 754         switch (skb->ip_summed) {
 755         case CHECKSUM_COMPLETE:
 756                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
 757                                   skb->csum)) {
 758                         skb->ip_summed = CHECKSUM_UNNECESSARY;
 759                         break;
 760                 }
 761
 762                 /* fall through */
 763         case CHECKSUM_NONE:
 764                 NAPI_GRO_CB(skb)->flush = 1;
 765                 return NULL;
 766         }
 767
 768         return tcp_gro_receive(head, skb);
 769 }
 770
 771 static int tcp6_gro_complete(struct sk_buff *skb)
 772 {
 773         const struct ipv6hdr *iph = ipv6_hdr(skb);
 774         struct tcphdr *th = tcp_hdr(skb);
 775
 776         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
 777                                   &iph->saddr, &iph->daddr, 0);
 778         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
 779
 780         return tcp_gro_complete(skb);
 781 }
 782
 783 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 784                                  u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
 785 {
 786         const struct tcphdr *th = tcp_hdr(skb);
 787         struct tcphdr *t1;
 788         struct sk_buff *buff;
 789         struct flowi6 fl6;
 790         struct net *net = dev_net(skb_dst(skb)->dev);
 791         struct sock *ctl_sk = net->ipv6.tcp_sk;
 792         unsigned int tot_len = sizeof(struct tcphdr);
 793         struct dst_entry *dst;
 794         __be32 *topt;
 795
 796         if (ts)
 797                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 798 #ifdef CONFIG_TCP_MD5SIG
 799         if (key)
 800                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 801 #endif
 802
 803         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 804                          GFP_ATOMIC);
 805         if (buff == NULL)
 806                 return;
 807
 808         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 809
 810         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 811         skb_reset_transport_header(buff);
 812
 813         /* Swap the send and the receive. */
 814         memset(t1, 0, sizeof(*t1));
 815         t1->dest = th->source;
 816         t1->source = th->dest;
 817         t1->doff = tot_len / 4;
 818         t1->seq = htonl(seq);
 819         t1->ack_seq = htonl(ack);
 820         t1->ack = !rst || !th->ack;
 821         t1->rst = rst;
 822         t1->window = htons(win);
 823
 824         topt = (__be32 *)(t1 + 1);
 825
 826         if (ts) {
 827                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 828                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 829                 *topt++ = htonl(tcp_time_stamp);
 830                 *topt++ = htonl(ts);
 831         }
 832
 833 #ifdef CONFIG_TCP_MD5SIG
 834         if (key) {
 835                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 836                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 837                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 838                                     &ipv6_hdr(skb)->saddr,
 839                                     &ipv6_hdr(skb)->daddr, t1);
 840         }
 841 #endif
 842
 843         memset(&fl6, 0, sizeof(fl6));
 844         fl6.daddr = ipv6_hdr(skb)->saddr;
 845         fl6.saddr = ipv6_hdr(skb)->daddr;
 846
 847         buff->ip_summed = CHECKSUM_PARTIAL;
 848         buff->csum = 0;
 849
 850         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 851
 852         fl6.flowi6_proto = IPPROTO_TCP;
 853         fl6.flowi6_oif = inet6_iif(skb);
 854         fl6.fl6_dport = t1->dest;
 855         fl6.fl6_sport = t1->source;
 856         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 857
 858         /* Pass a socket to ip6_dst_lookup either it is for RST
 859          * Underlying function will use this to retrieve the network
 860          * namespace
 861          */
 862         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
 863         if (!IS_ERR(dst)) {
 864                 skb_dst_set(buff, dst);
 865                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 866                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 867                 if (rst)
 868                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 869                 return;
 870         }
 871
 872         kfree_skb(buff);
 873 }
 874
 875 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 876 {
 877         const struct tcphdr *th = tcp_hdr(skb);
 878         u32 seq = 0, ack_seq = 0;
 879         struct tcp_md5sig_key *key = NULL;
 880 #ifdef CONFIG_TCP_MD5SIG
 881         const __u8 *hash_location = NULL;
 882         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 883         unsigned char newhash[16];
 884         int genhash;
 885         struct sock *sk1 = NULL;
 886 #endif
 887
 888         if (th->rst)
 889                 return;
 890
 891         if (!ipv6_unicast_destination(skb))
 892                 return;
 893
 894 #ifdef CONFIG_TCP_MD5SIG
 895         hash_location = tcp_parse_md5sig_option(th);
 896         if (!sk && hash_location) {
 897                 /*
 898                  * active side is lost. Try to find listening socket through
 899                  * source port, and then find md5 key through listening socket.
 900                  * we are not loose security here:
 901                  * Incoming packet is checked with md5 hash with finding key,
 902                  * no RST generated if md5 hash doesn't match.
