active-standby: add cmdline into /proc/net/
[linux-2.6.git] / net / ipv6 / tcp_ipv6.c
1 /*
2  *      TCP over IPv6
3  *      Linux INET6 implementation
4  *
5  *      Authors:
6  *      Pedro Roque             <roque@di.fc.ul.pt>
7  *
8  *      Based on:
9  *      linux/net/ipv4/tcp.c
10  *      linux/net/ipv4/tcp_input.c
11  *      linux/net/ipv4/tcp_output.c
12  *
13  *      Fixes:
14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
17  *                                      a single port at the same time.
18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
19  *
20  *      This program is free software; you can redistribute it and/or
21  *      modify it under the terms of the GNU General Public License
22  *      as published by the Free Software Foundation; either version
23  *      2 of the License, or (at your option) any later version.
24  *
25  * Copyright (c) 2013, NVIDIA CORPORATION.  All rights reserved.
26  */
27
28 #include <linux/bottom_half.h>
29 #include <linux/module.h>
30 #include <linux/errno.h>
31 #include <linux/types.h>
32 #include <linux/socket.h>
33 #include <linux/sockios.h>
34 #include <linux/net.h>
35 #include <linux/jiffies.h>
36 #include <linux/in.h>
37 #include <linux/in6.h>
38 #include <linux/netdevice.h>
39 #include <linux/init.h>
40 #include <linux/jhash.h>
41 #include <linux/ipsec.h>
42 #include <linux/times.h>
43 #include <linux/slab.h>
44
45 #include <linux/ipv6.h>
46 #include <linux/icmpv6.h>
47 #include <linux/random.h>
48
49 #include <net/tcp.h>
50 #include <net/ndisc.h>
51 #include <net/inet6_hashtables.h>
52 #include <net/inet6_connection_sock.h>
53 #include <net/ipv6.h>
54 #include <net/transp_v6.h>
55 #include <net/addrconf.h>
56 #include <net/ip6_route.h>
57 #include <net/ip6_checksum.h>
58 #include <net/inet_ecn.h>
59 #include <net/protocol.h>
60 #include <net/xfrm.h>
61 #include <net/snmp.h>
62 #include <net/dsfield.h>
63 #include <net/timewait_sock.h>
64 #include <net/netdma.h>
65 #include <net/inet_common.h>
66 #include <net/secure_seq.h>
67 #include <net/tcp_memcontrol.h>
68
69 #include <asm/uaccess.h>
70
71 #include <linux/proc_fs.h>
72 #include <linux/seq_file.h>
73
74 #include <linux/crypto.h>
75 #include <linux/scatterlist.h>
76
77 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
78 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
79                                       struct request_sock *req);
80
81 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
82 static void     __tcp_v6_send_check(struct sk_buff *skb,
83                                     const struct in6_addr *saddr,
84                                     const struct in6_addr *daddr);
85
86 static const struct inet_connection_sock_af_ops ipv6_mapped;
87 static const struct inet_connection_sock_af_ops ipv6_specific;
88 #ifdef CONFIG_TCP_MD5SIG
89 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
90 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
91 #else
92 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
93                                                    const struct in6_addr *addr)
94 {
95         return NULL;
96 }
97 #endif
98
99 static void tcp_v6_hash(struct sock *sk)
100 {
101         if (sk->sk_state != TCP_CLOSE) {
102                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
103                         tcp_prot.hash(sk);
104                         return;
105                 }
106                 local_bh_disable();
107                 __inet6_hash(sk, NULL);
108                 local_bh_enable();
109         }
110 }
111
112 static __inline__ __sum16 tcp_v6_check(int len,
113                                    const struct in6_addr *saddr,
114                                    const struct in6_addr *daddr,
115                                    __wsum base)
116 {
117         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
118 }
119
120 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
121 {
122         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
123                                             ipv6_hdr(skb)->saddr.s6_addr32,
124                                             tcp_hdr(skb)->dest,
125                                             tcp_hdr(skb)->source);
126 }
127
128 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
129                           int addr_len)
130 {
131         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
132         struct inet_sock *inet = inet_sk(sk);
133         struct inet_connection_sock *icsk = inet_csk(sk);
134         struct ipv6_pinfo *np = inet6_sk(sk);
135         struct tcp_sock *tp = tcp_sk(sk);
136         struct in6_addr *saddr = NULL, *final_p, final;
137         struct rt6_info *rt;
138         struct flowi6 fl6;
139         struct dst_entry *dst;
140         int addr_type;
141         int err;
142
143         if (addr_len < SIN6_LEN_RFC2133)
144                 return -EINVAL;
145
146         if (usin->sin6_family != AF_INET6)
147                 return -EAFNOSUPPORT;
148
149         memset(&fl6, 0, sizeof(fl6));
150
151         if (np->sndflow) {
152                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
153                 IP6_ECN_flow_init(fl6.flowlabel);
154                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
155                         struct ip6_flowlabel *flowlabel;
156                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
157                         if (flowlabel == NULL)
158                                 return -EINVAL;
159                         usin->sin6_addr = flowlabel->dst;
160                         fl6_sock_release(flowlabel);
161                 }
162         }
163
164         /*
165          *      connect() to INADDR_ANY means loopback (BSD'ism).
166          */
167
168         if(ipv6_addr_any(&usin->sin6_addr))
169                 usin->sin6_addr.s6_addr[15] = 0x1;
170
171         addr_type = ipv6_addr_type(&usin->sin6_addr);
172
173         if(addr_type & IPV6_ADDR_MULTICAST)
174                 return -ENETUNREACH;
175
176         if (addr_type&IPV6_ADDR_LINKLOCAL) {
177                 if (addr_len >= sizeof(struct sockaddr_in6) &&
178                     usin->sin6_scope_id) {
179                         /* If interface is set while binding, indices
180                          * must coincide.
