active-standby: add cmdline into /proc/net/
[linux-2.6.git] / net / ipv4 / tcp_ipv4.c
1 /*
2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
3  *              operating system.  INET is implemented using the  BSD Socket
4  *              interface as the means of communication with the user level.
5  *
6  *              Implementation of the Transmission Control Protocol(TCP).
7  *
8  *              IPv4 specific functions
9  *
10  *
11  *              code split from:
12  *              linux/ipv4/tcp.c
13  *              linux/ipv4/tcp_input.c
14  *              linux/ipv4/tcp_output.c
15  *
16  *              See tcp.c for author information
17  *
18  *      This program is free software; you can redistribute it and/or
19  *      modify it under the terms of the GNU General Public License
20  *      as published by the Free Software Foundation; either version
21  *      2 of the License, or (at your option) any later version.
22  */
23
24 /*
25  * Changes:
26  *              David S. Miller :       New socket lookup architecture.
27  *                                      This code is dedicated to John Dyson.
28  *              David S. Miller :       Change semantics of established hash,
29  *                                      half is devoted to TIME_WAIT sockets
30  *                                      and the rest go in the other half.
31  *              Andi Kleen :            Add support for syncookies and fixed
32  *                                      some bugs: ip options weren't passed to
33  *                                      the TCP layer, missed a check for an
34  *                                      ACK bit.
35  *              Andi Kleen :            Implemented fast path mtu discovery.
36  *                                      Fixed many serious bugs in the
37  *                                      request_sock handling and moved
38  *                                      most of it into the af independent code.
39  *                                      Added tail drop and some other bugfixes.
40  *                                      Added new listen semantics.
41  *              Mike McLagan    :       Routing by source
42  *      Juan Jose Ciarlante:            ip_dynaddr bits
43  *              Andi Kleen:             various fixes.
44  *      Vitaly E. Lavrov        :       Transparent proxy revived after year
45  *                                      coma.
46  *      Andi Kleen              :       Fix new listen.
47  *      Andi Kleen              :       Fix accept error reporting.
48  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
49  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
50  *                                      a single port at the same time.
51  *
52  * Copyright (c) 2013, NVIDIA CORPORATION.  All rights reserved.
53  */
54
55 #define pr_fmt(fmt) "TCP: " fmt
56
57 #include <linux/bottom_half.h>
58 #include <linux/types.h>
59 #include <linux/fcntl.h>
60 #include <linux/module.h>
61 #include <linux/random.h>
62 #include <linux/cache.h>
63 #include <linux/jhash.h>
64 #include <linux/init.h>
65 #include <linux/times.h>
66 #include <linux/slab.h>
67
68 #include <net/net_namespace.h>
69 #include <net/icmp.h>
70 #include <net/inet_hashtables.h>
71 #include <net/tcp.h>
72 #include <net/transp_v6.h>
73 #include <net/ipv6.h>
74 #include <net/inet_common.h>
75 #include <net/timewait_sock.h>
76 #include <net/xfrm.h>
77 #include <net/netdma.h>
78 #include <net/secure_seq.h>
79 #include <net/tcp_memcontrol.h>
80
81 #include <linux/inet.h>
82 #include <linux/ipv6.h>
83 #include <linux/stddef.h>
84 #include <linux/proc_fs.h>
85 #include <linux/seq_file.h>
86
87 #include <linux/crypto.h>
88 #include <linux/scatterlist.h>
89
90 int sysctl_tcp_tw_reuse __read_mostly;
91 int sysctl_tcp_low_latency __read_mostly;
92 EXPORT_SYMBOL(sysctl_tcp_low_latency);
93
94
95 #ifdef CONFIG_TCP_MD5SIG
96 static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
97                                __be32 daddr, __be32 saddr, const struct tcphdr *th);
98 #endif
99
100 struct inet_hashinfo tcp_hashinfo;
101 EXPORT_SYMBOL(tcp_hashinfo);
102
103 static inline __u32 tcp_v4_init_sequence(const struct sk_buff *skb)
104 {
105         return secure_tcp_sequence_number(ip_hdr(skb)->daddr,
106                                           ip_hdr(skb)->saddr,
107                                           tcp_hdr(skb)->dest,
108                                           tcp_hdr(skb)->source);
109 }
110
111 int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
112 {
113         const struct tcp_timewait_sock *tcptw = tcp_twsk(sktw);
114         struct tcp_sock *tp = tcp_sk(sk);
115
116         /* With PAWS, it is safe from the viewpoint
117            of data integrity. Even without PAWS it is safe provided sequence
118            spaces do not overlap i.e. at data rates <= 80Mbit/sec.
119
120            Actually, the idea is close to VJ's one, only timestamp cache is
121            held not per host, but per port pair and TW bucket is used as state
122            holder.
123
124            If TW bucket has been already destroyed we fall back to VJ's scheme
125            and use initial timestamp retrieved from peer table.
126          */
127         if (tcptw->tw_ts_recent_stamp &&
128             (twp == NULL || (sysctl_tcp_tw_reuse &&
129                              get_seconds() - tcptw->tw_ts_recent_stamp > 1))) {
130                 tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
131                 if (tp->write_seq == 0)
132                         tp->write_seq = 1;
133                 tp->rx_opt.ts_recent       = tcptw->tw_ts_recent;
134                 tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
135                 sock_hold(sktw);
136                 return 1;
137         }
138
139         return 0;
140 }
141 EXPORT_SYMBOL_GPL(tcp_twsk_unique);
142
143 /* This will initiate an outgoing connection. */
144 int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
145 {
146         struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
147         struct inet_sock *inet = inet_sk(sk);
148         struct tcp_sock *tp = tcp_sk(sk);
149         __be16 orig_sport, orig_dport;
150         __be32 daddr, nexthop;
151         struct flowi4 *fl4;
152         struct rtable *rt;
153         int err;
154         struct ip_options_rcu *inet_opt;
155
156         if (addr_len < sizeof(struct sockaddr_in))
157                 return -EINVAL;
158
159         if (usin->sin_family != AF_INET)
160                 return -EAFNOSUPPORT;
161
162         nexthop = daddr = usin->sin_addr.s_addr;
163         inet_opt = rcu_dereference_protected(inet->inet_opt,
164                                              sock_owned_by_user(sk));
165         if (inet_opt && inet_opt->opt.srr) {
166                 if (!daddr)
167                         return -EINVAL;
168                 nexthop = inet_opt->opt.faddr;
169         }
170
171         orig_sport = inet->inet_sport;
172         orig_dport = usin->sin_port;
173         fl4 = &inet->cork.fl.u.ip4;
174         rt = ip_route_connect(fl4, nexthop, inet->inet_saddr,
175                               RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
176                               IPPROTO_TCP,
177                               orig_sport, orig_dport, sk, true);
178         if (IS_ERR(rt)) {
179                 err = PTR_ERR(rt);
180                 if (err == -ENETUNREACH)
181                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
182                 return err;
183         }
184
185         if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) {
186                 ip_rt_put(rt);
187                 return -ENETUNREACH;
188         }
189
190         if (!inet_opt || !inet_opt->opt.srr)
191                 daddr = fl4->daddr;
192
193         if (!inet->inet_saddr)
194                 inet->inet_saddr = fl4->saddr;
195         inet->inet_rcv_saddr = inet->inet_saddr;
196
197         if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
198                 /* Reset inherited state */
199                 tp->rx_opt.ts_recent       = 0;
200                 tp->rx_opt.ts_recent_stamp = 0;
201                 tp->write_seq              = 0;
202         }
203
204         if (tcp_death_row.sysctl_tw_recycle &&
205             !tp->rx_opt.ts_recent_stamp && fl4->daddr == daddr) {
206                 struct inet_peer *peer = rt_get_peer(rt, fl4->daddr);
207                 /*
208                  * VJ's idea. We save last timestamp seen from
209                  * the destination in peer table, when entering state
210                  * TIME-WAIT * and initialize rx_opt.ts_recent from it,
211                  * when trying new connection.
212                  */
213                 if (peer) {
214                         inet_peer_refcheck(peer);
215                         if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
216                                 tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
217                                 tp->rx_opt.ts_recent = peer->tcp_ts;
218                         }
219                 }
220         }
221
222         inet->inet_dport = usin->sin_port;
223         inet->inet_daddr = daddr;
224
225         inet_csk(sk)->icsk_ext_hdr_len = 0;
226         if (inet_opt)
227                 inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
228
229         tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT;
230
231         /* Socket identity is still unknown (sport may be zero).
232          * However we set state to SYN-SENT and not releasing socket
233          * lock select source port, enter ourselves into the hash tables and
234          * complete initialization after this.
235          */
236         tcp_set_state(sk, TCP_SYN_SENT);
237         err = inet_hash_connect(&tcp_death_row, sk);
238         if (err)
239                 goto failure;
240
241         rt = ip_route_newports(fl4, rt, orig_sport, orig_dport,
242                                inet->inet_sport, inet->inet_dport, sk);
243         if (IS_ERR(rt)) {
244                 err = PTR_ERR(rt);
245                 rt = NULL;
246                 goto failure;
247         }
248         /* OK, now commit destination to socket.  */
249         sk->sk_gso_type = SKB_GSO_TCPV4;
250         sk_setup_caps(sk, &rt->dst);
251
252         if (!tp->write_seq)
253                 tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr,
254                                                            inet->inet_daddr,
255                                                            inet->inet_sport,
256                                                            usin->sin_port);
257
258         inet->inet_id = tp->write_seq ^ jiffies;
259
260         err = tcp_connect(sk);
261         rt = NULL;
262         if (err)
263                 goto failure;
264
265         return 0;
266
267 failure:
268         /*
269          * This unhashes the socket and releases the local port,
270          * if necessary.
271          */
272         tcp_set_state(sk, TCP_CLOSE);
273         ip_rt_put(rt);
274         sk->sk_route_caps = 0;
275         inet->inet_dport = 0;
276         return err;
277 }
278 EXPORT_SYMBOL(tcp_v4_connect);
279
280 /*
281  * This routine does path mtu discovery as defined in RFC1191.
282  */
283 static void do_pmtu_discovery(struct sock *sk, const struct iphdr *iph, u32 mtu)
284 {
285         struct dst_entry *dst;
286         struct inet_sock *inet = inet_sk(sk);
287
288         /* We are not interested in TCP_LISTEN and open_requests (SYN-ACKs
289          * send out by Linux are always <576bytes so they should go through
290          * unfragmented).
291          */
292         if (sk->sk_state == TCP_LISTEN)
293                 return;
294
295         /* We don't check in the destentry if pmtu discovery is forbidden
296          * on this route. We just assume that no packet_to_big packets
297          * are send back when pmtu discovery is not active.
298          * There is a small race when the user changes this flag in the
299          * route, but I think that's acceptable.
300          */
301         if ((dst = __sk_dst_check(sk, 0)) == NULL)
302                 return;
303
304         dst->ops->update_pmtu(dst, mtu);
305
306         /* Something is about to be wrong... Remember soft error
307          * for the case, if this connection will not able to recover.
308          */
309         if (mtu < dst_mtu(dst) && ip_dont_fragment(sk, dst))
310                 sk->sk_err_soft = EMSGSIZE;
311
312         mtu = dst_mtu(dst);
313
314         if (inet->pmtudisc != IP_PMTUDISC_DONT &&
315             inet_csk(sk)->icsk_pmtu_cookie > mtu) {
316                 tcp_sync_mss(sk, mtu);
317
318                 /* Resend the TCP packet because it's
319                  * clear that the old packet has been
320                  * dropped. This is the new "fast" path mtu
321                  * discovery.
322                  */
323                 tcp_simple_retransmit(sk);
324         } /* else let the usual retransmit timer handle it */
325 }
326
327 /*
328  * This routine is called by the ICMP module when it gets some
329  * sort of error condition.  If err < 0 then the socket should
330  * be closed and the error returned to the user.  If err > 0
331  * it's just the icmp type << 8 | icmp code.  After adjustment
332  * header points to the first 8 bytes of the tcp header.  We need
333  * to find the appropriate port.
334  *
335  * The locking strategy used here is very "optimistic". When
336  * someone else accesses the socket the ICMP is just dropped
337  * and for some paths there is no check at all.