 903                  */
 904                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 905                                            &tcp_hashinfo, &ipv6h->daddr,
 906                                            ntohs(th->source), inet6_iif(skb));
 907                 if (!sk1)
 908                         return;
 909
 910                 rcu_read_lock();
 911                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 912                 if (!key)
 913                         goto release_sk1;
 914
 915                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 916                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 917                         goto release_sk1;
 918         } else {
 919                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 920         }
 921 #endif
 922
 923         if (th->ack)
 924                 seq = ntohl(th->ack_seq);
 925         else
 926                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 927                           (th->doff << 2);
 928
 929         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
 930
 931 #ifdef CONFIG_TCP_MD5SIG
 932 release_sk1:
 933         if (sk1) {
 934                 rcu_read_unlock();
 935                 sock_put(sk1);
 936         }
 937 #endif
 938 }
 939
 940 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
 941                             struct tcp_md5sig_key *key, u8 tclass)
 942 {
 943         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
 944 }
 945
 946 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 947 {
 948         struct inet_timewait_sock *tw = inet_twsk(sk);
 949         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 950
 951         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 952                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 953                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
 954                         tw->tw_tclass);
 955
 956         inet_twsk_put(tw);
 957 }
 958
 959 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 960                                   struct request_sock *req)
 961 {
 962         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
 963                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 964 }
 965
 966
 967 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 968 {
 969         struct request_sock *req, **prev;
 970         const struct tcphdr *th = tcp_hdr(skb);
 971         struct sock *nsk;
 972
 973         /* Find possible connection requests. */
 974         req = inet6_csk_search_req(sk, &prev, th->source,
 975                                    &ipv6_hdr(skb)->saddr,
 976                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 977         if (req)
 978                 return tcp_check_req(sk, skb, req, prev);
 979
 980         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 981                         &ipv6_hdr(skb)->saddr, th->source,
 982                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 983
 984         if (nsk) {
 985                 if (nsk->sk_state != TCP_TIME_WAIT) {
 986                         bh_lock_sock(nsk);
 987                         return nsk;
 988                 }
 989                 inet_twsk_put(inet_twsk(nsk));
 990                 return NULL;
 991         }
 992
 993 #ifdef CONFIG_SYN_COOKIES
 994         if (!th->syn)
 995                 sk = cookie_v6_check(sk, skb);
 996 #endif
 997         return sk;
 998 }
 999
1000 /* FIXME: this is substantially similar to the ipv4 code.
1001  * Can some kind of merge be done? -- erics
1002  */
1003 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1004 {
1005         struct tcp_extend_values tmp_ext;
1006         struct tcp_options_received tmp_opt;
1007         const u8 *hash_location;
1008         struct request_sock *req;
1009         struct inet6_request_sock *treq;
1010         struct ipv6_pinfo *np = inet6_sk(sk);
1011         struct tcp_sock *tp = tcp_sk(sk);
1012         __u32 isn = TCP_SKB_CB(skb)->when;
1013         struct dst_entry *dst = NULL;
1014         struct flowi6 fl6;
1015         bool want_cookie = false;
1016
1017         if (skb->protocol == htons(ETH_P_IP))
1018                 return tcp_v4_conn_request(sk, skb);
1019
1020         if (!ipv6_unicast_destination(skb))
1021                 goto drop;
1022
1023         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1024                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
1025                 if (!want_cookie)
1026                         goto drop;
1027         }
1028
1029         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1030                 goto drop;
1031
1032         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1033         if (req == NULL)
1034                 goto drop;
1035
1036 #ifdef CONFIG_TCP_MD5SIG
1037         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1038 #endif
1039
1040         tcp_clear_options(&tmp_opt);
1041         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1042         tmp_opt.user_mss = tp->rx_opt.user_mss;
1043         tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
1044
1045         if (tmp_opt.cookie_plus > 0 &&
1046             tmp_opt.saw_tstamp &&
1047             !tp->rx_opt.cookie_out_never &&
1048             (sysctl_tcp_cookie_size > 0 ||
1049              (tp->cookie_values != NULL &&
1050               tp->cookie_values->cookie_desired > 0))) {
1051                 u8 *c;
1052                 u32 *d;
1053                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1054                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1055
1056                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1057                         goto drop_and_free;
1058
1059                 /* Secret recipe starts with IP addresses */
1060                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1061                 *mess++ ^= *d++;
1062                 *mess++ ^= *d++;
1063                 *mess++ ^= *d++;
1064                 *mess++ ^= *d++;
1065                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1066                 *mess++ ^= *d++;
1067                 *mess++ ^= *d++;
1068                 *mess++ ^= *d++;
1069                 *mess++ ^= *d++;
1070
1071                 /* plus variable length Initiator Cookie */
1072                 c = (u8 *)mess;
1073                 while (l-- > 0)
1074                         *c++ ^= *hash_location++;
1075
1076                 want_cookie = false;    /* not our kind of cookie */
1077                 tmp_ext.cookie_out_never = 0; /* false */
1078                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1079         } else if (!tp->rx_opt.cookie_in_always) {
1080                 /* redundant indications, but ensure initialization. */
1081                 tmp_ext.cookie_out_never = 1; /* true */
1082                 tmp_ext.cookie_plus = 0;
1083         } else {
1084                 goto drop_and_free;
1085         }
1086         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1087
1088         if (want_cookie && !tmp_opt.saw_tstamp)
1089                 tcp_clear_options(&tmp_opt);
1090
1091         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1092         tcp_openreq_init(req, &tmp_opt, skb);
1093
1094         treq = inet6_rsk(req);
1095         treq->rmt_addr = ipv6_hdr(skb)->saddr;
1096         treq->loc_addr = ipv6_hdr(skb)->daddr;
1097         if (!want_cookie || tmp_opt.tstamp_ok)
1098                 TCP_ECN_create_request(req, skb);
1099
1100         treq->iif = sk->sk_bound_dev_if;
1101
1102         /* So that link locals have meaning */
1103         if (!sk->sk_bound_dev_if &&
1104             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1105                 treq->iif = inet6_iif(skb);
1106
1107         if (!isn) {
1108                 if (ipv6_opt_accepted(sk, skb) ||
1109                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1110                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1111                         atomic_inc(&skb->users);
1112                         treq->pktopts = skb;
1113                 }
1114
1115                 if (want_cookie) {
1116                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1117                         req->cookie_ts = tmp_opt.tstamp_ok;
1118                         goto have_isn;
1119                 }
1120
1121                 /* VJ's idea. We save last timestamp seen
1122                  * from the destination in peer table, when entering
1123                  * state TIME-WAIT, and check against it before
1124                  * accepting new connection request.