181                          */
182                         if (sk->sk_bound_dev_if &&
183                             sk->sk_bound_dev_if != usin->sin6_scope_id)
184                                 return -EINVAL;
185
186                         sk->sk_bound_dev_if = usin->sin6_scope_id;
187                 }
188
189                 /* Connect to link-local address requires an interface */
190                 if (!sk->sk_bound_dev_if)
191                         return -EINVAL;
192         }
193
194         if (tp->rx_opt.ts_recent_stamp &&
195             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
196                 tp->rx_opt.ts_recent = 0;
197                 tp->rx_opt.ts_recent_stamp = 0;
198                 tp->write_seq = 0;
199         }
200
201         np->daddr = usin->sin6_addr;
202         np->flow_label = fl6.flowlabel;
203
204         /*
205          *      TCP over IPv4
206          */
207
208         if (addr_type == IPV6_ADDR_MAPPED) {
209                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
210                 struct sockaddr_in sin;
211
212                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
213
214                 if (__ipv6_only_sock(sk))
215                         return -ENETUNREACH;
216
217                 sin.sin_family = AF_INET;
218                 sin.sin_port = usin->sin6_port;
219                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
220
221                 icsk->icsk_af_ops = &ipv6_mapped;
222                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
223 #ifdef CONFIG_TCP_MD5SIG
224                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
225 #endif
226
227                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
228
229                 if (err) {
230                         icsk->icsk_ext_hdr_len = exthdrlen;
231                         icsk->icsk_af_ops = &ipv6_specific;
232                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
233 #ifdef CONFIG_TCP_MD5SIG
234                         tp->af_specific = &tcp_sock_ipv6_specific;
235 #endif
236                         goto failure;
237                 } else {
238                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
239                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
240                                                &np->rcv_saddr);
241                 }
242
243                 return err;
244         }
245
246         if (!ipv6_addr_any(&np->rcv_saddr))
247                 saddr = &np->rcv_saddr;
248
249         fl6.flowi6_proto = IPPROTO_TCP;
250         fl6.daddr = np->daddr;
251         fl6.saddr = saddr ? *saddr : np->saddr;
252         fl6.flowi6_oif = sk->sk_bound_dev_if;
253         fl6.flowi6_mark = sk->sk_mark;
254         fl6.fl6_dport = usin->sin6_port;
255         fl6.fl6_sport = inet->inet_sport;
256
257         final_p = fl6_update_dst(&fl6, np->opt, &final);
258
259         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
260
261         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
262         if (IS_ERR(dst)) {
263                 err = PTR_ERR(dst);
264                 goto failure;
265         }
266
267         if (saddr == NULL) {
268                 saddr = &fl6.saddr;
269                 np->rcv_saddr = *saddr;
270         }
271
272         /* set the source address */
273         np->saddr = *saddr;
274         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
275
276         sk->sk_gso_type = SKB_GSO_TCPV6;
277         __ip6_dst_store(sk, dst, NULL, NULL);
278
279         rt = (struct rt6_info *) dst;
280         if (tcp_death_row.sysctl_tw_recycle &&
281             !tp->rx_opt.ts_recent_stamp &&
282             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
283                 struct inet_peer *peer = rt6_get_peer(rt);
284                 /*
285                  * VJ's idea. We save last timestamp seen from
286                  * the destination in peer table, when entering state
287                  * TIME-WAIT * and initialize rx_opt.ts_recent from it,
288                  * when trying new connection.
289                  */
290                 if (peer) {
291                         inet_peer_refcheck(peer);
292                         if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
293                                 tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
294                                 tp->rx_opt.ts_recent = peer->tcp_ts;
295                         }
296                 }
297         }
298
299         icsk->icsk_ext_hdr_len = 0;
300         if (np->opt)
301                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
302                                           np->opt->opt_nflen);
303
304         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
305
306         inet->inet_dport = usin->sin6_port;
307
308         tcp_set_state(sk, TCP_SYN_SENT);
309         err = inet6_hash_connect(&tcp_death_row, sk);
310         if (err)
311                 goto late_failure;
312
313         if (!tp->write_seq)
314                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
315                                                              np->daddr.s6_addr32,
316                                                              inet->inet_sport,
317                                                              inet->inet_dport);
318
319         err = tcp_connect(sk);
320         if (err)
321                 goto late_failure;
322
323         return 0;
324
325 late_failure:
326         tcp_set_state(sk, TCP_CLOSE);
327         __sk_dst_reset(sk);
328 failure:
329         inet->inet_dport = 0;
330         sk->sk_route_caps = 0;
331         return err;
332 }
333
334 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
335                 u8 type, u8 code, int offset, __be32 info)
336 {
337         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
338         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
339         struct ipv6_pinfo *np;
340         struct sock *sk;
341         int err;
342         struct tcp_sock *tp;
343         __u32 seq;
344         struct net *net = dev_net(skb->dev);
345
346         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
347                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
348
349         if (sk == NULL) {
350                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
351                                    ICMP6_MIB_INERRORS);
352                 return;
353         }
354
355         if (sk->sk_state == TCP_TIME_WAIT) {
356                 inet_twsk_put(inet_twsk(sk));
357                 return;
358         }
359
360         bh_lock_sock(sk);
361         if (sock_owned_by_user(sk))
362                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
363
364         if (sk->sk_state == TCP_CLOSE)
365                 goto out;
366
367         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
368                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
369                 goto out;
370         }
371
372         tp = tcp_sk(sk);
373         seq = ntohl(th->seq);
374         if (sk->sk_state != TCP_LISTEN &&
375             !between(seq, tp->snd_una, tp->snd_nxt)) {
376                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
377                 goto out;
378         }
379
380         np = inet6_sk(sk);
381
382         if (type == ICMPV6_PKT_TOOBIG) {
383                 struct dst_entry *dst;
384
385                 if (sock_owned_by_user(sk))
386                         goto out;
387                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
388                         goto out;
389
390                 /* icmp should have updated the destination cache entry */
391                 dst = __sk_dst_check(sk, np->dst_cookie);
392
393                 if (dst == NULL) {
394                         struct inet_sock *inet = inet_sk(sk);
395                         struct flowi6 fl6;
396
397                         /* BUGGG_FUTURE: Again, it is not clear how
398                            to handle rthdr case. Ignore this complexity
399                            for now.