338  * A more general error queue to queue errors for later handling
339  * is probably better.
340  *
341  */
342
343 void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
344 {
345         const struct iphdr *iph = (const struct iphdr *)icmp_skb->data;
346         struct tcphdr *th = (struct tcphdr *)(icmp_skb->data + (iph->ihl << 2));
347         struct inet_connection_sock *icsk;
348         struct tcp_sock *tp;
349         struct inet_sock *inet;
350         const int type = icmp_hdr(icmp_skb)->type;
351         const int code = icmp_hdr(icmp_skb)->code;
352         struct sock *sk;
353         struct sk_buff *skb;
354         __u32 seq;
355         __u32 remaining;
356         int err;
357         struct net *net = dev_net(icmp_skb->dev);
358
359         if (icmp_skb->len < (iph->ihl << 2) + 8) {
360                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
361                 return;
362         }
363
364         sk = inet_lookup(net, &tcp_hashinfo, iph->daddr, th->dest,
365                         iph->saddr, th->source, inet_iif(icmp_skb));
366         if (!sk) {
367                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
368                 return;
369         }
370         if (sk->sk_state == TCP_TIME_WAIT) {
371                 inet_twsk_put(inet_twsk(sk));
372                 return;
373         }
374
375         bh_lock_sock(sk);
376         /* If too many ICMPs get dropped on busy
377          * servers this needs to be solved differently.
378          */
379         if (sock_owned_by_user(sk))
380                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
381
382         if (sk->sk_state == TCP_CLOSE)
383                 goto out;
384
385         if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
386                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
387                 goto out;
388         }
389
390         icsk = inet_csk(sk);
391         tp = tcp_sk(sk);
392         seq = ntohl(th->seq);
393         if (sk->sk_state != TCP_LISTEN &&
394             !between(seq, tp->snd_una, tp->snd_nxt)) {
395                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
396                 goto out;
397         }
398
399         switch (type) {
400         case ICMP_SOURCE_QUENCH:
401                 /* Just silently ignore these. */
402                 goto out;
403         case ICMP_PARAMETERPROB:
404                 err = EPROTO;
405                 break;
406         case ICMP_DEST_UNREACH:
407                 if (code > NR_ICMP_UNREACH)
408                         goto out;
409
410                 if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */
411                         if (!sock_owned_by_user(sk))
412                                 do_pmtu_discovery(sk, iph, info);
413                         goto out;
414                 }
415
416                 err = icmp_err_convert[code].errno;
417                 /* check if icmp_skb allows revert of backoff
418                  * (see draft-zimmermann-tcp-lcd) */
419                 if (code != ICMP_NET_UNREACH && code != ICMP_HOST_UNREACH)
420                         break;
421                 if (seq != tp->snd_una  || !icsk->icsk_retransmits ||
422                     !icsk->icsk_backoff)
423                         break;
424
425                 if (sock_owned_by_user(sk))
426                         break;
427
428                 icsk->icsk_backoff--;
429                 inet_csk(sk)->icsk_rto = (tp->srtt ? __tcp_set_rto(tp) :
430                         TCP_TIMEOUT_INIT) << icsk->icsk_backoff;
431                 tcp_bound_rto(sk);
432
433                 skb = tcp_write_queue_head(sk);
434                 BUG_ON(!skb);
435
436                 remaining = icsk->icsk_rto - min(icsk->icsk_rto,
437                                 tcp_time_stamp - TCP_SKB_CB(skb)->when);
438
439                 if (remaining) {
440                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
441                                                   remaining, TCP_RTO_MAX);
442                 } else {
443                         /* RTO revert clocked out retransmission.
444                          * Will retransmit now */
445                         tcp_retransmit_timer(sk);
446                 }
447
448                 break;
449         case ICMP_TIME_EXCEEDED:
450                 err = EHOSTUNREACH;
451                 break;
452         default:
453                 goto out;
454         }
455
456         switch (sk->sk_state) {
457                 struct request_sock *req, **prev;
458         case TCP_LISTEN:
459                 if (sock_owned_by_user(sk))
460                         goto out;
461
462                 req = inet_csk_search_req(sk, &prev, th->dest,
463                                           iph->daddr, iph->saddr);
464                 if (!req)
465                         goto out;
466
467                 /* ICMPs are not backlogged, hence we cannot get
468                    an established socket here.
469                  */
470                 WARN_ON(req->sk);
471
472                 if (seq != tcp_rsk(req)->snt_isn) {
473                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
474                         goto out;
475                 }
476
477                 /*
478                  * Still in SYN_RECV, just remove it silently.
479                  * There is no good way to pass the error to the newly
480                  * created socket, and POSIX does not want network
481                  * errors returned from accept().
482                  */
483                 inet_csk_reqsk_queue_drop(sk, req, prev);
484                 goto out;
485
486         case TCP_SYN_SENT:
487         case TCP_SYN_RECV:  /* Cannot happen.
488                                It can f.e. if SYNs crossed.
489                              */
490                 if (!sock_owned_by_user(sk)) {
491                         sk->sk_err = err;
492
493                         sk->sk_error_report(sk);
494
495                         tcp_done(sk);
496                 } else {
497                         sk->sk_err_soft = err;
498                 }
499                 goto out;
500         }
501
502         /* If we've already connected we will keep trying
503          * until we time out, or the user gives up.
504          *
505          * rfc1122 4.2.3.9 allows to consider as hard errors
506          * only PROTO_UNREACH and PORT_UNREACH (well, FRAG_FAILED too,
507          * but it is obsoleted by pmtu discovery).
508          *
509          * Note, that in modern internet, where routing is unreliable
510          * and in each dark corner broken firewalls sit, sending random
511          * errors ordered by their masters even this two messages finally lose
512          * their original sense (even Linux sends invalid PORT_UNREACHs)
513          *
514          * Now we are in compliance with RFCs.
515          *                                                      --ANK (980905)
516          */
517
518         inet = inet_sk(sk);
519         if (!sock_owned_by_user(sk) && inet->recverr) {
520                 sk->sk_err = err;
521                 sk->sk_error_report(sk);
522         } else  { /* Only an error on timeout */
523                 sk->sk_err_soft = err;
524         }
525
526 out:
527         bh_unlock_sock(sk);
528         sock_put(sk);
529 }
530
531 static void __tcp_v4_send_check(struct sk_buff *skb,
532                                 __be32 saddr, __be32 daddr)
533 {
534         struct tcphdr *th = tcp_hdr(skb);
535
536         if (skb->ip_summed == CHECKSUM_PARTIAL) {
537                 th->check = ~tcp_v4_check(skb->len, saddr, daddr, 0);
538                 skb->csum_start = skb_transport_header(skb) - skb->head;
539                 skb->csum_offset = offsetof(struct tcphdr, check);
540         } else {
541                 th->check = tcp_v4_check(skb->len, saddr, daddr,
542                                          csum_partial(th,
543                                                       th->doff << 2,
544                                                       skb->csum));
545         }
546 }
547
548 /* This routine computes an IPv4 TCP checksum. */
549 void tcp_v4_send_check(struct sock *sk, struct sk_buff *skb)
550 {
551         const struct inet_sock *inet = inet_sk(sk);
552
553         __tcp_v4_send_check(skb, inet->inet_saddr, inet->inet_daddr);
554 }
555 EXPORT_SYMBOL(tcp_v4_send_check);
556
557 int tcp_v4_gso_send_check(struct sk_buff *skb)
558 {
559         const struct iphdr *iph;
560         struct tcphdr *th;
561
562         if (!pskb_may_pull(skb, sizeof(*th)))
563                 return -EINVAL;
564
565         iph = ip_hdr(skb);
566         th = tcp_hdr(skb);
567
568         th->check = 0;
569         skb->ip_summed = CHECKSUM_PARTIAL;
570         __tcp_v4_send_check(skb, iph->saddr, iph->daddr);
571         return 0;
572 }
573
574 /*
575  *      This routine will send an RST to the other tcp.
576  *
577  *      Someone asks: why I NEVER use socket parameters (TOS, TTL etc.)
578  *                    for reset.
579  *      Answer: if a packet caused RST, it is not for a socket
580  *              existing in our system, if it is matched to a socket,
581  *              it is just duplicate segment or bug in other side's TCP.
582  *              So that we build reply only basing on parameters
583  *              arrived with segment.
584  *      Exception: precedence violation. We do not implement it in any case.
585  */
586
587 static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
588 {
589         const struct tcphdr *th = tcp_hdr(skb);
590         struct {
591                 struct tcphdr th;
592 #ifdef CONFIG_TCP_MD5SIG
593                 __be32 opt[(TCPOLEN_MD5SIG_ALIGNED >> 2)];
594 #endif
595         } rep;
596         struct ip_reply_arg arg;
597 #ifdef CONFIG_TCP_MD5SIG
598         struct tcp_md5sig_key *key;
599         const __u8 *hash_location = NULL;
600         unsigned char newhash[16];
601         int genhash;
602         struct sock *sk1 = NULL;
603 #endif
604         struct net *net;
605
606         /* Never send a reset in response to a reset. */
607         if (th->rst)
608                 return;
609
610         if (skb_rtable(skb)->rt_type != RTN_LOCAL)
611                 return;
612
613         /* Swap the send and the receive. */
614         memset(&rep, 0, sizeof(rep));
615         rep.th.dest   = th->source;
616         rep.th.source = th->dest;
617         rep.th.doff   = sizeof(struct tcphdr) / 4;
618         rep.th.rst    = 1;
619
620         if (th->ack) {
621                 rep.th.seq = th->ack_seq;
622         } else {
623                 rep.th.ack = 1;
624                 rep.th.ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin +
625                                        skb->len - (th->doff << 2));
626         }
627
628         memset(&arg, 0, sizeof(arg));
629         arg.iov[0].iov_base = (unsigned char *)&rep;
630         arg.iov[0].iov_len  = sizeof(rep.th);
631
632 #ifdef CONFIG_TCP_MD5SIG
633         hash_location = tcp_parse_md5sig_option(th);
634         if (!sk && hash_location) {
635                 /*
636                  * active side is lost. Try to find listening socket through
637                  * source port, and then find md5 key through listening socket.
638                  * we are not loose security here:
639                  * Incoming packet is checked with md5 hash with finding key,
640                  * no RST generated if md5 hash doesn't match.
641                  */
642                 sk1 = __inet_lookup_listener(dev_net(skb_dst(skb)->dev),
643                                              &tcp_hashinfo, ip_hdr(skb)->daddr,
644                                              ntohs(th->source), inet_iif(skb));
645                 /* don't send rst if it can't find key */
646                 if (!sk1)
647                         return;
648                 rcu_read_lock();
649                 key = tcp_md5_do_lookup(sk1, (union tcp_md5_addr *)
650                                         &ip_hdr(skb)->saddr, AF_INET);
651                 if (!key)
652                         goto release_sk1;
653
654                 genhash = tcp_v4_md5_hash_skb(newhash, key, NULL, NULL, skb);
655                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
656                         goto release_sk1;
657         } else {
658                 key = sk ? tcp_md5_do_lookup(sk, (union tcp_md5_addr *)
659                                              &ip_hdr(skb)->saddr,
660                                              AF_INET) : NULL;
661         }
662
663         if (key) {
664                 rep.opt[0] = htonl((TCPOPT_NOP << 24) |
665                                    (TCPOPT_NOP << 16) |
666                                    (TCPOPT_MD5SIG << 8) |
667                                    TCPOLEN_MD5SIG);
668                 /* Update length and the length the header thinks exists */
669                 arg.iov[0].iov_len += TCPOLEN_MD5SIG_ALIGNED;
670                 rep.th.doff = arg.iov[0].iov_len / 4;
671
672                 tcp_v4_md5_hash_hdr((__u8 *) &rep.opt[1],
673                                      key, ip_hdr(skb)->saddr,
674                                      ip_hdr(skb)->daddr, &rep.th);
675         }
676 #endif
677         arg.csum = csum_tcpudp_nofold(ip_hdr(skb)->daddr,
678                                       ip_hdr(skb)->saddr, /* XXX */
679                                       arg.iov[0].iov_len, IPPROTO_TCP, 0);
680         arg.csumoffset = offsetof(struct tcphdr, check) / 2;
681         arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
682         /* When socket is gone, all binding information is lost.