1125                  *
1126                  * If "isn" is not zero, this request hit alive
1127                  * timewait bucket, so that all the necessary checks
1128                  * are made in the function processing timewait state.
1129                  */
1130                 if (tmp_opt.saw_tstamp &&
1131                     tcp_death_row.sysctl_tw_recycle &&
1132                     (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1133                         if (!tcp_peer_is_proven(req, dst, true)) {
1134                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1135                                 goto drop_and_release;
1136                         }
1137                 }
1138                 /* Kill the following clause, if you dislike this way. */
1139                 else if (!sysctl_tcp_syncookies &&
1140                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1141                           (sysctl_max_syn_backlog >> 2)) &&
1142                          !tcp_peer_is_proven(req, dst, false)) {
1143                         /* Without syncookies last quarter of
1144                          * backlog is filled with destinations,
1145                          * proven to be alive.
1146                          * It means that we continue to communicate
1147                          * to destinations, already remembered
1148                          * to the moment of synflood.
1149                          */
1150                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1151                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1152                         goto drop_and_release;
1153                 }
1154
1155                 isn = tcp_v6_init_sequence(skb);
1156         }
1157 have_isn:
1158         tcp_rsk(req)->snt_isn = isn;
1159         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1160
1161         if (security_inet_conn_request(sk, skb, req))
1162                 goto drop_and_release;
1163
1164         if (tcp_v6_send_synack(sk, dst, &fl6, req,
1165                                (struct request_values *)&tmp_ext,
1166                                skb_get_queue_mapping(skb)) ||
1167             want_cookie)
1168                 goto drop_and_free;
1169
1170         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1171         return 0;
1172
1173 drop_and_release:
1174         dst_release(dst);
1175 drop_and_free:
1176         reqsk_free(req);
1177 drop:
1178         return 0; /* don't send reset */
1179 }
1180
1181 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1182                                           struct request_sock *req,
1183                                           struct dst_entry *dst)
1184 {
1185         struct inet6_request_sock *treq;
1186         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1187         struct tcp6_sock *newtcp6sk;
1188         struct inet_sock *newinet;
1189         struct tcp_sock *newtp;
1190         struct sock *newsk;
1191 #ifdef CONFIG_TCP_MD5SIG
1192         struct tcp_md5sig_key *key;
1193 #endif
1194         struct flowi6 fl6;
1195
1196         if (skb->protocol == htons(ETH_P_IP)) {
1197                 /*
1198                  *      v6 mapped
1199                  */
1200
1201                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1202
1203                 if (newsk == NULL)
1204                         return NULL;
1205
1206                 newtcp6sk = (struct tcp6_sock *)newsk;
1207                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1208
1209                 newinet = inet_sk(newsk);
1210                 newnp = inet6_sk(newsk);
1211                 newtp = tcp_sk(newsk);
1212
1213                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1214
1215                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1216
1217                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1218
1219                 newnp->rcv_saddr = newnp->saddr;
1220
1221                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1222                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1223 #ifdef CONFIG_TCP_MD5SIG
1224                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1225 #endif
1226
1227                 newnp->ipv6_ac_list = NULL;
1228                 newnp->ipv6_fl_list = NULL;
1229                 newnp->pktoptions  = NULL;
1230                 newnp->opt         = NULL;
1231                 newnp->mcast_oif   = inet6_iif(skb);
1232                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1233                 newnp->rcv_tclass  = ipv6_tclass(ipv6_hdr(skb));
1234
1235                 /*
1236                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1237                  * here, tcp_create_openreq_child now does this for us, see the comment in
1238                  * that function for the gory details. -acme
1239                  */
1240
1241                 /* It is tricky place. Until this moment IPv4 tcp
1242                    worked with IPv6 icsk.icsk_af_ops.
1243                    Sync it now.
1244                  */
1245                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1246
1247                 return newsk;
1248         }
1249
1250         treq = inet6_rsk(req);
1251
1252         if (sk_acceptq_is_full(sk))
1253                 goto out_overflow;
1254
1255         if (!dst) {
1256                 dst = inet6_csk_route_req(sk, &fl6, req);
1257                 if (!dst)
1258                         goto out;
1259         }
1260
1261         newsk = tcp_create_openreq_child(sk, req, skb);
1262         if (newsk == NULL)
1263                 goto out_nonewsk;
1264
1265         /*
1266          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1267          * count here, tcp_create_openreq_child now does this for us, see the
1268          * comment in that function for the gory details. -acme
1269          */
1270
1271         newsk->sk_gso_type = SKB_GSO_TCPV6;
1272         __ip6_dst_store(newsk, dst, NULL, NULL);
1273
1274         newtcp6sk = (struct tcp6_sock *)newsk;
1275         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1276
1277         newtp = tcp_sk(newsk);
1278         newinet = inet_sk(newsk);
1279         newnp = inet6_sk(newsk);
1280
1281         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1282
1283         newnp->daddr = treq->rmt_addr;
1284         newnp->saddr = treq->loc_addr;
1285         newnp->rcv_saddr = treq->loc_addr;
1286         newsk->sk_bound_dev_if = treq->iif;
1287
1288         /* Now IPv6 options...