400                          */
401                         memset(&fl6, 0, sizeof(fl6));
402                         fl6.flowi6_proto = IPPROTO_TCP;
403                         fl6.daddr = np->daddr;
404                         fl6.saddr = np->saddr;
405                         fl6.flowi6_oif = sk->sk_bound_dev_if;
406                         fl6.flowi6_mark = sk->sk_mark;
407                         fl6.fl6_dport = inet->inet_dport;
408                         fl6.fl6_sport = inet->inet_sport;
409                         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
410
411                         dst = ip6_dst_lookup_flow(sk, &fl6, NULL, false);
412                         if (IS_ERR(dst)) {
413                                 sk->sk_err_soft = -PTR_ERR(dst);
414                                 goto out;
415                         }
416
417                 } else
418                         dst_hold(dst);
419
420                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
421                         tcp_sync_mss(sk, dst_mtu(dst));
422                         tcp_simple_retransmit(sk);
423                 } /* else let the usual retransmit timer handle it */
424                 dst_release(dst);
425                 goto out;
426         }
427
428         icmpv6_err_convert(type, code, &err);
429
430         /* Might be for an request_sock */
431         switch (sk->sk_state) {
432                 struct request_sock *req, **prev;
433         case TCP_LISTEN:
434                 if (sock_owned_by_user(sk))
435                         goto out;
436
437                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
438                                            &hdr->saddr, inet6_iif(skb));
439                 if (!req)
440                         goto out;
441
442                 /* ICMPs are not backlogged, hence we cannot get
443                  * an established socket here.
444                  */
445                 WARN_ON(req->sk != NULL);
446
447                 if (seq != tcp_rsk(req)->snt_isn) {
448                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
449                         goto out;
450                 }
451
452                 inet_csk_reqsk_queue_drop(sk, req, prev);
453                 goto out;
454
455         case TCP_SYN_SENT:
456         case TCP_SYN_RECV:  /* Cannot happen.
457                                It can, it SYNs are crossed. --ANK */
458                 if (!sock_owned_by_user(sk)) {
459                         sk->sk_err = err;
460                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
461
462                         tcp_done(sk);
463                 } else
464                         sk->sk_err_soft = err;
465                 goto out;
466         }
467
468         if (!sock_owned_by_user(sk) && np->recverr) {
469                 sk->sk_err = err;
470                 sk->sk_error_report(sk);
471         } else
472                 sk->sk_err_soft = err;
473
474 out:
475         bh_unlock_sock(sk);
476         sock_put(sk);
477 }
478
479
480 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
481                               struct request_values *rvp)
482 {
483         struct inet6_request_sock *treq = inet6_rsk(req);
484         struct ipv6_pinfo *np = inet6_sk(sk);
485         struct sk_buff * skb;
486         struct ipv6_txoptions *opt = NULL;
487         struct in6_addr * final_p, final;
488         struct flowi6 fl6;
489         struct dst_entry *dst;
490         int err;
491
492         memset(&fl6, 0, sizeof(fl6));
493         fl6.flowi6_proto = IPPROTO_TCP;
494         fl6.daddr = treq->rmt_addr;
495         fl6.saddr = treq->loc_addr;
496         fl6.flowlabel = 0;
497         fl6.flowi6_oif = treq->iif;
498         fl6.flowi6_mark = sk->sk_mark;
499         fl6.fl6_dport = inet_rsk(req)->rmt_port;
500         fl6.fl6_sport = inet_rsk(req)->loc_port;
501         security_req_classify_flow(req, flowi6_to_flowi(&fl6));
502
503         opt = np->opt;
504         final_p = fl6_update_dst(&fl6, opt, &final);
505
506         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
507         if (IS_ERR(dst)) {
508                 err = PTR_ERR(dst);
509                 dst = NULL;
510                 goto done;
511         }
512         skb = tcp_make_synack(sk, dst, req, rvp);
513         err = -ENOMEM;
514         if (skb) {
515                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
516
517                 fl6.daddr = treq->rmt_addr;
518                 err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
519                 err = net_xmit_eval(err);
520         }
521
522 done:
523         if (opt && opt != np->opt)
524                 sock_kfree_s(sk, opt, opt->tot_len);
525         dst_release(dst);
526         return err;
527 }
528
529 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
530                              struct request_values *rvp)
531 {
532         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
533         return tcp_v6_send_synack(sk, req, rvp);
534 }
535
536 static void tcp_v6_reqsk_destructor(struct request_sock *req)
537 {
538         kfree_skb(inet6_rsk(req)->pktopts);
539 }
540
541 #ifdef CONFIG_TCP_MD5SIG
542 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
543                                                    const struct in6_addr *addr)
544 {
545         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
546 }
547
548 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
549                                                 struct sock *addr_sk)
550 {
551         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
552 }
553
554 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
555                                                       struct request_sock *req)
556 {
557         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
558 }
559
560 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
561                                   int optlen)
562 {
563         struct tcp_md5sig cmd;
564         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
565
566         if (optlen < sizeof(cmd))
567                 return -EINVAL;
568
569         if (copy_from_user(&cmd, optval, sizeof(cmd)))
570                 return -EFAULT;
571
572         if (sin6->sin6_family != AF_INET6)
573                 return -EINVAL;
574
575         if (!cmd.tcpm_keylen) {
576                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
577                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
578                                               AF_INET);
579                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