683          * routing might fail in this case. No choice here, if we choose to force
684          * input interface, we will misroute in case of asymmetric route.
685          */
686         if (sk)
687                 arg.bound_dev_if = sk->sk_bound_dev_if;
688
689         net = dev_net(skb_dst(skb)->dev);
690         arg.tos = ip_hdr(skb)->tos;
691         ip_send_reply(net->ipv4.tcp_sock, skb, ip_hdr(skb)->saddr,
692                       &arg, arg.iov[0].iov_len);
693
694         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
695         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
696
697 #ifdef CONFIG_TCP_MD5SIG
698 release_sk1:
699         if (sk1) {
700                 rcu_read_unlock();
701                 sock_put(sk1);
702         }
703 #endif
704 }
705
706 /* The code following below sending ACKs in SYN-RECV and TIME-WAIT states
707    outside socket context is ugly, certainly. What can I do?
708  */
709
710 static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
711                             u32 win, u32 ts, int oif,
712                             struct tcp_md5sig_key *key,
713                             int reply_flags, u8 tos)
714 {
715         const struct tcphdr *th = tcp_hdr(skb);
716         struct {
717                 struct tcphdr th;
718                 __be32 opt[(TCPOLEN_TSTAMP_ALIGNED >> 2)
719 #ifdef CONFIG_TCP_MD5SIG
720                            + (TCPOLEN_MD5SIG_ALIGNED >> 2)
721 #endif
722                         ];
723         } rep;
724         struct ip_reply_arg arg;
725         struct net *net = dev_net(skb_dst(skb)->dev);
726
727         memset(&rep.th, 0, sizeof(struct tcphdr));
728         memset(&arg, 0, sizeof(arg));
729
730         arg.iov[0].iov_base = (unsigned char *)&rep;
731         arg.iov[0].iov_len  = sizeof(rep.th);
732         if (ts) {
733                 rep.opt[0] = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
734                                    (TCPOPT_TIMESTAMP << 8) |
735                                    TCPOLEN_TIMESTAMP);
736                 rep.opt[1] = htonl(tcp_time_stamp);
737                 rep.opt[2] = htonl(ts);
738                 arg.iov[0].iov_len += TCPOLEN_TSTAMP_ALIGNED;
739         }
740
741         /* Swap the send and the receive. */
742         rep.th.dest    = th->source;
743         rep.th.source  = th->dest;
744         rep.th.doff    = arg.iov[0].iov_len / 4;
745         rep.th.seq     = htonl(seq);
746         rep.th.ack_seq = htonl(ack);
747         rep.th.ack     = 1;
748         rep.th.window  = htons(win);
749
750 #ifdef CONFIG_TCP_MD5SIG
751         if (key) {
752                 int offset = (ts) ? 3 : 0;
753
754                 rep.opt[offset++] = htonl((TCPOPT_NOP << 24) |
755                                           (TCPOPT_NOP << 16) |
756                                           (TCPOPT_MD5SIG << 8) |
757                                           TCPOLEN_MD5SIG);
758                 arg.iov[0].iov_len += TCPOLEN_MD5SIG_ALIGNED;
759                 rep.th.doff = arg.iov[0].iov_len/4;
760
761                 tcp_v4_md5_hash_hdr((__u8 *) &rep.opt[offset],
762                                     key, ip_hdr(skb)->saddr,
763                                     ip_hdr(skb)->daddr, &rep.th);
764         }
765 #endif
766         arg.flags = reply_flags;
767         arg.csum = csum_tcpudp_nofold(ip_hdr(skb)->daddr,
768                                       ip_hdr(skb)->saddr, /* XXX */
769                                       arg.iov[0].iov_len, IPPROTO_TCP, 0);
770         arg.csumoffset = offsetof(struct tcphdr, check) / 2;
771         if (oif)
772                 arg.bound_dev_if = oif;
773         arg.tos = tos;
774         ip_send_reply(net->ipv4.tcp_sock, skb, ip_hdr(skb)->saddr,
775                       &arg, arg.iov[0].iov_len);
776
777         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
778 }
779
780 static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
781 {
782         struct inet_timewait_sock *tw = inet_twsk(sk);
783         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
784
785         tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
786                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
787                         tcptw->tw_ts_recent,
788                         tw->tw_bound_dev_if,
789                         tcp_twsk_md5_key(tcptw),
790                         tw->tw_transparent ? IP_REPLY_ARG_NOSRCCHECK : 0,
791                         tw->tw_tos
792                         );
793
794         inet_twsk_put(tw);
795 }
796
797 static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
798                                   struct request_sock *req)
799 {
800         tcp_v4_send_ack(skb, tcp_rsk(req)->snt_isn + 1,
801                         tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd,
802                         req->ts_recent,
803                         0,
804                         tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr,
805                                           AF_INET),
806                         inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0,
807                         ip_hdr(skb)->tos);
808 }
809
810 /*
811  *      Send a SYN-ACK after having received a SYN.
812  *      This still operates on a request_sock only, not on a big
813  *      socket.
814  */
815 static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
816                               struct request_sock *req,
817                               struct request_values *rvp)
818 {
819         const struct inet_request_sock *ireq = inet_rsk(req);
820         struct flowi4 fl4;
821         int err = -1;
822         struct sk_buff * skb;
823
824         /* First, grab a route. */
825         if (!dst && (dst = inet_csk_route_req(sk, &fl4, req)) == NULL)
826                 return -1;
827
828         skb = tcp_make_synack(sk, dst, req, rvp);
829
830         if (skb) {
831                 __tcp_v4_send_check(skb, ireq->loc_addr, ireq->rmt_addr);
832
833                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
834                                             ireq->rmt_addr,
835                                             ireq->opt);
836                 err = net_xmit_eval(err);
837         }
838
839         dst_release(dst);
840         return err;
841 }
842
843 static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req,
844                               struct request_values *rvp)
845 {
846         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
847         return tcp_v4_send_synack(sk, NULL, req, rvp);
848 }
849
850 /*
851  *      IPv4 request_sock destructor.
852  */
853 static void tcp_v4_reqsk_destructor(struct request_sock *req)
854 {
855         kfree(inet_rsk(req)->opt);
856 }
857
858 /*
859  * Return 1 if a syncookie should be sent
860  */
861 int tcp_syn_flood_action(struct sock *sk,
862                          const struct sk_buff *skb,
863                          const char *proto)
864 {
865         const char *msg = "Dropping request";
866         int want_cookie = 0;
867         struct listen_sock *lopt;
868
869
870
871 #ifdef CONFIG_SYN_COOKIES
872         if (sysctl_tcp_syncookies) {
873                 msg = "Sending cookies";
874                 want_cookie = 1;
875                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
876         } else
877 #endif
878                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
879
880         lopt = inet_csk(sk)->icsk_accept_queue.listen_opt;
881         if (!lopt->synflood_warned) {
882                 lopt->synflood_warned = 1;
883                 pr_info("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
884                         proto, ntohs(tcp_hdr(skb)->dest), msg);
885         }
886         return want_cookie;
887 }
888 EXPORT_SYMBOL(tcp_syn_flood_action);
889
890 /*
891  * Save and compile IPv4 options into the request_sock if needed.
892  */
893 static struct ip_options_rcu *tcp_v4_save_options(struct sock *sk,
894                                                   struct sk_buff *skb)
895 {
896         const struct ip_options *opt = &(IPCB(skb)->opt);
897         struct ip_options_rcu *dopt = NULL;
898
899         if (opt && opt->optlen) {
900                 int opt_size = sizeof(*dopt) + opt->optlen;
901
902                 dopt = kmalloc(opt_size, GFP_ATOMIC);
903                 if (dopt) {
904                         if (ip_options_echo(&dopt->opt, skb)) {
905                                 kfree(dopt);
906                                 dopt = NULL;
907                         }
908                 }
909         }
910         return dopt;
911 }
912
913 #ifdef CONFIG_TCP_MD5SIG
914 /*
915  * RFC2385 MD5 checksumming requires a mapping of
916  * IP address->MD5 Key.
917  * We need to maintain these in the sk structure.
918  */
919
920 /* Find the Key structure for an address.  */
921 struct tcp_md5sig_key *tcp_md5_do_lookup(struct sock *sk,
922                                          const union tcp_md5_addr *addr,
923                                          int family)
924 {
925         struct tcp_sock *tp = tcp_sk(sk);
926         struct tcp_md5sig_key *key;
927         struct hlist_node *pos;
928         unsigned int size = sizeof(struct in_addr);
929         struct tcp_md5sig_info *md5sig;
930
931         /* caller either holds rcu_read_lock() or socket lock */
932         md5sig = rcu_dereference_check(tp->md5sig_info,
933                                        sock_owned_by_user(sk) ||
934                                        lockdep_is_held(&sk->sk_lock.slock));
935         if (!md5sig)
936                 return NULL;
937 #if IS_ENABLED(CONFIG_IPV6)
938         if (family == AF_INET6)
939                 size = sizeof(struct in6_addr);
940 #endif
941         hlist_for_each_entry_rcu(key, pos, &md5sig->head, node) {
942                 if (key->family != family)
943                         continue;
944                 if (!memcmp(&key->addr, addr, size))
945                         return key;
946         }
947         return NULL;
948 }
949 EXPORT_SYMBOL(tcp_md5_do_lookup);
950
951 struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk,
952                                          struct sock *addr_sk)
953 {
954         union tcp_md5_addr *addr;
955
956         addr = (union tcp_md5_addr *)&inet_sk(addr_sk)->inet_daddr;
957         return tcp_md5_do_lookup(sk, addr, AF_INET);
958 }
959 EXPORT_SYMBOL(tcp_v4_md5_lookup);
960
961 static struct tcp_md5sig_key *tcp_v4_reqsk_md5_lookup(struct sock *sk,
962                                                       struct request_sock *req)
963 {
964         union tcp_md5_addr *addr;
965
966         addr = (union tcp_md5_addr *)&inet_rsk(req)->rmt_addr;
967         return tcp_md5_do_lookup(sk, addr, AF_INET);
968 }
969
970 /* This can be called on a newly created socket, from other files */
971 int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
972                    int family, const u8 *newkey, u8 newkeylen, gfp_t gfp)
973 {
974         /* Add Key to the list */
975         struct tcp_md5sig_key *key;
976         struct tcp_sock *tp = tcp_sk(sk);
977         struct tcp_md5sig_info *md5sig;
978
979         key = tcp_md5_do_lookup(sk, addr, family);
980         if (key) {
981                 /* Pre-existing entry - just update that one. */
982                 memcpy(key->key, newkey, newkeylen);
983                 key->keylen = newkeylen;
984                 return 0;
985         }
986
987         md5sig = rcu_dereference_protected(tp->md5sig_info,
988                                            sock_owned_by_user(sk));
989         if (!md5sig) {
990                 md5sig = kmalloc(sizeof(*md5sig), gfp);
991                 if (!md5sig)
992                         return -ENOMEM;
993
994                 sk_nocaps_add(sk, NETIF_F_GSO_MASK);
995                 INIT_HLIST_HEAD(&md5sig->head);
996                 rcu_assign_pointer(tp->md5sig_info, md5sig);
997         }
998
999         key = sock_kmalloc(sk, sizeof(*key), gfp);
1000         if (!key)
1001                 return -ENOMEM;
1002         if (hlist_empty(&md5sig->head) && !tcp_alloc_md5sig_pool(sk)) {
1003                 sock_kfree_s(sk, key, sizeof(*key));
1004                 return -ENOMEM;
1005         }
1006
1007         memcpy(key->key, newkey, newkeylen);
1008         key->keylen = newkeylen;
1009         key->family = family;
1010         memcpy(&key->addr, addr,
1011                (family == AF_INET6) ? sizeof(struct in6_addr) :
1012                                       sizeof(struct in_addr));
1013         hlist_add_head_rcu(&key->node, &md5sig->head);
1014         return 0;
1015 }
1016 EXPORT_SYMBOL(tcp_md5_do_add);
1017
1018 int tcp_md5_do_del(struct sock *sk, const union tcp_md5_addr *addr, int family)
1019 {
1020         struct tcp_sock *tp = tcp_sk(sk);
1021         struct tcp_md5sig_key *key;
1022         struct tcp_md5sig_info *md5sig;
1023
1024         key = tcp_md5_do_lookup(sk, addr, family);
1025         if (!key)
1026                 return -ENOENT;
1027         hlist_del_rcu(&key->node);
1028         atomic_sub(sizeof(*key), &sk->sk_omem_alloc);
1029         kfree_rcu(key, rcu);
1030         md5sig = rcu_dereference_protected(tp->md5sig_info,