1289
1290            First: no IPv4 options.
1291          */
1292         newinet->inet_opt = NULL;
1293         newnp->ipv6_ac_list = NULL;
1294         newnp->ipv6_fl_list = NULL;
1295
1296         /* Clone RX bits */
1297         newnp->rxopt.all = np->rxopt.all;
1298
1299         /* Clone pktoptions received with SYN */
1300         newnp->pktoptions = NULL;
1301         if (treq->pktopts != NULL) {
1302                 newnp->pktoptions = skb_clone(treq->pktopts,
1303                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1304                 consume_skb(treq->pktopts);
1305                 treq->pktopts = NULL;
1306                 if (newnp->pktoptions)
1307                         skb_set_owner_r(newnp->pktoptions, newsk);
1308         }
1309         newnp->opt        = NULL;
1310         newnp->mcast_oif  = inet6_iif(skb);
1311         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1312         newnp->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
1313
1314         /* Clone native IPv6 options from listening socket (if any)
1315
1316            Yes, keeping reference count would be much more clever,
1317            but we make one more one thing there: reattach optmem
1318            to newsk.
1319          */
1320         if (np->opt)
1321                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1322
1323         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1324         if (newnp->opt)
1325                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1326                                                      newnp->opt->opt_flen);
1327
1328         tcp_mtup_init(newsk);
1329         tcp_sync_mss(newsk, dst_mtu(dst));
1330         newtp->advmss = dst_metric_advmss(dst);
1331         if (tcp_sk(sk)->rx_opt.user_mss &&
1332             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1333                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1334
1335         tcp_initialize_rcv_mss(newsk);
1336         if (tcp_rsk(req)->snt_synack)
1337                 tcp_valid_rtt_meas(newsk,
1338                     tcp_time_stamp - tcp_rsk(req)->snt_synack);
1339         newtp->total_retrans = req->retrans;
1340
1341         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1342         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1343
1344 #ifdef CONFIG_TCP_MD5SIG
1345         /* Copy over the MD5 key from the original socket */
1346         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1347                 /* We're using one, so create a matching key
1348                  * on the newsk structure. If we fail to get
1349                  * memory, then we end up not copying the key
1350                  * across. Shucks.
1351                  */
1352                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1353                                AF_INET6, key->key, key->keylen,
1354                                sk_gfp_atomic(sk, GFP_ATOMIC));
1355         }
1356 #endif
1357
1358         if (__inet_inherit_port(sk, newsk) < 0) {
1359                 sock_put(newsk);
1360                 goto out;
1361         }
1362         __inet6_hash(newsk, NULL);
1363
1364         return newsk;
1365
1366 out_overflow:
1367         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1368 out_nonewsk:
1369         dst_release(dst);
1370 out:
1371         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1372         return NULL;
1373 }
1374
1375 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1376 {
1377         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1378                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1379                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1380                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1381                         return 0;
1382                 }
1383         }
1384
1385         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1386                                               &ipv6_hdr(skb)->saddr,
1387                                               &ipv6_hdr(skb)->daddr, 0));
1388
1389         if (skb->len <= 76) {
1390                 return __skb_checksum_complete(skb);
1391         }
1392         return 0;
1393 }
1394
1395 /* The socket must have it's spinlock held when we get
1396  * here.
1397  *
1398  * We have a potential double-lock case here, so even when
1399  * doing backlog processing we use the BH locking scheme.
1400  * This is because we cannot sleep with the original spinlock
1401  * held.
1402  */
1403 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1404 {
1405         struct ipv6_pinfo *np = inet6_sk(sk);
1406         struct tcp_sock *tp;
1407         struct sk_buff *opt_skb = NULL;
1408
1409         /* Imagine: socket is IPv6. IPv4 packet arrives,
1410            goes to IPv4 receive handler and backlogged.
1411            From backlog it always goes here. Kerboom...
1412            Fortunately, tcp_rcv_established and rcv_established
1413            handle them correctly, but it is not case with
1414            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1415          */
1416
1417         if (skb->protocol == htons(ETH_P_IP))
1418                 return tcp_v4_do_rcv(sk, skb);
1419
1420 #ifdef CONFIG_TCP_MD5SIG
1421         if (tcp_v6_inbound_md5_hash (sk, skb))
1422                 goto discard;
1423 #endif
1424
1425         if (sk_filter(sk, skb))
1426                 goto discard;
1427
1428         /*
1429          *      socket locking is here for SMP purposes as backlog rcv
1430          *      is currently called with bh processing disabled.
1431          */
1432
1433         /* Do Stevens' IPV6_PKTOPTIONS.
1434
1435            Yes, guys, it is the only place in our code, where we
1436            may make it not affecting IPv4.
1437            The rest of code is protocol independent,
1438            and I do not like idea to uglify IPv4.
1439
1440            Actually, all the idea behind IPV6_PKTOPTIONS
1441            looks not very well thought. For now we latch
1442            options, received in the last packet, enqueued
1443            by tcp. Feel free to propose better solution.
1444                                                --ANK (980728)
1445          */
1446         if (np->rxopt.all)
1447                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1448
1449         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1450                 struct dst_entry *dst = sk->sk_rx_dst;
1451
1452                 sock_rps_save_rxhash(sk, skb);
1453                 if (dst) {
1454                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1455                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1456                                 dst_release(dst);
1457                                 sk->sk_rx_dst = NULL;
1458                         }
1459                 }
1460
1461                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1462                         goto reset;
1463                 if (opt_skb)
1464                         goto ipv6_pktoptions;
1465                 return 0;
1466         }
1467
1468         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1469                 goto csum_err;
1470
1471         if (sk->sk_state == TCP_LISTEN) {
1472                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1473                 if (!nsk)
1474                         goto discard;
1475
1476                 /*
1477                  * Queue it on the new socket if the new socket is active,
1478                  * otherwise we just shortcircuit this and continue with
1479                  * the new socket..