580                                       AF_INET6);
581         }
582
583         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
584                 return -EINVAL;
585
586         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
587                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
588                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
589
590         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
591                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
592 }
593
594 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
595                                         const struct in6_addr *daddr,
596                                         const struct in6_addr *saddr, int nbytes)
597 {
598         struct tcp6_pseudohdr *bp;
599         struct scatterlist sg;
600
601         bp = &hp->md5_blk.ip6;
602         /* 1. TCP pseudo-header (RFC2460) */
603         bp->saddr = *saddr;
604         bp->daddr = *daddr;
605         bp->protocol = cpu_to_be32(IPPROTO_TCP);
606         bp->len = cpu_to_be32(nbytes);
607
608         sg_init_one(&sg, bp, sizeof(*bp));
609         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
610 }
611
612 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
613                                const struct in6_addr *daddr, struct in6_addr *saddr,
614                                const struct tcphdr *th)
615 {
616         struct tcp_md5sig_pool *hp;
617         struct hash_desc *desc;
618
619         hp = tcp_get_md5sig_pool();
620         if (!hp)
621                 goto clear_hash_noput;
622         desc = &hp->md5_desc;
623
624         if (crypto_hash_init(desc))
625                 goto clear_hash;
626         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
627                 goto clear_hash;
628         if (tcp_md5_hash_header(hp, th))
629                 goto clear_hash;
630         if (tcp_md5_hash_key(hp, key))
631                 goto clear_hash;
632         if (crypto_hash_final(desc, md5_hash))
633                 goto clear_hash;
634
635         tcp_put_md5sig_pool();
636         return 0;
637
638 clear_hash:
639         tcp_put_md5sig_pool();
640 clear_hash_noput:
641         memset(md5_hash, 0, 16);
642         return 1;
643 }
644
645 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
646                                const struct sock *sk,
647                                const struct request_sock *req,
648                                const struct sk_buff *skb)
649 {
650         const struct in6_addr *saddr, *daddr;
651         struct tcp_md5sig_pool *hp;
652         struct hash_desc *desc;
653         const struct tcphdr *th = tcp_hdr(skb);
654
655         if (sk) {
656                 saddr = &inet6_sk(sk)->saddr;
657                 daddr = &inet6_sk(sk)->daddr;
658         } else if (req) {
659                 saddr = &inet6_rsk(req)->loc_addr;
660                 daddr = &inet6_rsk(req)->rmt_addr;
661         } else {
662                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
663                 saddr = &ip6h->saddr;
664                 daddr = &ip6h->daddr;
665         }
666
667         hp = tcp_get_md5sig_pool();
668         if (!hp)
669                 goto clear_hash_noput;
670         desc = &hp->md5_desc;
671
672         if (crypto_hash_init(desc))
673                 goto clear_hash;
674
675         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
676                 goto clear_hash;
677         if (tcp_md5_hash_header(hp, th))
678                 goto clear_hash;
679         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
680                 goto clear_hash;
681         if (tcp_md5_hash_key(hp, key))
682                 goto clear_hash;
683         if (crypto_hash_final(desc, md5_hash))
684                 goto clear_hash;
685
686         tcp_put_md5sig_pool();
687         return 0;
688
689 clear_hash:
690         tcp_put_md5sig_pool();
691 clear_hash_noput:
692         memset(md5_hash, 0, 16);
693         return 1;
694 }
695
696 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
697 {
698         const __u8 *hash_location = NULL;
699         struct tcp_md5sig_key *hash_expected;
700         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
701         const struct tcphdr *th = tcp_hdr(skb);
702         int genhash;
703         u8 newhash[16];
704
705         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
706         hash_location = tcp_parse_md5sig_option(th);
707
708         /* We've parsed the options - do we have a hash? */
709         if (!hash_expected && !hash_location)
710                 return 0;
711
712         if (hash_expected && !hash_location) {
713                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
714                 return 1;
715         }
716
717         if (!hash_expected && hash_location) {
718                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
719                 return 1;
720         }
721
722         /* check the signature */
723         genhash = tcp_v6_md5_hash_skb(newhash,
724                                       hash_expected,
725                                       NULL, NULL, skb);
726
727         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
728                 if (net_ratelimit()) {
729                         printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
730                                genhash ? "failed" : "mismatch",
731                                &ip6h->saddr, ntohs(th->source),
732                                &ip6h->daddr, ntohs(th->dest));
733                 }
734                 return 1;
735         }
736         return 0;
737 }
738 #endif
739
740 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
741         .family         =       AF_INET6,
742         .obj_size       =       sizeof(struct tcp6_request_sock),
743         .rtx_syn_ack    =       tcp_v6_rtx_synack,
744         .send_ack       =       tcp_v6_reqsk_send_ack,
745         .destructor     =       tcp_v6_reqsk_destructor,
746         .send_reset     =       tcp_v6_send_reset,
747         .syn_ack_timeout =      tcp_syn_ack_timeout,
748 };
749
750 #ifdef CONFIG_TCP_MD5SIG
751 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
752         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
753         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
754 };
755 #endif
756
757 static void __tcp_v6_send_check(struct sk_buff *skb,
758                                 const struct in6_addr *saddr, const struct in6_addr *daddr)
759 {
760         struct tcphdr *th = tcp_hdr(skb);
761
762         if (skb->ip_summed == CHECKSUM_PARTIAL) {