1031                                            sock_owned_by_user(sk));
1032         if (hlist_empty(&md5sig->head))
1033                 tcp_free_md5sig_pool();
1034         return 0;
1035 }
1036 EXPORT_SYMBOL(tcp_md5_do_del);
1037
1038 void tcp_clear_md5_list(struct sock *sk)
1039 {
1040         struct tcp_sock *tp = tcp_sk(sk);
1041         struct tcp_md5sig_key *key;
1042         struct hlist_node *pos, *n;
1043         struct tcp_md5sig_info *md5sig;
1044
1045         md5sig = rcu_dereference_protected(tp->md5sig_info, 1);
1046
1047         if (!hlist_empty(&md5sig->head))
1048                 tcp_free_md5sig_pool();
1049         hlist_for_each_entry_safe(key, pos, n, &md5sig->head, node) {
1050                 hlist_del_rcu(&key->node);
1051                 atomic_sub(sizeof(*key), &sk->sk_omem_alloc);
1052                 kfree_rcu(key, rcu);
1053         }
1054 }
1055
1056 static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
1057                                  int optlen)
1058 {
1059         struct tcp_md5sig cmd;
1060         struct sockaddr_in *sin = (struct sockaddr_in *)&cmd.tcpm_addr;
1061
1062         if (optlen < sizeof(cmd))
1063                 return -EINVAL;
1064
1065         if (copy_from_user(&cmd, optval, sizeof(cmd)))
1066                 return -EFAULT;
1067
1068         if (sin->sin_family != AF_INET)
1069                 return -EINVAL;
1070
1071         if (!cmd.tcpm_key || !cmd.tcpm_keylen)
1072                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr,
1073                                       AF_INET);
1074
1075         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
1076                 return -EINVAL;
1077
1078         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin->sin_addr.s_addr,
1079                               AF_INET, cmd.tcpm_key, cmd.tcpm_keylen,
1080                               GFP_KERNEL);
1081 }
1082
1083 static int tcp_v4_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
1084                                         __be32 daddr, __be32 saddr, int nbytes)
1085 {
1086         struct tcp4_pseudohdr *bp;
1087         struct scatterlist sg;
1088
1089         bp = &hp->md5_blk.ip4;
1090
1091         /*
1092          * 1. the TCP pseudo-header (in the order: source IP address,
1093          * destination IP address, zero-padded protocol number, and
1094          * segment length)
1095          */
1096         bp->saddr = saddr;
1097         bp->daddr = daddr;
1098         bp->pad = 0;
1099         bp->protocol = IPPROTO_TCP;
1100         bp->len = cpu_to_be16(nbytes);
1101
1102         sg_init_one(&sg, bp, sizeof(*bp));
1103         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
1104 }
1105
1106 static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
1107                                __be32 daddr, __be32 saddr, const struct tcphdr *th)
1108 {
1109         struct tcp_md5sig_pool *hp;
1110         struct hash_desc *desc;
1111
1112         hp = tcp_get_md5sig_pool();
1113         if (!hp)
1114                 goto clear_hash_noput;
1115         desc = &hp->md5_desc;
1116
1117         if (crypto_hash_init(desc))
1118                 goto clear_hash;
1119         if (tcp_v4_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
1120                 goto clear_hash;
1121         if (tcp_md5_hash_header(hp, th))
1122                 goto clear_hash;
1123         if (tcp_md5_hash_key(hp, key))
1124                 goto clear_hash;
1125         if (crypto_hash_final(desc, md5_hash))
1126                 goto clear_hash;
1127
1128         tcp_put_md5sig_pool();
1129         return 0;
1130
1131 clear_hash:
1132         tcp_put_md5sig_pool();
1133 clear_hash_noput:
1134         memset(md5_hash, 0, 16);
1135         return 1;
1136 }
1137
1138 int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
1139                         const struct sock *sk, const struct request_sock *req,
1140                         const struct sk_buff *skb)
1141 {
1142         struct tcp_md5sig_pool *hp;
1143         struct hash_desc *desc;
1144         const struct tcphdr *th = tcp_hdr(skb);
1145         __be32 saddr, daddr;
1146
1147         if (sk) {
1148                 saddr = inet_sk(sk)->inet_saddr;
1149                 daddr = inet_sk(sk)->inet_daddr;
1150         } else if (req) {
1151                 saddr = inet_rsk(req)->loc_addr;
1152                 daddr = inet_rsk(req)->rmt_addr;
1153         } else {
1154                 const struct iphdr *iph = ip_hdr(skb);
1155                 saddr = iph->saddr;
1156                 daddr = iph->daddr;
1157         }
1158
1159         hp = tcp_get_md5sig_pool();
1160         if (!hp)
1161                 goto clear_hash_noput;
1162         desc = &hp->md5_desc;
1163
1164         if (crypto_hash_init(desc))
1165                 goto clear_hash;
1166
1167         if (tcp_v4_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
1168                 goto clear_hash;
1169         if (tcp_md5_hash_header(hp, th))
1170                 goto clear_hash;
1171         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
1172                 goto clear_hash;
1173         if (tcp_md5_hash_key(hp, key))
1174                 goto clear_hash;
1175         if (crypto_hash_final(desc, md5_hash))
1176                 goto clear_hash;
1177
1178         tcp_put_md5sig_pool();
1179         return 0;
1180
1181 clear_hash:
1182         tcp_put_md5sig_pool();
1183 clear_hash_noput:
1184         memset(md5_hash, 0, 16);
1185         return 1;
1186 }
1187 EXPORT_SYMBOL(tcp_v4_md5_hash_skb);
1188
1189 static int tcp_v4_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
1190 {
1191         /*
1192          * This gets called for each TCP segment that arrives
1193          * so we want to be efficient.
1194          * We have 3 drop cases:
1195          * o No MD5 hash and one expected.
1196          * o MD5 hash and we're not expecting one.
1197          * o MD5 hash and its wrong.
1198          */
1199         const __u8 *hash_location = NULL;
1200         struct tcp_md5sig_key *hash_expected;
1201         const struct iphdr *iph = ip_hdr(skb);
1202         const struct tcphdr *th = tcp_hdr(skb);
1203         int genhash;
1204         unsigned char newhash[16];
1205
1206         hash_expected = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&iph->saddr,
1207                                           AF_INET);
1208         hash_location = tcp_parse_md5sig_option(th);
1209
1210         /* We've parsed the options - do we have a hash? */
1211         if (!hash_expected && !hash_location)
1212                 return 0;
1213
1214         if (hash_expected && !hash_location) {
1215                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
1216                 return 1;
1217         }
1218
1219         if (!hash_expected && hash_location) {
1220                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
1221                 return 1;
1222         }
1223
1224         /* Okay, so this is hash_expected and hash_location -
1225          * so we need to calculate the checksum.
1226          */
1227         genhash = tcp_v4_md5_hash_skb(newhash,
1228                                       hash_expected,
1229                                       NULL, NULL, skb);
1230
1231         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
1232                 if (net_ratelimit()) {
1233                         pr_info("MD5 Hash failed for (%pI4, %d)->(%pI4, %d)%s\n",
1234                                 &iph->saddr, ntohs(th->source),
1235                                 &iph->daddr, ntohs(th->dest),
1236                                 genhash ? " tcp_v4_calc_md5_hash failed" : "");
1237                 }
1238                 return 1;
1239         }
1240         return 0;
1241 }
1242
1243 #endif
1244
1245 struct request_sock_ops tcp_request_sock_ops __read_mostly = {
1246         .family         =       PF_INET,
1247         .obj_size       =       sizeof(struct tcp_request_sock),
1248         .rtx_syn_ack    =       tcp_v4_rtx_synack,
1249         .send_ack       =       tcp_v4_reqsk_send_ack,
1250         .destructor     =       tcp_v4_reqsk_destructor,
1251         .send_reset     =       tcp_v4_send_reset,
1252         .syn_ack_timeout =      tcp_syn_ack_timeout,
1253 };
1254
1255 #ifdef CONFIG_TCP_MD5SIG
1256 static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
1257         .md5_lookup     =       tcp_v4_reqsk_md5_lookup,
1258         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1259 };
1260 #endif
1261
1262 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
1263 {
1264         struct tcp_extend_values tmp_ext;
1265         struct tcp_options_received tmp_opt;
1266         const u8 *hash_location;
1267         struct request_sock *req;
1268         struct inet_request_sock *ireq;
1269         struct tcp_sock *tp = tcp_sk(sk);
1270         struct dst_entry *dst = NULL;
1271         __be32 saddr = ip_hdr(skb)->saddr;
1272         __be32 daddr = ip_hdr(skb)->daddr;
1273         __u32 isn = TCP_SKB_CB(skb)->when;
1274         int want_cookie = 0;
1275
1276         /* Never answer to SYNs send to broadcast or multicast */
1277         if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
1278                 goto drop;
1279
1280         /* TW buckets are converted to open requests without
1281          * limitations, they conserve resources and peer is
1282          * evidently real one.
1283          */
1284         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1285                 want_cookie = tcp_syn_flood_action(sk, skb, "TCP");
1286                 if (!want_cookie)
1287                         goto drop;
1288         }
1289
1290         /* Accept backlog is full. If we have already queued enough
1291          * of warm entries in syn queue, drop request. It is better than
1292          * clogging syn queue with openreqs with exponentially increasing
1293          * timeout.
1294          */
1295         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1296                 goto drop;
1297
1298         req = inet_reqsk_alloc(&tcp_request_sock_ops);
1299         if (!req)
1300                 goto drop;
1301
1302 #ifdef CONFIG_TCP_MD5SIG
1303         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv4_ops;
1304 #endif
1305
1306         tcp_clear_options(&tmp_opt);
1307         tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
1308         tmp_opt.user_mss  = tp->rx_opt.user_mss;
1309         tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1310
1311         if (tmp_opt.cookie_plus > 0 &&
1312             tmp_opt.saw_tstamp &&
1313             !tp->rx_opt.cookie_out_never &&
1314             (sysctl_tcp_cookie_size > 0 ||
1315              (tp->cookie_values != NULL &&
1316               tp->cookie_values->cookie_desired > 0))) {
1317                 u8 *c;
1318                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1319                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1320
1321                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1322                         goto drop_and_release;
1323
1324                 /* Secret recipe starts with IP addresses */
1325                 *mess++ ^= (__force u32)daddr;
1326                 *mess++ ^= (__force u32)saddr;
1327
1328                 /* plus variable length Initiator Cookie */
1329                 c = (u8 *)mess;
1330                 while (l-- > 0)
1331                         *c++ ^= *hash_location++;
1332
1333                 want_cookie = 0;        /* not our kind of cookie */
1334                 tmp_ext.cookie_out_never = 0; /* false */
1335                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1336         } else if (!tp->rx_opt.cookie_in_always) {
1337                 /* redundant indications, but ensure initialization. */
1338                 tmp_ext.cookie_out_never = 1; /* true */
1339                 tmp_ext.cookie_plus = 0;
1340         } else {
1341                 goto drop_and_release;
1342         }
1343         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1344
1345         if (want_cookie && !tmp_opt.saw_tstamp)
1346                 tcp_clear_options(&tmp_opt);
1347
1348         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1349         tcp_openreq_init(req, &tmp_opt, skb);
1350
1351         ireq = inet_rsk(req);
1352         ireq->loc_addr = daddr;
1353         ireq->rmt_addr = saddr;
1354         ireq->no_srccheck = inet_sk(sk)->transparent;
1355         ireq->opt = tcp_v4_save_options(sk, skb);
1356
1357         if (security_inet_conn_request(sk, skb, req))
1358                 goto drop_and_free;
1359
1360         if (!want_cookie || tmp_opt.tstamp_ok)
1361                 TCP_ECN_create_request(req, tcp_hdr(skb));
1362
1363         if (want_cookie) {
1364                 isn = cookie_v4_init_sequence(sk, skb, &req->mss);
1365                 req->cookie_ts = tmp_opt.tstamp_ok;
1366         } else if (!isn) {
1367                 struct inet_peer *peer = NULL;
1368                 struct flowi4 fl4;
1369
1370                 /* VJ's idea. We save last timestamp seen
1371                  * from the destination in peer table, when entering
1372                  * state TIME-WAIT, and check against it before
1373                  * accepting new connection request.