1480                  */
1481                 if(nsk != sk) {
1482                         sock_rps_save_rxhash(nsk, skb);
1483                         if (tcp_child_process(sk, nsk, skb))
1484                                 goto reset;
1485                         if (opt_skb)
1486                                 __kfree_skb(opt_skb);
1487                         return 0;
1488                 }
1489         } else
1490                 sock_rps_save_rxhash(sk, skb);
1491
1492         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1493                 goto reset;
1494         if (opt_skb)
1495                 goto ipv6_pktoptions;
1496         return 0;
1497
1498 reset:
1499         tcp_v6_send_reset(sk, skb);
1500 discard:
1501         if (opt_skb)
1502                 __kfree_skb(opt_skb);
1503         kfree_skb(skb);
1504         return 0;
1505 csum_err:
1506         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1507         goto discard;
1508
1509
1510 ipv6_pktoptions:
1511         /* Do you ask, what is it?
1512
1513            1. skb was enqueued by tcp.
1514            2. skb is added to tail of read queue, rather than out of order.
1515            3. socket is not in passive state.
1516            4. Finally, it really contains options, which user wants to receive.
1517          */
1518         tp = tcp_sk(sk);
1519         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1520             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1521                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1522                         np->mcast_oif = inet6_iif(opt_skb);
1523                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1524                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1525                 if (np->rxopt.bits.rxtclass)
1526                         np->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
1527                 if (ipv6_opt_accepted(sk, opt_skb)) {
1528                         skb_set_owner_r(opt_skb, sk);
1529                         opt_skb = xchg(&np->pktoptions, opt_skb);
1530                 } else {
1531                         __kfree_skb(opt_skb);
1532                         opt_skb = xchg(&np->pktoptions, NULL);
1533                 }
1534         }
1535
1536         kfree_skb(opt_skb);
1537         return 0;
1538 }
1539
1540 static int tcp_v6_rcv(struct sk_buff *skb)
1541 {
1542         const struct tcphdr *th;
1543         const struct ipv6hdr *hdr;
1544         struct sock *sk;
1545         int ret;
1546         struct net *net = dev_net(skb->dev);
1547
1548         if (skb->pkt_type != PACKET_HOST)
1549                 goto discard_it;
1550
1551         /*
1552          *      Count it even if it's bad.
1553          */
1554         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1555
1556         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1557                 goto discard_it;
1558
1559         th = tcp_hdr(skb);
1560
1561         if (th->doff < sizeof(struct tcphdr)/4)
1562                 goto bad_packet;
1563         if (!pskb_may_pull(skb, th->doff*4))
1564                 goto discard_it;
1565
1566         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1567                 goto bad_packet;
1568
1569         th = tcp_hdr(skb);
1570         hdr = ipv6_hdr(skb);
1571         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1572         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1573                                     skb->len - th->doff*4);
1574         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1575         TCP_SKB_CB(skb)->when = 0;
1576         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1577         TCP_SKB_CB(skb)->sacked = 0;
1578
1579         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1580         if (!sk)
1581                 goto no_tcp_socket;
1582
1583 process:
1584         if (sk->sk_state == TCP_TIME_WAIT)
1585                 goto do_time_wait;
1586
1587         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1588                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1589                 goto discard_and_relse;
1590         }
1591
1592         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1593                 goto discard_and_relse;
1594
1595         if (sk_filter(sk, skb))
1596                 goto discard_and_relse;
1597
1598         skb->dev = NULL;
1599
1600         bh_lock_sock_nested(sk);
1601         ret = 0;
1602         if (!sock_owned_by_user(sk)) {
1603 #ifdef CONFIG_NET_DMA
1604                 struct tcp_sock *tp = tcp_sk(sk);
1605                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1606                         tp->ucopy.dma_chan = net_dma_find_channel();
1607                 if (tp->ucopy.dma_chan)
1608                         ret = tcp_v6_do_rcv(sk, skb);
1609                 else
1610 #endif
1611                 {
1612                         if (!tcp_prequeue(sk, skb))
1613                                 ret = tcp_v6_do_rcv(sk, skb);
1614                 }
1615         } else if (unlikely(sk_add_backlog(sk, skb,
1616                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1617                 bh_unlock_sock(sk);
1618                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1619                 goto discard_and_relse;
1620         }
1621         bh_unlock_sock(sk);
1622
1623         sock_put(sk);
1624         return ret ? -1 : 0;
1625
1626 no_tcp_socket:
1627         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1628                 goto discard_it;
1629
1630         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1631 bad_packet:
1632                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1633         } else {
1634                 tcp_v6_send_reset(NULL, skb);
1635         }
1636
1637 discard_it:
1638
1639         /*
1640          *      Discard frame
1641          */
1642
1643         kfree_skb(skb);
1644         return 0;
1645
1646 discard_and_relse:
1647         sock_put(sk);
1648         goto discard_it;
1649
1650 do_time_wait:
1651         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1652                 inet_twsk_put(inet_twsk(sk));