763                 th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
764                 skb->csum_start = skb_transport_header(skb) - skb->head;
765                 skb->csum_offset = offsetof(struct tcphdr, check);
766         } else {
767                 th->check = tcp_v6_check(skb->len, saddr, daddr,
768                                          csum_partial(th, th->doff << 2,
769                                                       skb->csum));
770         }
771 }
772
773 static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
774 {
775         struct ipv6_pinfo *np = inet6_sk(sk);
776
777         __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
778 }
779
780 static int tcp_v6_gso_send_check(struct sk_buff *skb)
781 {
782         const struct ipv6hdr *ipv6h;
783         struct tcphdr *th;
784
785         if (!pskb_may_pull(skb, sizeof(*th)))
786                 return -EINVAL;
787
788         ipv6h = ipv6_hdr(skb);
789         th = tcp_hdr(skb);
790
791         th->check = 0;
792         skb->ip_summed = CHECKSUM_PARTIAL;
793         __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
794         return 0;
795 }
796
797 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
798                                          struct sk_buff *skb)
799 {
800         const struct ipv6hdr *iph = skb_gro_network_header(skb);
801
802         switch (skb->ip_summed) {
803         case CHECKSUM_COMPLETE:
804                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
805                                   skb->csum)) {
806                         skb->ip_summed = CHECKSUM_UNNECESSARY;
807                         break;
808                 }
809
810                 /* fall through */
811         case CHECKSUM_NONE:
812                 NAPI_GRO_CB(skb)->flush = 1;
813                 return NULL;
814         }
815
816         return tcp_gro_receive(head, skb);
817 }
818
819 static int tcp6_gro_complete(struct sk_buff *skb)
820 {
821         const struct ipv6hdr *iph = ipv6_hdr(skb);
822         struct tcphdr *th = tcp_hdr(skb);
823
824         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
825                                   &iph->saddr, &iph->daddr, 0);
826         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
827
828         return tcp_gro_complete(skb);
829 }
830
831 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
832                                  u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
833 {
834         const struct tcphdr *th = tcp_hdr(skb);
835         struct tcphdr *t1;
836         struct sk_buff *buff;
837         struct flowi6 fl6;
838         struct net *net = dev_net(skb_dst(skb)->dev);
839         struct sock *ctl_sk = net->ipv6.tcp_sk;
840         unsigned int tot_len = sizeof(struct tcphdr);
841         struct dst_entry *dst;
842         __be32 *topt;
843
844         if (ts)
845                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
846 #ifdef CONFIG_TCP_MD5SIG
847         if (key)
848                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
849 #endif
850
851         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
852                          GFP_ATOMIC);
853         if (buff == NULL)
854                 return;
855
856         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
857
858         t1 = (struct tcphdr *) skb_push(buff, tot_len);
859         skb_reset_transport_header(buff);
860
861         /* Swap the send and the receive. */
862         memset(t1, 0, sizeof(*t1));
863         t1->dest = th->source;
864         t1->source = th->dest;
865         t1->doff = tot_len / 4;
866         t1->seq = htonl(seq);
867         t1->ack_seq = htonl(ack);
868         t1->ack = !rst || !th->ack;
869         t1->rst = rst;
870         t1->window = htons(win);
871
872         topt = (__be32 *)(t1 + 1);
873
874         if (ts) {
875                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
876                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
877                 *topt++ = htonl(tcp_time_stamp);
878                 *topt++ = htonl(ts);
879         }
880
881 #ifdef CONFIG_TCP_MD5SIG
882         if (key) {
883                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
884                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
885                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
886                                     &ipv6_hdr(skb)->saddr,
887                                     &ipv6_hdr(skb)->daddr, t1);
888         }
889 #endif
890
891         memset(&fl6, 0, sizeof(fl6));
892         fl6.daddr = ipv6_hdr(skb)->saddr;
893         fl6.saddr = ipv6_hdr(skb)->daddr;
894
895         buff->ip_summed = CHECKSUM_PARTIAL;
896         buff->csum = 0;
897
898         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
899
900         fl6.flowi6_proto = IPPROTO_TCP;
901         if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
902                 fl6.flowi6_oif = inet6_iif(skb);
903         fl6.fl6_dport = t1->dest;
904         fl6.fl6_sport = t1->source;
905         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
906
907         /* Pass a socket to ip6_dst_lookup either it is for RST
908          * Underlying function will use this to retrieve the network
909          * namespace
910          */
911         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
912         if (!IS_ERR(dst)) {
913                 skb_dst_set(buff, dst);
914                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
915                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
916                 if (rst)
917                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
918                 return;
919         }
920
921         kfree_skb(buff);
922 }
923
924 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
925 {
926         const struct tcphdr *th = tcp_hdr(skb);
927         u32 seq = 0, ack_seq = 0;
928         struct tcp_md5sig_key *key = NULL;
929 #ifdef CONFIG_TCP_MD5SIG
930         const __u8 *hash_location = NULL;
931         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
932         unsigned char newhash[16];
933         int genhash;
934         struct sock *sk1 = NULL;
935 #endif
936
937         if (th->rst)
938                 return;
939
940         if (!ipv6_unicast_destination(skb))
941                 return;
942
943 #ifdef CONFIG_TCP_MD5SIG
944         hash_location = tcp_parse_md5sig_option(th);
945         if (!sk && hash_location) {
946                 /*
947                  * active side is lost. Try to find listening socket through
948                  * source port, and then find md5 key through listening socket.