1374                  *
1375                  * If "isn" is not zero, this request hit alive
1376                  * timewait bucket, so that all the necessary checks
1377                  * are made in the function processing timewait state.
1378                  */
1379                 if (tmp_opt.saw_tstamp &&
1380                     tcp_death_row.sysctl_tw_recycle &&
1381                     (dst = inet_csk_route_req(sk, &fl4, req)) != NULL &&
1382                     fl4.daddr == saddr &&
1383                     (peer = rt_get_peer((struct rtable *)dst, fl4.daddr)) != NULL) {
1384                         inet_peer_refcheck(peer);
1385                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1386                             (s32)(peer->tcp_ts - req->ts_recent) >
1387                                                         TCP_PAWS_WINDOW) {
1388                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1389                                 goto drop_and_release;
1390                         }
1391                 }
1392                 /* Kill the following clause, if you dislike this way. */
1393                 else if (!sysctl_tcp_syncookies &&
1394                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1395                           (sysctl_max_syn_backlog >> 2)) &&
1396                          (!peer || !peer->tcp_ts_stamp) &&
1397                          (!dst || !dst_metric(dst, RTAX_RTT))) {
1398                         /* Without syncookies last quarter of
1399                          * backlog is filled with destinations,
1400                          * proven to be alive.
1401                          * It means that we continue to communicate
1402                          * to destinations, already remembered
1403                          * to the moment of synflood.
1404                          */
1405                         LIMIT_NETDEBUG(KERN_DEBUG pr_fmt("drop open request from %pI4/%u\n"),
1406                                        &saddr, ntohs(tcp_hdr(skb)->source));
1407                         goto drop_and_release;
1408                 }
1409
1410                 isn = tcp_v4_init_sequence(skb);
1411         }
1412         tcp_rsk(req)->snt_isn = isn;
1413         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1414
1415         if (tcp_v4_send_synack(sk, dst, req,
1416                                (struct request_values *)&tmp_ext) ||
1417             want_cookie)
1418                 goto drop_and_free;
1419
1420         inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1421         return 0;
1422
1423 drop_and_release:
1424         dst_release(dst);
1425 drop_and_free:
1426         reqsk_free(req);
1427 drop:
1428         return 0;
1429 }
1430 EXPORT_SYMBOL(tcp_v4_conn_request);
1431
1432
1433 /*
1434  * The three way handshake has completed - we got a valid synack -
1435  * now create the new socket.
1436  */
1437 struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1438                                   struct request_sock *req,
1439                                   struct dst_entry *dst)
1440 {
1441         struct inet_request_sock *ireq;
1442         struct inet_sock *newinet;
1443         struct tcp_sock *newtp;
1444         struct sock *newsk;
1445 #ifdef CONFIG_TCP_MD5SIG
1446         struct tcp_md5sig_key *key;
1447 #endif
1448         struct ip_options_rcu *inet_opt;
1449
1450         if (sk_acceptq_is_full(sk))
1451                 goto exit_overflow;
1452
1453         newsk = tcp_create_openreq_child(sk, req, skb);
1454         if (!newsk)
1455                 goto exit_nonewsk;
1456
1457         newsk->sk_gso_type = SKB_GSO_TCPV4;
1458
1459         newtp                 = tcp_sk(newsk);
1460         newinet               = inet_sk(newsk);
1461         ireq                  = inet_rsk(req);
1462         newinet->inet_daddr   = ireq->rmt_addr;
1463         newinet->inet_rcv_saddr = ireq->loc_addr;
1464         newinet->inet_saddr           = ireq->loc_addr;
1465         inet_opt              = ireq->opt;
1466         rcu_assign_pointer(newinet->inet_opt, inet_opt);
1467         ireq->opt             = NULL;
1468         newinet->mc_index     = inet_iif(skb);
1469         newinet->mc_ttl       = ip_hdr(skb)->ttl;
1470         newinet->rcv_tos      = ip_hdr(skb)->tos;
1471         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1472         if (inet_opt)
1473                 inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
1474         newinet->inet_id = newtp->write_seq ^ jiffies;
1475
1476         if (!dst) {
1477                 dst = inet_csk_route_child_sock(sk, newsk, req);
1478                 if (!dst)
1479                         goto put_and_exit;
1480         } else {
1481                 /* syncookie case : see end of cookie_v4_check() */
1482         }
1483         sk_setup_caps(newsk, dst);
1484
1485         tcp_mtup_init(newsk);
1486         tcp_sync_mss(newsk, dst_mtu(dst));
1487         newtp->advmss = dst_metric_advmss(dst);
1488         if (tcp_sk(sk)->rx_opt.user_mss &&
1489             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1490                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1491
1492         tcp_initialize_rcv_mss(newsk);
1493         if (tcp_rsk(req)->snt_synack)
1494                 tcp_valid_rtt_meas(newsk,
1495                     tcp_time_stamp - tcp_rsk(req)->snt_synack);
1496         newtp->total_retrans = req->retrans;
1497
1498 #ifdef CONFIG_TCP_MD5SIG
1499         /* Copy over the MD5 key from the original socket */
1500         key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&newinet->inet_daddr,
1501                                 AF_INET);
1502         if (key != NULL) {
1503                 /*
1504                  * We're using one, so create a matching key
1505                  * on the newsk structure. If we fail to get
1506                  * memory, then we end up not copying the key
1507                  * across. Shucks.
1508                  */
1509                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newinet->inet_daddr,
1510                                AF_INET, key->key, key->keylen, GFP_ATOMIC);
1511                 sk_nocaps_add(newsk, NETIF_F_GSO_MASK);
1512         }
1513 #endif
1514
1515         if (__inet_inherit_port(sk, newsk) < 0)
1516                 goto put_and_exit;
1517         __inet_hash_nolisten(newsk, NULL);
1518
1519         return newsk;
1520
1521 exit_overflow:
1522         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1523 exit_nonewsk:
1524         dst_release(dst);
1525 exit:
1526         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1527         return NULL;
1528 put_and_exit:
1529         inet_csk_prepare_forced_close(newsk);
1530         tcp_done(newsk);
1531         goto exit;
1532 }
1533 EXPORT_SYMBOL(tcp_v4_syn_recv_sock);
1534
1535 static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
1536 {
1537         struct tcphdr *th = tcp_hdr(skb);
1538         const struct iphdr *iph = ip_hdr(skb);
1539         struct sock *nsk;
1540         struct request_sock **prev;
1541         /* Find possible connection requests. */
1542         struct request_sock *req = inet_csk_search_req(sk, &prev, th->source,
1543                                                        iph->saddr, iph->daddr);
1544         if (req)
1545                 return tcp_check_req(sk, skb, req, prev);
1546
1547         nsk = inet_lookup_established(sock_net(sk), &tcp_hashinfo, iph->saddr,
1548                         th->source, iph->daddr, th->dest, inet_iif(skb));
1549
1550         if (nsk) {
1551                 if (nsk->sk_state != TCP_TIME_WAIT) {
1552                         bh_lock_sock(nsk);
1553                         return nsk;
1554                 }
1555                 inet_twsk_put(inet_twsk(nsk));
1556                 return NULL;
1557         }
1558
1559 #ifdef CONFIG_SYN_COOKIES
1560         if (!th->syn)
1561                 sk = cookie_v4_check(sk, skb, &(IPCB(skb)->opt));
1562 #endif
1563         return sk;
1564 }
1565
1566 static __sum16 tcp_v4_checksum_init(struct sk_buff *skb)
1567 {
1568         const struct iphdr *iph = ip_hdr(skb);
1569
1570         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1571                 if (!tcp_v4_check(skb->len, iph->saddr,
1572                                   iph->daddr, skb->csum)) {
1573                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1574                         return 0;
1575                 }
1576         }
1577
1578         skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
1579                                        skb->len, IPPROTO_TCP, 0);
1580
1581         if (skb->len <= 76) {
1582                 return __skb_checksum_complete(skb);
1583         }
1584         return 0;
1585 }
1586
1587
1588 /* The socket must have it's spinlock held when we get
1589  * here.
1590  *
1591  * We have a potential double-lock case here, so even when
1592  * doing backlog processing we use the BH locking scheme.
1593  * This is because we cannot sleep with the original spinlock
1594  * held.
1595  */
1596 int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
1597 {
1598         struct sock *rsk;
1599 #ifdef CONFIG_TCP_MD5SIG
1600         /*
1601          * We really want to reject the packet as early as possible
1602          * if:
1603          *  o We're expecting an MD5'd packet and this is no MD5 tcp option
1604          *  o There is an MD5 option and we're not expecting one
1605          */
1606         if (tcp_v4_inbound_md5_hash(sk, skb))
1607                 goto discard;
1608 #endif
1609
1610         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1611                 sock_rps_save_rxhash(sk, skb);
1612                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
1613                         rsk = sk;
1614                         goto reset;
1615                 }
1616                 return 0;
1617         }
1618
1619         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1620                 goto csum_err;
1621
1622         if (sk->sk_state == TCP_LISTEN) {
1623                 struct sock *nsk = tcp_v4_hnd_req(sk, skb);
1624                 if (!nsk)
1625                         goto discard;
1626
1627                 if (nsk != sk) {
1628                         sock_rps_save_rxhash(nsk, skb);
1629                         if (tcp_child_process(sk, nsk, skb)) {
1630                                 rsk = nsk;
1631                                 goto reset;
1632                         }
1633                         return 0;
1634                 }
1635         } else
1636                 sock_rps_save_rxhash(sk, skb);
1637
1638         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len)) {
1639                 rsk = sk;
1640                 goto reset;
1641         }
1642         return 0;
1643
1644 reset:
1645         tcp_v4_send_reset(rsk, skb);
1646 discard:
1647         kfree_skb(skb);
1648         /* Be careful here. If this function gets more complicated and
1649          * gcc suffers from register pressure on the x86, sk (in %ebx)
1650          * might be destroyed here. This current version compiles correctly,
1651          * but you have been warned.
1652          */
1653         return 0;
1654
1655 csum_err:
1656         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1657         goto discard;
1658 }
1659 EXPORT_SYMBOL(tcp_v4_do_rcv);
1660
1661 /*
1662  *      From tcp_input.c
1663  */
1664
1665 int tcp_v4_rcv(struct sk_buff *skb)
1666 {
1667         const struct iphdr *iph;
1668         const struct tcphdr *th;
1669         struct sock *sk;
1670         int ret;
1671         struct net *net = dev_net(skb->dev);
1672
1673         if (skb->pkt_type != PACKET_HOST)
1674                 goto discard_it;
1675
1676         /* Count it even if it's bad */
1677         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1678
1679         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1680                 goto discard_it;
1681
1682         th = tcp_hdr(skb);
1683
1684         if (th->doff < sizeof(struct tcphdr) / 4)
1685                 goto bad_packet;
1686         if (!pskb_may_pull(skb, th->doff * 4))
1687                 goto discard_it;
1688
1689         /* An explanation is required here, I think.
1690          * Packet length and doff are validated by header prediction,
1691          * provided case of th->doff==0 is eliminated.