1653                 goto discard_it;
1654         }
1655
1656         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1657                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1658                 inet_twsk_put(inet_twsk(sk));
1659                 goto discard_it;
1660         }
1661
1662         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1663         case TCP_TW_SYN:
1664         {
1665                 struct sock *sk2;
1666
1667                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1668                                             &ipv6_hdr(skb)->daddr,
1669                                             ntohs(th->dest), inet6_iif(skb));
1670                 if (sk2 != NULL) {
1671                         struct inet_timewait_sock *tw = inet_twsk(sk);
1672                         inet_twsk_deschedule(tw, &tcp_death_row);
1673                         inet_twsk_put(tw);
1674                         sk = sk2;
1675                         goto process;
1676                 }
1677                 /* Fall through to ACK */
1678         }
1679         case TCP_TW_ACK:
1680                 tcp_v6_timewait_ack(sk, skb);
1681                 break;
1682         case TCP_TW_RST:
1683                 goto no_tcp_socket;
1684         case TCP_TW_SUCCESS:;
1685         }
1686         goto discard_it;
1687 }
1688
1689 static void tcp_v6_early_demux(struct sk_buff *skb)
1690 {
1691         const struct ipv6hdr *hdr;
1692         const struct tcphdr *th;
1693         struct sock *sk;
1694
1695         if (skb->pkt_type != PACKET_HOST)
1696                 return;
1697
1698         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1699                 return;
1700
1701         hdr = ipv6_hdr(skb);
1702         th = tcp_hdr(skb);
1703
1704         if (th->doff < sizeof(struct tcphdr) / 4)
1705                 return;
1706
1707         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1708                                         &hdr->saddr, th->source,
1709                                         &hdr->daddr, ntohs(th->dest),
1710                                         inet6_iif(skb));
1711         if (sk) {
1712                 skb->sk = sk;
1713                 skb->destructor = sock_edemux;
1714                 if (sk->sk_state != TCP_TIME_WAIT) {
1715                         struct dst_entry *dst = sk->sk_rx_dst;
1716                         struct inet_sock *icsk = inet_sk(sk);
1717                         if (dst)
1718                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1719                         if (dst &&
1720                             icsk->rx_dst_ifindex == skb->skb_iif)
1721                                 skb_dst_set_noref(skb, dst);
1722                 }
1723         }
1724 }
1725
1726 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1727         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1728         .twsk_unique    = tcp_twsk_unique,
1729         .twsk_destructor= tcp_twsk_destructor,
1730 };
1731
1732 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
1733 {
1734         struct dst_entry *dst = skb_dst(skb);
1735         const struct rt6_info *rt = (const struct rt6_info *)dst;
1736
1737         dst_hold(dst);
1738         sk->sk_rx_dst = dst;
1739         inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
1740         if (rt->rt6i_node)
1741                 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
1742 }
1743
1744 static const struct inet_connection_sock_af_ops ipv6_specific = {
1745         .queue_xmit        = inet6_csk_xmit,
1746         .send_check        = tcp_v6_send_check,
1747         .rebuild_header    = inet6_sk_rebuild_header,
1748         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1749         .conn_request      = tcp_v6_conn_request,
1750         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1751         .net_header_len    = sizeof(struct ipv6hdr),
1752         .net_frag_header_len = sizeof(struct frag_hdr),
1753         .setsockopt        = ipv6_setsockopt,
1754         .getsockopt        = ipv6_getsockopt,
1755         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1756         .sockaddr_len      = sizeof(struct sockaddr_in6),
1757         .bind_conflict     = inet6_csk_bind_conflict,
1758 #ifdef CONFIG_COMPAT
1759         .compat_setsockopt = compat_ipv6_setsockopt,
1760         .compat_getsockopt = compat_ipv6_getsockopt,
1761 #endif
1762 };
1763
1764 #ifdef CONFIG_TCP_MD5SIG
1765 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1766         .md5_lookup     =       tcp_v6_md5_lookup,
1767         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1768         .md5_parse      =       tcp_v6_parse_md5_keys,
1769 };
1770 #endif
1771
1772 /*
1773  *      TCP over IPv4 via INET6 API
1774  */
1775
1776 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1777         .queue_xmit        = ip_queue_xmit,
1778         .send_check        = tcp_v4_send_check,
1779         .rebuild_header    = inet_sk_rebuild_header,
1780         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1781         .conn_request      = tcp_v6_conn_request,
1782         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1783         .net_header_len    = sizeof(struct iphdr),
1784         .setsockopt        = ipv6_setsockopt,
1785         .getsockopt        = ipv6_getsockopt,
1786         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1787         .sockaddr_len      = sizeof(struct sockaddr_in6),
1788         .bind_conflict     = inet6_csk_bind_conflict,
1789 #ifdef CONFIG_COMPAT
1790         .compat_setsockopt = compat_ipv6_setsockopt,
1791         .compat_getsockopt = compat_ipv6_getsockopt,
1792 #endif
1793 };
1794
1795 #ifdef CONFIG_TCP_MD5SIG
1796 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1797         .md5_lookup     =       tcp_v4_md5_lookup,
1798         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1799         .md5_parse      =       tcp_v6_parse_md5_keys,
1800 };
1801 #endif
1802
1803 /* NOTE: A lot of things set to zero explicitly by call to
1804  *       sk_alloc() so need not be done here.