949                  * we are not loose security here:
950                  * Incoming packet is checked with md5 hash with finding key,
951                  * no RST generated if md5 hash doesn't match.
952                  */
953                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
954                                            &tcp_hashinfo, &ipv6h->daddr,
955                                            ntohs(th->source), inet6_iif(skb));
956                 if (!sk1)
957                         return;
958
959                 rcu_read_lock();
960                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
961                 if (!key)
962                         goto release_sk1;
963
964                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
965                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
966                         goto release_sk1;
967         } else {
968                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
969         }
970 #endif
971
972         if (th->ack)
973                 seq = ntohl(th->ack_seq);
974         else
975                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
976                           (th->doff << 2);
977
978         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
979
980 #ifdef CONFIG_TCP_MD5SIG
981 release_sk1:
982         if (sk1) {
983                 rcu_read_unlock();
984                 sock_put(sk1);
985         }
986 #endif
987 }
988
989 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
990                             struct tcp_md5sig_key *key, u8 tclass)
991 {
992         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
993 }
994
995 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
996 {
997         struct inet_timewait_sock *tw = inet_twsk(sk);
998         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
999
1000         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1001                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1002                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
1003                         tw->tw_tclass);
1004
1005         inet_twsk_put(tw);
1006 }
1007
1008 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1009                                   struct request_sock *req)
1010 {
1011         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1012                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
1013 }
1014
1015
1016 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1017 {
1018         struct request_sock *req, **prev;
1019         const struct tcphdr *th = tcp_hdr(skb);
1020         struct sock *nsk;
1021
1022         /* Find possible connection requests. */
1023         req = inet6_csk_search_req(sk, &prev, th->source,
1024                                    &ipv6_hdr(skb)->saddr,
1025                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1026         if (req)
1027                 return tcp_check_req(sk, skb, req, prev);
1028
1029         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1030                         &ipv6_hdr(skb)->saddr, th->source,
1031                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1032
1033         if (nsk) {
1034                 if (nsk->sk_state != TCP_TIME_WAIT) {
1035                         bh_lock_sock(nsk);
1036                         return nsk;
1037                 }
1038                 inet_twsk_put(inet_twsk(nsk));
1039                 return NULL;
1040         }
1041
1042 #ifdef CONFIG_SYN_COOKIES
1043         if (!th->syn)
1044                 sk = cookie_v6_check(sk, skb);
1045 #endif
1046         return sk;
1047 }
1048
1049 /* FIXME: this is substantially similar to the ipv4 code.
1050  * Can some kind of merge be done? -- erics
1051  */
1052 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1053 {
1054         struct tcp_extend_values tmp_ext;
1055         struct tcp_options_received tmp_opt;
1056         const u8 *hash_location;
1057         struct request_sock *req;
1058         struct inet6_request_sock *treq;
1059         struct ipv6_pinfo *np = inet6_sk(sk);
1060         struct tcp_sock *tp = tcp_sk(sk);
1061         __u32 isn = TCP_SKB_CB(skb)->when;
1062         struct dst_entry *dst = NULL;
1063         int want_cookie = 0;
1064
1065         if (skb->protocol == htons(ETH_P_IP))
1066                 return tcp_v4_conn_request(sk, skb);
1067
1068         if (!ipv6_unicast_destination(skb))
1069                 goto drop;
1070
1071         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1072                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
1073                 if (!want_cookie)
1074                         goto drop;
1075         }
1076
1077         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1078                 goto drop;
1079
1080         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1081         if (req == NULL)
1082                 goto drop;
1083
1084 #ifdef CONFIG_TCP_MD5SIG
1085         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1086 #endif
1087
1088         tcp_clear_options(&tmp_opt);
1089         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1090         tmp_opt.user_mss = tp->rx_opt.user_mss;
1091         tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1092
1093         if (tmp_opt.cookie_plus > 0 &&
1094             tmp_opt.saw_tstamp &&
1095             !tp->rx_opt.cookie_out_never &&
1096             (sysctl_tcp_cookie_size > 0 ||
1097              (tp->cookie_values != NULL &&
1098               tp->cookie_values->cookie_desired > 0))) {
1099                 u8 *c;
1100                 u32 *d;
1101                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1102                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1103
1104                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1105                         goto drop_and_free;
1106
1107                 /* Secret recipe starts with IP addresses */
1108                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1109                 *mess++ ^= *d++;
1110                 *mess++ ^= *d++;
1111                 *mess++ ^= *d++;
1112                 *mess++ ^= *d++;
1113                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1114                 *mess++ ^= *d++;
1115                 *mess++ ^= *d++;
1116                 *mess++ ^= *d++;
1117                 *mess++ ^= *d++;
1118
1119                 /* plus variable length Initiator Cookie */
1120                 c = (u8 *)mess;
1121                 while (l-- > 0)
1122                         *c++ ^= *hash_location++;
1123
1124                 want_cookie = 0;        /* not our kind of cookie */
1125                 tmp_ext.cookie_out_never = 0; /* false */
1126                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1127         } else if (!tp->rx_opt.cookie_in_always) {
1128                 /* redundant indications, but ensure initialization. */
1129                 tmp_ext.cookie_out_never = 1; /* true */
1130                 tmp_ext.cookie_plus = 0;
1131         } else {
1132                 goto drop_and_free;
1133         }
1134         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1135
1136         if (want_cookie && !tmp_opt.saw_tstamp)
1137                 tcp_clear_options(&tmp_opt);
1138
1139         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1140         tcp_openreq_init(req, &tmp_opt, skb);
1141
1142         treq = inet6_rsk(req);
1143         treq->rmt_addr = ipv6_hdr(skb)->saddr;
1144         treq->loc_addr = ipv6_hdr(skb)->daddr;
1145         if (!want_cookie || tmp_opt.tstamp_ok)
1146                 TCP_ECN_create_request(req, tcp_hdr(skb));
1147
1148         treq->iif = sk->sk_bound_dev_if;
1149
1150         /* So that link locals have meaning */
1151         if (!sk->sk_bound_dev_if &&
1152             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1153                 treq->iif = inet6_iif(skb);
1154
1155         if (!isn) {
1156                 struct inet_peer *peer = NULL;
1157
1158                 if (ipv6_opt_accepted(sk, skb) ||
1159                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1160                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1161                         atomic_inc(&skb->users);
1162                         treq->pktopts = skb;
1163                 }
1164
1165                 if (want_cookie) {
1166                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1167                         req->cookie_ts = tmp_opt.tstamp_ok;
1168                         goto have_isn;
1169                 }
1170
1171                 /* VJ's idea. We save last timestamp seen
1172                  * from the destination in peer table, when entering
1173                  * state TIME-WAIT, and check against it before
1174                  * accepting new connection request.