1692          * So, we defer the checks. */
1693         if (!skb_csum_unnecessary(skb) && tcp_v4_checksum_init(skb))
1694                 goto bad_packet;
1695
1696         th = tcp_hdr(skb);
1697         iph = ip_hdr(skb);
1698         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1699         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1700                                     skb->len - th->doff * 4);
1701         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1702         TCP_SKB_CB(skb)->when    = 0;
1703         TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph);
1704         TCP_SKB_CB(skb)->sacked  = 0;
1705
1706         sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1707         if (!sk)
1708                 goto no_tcp_socket;
1709
1710 process:
1711         if (sk->sk_state == TCP_TIME_WAIT)
1712                 goto do_time_wait;
1713
1714         if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
1715                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1716                 goto discard_and_relse;
1717         }
1718
1719         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
1720                 goto discard_and_relse;
1721         nf_reset(skb);
1722
1723         if (sk_filter(sk, skb))
1724                 goto discard_and_relse;
1725
1726         skb->dev = NULL;
1727
1728         bh_lock_sock_nested(sk);
1729         ret = 0;
1730         if (!sock_owned_by_user(sk)) {
1731 #ifdef CONFIG_NET_DMA
1732                 struct tcp_sock *tp = tcp_sk(sk);
1733                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1734                         tp->ucopy.dma_chan = net_dma_find_channel();
1735                 if (tp->ucopy.dma_chan)
1736                         ret = tcp_v4_do_rcv(sk, skb);
1737                 else
1738 #endif
1739                 {
1740                         if (!tcp_prequeue(sk, skb))
1741                                 ret = tcp_v4_do_rcv(sk, skb);
1742                 }
1743         } else if (unlikely(sk_add_backlog(sk, skb))) {
1744                 bh_unlock_sock(sk);
1745                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1746                 goto discard_and_relse;
1747         }
1748         bh_unlock_sock(sk);
1749
1750         sock_put(sk);
1751
1752         return ret;
1753
1754 no_tcp_socket:
1755         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
1756                 goto discard_it;
1757
1758         if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
1759 bad_packet:
1760                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1761         } else {
1762                 tcp_v4_send_reset(NULL, skb);
1763         }
1764
1765 discard_it:
1766         /* Discard frame. */
1767         kfree_skb(skb);
1768         return 0;
1769
1770 discard_and_relse:
1771         sock_put(sk);
1772         goto discard_it;
1773
1774 do_time_wait:
1775         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1776                 inet_twsk_put(inet_twsk(sk));
1777                 goto discard_it;
1778         }
1779
1780         if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
1781                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1782                 inet_twsk_put(inet_twsk(sk));
1783                 goto discard_it;
1784         }
1785         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1786         case TCP_TW_SYN: {
1787                 struct sock *sk2 = inet_lookup_listener(dev_net(skb->dev),
1788                                                         &tcp_hashinfo,
1789                                                         iph->daddr, th->dest,
1790                                                         inet_iif(skb));
1791                 if (sk2) {
1792                         inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);
1793                         inet_twsk_put(inet_twsk(sk));
1794                         sk = sk2;
1795                         goto process;
1796                 }
1797                 /* Fall through to ACK */
1798         }
1799         case TCP_TW_ACK:
1800                 tcp_v4_timewait_ack(sk, skb);
1801                 break;
1802         case TCP_TW_RST:
1803                 goto no_tcp_socket;
1804         case TCP_TW_SUCCESS:;
1805         }
1806         goto discard_it;
1807 }
1808
1809 struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it)
1810 {
1811         struct rtable *rt = (struct rtable *) __sk_dst_get(sk);
1812         struct inet_sock *inet = inet_sk(sk);
1813         struct inet_peer *peer;
1814
1815         if (!rt ||
1816             inet->cork.fl.u.ip4.daddr != inet->inet_daddr) {
1817                 peer = inet_getpeer_v4(inet->inet_daddr, 1);
1818                 *release_it = true;
1819         } else {
1820                 if (!rt->peer)
1821                         rt_bind_peer(rt, inet->inet_daddr, 1);
1822                 peer = rt->peer;
1823                 *release_it = false;
1824         }
1825
1826         return peer;
1827 }
1828 EXPORT_SYMBOL(tcp_v4_get_peer);
1829
1830 void *tcp_v4_tw_get_peer(struct sock *sk)
1831 {
1832         const struct inet_timewait_sock *tw = inet_twsk(sk);
1833
1834         return inet_getpeer_v4(tw->tw_daddr, 1);
1835 }
1836 EXPORT_SYMBOL(tcp_v4_tw_get_peer);
1837
1838 static struct timewait_sock_ops tcp_timewait_sock_ops = {
1839         .twsk_obj_size  = sizeof(struct tcp_timewait_sock),
1840         .twsk_unique    = tcp_twsk_unique,
1841         .twsk_destructor= tcp_twsk_destructor,
1842         .twsk_getpeer   = tcp_v4_tw_get_peer,
1843 };
1844
1845 const struct inet_connection_sock_af_ops ipv4_specific = {
1846         .queue_xmit        = ip_queue_xmit,
1847         .send_check        = tcp_v4_send_check,
1848         .rebuild_header    = inet_sk_rebuild_header,
1849         .conn_request      = tcp_v4_conn_request,
1850         .syn_recv_sock     = tcp_v4_syn_recv_sock,
1851         .get_peer          = tcp_v4_get_peer,
1852         .net_header_len    = sizeof(struct iphdr),
1853         .setsockopt        = ip_setsockopt,
1854         .getsockopt        = ip_getsockopt,
1855         .addr2sockaddr     = inet_csk_addr2sockaddr,
1856         .sockaddr_len      = sizeof(struct sockaddr_in),
1857         .bind_conflict     = inet_csk_bind_conflict,
1858 #ifdef CONFIG_COMPAT
1859         .compat_setsockopt = compat_ip_setsockopt,
1860         .compat_getsockopt = compat_ip_getsockopt,
1861 #endif
1862 };
1863 EXPORT_SYMBOL(ipv4_specific);
1864
1865 #ifdef CONFIG_TCP_MD5SIG
1866 static const struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
1867         .md5_lookup             = tcp_v4_md5_lookup,
1868         .calc_md5_hash          = tcp_v4_md5_hash_skb,
1869         .md5_parse              = tcp_v4_parse_md5_keys,
1870 };
1871 #endif
1872
1873 /* NOTE: A lot of things set to zero explicitly by call to
1874  *       sk_alloc() so need not be done here.
1875  */
1876 static int tcp_v4_init_sock(struct sock *sk)
1877 {
1878         struct inet_connection_sock *icsk = inet_csk(sk);
1879         struct tcp_sock *tp = tcp_sk(sk);
1880
1881         skb_queue_head_init(&tp->out_of_order_queue);
1882         tcp_init_xmit_timers(sk);
1883         tcp_prequeue_init(tp);
1884
1885         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1886         tp->mdev = TCP_TIMEOUT_INIT;
1887
1888         /* So many TCP implementations out there (incorrectly) count the
1889          * initial SYN frame in their delayed-ACK and congestion control
1890          * algorithms that we must have the following bandaid to talk
1891          * efficiently to them.  -DaveM
1892          */
1893         tp->snd_cwnd = TCP_INIT_CWND;
1894
1895         /* See draft-stevens-tcpca-spec-01 for discussion of the
1896          * initialization of these values.
1897          */
1898         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
1899         tp->snd_cwnd_clamp = ~0;
1900         tp->mss_cache = TCP_MSS_DEFAULT;
1901
1902         tp->reordering = sysctl_tcp_reordering;
1903         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1904
1905         sk->sk_state = TCP_CLOSE;
1906
1907         sk->sk_write_space = sk_stream_write_space;
1908         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1909
1910         icsk->icsk_af_ops = &ipv4_specific;
1911         icsk->icsk_sync_mss = tcp_sync_mss;
1912 #ifdef CONFIG_TCP_MD5SIG
1913         tp->af_specific = &tcp_sock_ipv4_specific;
1914 #endif
1915
1916         /* TCP Cookie Transactions */
1917         if (sysctl_tcp_cookie_size > 0) {
1918                 /* Default, cookies without s_data_payload. */
1919                 tp->cookie_values =
1920                         kzalloc(sizeof(*tp->cookie_values),
1921                                 sk->sk_allocation);
1922                 if (tp->cookie_values != NULL)
1923                         kref_init(&tp->cookie_values->kref);
1924         }
1925         /* Presumed zeroed, in order of appearance:
1926          *      cookie_in_always, cookie_out_never,
1927          *      s_data_constant, s_data_in, s_data_out
1928          */
1929         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1930         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1931
1932         local_bh_disable();
1933         sock_update_memcg(sk);
1934         sk_sockets_allocated_inc(sk);
1935         local_bh_enable();
1936
1937         return 0;
1938 }
1939
1940 void tcp_v4_destroy_sock(struct sock *sk)
1941 {
1942         struct tcp_sock *tp = tcp_sk(sk);
1943
1944         tcp_clear_xmit_timers(sk);
1945
1946         tcp_cleanup_congestion_control(sk);
1947
1948         /* Cleanup up the write buffer. */
1949         tcp_write_queue_purge(sk);
1950
1951         /* Cleans up our, hopefully empty, out_of_order_queue. */
1952         __skb_queue_purge(&tp->out_of_order_queue);
1953
1954 #ifdef CONFIG_TCP_MD5SIG
1955         /* Clean up the MD5 key list, if any */
1956         if (tp->md5sig_info) {
1957                 tcp_clear_md5_list(sk);
1958                 kfree_rcu(tp->md5sig_info, rcu);
1959                 tp->md5sig_info = NULL;
1960         }
1961 #endif
1962
1963 #ifdef CONFIG_NET_DMA
1964         /* Cleans up our sk_async_wait_queue */
1965         __skb_queue_purge(&sk->sk_async_wait_queue);
1966 #endif
1967
1968         /* Clean prequeue, it must be empty really */
1969         __skb_queue_purge(&tp->ucopy.prequeue);
1970
1971         /* Clean up a referenced TCP bind bucket. */
1972         if (inet_csk(sk)->icsk_bind_hash)
1973                 inet_put_port(sk);
1974
1975         /*
1976          * If sendmsg cached page exists, toss it.
1977          */
1978         if (sk->sk_sndmsg_page) {
1979                 __free_page(sk->sk_sndmsg_page);
1980                 sk->sk_sndmsg_page = NULL;
1981         }
1982
1983         /* TCP Cookie Transactions */
1984         if (tp->cookie_values != NULL) {
1985                 kref_put(&tp->cookie_values->kref,
1986                          tcp_cookie_values_release);
1987                 tp->cookie_values = NULL;
1988         }
1989
1990         sk_sockets_allocated_dec(sk);
1991         sock_release_memcg(sk);
1992 }
1993 EXPORT_SYMBOL(tcp_v4_destroy_sock);
1994
1995 #ifdef CONFIG_PROC_FS
1996 /* Proc filesystem TCP sock list dumping. */
1997
1998 static inline struct inet_timewait_sock *tw_head(struct hlist_nulls_head *head)
1999 {
2000         return hlist_nulls_empty(head) ? NULL :
2001                 list_entry(head->first, struct inet_timewait_sock, tw_node);
2002 }
2003
2004 static inline struct inet_timewait_sock *tw_next(struct inet_timewait_sock *tw)
2005 {
2006         return !is_a_nulls(tw->tw_node.next) ?
2007                 hlist_nulls_entry(tw->tw_node.next, typeof(*tw), tw_node) : NULL;
2008 }
2009
2010 /*
2011  * Get next listener socket follow cur.  If cur is NULL, get first socket
2012  * starting from bucket given in st->bucket; when st->bucket is zero the
2013  * very first socket in the hash table is returned.