1805  */
1806 static int tcp_v6_init_sock(struct sock *sk)
1807 {
1808         struct inet_connection_sock *icsk = inet_csk(sk);
1809
1810         tcp_init_sock(sk);
1811
1812         icsk->icsk_af_ops = &ipv6_specific;
1813
1814 #ifdef CONFIG_TCP_MD5SIG
1815         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1816 #endif
1817
1818         return 0;
1819 }
1820
1821 static void tcp_v6_destroy_sock(struct sock *sk)
1822 {
1823         tcp_v4_destroy_sock(sk);
1824         inet6_destroy_sock(sk);
1825 }
1826
1827 #ifdef CONFIG_PROC_FS
1828 /* Proc filesystem TCPv6 sock list dumping. */
1829 static void get_openreq6(struct seq_file *seq,
1830                          const struct sock *sk, struct request_sock *req, int i, int uid)
1831 {
1832         int ttd = req->expires - jiffies;
1833         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1834         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1835
1836         if (ttd < 0)
1837                 ttd = 0;
1838
1839         seq_printf(seq,
1840                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1841                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1842                    i,
1843                    src->s6_addr32[0], src->s6_addr32[1],
1844                    src->s6_addr32[2], src->s6_addr32[3],
1845                    ntohs(inet_rsk(req)->loc_port),
1846                    dest->s6_addr32[0], dest->s6_addr32[1],
1847                    dest->s6_addr32[2], dest->s6_addr32[3],
1848                    ntohs(inet_rsk(req)->rmt_port),
1849                    TCP_SYN_RECV,
1850                    0,0, /* could print option size, but that is af dependent. */
1851                    1,   /* timers active (only the expire timer) */
1852                    jiffies_to_clock_t(ttd),
1853                    req->retrans,
1854                    uid,
1855                    0,  /* non standard timer */
1856                    0, /* open_requests have no inode */
1857                    0, req);
1858 }
1859
1860 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1861 {
1862         const struct in6_addr *dest, *src;
1863         __u16 destp, srcp;
1864         int timer_active;
1865         unsigned long timer_expires;
1866         const struct inet_sock *inet = inet_sk(sp);
1867         const struct tcp_sock *tp = tcp_sk(sp);
1868         const struct inet_connection_sock *icsk = inet_csk(sp);
1869         const struct ipv6_pinfo *np = inet6_sk(sp);
1870
1871         dest  = &np->daddr;
1872         src   = &np->rcv_saddr;
1873         destp = ntohs(inet->inet_dport);
1874         srcp  = ntohs(inet->inet_sport);
1875
1876         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1877                 timer_active    = 1;
1878                 timer_expires   = icsk->icsk_timeout;
1879         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1880                 timer_active    = 4;
1881                 timer_expires   = icsk->icsk_timeout;
1882         } else if (timer_pending(&sp->sk_timer)) {
1883                 timer_active    = 2;
1884                 timer_expires   = sp->sk_timer.expires;
1885         } else {
1886                 timer_active    = 0;
1887                 timer_expires = jiffies;
1888         }
1889
1890         seq_printf(seq,
1891                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1892                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
1893                    i,
1894                    src->s6_addr32[0], src->s6_addr32[1],
1895                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1896                    dest->s6_addr32[0], dest->s6_addr32[1],
1897                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1898                    sp->sk_state,
1899                    tp->write_seq-tp->snd_una,
1900                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1901                    timer_active,
1902                    jiffies_to_clock_t(timer_expires - jiffies),
1903                    icsk->icsk_retransmits,
1904                    sock_i_uid(sp),
1905                    icsk->icsk_probes_out,
1906                    sock_i_ino(sp),
1907                    atomic_read(&sp->sk_refcnt), sp,
1908                    jiffies_to_clock_t(icsk->icsk_rto),
1909                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1910                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1911                    tp->snd_cwnd,
1912                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1913                    );
1914 }
1915
1916 static void get_timewait6_sock(struct seq_file *seq,
1917                                struct inet_timewait_sock *tw, int i)
1918 {
1919         const struct in6_addr *dest, *src;
1920         __u16 destp, srcp;
1921         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1922         int ttd = tw->tw_ttd - jiffies;
1923
1924         if (ttd < 0)
1925                 ttd = 0;
1926
1927         dest = &tw6->tw_v6_daddr;
1928         src  = &tw6->tw_v6_rcv_saddr;
1929         destp = ntohs(tw->tw_dport);
1930         srcp  = ntohs(tw->tw_sport);
1931
1932         seq_printf(seq,
1933                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1934                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1935                    i,
1936                    src->s6_addr32[0], src->s6_addr32[1],
1937                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1938                    dest->s6_addr32[0], dest->s6_addr32[1],
1939                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1940                    tw->tw_substate, 0, 0,
1941                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
1942                    atomic_read(&tw->tw_refcnt), tw);
1943 }
1944
1945 static int tcp6_seq_show(struct seq_file *seq, void *v)
1946 {
1947         struct tcp_iter_state *st;
1948
1949         if (v == SEQ_START_TOKEN) {
1950                 seq_puts(seq,
1951                          "  sl  "
1952                          "local_address                         "
1953                          "remote_address                        "
1954                          "st tx_queue rx_queue tr tm->when retrnsmt"
1955                          "   uid  timeout inode\n");