1175                  *
1176                  * If "isn" is not zero, this request hit alive
1177                  * timewait bucket, so that all the necessary checks
1178                  * are made in the function processing timewait state.
1179                  */
1180                 if (tmp_opt.saw_tstamp &&
1181                     tcp_death_row.sysctl_tw_recycle &&
1182                     (dst = inet6_csk_route_req(sk, req)) != NULL &&
1183                     (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
1184                     ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
1185                                     &treq->rmt_addr)) {
1186                         inet_peer_refcheck(peer);
1187                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1188                             (s32)(peer->tcp_ts - req->ts_recent) >
1189                                                         TCP_PAWS_WINDOW) {
1190                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1191                                 goto drop_and_release;
1192                         }
1193                 }
1194                 /* Kill the following clause, if you dislike this way. */
1195                 else if (!sysctl_tcp_syncookies &&
1196                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1197                           (sysctl_max_syn_backlog >> 2)) &&
1198                          (!peer || !peer->tcp_ts_stamp) &&
1199                          (!dst || !dst_metric(dst, RTAX_RTT))) {
1200                         /* Without syncookies last quarter of
1201                          * backlog is filled with destinations,
1202                          * proven to be alive.
1203                          * It means that we continue to communicate
1204                          * to destinations, already remembered
1205                          * to the moment of synflood.
1206                          */
1207                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1208                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1209                         goto drop_and_release;
1210                 }
1211
1212                 isn = tcp_v6_init_sequence(skb);
1213         }
1214 have_isn:
1215         tcp_rsk(req)->snt_isn = isn;
1216         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1217
1218         security_inet_conn_request(sk, skb, req);
1219
1220         if (tcp_v6_send_synack(sk, req,
1221                                (struct request_values *)&tmp_ext) ||
1222             want_cookie)
1223                 goto drop_and_free;
1224
1225         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1226         return 0;
1227
1228 drop_and_release:
1229         dst_release(dst);
1230 drop_and_free:
1231         reqsk_free(req);
1232 drop:
1233         return 0; /* don't send reset */
1234 }
1235
1236 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1237                                           struct request_sock *req,
1238                                           struct dst_entry *dst)
1239 {
1240         struct inet6_request_sock *treq;
1241         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1242         struct tcp6_sock *newtcp6sk;
1243         struct inet_sock *newinet;
1244         struct tcp_sock *newtp;
1245         struct sock *newsk;
1246         struct ipv6_txoptions *opt;
1247 #ifdef CONFIG_TCP_MD5SIG
1248         struct tcp_md5sig_key *key;
1249 #endif
1250
1251         if (skb->protocol == htons(ETH_P_IP)) {
1252                 /*
1253                  *      v6 mapped
1254                  */
1255
1256                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1257
1258                 if (newsk == NULL)
1259                         return NULL;
1260
1261                 newtcp6sk = (struct tcp6_sock *)newsk;
1262                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1263
1264                 newinet = inet_sk(newsk);
1265                 newnp = inet6_sk(newsk);
1266                 newtp = tcp_sk(newsk);
1267
1268                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1269
1270                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1271
1272                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1273
1274                 newnp->rcv_saddr = newnp->saddr;
1275
1276                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1277                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1278 #ifdef CONFIG_TCP_MD5SIG
1279                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1280 #endif
1281
1282                 newnp->ipv6_ac_list = NULL;
1283                 newnp->ipv6_fl_list = NULL;
1284                 newnp->pktoptions  = NULL;
1285                 newnp->opt         = NULL;
1286                 newnp->mcast_oif   = inet6_iif(skb);
1287                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1288                 newnp->rcv_tclass  = ipv6_tclass(ipv6_hdr(skb));
1289
1290                 /*
1291                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1292                  * here, tcp_create_openreq_child now does this for us, see the comment in
1293                  * that function for the gory details. -acme
1294                  */
1295
1296                 /* It is tricky place. Until this moment IPv4 tcp
1297                    worked with IPv6 icsk.icsk_af_ops.