2014  */
2015 static void *listening_get_next(struct seq_file *seq, void *cur)
2016 {
2017         struct inet_connection_sock *icsk;
2018         struct hlist_nulls_node *node;
2019         struct sock *sk = cur;
2020         struct inet_listen_hashbucket *ilb;
2021         struct tcp_iter_state *st = seq->private;
2022         struct net *net = seq_file_net(seq);
2023
2024         if (!sk) {
2025                 ilb = &tcp_hashinfo.listening_hash[st->bucket];
2026                 spin_lock_bh(&ilb->lock);
2027                 sk = sk_nulls_head(&ilb->head);
2028                 st->offset = 0;
2029                 goto get_sk;
2030         }
2031         ilb = &tcp_hashinfo.listening_hash[st->bucket];
2032         ++st->num;
2033         ++st->offset;
2034
2035         if (st->state == TCP_SEQ_STATE_OPENREQ) {
2036                 struct request_sock *req = cur;
2037
2038                 icsk = inet_csk(st->syn_wait_sk);
2039                 req = req->dl_next;
2040                 while (1) {
2041                         while (req) {
2042                                 if (req->rsk_ops->family == st->family) {
2043                                         cur = req;
2044                                         goto out;
2045                                 }
2046                                 req = req->dl_next;
2047                         }
2048                         if (++st->sbucket >= icsk->icsk_accept_queue.listen_opt->nr_table_entries)
2049                                 break;
2050 get_req:
2051                         req = icsk->icsk_accept_queue.listen_opt->syn_table[st->sbucket];
2052                 }
2053                 sk        = sk_nulls_next(st->syn_wait_sk);
2054                 st->state = TCP_SEQ_STATE_LISTENING;
2055                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
2056         } else {
2057                 icsk = inet_csk(sk);
2058                 read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
2059                 if (reqsk_queue_len(&icsk->icsk_accept_queue))
2060                         goto start_req;
2061                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
2062                 sk = sk_nulls_next(sk);
2063         }
2064 get_sk:
2065         sk_nulls_for_each_from(sk, node) {
2066                 if (!net_eq(sock_net(sk), net))
2067                         continue;
2068                 if (sk->sk_family == st->family) {
2069                         cur = sk;
2070                         goto out;
2071                 }
2072                 icsk = inet_csk(sk);
2073                 read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
2074                 if (reqsk_queue_len(&icsk->icsk_accept_queue)) {
2075 start_req:
2076                         st->uid         = sock_i_uid(sk);
2077                         st->syn_wait_sk = sk;
2078                         st->state       = TCP_SEQ_STATE_OPENREQ;
2079                         st->sbucket     = 0;
2080                         goto get_req;
2081                 }
2082                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
2083         }
2084         spin_unlock_bh(&ilb->lock);
2085         st->offset = 0;
2086         if (++st->bucket < INET_LHTABLE_SIZE) {
2087                 ilb = &tcp_hashinfo.listening_hash[st->bucket];
2088                 spin_lock_bh(&ilb->lock);
2089                 sk = sk_nulls_head(&ilb->head);
2090                 goto get_sk;
2091         }
2092         cur = NULL;
2093 out:
2094         return cur;
2095 }
2096
2097 static void *listening_get_idx(struct seq_file *seq, loff_t *pos)
2098 {
2099         struct tcp_iter_state *st = seq->private;
2100         void *rc;
2101
2102         st->bucket = 0;
2103         st->offset = 0;
2104         rc = listening_get_next(seq, NULL);
2105
2106         while (rc && *pos) {
2107                 rc = listening_get_next(seq, rc);
2108                 --*pos;
2109         }
2110         return rc;
2111 }
2112
2113 static inline int empty_bucket(struct tcp_iter_state *st)
2114 {
2115         return hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].chain) &&
2116                 hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].twchain);
2117 }
2118
2119 /*
2120  * Get first established socket starting from bucket given in st->bucket.
2121  * If st->bucket is zero, the very first socket in the hash is returned.
2122  */
2123 static void *established_get_first(struct seq_file *seq)
2124 {
2125         struct tcp_iter_state *st = seq->private;
2126         struct net *net = seq_file_net(seq);
2127         void *rc = NULL;
2128
2129         st->offset = 0;
2130         for (; st->bucket <= tcp_hashinfo.ehash_mask; ++st->bucket) {
2131                 struct sock *sk;
2132                 struct hlist_nulls_node *node;
2133                 struct inet_timewait_sock *tw;
2134                 spinlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, st->bucket);
2135
2136                 /* Lockless fast path for the common case of empty buckets */
2137                 if (empty_bucket(st))
2138                         continue;
2139
2140                 spin_lock_bh(lock);
2141                 sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
2142                         if (sk->sk_family != st->family ||
2143                             !net_eq(sock_net(sk), net)) {
2144                                 continue;
2145                         }
2146                         rc = sk;
2147                         goto out;
2148                 }
2149                 st->state = TCP_SEQ_STATE_TIME_WAIT;
2150                 inet_twsk_for_each(tw, node,
2151                                    &tcp_hashinfo.ehash[st->bucket].twchain) {
2152                         if (tw->tw_family != st->family ||
2153                             !net_eq(twsk_net(tw), net)) {
2154                                 continue;
2155                         }
2156                         rc = tw;
2157                         goto out;
2158                 }
2159                 spin_unlock_bh(lock);
2160                 st->state = TCP_SEQ_STATE_ESTABLISHED;
2161         }
2162 out:
2163         return rc;
2164 }
2165
2166 static void *established_get_next(struct seq_file *seq, void *cur)
2167 {
2168         struct sock *sk = cur;
2169         struct inet_timewait_sock *tw;
2170         struct hlist_nulls_node *node;
2171         struct tcp_iter_state *st = seq->private;
2172         struct net *net = seq_file_net(seq);
2173
2174         ++st->num;
2175         ++st->offset;
2176
2177         if (st->state == TCP_SEQ_STATE_TIME_WAIT) {
2178                 tw = cur;
2179                 tw = tw_next(tw);
2180 get_tw:
2181                 while (tw && (tw->tw_family != st->family || !net_eq(twsk_net(tw), net))) {
2182                         tw = tw_next(tw);
2183                 }
2184                 if (tw) {
2185                         cur = tw;
2186                         goto out;
2187                 }
2188                 spin_unlock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
2189                 st->state = TCP_SEQ_STATE_ESTABLISHED;
2190
2191                 /* Look for next non empty bucket */
2192                 st->offset = 0;
2193                 while (++st->bucket <= tcp_hashinfo.ehash_mask &&
2194                                 empty_bucket(st))
2195                         ;
2196                 if (st->bucket > tcp_hashinfo.ehash_mask)
2197                         return NULL;
2198
2199                 spin_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
2200                 sk = sk_nulls_head(&tcp_hashinfo.ehash[st->bucket].chain);
2201         } else
2202                 sk = sk_nulls_next(sk);
2203
2204         sk_nulls_for_each_from(sk, node) {
2205                 if (sk->sk_family == st->family && net_eq(sock_net(sk), net))
2206                         goto found;
2207         }
2208
2209         st->state = TCP_SEQ_STATE_TIME_WAIT;
2210         tw = tw_head(&tcp_hashinfo.ehash[st->bucket].twchain);
2211         goto get_tw;
2212 found:
2213         cur = sk;
2214 out:
2215         return cur;
2216 }
2217
2218 static void *established_get_idx(struct seq_file *seq, loff_t pos)
2219 {
2220         struct tcp_iter_state *st = seq->private;
2221         void *rc;
2222
2223         st->bucket = 0;
2224         rc = established_get_first(seq);
2225
2226         while (rc && pos) {
2227                 rc = established_get_next(seq, rc);
2228                 --pos;
2229         }
2230         return rc;
2231 }
2232
2233 static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
2234 {
2235         void *rc;
2236         struct tcp_iter_state *st = seq->private;
2237
2238         st->state = TCP_SEQ_STATE_LISTENING;
2239         rc        = listening_get_idx(seq, &pos);
2240
2241         if (!rc) {
2242                 st->state = TCP_SEQ_STATE_ESTABLISHED;
2243                 rc        = established_get_idx(seq, pos);
2244         }
2245
2246         return rc;
2247 }
2248
2249 static void *tcp_seek_last_pos(struct seq_file *seq)
2250 {
2251         struct tcp_iter_state *st = seq->private;
2252         int offset = st->offset;
2253         int orig_num = st->num;
2254         void *rc = NULL;
2255
2256         switch (st->state) {
2257         case TCP_SEQ_STATE_OPENREQ:
2258         case TCP_SEQ_STATE_LISTENING:
2259                 if (st->bucket >= INET_LHTABLE_SIZE)
2260                         break;
2261                 st->state = TCP_SEQ_STATE_LISTENING;
2262                 rc = listening_get_next(seq, NULL);
2263                 while (offset-- && rc)
2264                         rc = listening_get_next(seq, rc);
2265                 if (rc)
2266                         break;
2267                 st->bucket = 0;
2268                 /* Fallthrough */
2269         case TCP_SEQ_STATE_ESTABLISHED:
2270         case TCP_SEQ_STATE_TIME_WAIT:
2271                 st->state = TCP_SEQ_STATE_ESTABLISHED;
2272                 if (st->bucket > tcp_hashinfo.ehash_mask)
2273                         break;
2274                 rc = established_get_first(seq);
2275                 while (offset-- && rc)
2276                         rc = established_get_next(seq, rc);
2277         }
2278
2279         st->num = orig_num;
2280
2281         return rc;
2282 }
2283
2284 static void *tcp_seq_start(struct seq_file *seq, loff_t *pos)
2285 {
2286         struct tcp_iter_state *st = seq->private;
2287         void *rc;
2288
2289         if (*pos && *pos == st->last_pos) {
2290                 rc = tcp_seek_last_pos(seq);
2291                 if (rc)
2292                         goto out;
2293         }
2294
2295         st->state = TCP_SEQ_STATE_LISTENING;
2296         st->num = 0;
2297         st->bucket = 0;
2298         st->offset = 0;
2299         rc = *pos ? tcp_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
2300
2301 out:
2302         st->last_pos = *pos;
2303         return rc;
2304 }
2305
2306 static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
2307 {
2308         struct tcp_iter_state *st = seq->private;
2309         void *rc = NULL;
2310
2311         if (v == SEQ_START_TOKEN) {
2312                 rc = tcp_get_idx(seq, 0);
2313                 goto out;
2314         }
2315
2316         switch (st->state) {
2317         case TCP_SEQ_STATE_OPENREQ:
2318         case TCP_SEQ_STATE_LISTENING:
2319                 rc = listening_get_next(seq, v);
2320                 if (!rc) {
2321                         st->state = TCP_SEQ_STATE_ESTABLISHED;
2322                         st->bucket = 0;
2323                         st->offset = 0;
2324                         rc        = established_get_first(seq);
2325                 }
2326                 break;
2327         case TCP_SEQ_STATE_ESTABLISHED:
2328         case TCP_SEQ_STATE_TIME_WAIT:
2329                 rc = established_get_next(seq, v);
2330                 break;
2331         }
2332 out:
2333         ++*pos;
2334         st->last_pos = *pos;
2335         return rc;
2336 }
2337
2338 static void tcp_seq_stop(struct seq_file *seq, void *v)
2339 {
2340         struct tcp_iter_state *st = seq->private;
2341
2342         switch (st->state) {
2343         case TCP_SEQ_STATE_OPENREQ:
2344                 if (v) {
2345                         struct inet_connection_sock *icsk = inet_csk(st->syn_wait_sk);
2346                         read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
2347                 }
2348         case TCP_SEQ_STATE_LISTENING:
2349                 if (v != SEQ_START_TOKEN)
2350                         spin_unlock_bh(&tcp_hashinfo.listening_hash[st->bucket].lock);
2351                 break;
2352         case TCP_SEQ_STATE_TIME_WAIT:
2353         case TCP_SEQ_STATE_ESTABLISHED:
2354                 if (v)
2355                         spin_unlock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