1956                 goto out;
1957         }
1958         st = seq->private;
1959
1960         switch (st->state) {
1961         case TCP_SEQ_STATE_LISTENING:
1962         case TCP_SEQ_STATE_ESTABLISHED:
1963                 get_tcp6_sock(seq, v, st->num);
1964                 break;
1965         case TCP_SEQ_STATE_OPENREQ:
1966                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1967                 break;
1968         case TCP_SEQ_STATE_TIME_WAIT:
1969                 get_timewait6_sock(seq, v, st->num);
1970                 break;
1971         }
1972 out:
1973         return 0;
1974 }
1975
1976 static const struct file_operations tcp6_afinfo_seq_fops = {
1977         .owner   = THIS_MODULE,
1978         .open    = tcp_seq_open,
1979         .read    = seq_read,
1980         .llseek  = seq_lseek,
1981         .release = seq_release_net
1982 };
1983
1984 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1985         .name           = "tcp6",
1986         .family         = AF_INET6,
1987         .seq_fops       = &tcp6_afinfo_seq_fops,
1988         .seq_ops        = {
1989                 .show           = tcp6_seq_show,
1990         },
1991 };
1992
1993 int __net_init tcp6_proc_init(struct net *net)
1994 {
1995         return tcp_proc_register(net, &tcp6_seq_afinfo);
1996 }
1997
1998 void tcp6_proc_exit(struct net *net)
1999 {
2000         tcp_proc_unregister(net, &tcp6_seq_afinfo);
2001 }
2002 #endif
2003
2004 struct proto tcpv6_prot = {
2005         .name                   = "TCPv6",
2006         .owner                  = THIS_MODULE,
2007         .close                  = tcp_close,
2008         .connect                = tcp_v6_connect,
2009         .disconnect             = tcp_disconnect,
2010         .accept                 = inet_csk_accept,
2011         .ioctl                  = tcp_ioctl,
2012         .init                   = tcp_v6_init_sock,
2013         .destroy                = tcp_v6_destroy_sock,
2014         .shutdown               = tcp_shutdown,
2015         .setsockopt             = tcp_setsockopt,
2016         .getsockopt             = tcp_getsockopt,
2017         .recvmsg                = tcp_recvmsg,
2018         .sendmsg                = tcp_sendmsg,
2019         .sendpage               = tcp_sendpage,
2020         .backlog_rcv            = tcp_v6_do_rcv,
2021         .release_cb             = tcp_release_cb,
2022         .mtu_reduced            = tcp_v6_mtu_reduced,
2023         .hash                   = tcp_v6_hash,
2024         .unhash                 = inet_unhash,
2025         .get_port               = inet_csk_get_port,
2026         .enter_memory_pressure  = tcp_enter_memory_pressure,
2027         .sockets_allocated      = &tcp_sockets_allocated,
2028         .memory_allocated       = &tcp_memory_allocated,
2029         .memory_pressure        = &tcp_memory_pressure,
2030         .orphan_count           = &tcp_orphan_count,
2031         .sysctl_wmem            = sysctl_tcp_wmem,
2032         .sysctl_rmem            = sysctl_tcp_rmem,
2033         .max_header             = MAX_TCP_HEADER,
2034         .obj_size               = sizeof(struct tcp6_sock),
2035         .slab_flags             = SLAB_DESTROY_BY_RCU,
2036         .twsk_prot              = &tcp6_timewait_sock_ops,
2037         .rsk_prot               = &tcp6_request_sock_ops,
2038         .h.hashinfo             = &tcp_hashinfo,
2039         .no_autobind            = true,
2040 #ifdef CONFIG_COMPAT
2041         .compat_setsockopt      = compat_tcp_setsockopt,
2042         .compat_getsockopt      = compat_tcp_getsockopt,
2043 #endif
2044 #ifdef CONFIG_MEMCG_KMEM
2045         .proto_cgroup           = tcp_proto_cgroup,
2046 #endif
2047 };
2048
2049 static const struct inet6_protocol tcpv6_protocol = {
2050         .early_demux    =       tcp_v6_early_demux,
2051         .handler        =       tcp_v6_rcv,
2052         .err_handler    =       tcp_v6_err,
2053         .gso_send_check =       tcp_v6_gso_send_check,
2054         .gso_segment    =       tcp_tso_segment,
2055         .gro_receive    =       tcp6_gro_receive,
2056         .gro_complete   =       tcp6_gro_complete,
2057         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2058 };
2059
2060 static struct inet_protosw tcpv6_protosw = {
2061         .type           =       SOCK_STREAM,
2062         .protocol       =       IPPROTO_TCP,
2063         .prot           =       &tcpv6_prot,
2064         .ops            =       &inet6_stream_ops,
2065         .no_check       =       0,
2066         .flags          =       INET_PROTOSW_PERMANENT |
2067                                 INET_PROTOSW_ICSK,
2068 };
2069
2070 static int __net_init tcpv6_net_init(struct net *net)
2071 {
2072         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2073                                     SOCK_RAW, IPPROTO_TCP, net);
2074 }
2075
2076 static void __net_exit tcpv6_net_exit(struct net *net)
2077 {
2078         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2079 }
2080
2081 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2082 {
2083         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2084 }
2085
2086 static struct pernet_operations tcpv6_net_ops = {
2087         .init       = tcpv6_net_init,
2088         .exit       = tcpv6_net_exit,
2089         .exit_batch = tcpv6_net_exit_batch,
2090 };
2091
2092 int __init tcpv6_init(void)
2093 {
2094         int ret;
2095
2096         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2097         if (ret)
2098                 goto out;
2099
2100         /* register inet6 protocol */
2101         ret = inet6_register_protosw(&tcpv6_protosw);
2102         if (ret)
2103                 goto out_tcpv6_protocol;
2104
2105         ret = register_pernet_subsys(&tcpv6_net_ops);
2106         if (ret)
2107                 goto out_tcpv6_protosw;
2108 out:
2109         return ret;
2110
2111 out_tcpv6_protocol:
2112         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2113 out_tcpv6_protosw:
2114         inet6_unregister_protosw(&tcpv6_protosw);
2115         goto out;
2116 }
2117
2118 void tcpv6_exit(void)
2119 {
2120         unregister_pernet_subsys(&tcpv6_net_ops);
2121         inet6_unregister_protosw(&tcpv6_protosw);
2122         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2123 }