2356                 break;
2357         }
2358 }
2359
2360 int tcp_seq_open(struct inode *inode, struct file *file)
2361 {
2362         struct tcp_seq_afinfo *afinfo = PDE(inode)->data;
2363         struct tcp_iter_state *s;
2364         int err;
2365
2366         err = seq_open_net(inode, file, &afinfo->seq_ops,
2367                           sizeof(struct tcp_iter_state));
2368         if (err < 0)
2369                 return err;
2370
2371         s = ((struct seq_file *)file->private_data)->private;
2372         s->family               = afinfo->family;
2373         s->last_pos             = 0;
2374         return 0;
2375 }
2376 EXPORT_SYMBOL(tcp_seq_open);
2377
2378 int tcp_proc_register(struct net *net, struct tcp_seq_afinfo *afinfo)
2379 {
2380         int rc = 0;
2381         struct proc_dir_entry *p;
2382
2383         afinfo->seq_ops.start           = tcp_seq_start;
2384         afinfo->seq_ops.next            = tcp_seq_next;
2385         afinfo->seq_ops.stop            = tcp_seq_stop;
2386
2387         p = proc_create_data(afinfo->name, S_IRUGO, net->proc_net,
2388                              afinfo->seq_fops, afinfo);
2389         if (!p)
2390                 rc = -ENOMEM;
2391         return rc;
2392 }
2393 EXPORT_SYMBOL(tcp_proc_register);
2394
2395 void tcp_proc_unregister(struct net *net, struct tcp_seq_afinfo *afinfo)
2396 {
2397         proc_net_remove(net, afinfo->name);
2398 }
2399 EXPORT_SYMBOL(tcp_proc_unregister);
2400
2401 static void get_openreq4(const struct sock *sk, const struct request_sock *req,
2402                          struct seq_file *f, int i, int uid, int *len)
2403 {
2404         const struct inet_request_sock *ireq = inet_rsk(req);
2405         int ttd = req->expires - jiffies;
2406
2407         seq_printf(f, "%4d: %08X:%04X %08X:%04X"
2408                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %pK%n",
2409                 i,
2410                 ireq->loc_addr,
2411                 ntohs(inet_sk(sk)->inet_sport),
2412                 ireq->rmt_addr,
2413                 ntohs(ireq->rmt_port),
2414                 TCP_SYN_RECV,
2415                 0, 0, /* could print option size, but that is af dependent. */
2416                 1,    /* timers active (only the expire timer) */
2417                 jiffies_to_clock_t(ttd),
2418                 req->retrans,
2419                 uid,
2420                 0,  /* non standard timer */
2421                 0, /* open_requests have no inode */
2422                 atomic_read(&sk->sk_refcnt),
2423                 req,
2424                 len);
2425 }
2426
2427 static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
2428 {
2429         int timer_active;
2430         unsigned long timer_expires;
2431         const struct tcp_sock *tp = tcp_sk(sk);
2432         const struct inet_connection_sock *icsk = inet_csk(sk);
2433         const struct inet_sock *inet = inet_sk(sk);
2434         __be32 dest = inet->inet_daddr;
2435         __be32 src = inet->inet_rcv_saddr;
2436         __u16 destp = ntohs(inet->inet_dport);
2437         __u16 srcp = ntohs(inet->inet_sport);
2438         int rx_queue;
2439         unsigned long cmdline = __get_free_page(GFP_TEMPORARY);
2440         if (cmdline == NULL)
2441                 return;
2442
2443         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2444                 timer_active    = 1;
2445                 timer_expires   = icsk->icsk_timeout;
2446         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2447                 timer_active    = 4;
2448                 timer_expires   = icsk->icsk_timeout;
2449         } else if (timer_pending(&sk->sk_timer)) {
2450                 timer_active    = 2;
2451                 timer_expires   = sk->sk_timer.expires;
2452         } else {
2453                 timer_active    = 0;
2454                 timer_expires = jiffies;
2455         }
2456
2457         if (sk->sk_state == TCP_LISTEN)
2458                 rx_queue = sk->sk_ack_backlog;
2459         else
2460                 /*
2461                  * because we dont lock socket, we might find a transient negative value
2462                  */
2463                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
2464
2465         seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
2466                 "%08X %5d %8d %lu %d %pK %lu %lu %u %u %d %s%n",
2467                 i, src, srcp, dest, destp, sk->sk_state,
2468                 tp->write_seq - tp->snd_una,
2469                 rx_queue,
2470                 timer_active,
2471                 jiffies_to_clock_t(timer_expires - jiffies),
2472                 icsk->icsk_retransmits,
2473                 sock_i_uid(sk),
2474                 icsk->icsk_probes_out,
2475                 sock_i_ino(sk),
2476                 atomic_read(&sk->sk_refcnt), sk,
2477                 jiffies_to_clock_t(icsk->icsk_rto),
2478                 jiffies_to_clock_t(icsk->icsk_ack.ato),
2479                 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
2480                 tp->snd_cwnd,
2481                 tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh,
2482                 sk_get_waiting_task_cmdline(sk, cmdline),
2483                 len);
2484
2485         free_page(cmdline);
2486 }
2487
2488 static void get_timewait4_sock(const struct inet_timewait_sock *tw,
2489                                struct seq_file *f, int i, int *len)
2490 {
2491         __be32 dest, src;
2492         __u16 destp, srcp;
2493         int ttd = tw->tw_ttd - jiffies;
2494
2495         if (ttd < 0)
2496                 ttd = 0;
2497
2498         dest  = tw->tw_daddr;
2499         src   = tw->tw_rcv_saddr;
2500         destp = ntohs(tw->tw_dport);
2501         srcp  = ntohs(tw->tw_sport);
2502
2503         seq_printf(f, "%4d: %08X:%04X %08X:%04X"
2504                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
2505                 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
2506                 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2507                 atomic_read(&tw->tw_refcnt), tw, len);
2508 }
2509
2510 #define TMPSZ 150
2511
2512 static int tcp4_seq_show(struct seq_file *seq, void *v)
2513 {
2514         struct tcp_iter_state *st;
2515         int len;
2516
2517         if (v == SEQ_START_TOKEN) {
2518                 seq_printf(seq, "%-*s\n", TMPSZ - 1,
2519                         "  sl  local_address rem_address   st tx_queue "
2520                         "rx_queue tr tm->when retrnsmt   uid  timeout "
2521                         "inode "
2522                         "cmdline");
2523                 goto out;
2524         }
2525         st = seq->private;
2526
2527         switch (st->state) {
2528         case TCP_SEQ_STATE_LISTENING:
2529         case TCP_SEQ_STATE_ESTABLISHED:
2530                 get_tcp4_sock(v, seq, st->num, &len);
2531                 break;
2532         case TCP_SEQ_STATE_OPENREQ:
2533                 get_openreq4(st->syn_wait_sk, v, seq, st->num, st->uid, &len);
2534                 break;
2535         case TCP_SEQ_STATE_TIME_WAIT:
2536                 get_timewait4_sock(v, seq, st->num, &len);
2537                 break;
2538         }
2539         seq_printf(seq, "\n");
2540 out:
2541         return 0;
2542 }
2543
2544 static const struct file_operations tcp_afinfo_seq_fops = {
2545         .owner   = THIS_MODULE,
2546         .open    = tcp_seq_open,
2547         .read    = seq_read,
2548         .llseek  = seq_lseek,
2549         .release = seq_release_net
2550 };
2551
2552 static struct tcp_seq_afinfo tcp4_seq_afinfo = {
2553         .name           = "tcp",
2554         .family         = AF_INET,
2555         .seq_fops       = &tcp_afinfo_seq_fops,
2556         .seq_ops        = {
2557                 .show           = tcp4_seq_show,
2558         },
2559 };
2560
2561 static int __net_init tcp4_proc_init_net(struct net *net)
2562 {
2563         return tcp_proc_register(net, &tcp4_seq_afinfo);
2564 }
2565
2566 static void __net_exit tcp4_proc_exit_net(struct net *net)
2567 {
2568         tcp_proc_unregister(net, &tcp4_seq_afinfo);
2569 }
2570
2571 static struct pernet_operations tcp4_net_ops = {
2572         .init = tcp4_proc_init_net,
2573         .exit = tcp4_proc_exit_net,
2574 };
2575
2576 int __init tcp4_proc_init(void)
2577 {
2578         return register_pernet_subsys(&tcp4_net_ops);
2579 }
2580
2581 void tcp4_proc_exit(void)
2582 {
2583         unregister_pernet_subsys(&tcp4_net_ops);
2584 }
2585 #endif /* CONFIG_PROC_FS */
2586
2587 struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
2588 {
2589         const struct iphdr *iph = skb_gro_network_header(skb);
2590
2591         switch (skb->ip_summed) {
2592         case CHECKSUM_COMPLETE:
2593                 if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
2594                                   skb->csum)) {
2595                         skb->ip_summed = CHECKSUM_UNNECESSARY;
2596                         break;
2597                 }
2598
2599                 /* fall through */
2600         case CHECKSUM_NONE:
2601                 NAPI_GRO_CB(skb)->flush = 1;
2602                 return NULL;
2603         }
2604
2605         return tcp_gro_receive(head, skb);
2606 }
2607
2608 int tcp4_gro_complete(struct sk_buff *skb)
2609 {
2610         const struct iphdr *iph = ip_hdr(skb);
2611         struct tcphdr *th = tcp_hdr(skb);
2612
2613         th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb),
2614                                   iph->saddr, iph->daddr, 0);
2615         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
2616
2617         return tcp_gro_complete(skb);
2618 }
2619
2620 struct proto tcp_prot = {
2621         .name                   = "TCP",
2622         .owner                  = THIS_MODULE,
2623         .close                  = tcp_close,
2624         .connect                = tcp_v4_connect,
2625         .disconnect             = tcp_disconnect,
2626         .accept                 = inet_csk_accept,
2627         .ioctl                  = tcp_ioctl,
2628         .init                   = tcp_v4_init_sock,
2629         .destroy                = tcp_v4_destroy_sock,
2630         .shutdown               = tcp_shutdown,
2631         .setsockopt             = tcp_setsockopt,
2632         .getsockopt             = tcp_getsockopt,
2633         .recvmsg                = tcp_recvmsg,
2634         .sendmsg                = tcp_sendmsg,
2635         .sendpage               = tcp_sendpage,
2636         .backlog_rcv            = tcp_v4_do_rcv,
2637         .hash                   = inet_hash,
2638         .unhash                 = inet_unhash,
2639         .get_port               = inet_csk_get_port,
2640         .enter_memory_pressure  = tcp_enter_memory_pressure,
2641         .sockets_allocated      = &tcp_sockets_allocated,
2642         .orphan_count           = &tcp_orphan_count,
2643         .memory_allocated       = &tcp_memory_allocated,
2644         .memory_pressure        = &tcp_memory_pressure,
2645         .sysctl_wmem            = sysctl_tcp_wmem,
2646         .sysctl_rmem            = sysctl_tcp_rmem,
2647         .max_header             = MAX_TCP_HEADER,
2648         .obj_size               = sizeof(struct tcp_sock),
2649         .slab_flags             = SLAB_DESTROY_BY_RCU,
2650         .twsk_prot              = &tcp_timewait_sock_ops,
2651         .rsk_prot               = &tcp_request_sock_ops,
2652         .h.hashinfo             = &tcp_hashinfo,
2653         .no_autobind            = true,
2654 #ifdef CONFIG_COMPAT
2655         .compat_setsockopt      = compat_tcp_setsockopt,
2656         .compat_getsockopt      = compat_tcp_getsockopt,
2657 #endif
2658 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_KMEM
2659         .init_cgroup            = tcp_init_cgroup,
2660         .destroy_cgroup         = tcp_destroy_cgroup,
2661         .proto_cgroup           = tcp_proto_cgroup,
2662 #endif
2663 };
2664 EXPORT_SYMBOL(tcp_prot);
2665
2666 static int __net_init tcp_sk_init(struct net *net)
2667 {
2668         return inet_ctl_sock_create(&net->ipv4.tcp_sock,
2669                                     PF_INET, SOCK_RAW, IPPROTO_TCP, net);
2670 }
2671
2672 static void __net_exit tcp_sk_exit(struct net *net)
2673 {
2674         inet_ctl_sock_destroy(net->ipv4.tcp_sock);
2675 }
2676
2677 static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
2678 {
2679         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET);
2680 }
2681
2682 static struct pernet_operations __net_initdata tcp_sk_ops = {
2683        .init       = tcp_sk_init,
2684        .exit       = tcp_sk_exit,
2685        .exit_batch = tcp_sk_exit_batch,
2686 };
2687
2688 void __init tcp_v4_init(void)
2689 {
2690         inet_hashinfo_init(&tcp_hashinfo);
2691         if (register_pernet_subsys(&tcp_sk_ops))
2692                 panic("Failed to create the TCP control socket.\n");
2693 }