1298                    Sync it now.
1299                  */
1300                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1301
1302                 return newsk;
1303         }
1304
1305         treq = inet6_rsk(req);
1306         opt = np->opt;
1307
1308         if (sk_acceptq_is_full(sk))
1309                 goto out_overflow;
1310
1311         if (!dst) {
1312                 dst = inet6_csk_route_req(sk, req);
1313                 if (!dst)
1314                         goto out;
1315         }
1316
1317         newsk = tcp_create_openreq_child(sk, req, skb);
1318         if (newsk == NULL)
1319                 goto out_nonewsk;
1320
1321         /*
1322          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1323          * count here, tcp_create_openreq_child now does this for us, see the
1324          * comment in that function for the gory details. -acme
1325          */
1326
1327         newsk->sk_gso_type = SKB_GSO_TCPV6;
1328         __ip6_dst_store(newsk, dst, NULL, NULL);
1329
1330         newtcp6sk = (struct tcp6_sock *)newsk;
1331         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1332
1333         newtp = tcp_sk(newsk);
1334         newinet = inet_sk(newsk);
1335         newnp = inet6_sk(newsk);
1336
1337         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1338
1339         newnp->daddr = treq->rmt_addr;
1340         newnp->saddr = treq->loc_addr;
1341         newnp->rcv_saddr = treq->loc_addr;
1342         newsk->sk_bound_dev_if = treq->iif;
1343
1344         /* Now IPv6 options...
1345
1346            First: no IPv4 options.
1347          */
1348         newinet->inet_opt = NULL;
1349         newnp->ipv6_ac_list = NULL;
1350         newnp->ipv6_fl_list = NULL;
1351
1352         /* Clone RX bits */
1353         newnp->rxopt.all = np->rxopt.all;
1354
1355         /* Clone pktoptions received with SYN */
1356         newnp->pktoptions = NULL;
1357         if (treq->pktopts != NULL) {
1358                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1359                 kfree_skb(treq->pktopts);
1360                 treq->pktopts = NULL;
1361                 if (newnp->pktoptions)
1362                         skb_set_owner_r(newnp->pktoptions, newsk);
1363         }
1364         newnp->opt        = NULL;
1365         newnp->mcast_oif  = inet6_iif(skb);
1366         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1367         newnp->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
1368
1369         /* Clone native IPv6 options from listening socket (if any)
1370
1371            Yes, keeping reference count would be much more clever,
1372            but we make one more one thing there: reattach optmem
1373            to newsk.
1374          */
1375         if (opt) {
1376                 newnp->opt = ipv6_dup_options(newsk, opt);
1377                 if (opt != np->opt)
1378                         sock_kfree_s(sk, opt, opt->tot_len);
1379         }
1380
1381         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1382         if (newnp->opt)
1383                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1384                                                      newnp->opt->opt_flen);
1385
1386         tcp_mtup_init(newsk);
1387         tcp_sync_mss(newsk, dst_mtu(dst));
1388         newtp->advmss = dst_metric_advmss(dst);
1389         if (tcp_sk(sk)->rx_opt.user_mss &&
1390             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1391                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1392
1393         tcp_initialize_rcv_mss(newsk);
1394         if (tcp_rsk(req)->snt_synack)
1395                 tcp_valid_rtt_meas(newsk,
1396                     tcp_time_stamp - tcp_rsk(req)->snt_synack);
1397         newtp->total_retrans = req->retrans;
1398
1399         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1400         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1401
1402 #ifdef CONFIG_TCP_MD5SIG
1403         /* Copy over the MD5 key from the original socket */
1404         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1405                 /* We're using one, so create a matching key
1406                  * on the newsk structure. If we fail to get
1407                  * memory, then we end up not copying the key
1408                  * across. Shucks.
1409                  */
1410                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1411                                AF_INET6, key->key, key->keylen, GFP_ATOMIC);
1412         }
1413 #endif
1414
1415         if (__inet_inherit_port(sk, newsk) < 0) {
1416                 inet_csk_prepare_forced_close(newsk);
1417                 tcp_done(newsk);
1418                 goto out;
1419         }
1420         __inet6_hash(newsk, NULL);
1421
1422         return newsk;
1423
1424 out_overflow:
1425         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1426 out_nonewsk:
1427         if (opt && opt != np->opt)
1428                 sock_kfree_s(sk, opt, opt->tot_len);
1429         dst_release(dst);
1430 out:
1431         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1432         return NULL;
1433 }
1434
1435 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1436 {
1437         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1438                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1439                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1440                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1441                         return 0;
1442                 }
1443         }
1444
1445         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1446                                               &ipv6_hdr(skb)->saddr,
1447                                               &ipv6_hdr(skb)->daddr, 0));
1448
1449         if (skb->len <= 76) {
1450                 return __skb_checksum_complete(skb);
1451         }
1452         return 0;
1453 }
1454
1455 /* The socket must have it's spinlock held when we get
1456  * here.
1457  *
1458  * We have a potential double-lock case here, so even when
1459  * doing backlog processing we use the BH locking scheme.
1460  * This is because we cannot sleep with the original spinlock
1461  * held.
1462  */
1463 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1464 {
1465         struct ipv6_pinfo *np = inet6_sk(sk);
1466         struct tcp_sock *tp;
1467         struct sk_buff *opt_skb = NULL;
1468
1469         /* Imagine: socket is IPv6. IPv4 packet arrives,
1470            goes to IPv4 receive handler and backlogged.
1471            From backlog it always goes here. Kerboom...
1472            Fortunately, tcp_rcv_established and rcv_established
1473            handle them correctly, but it is not case with
1474            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1475          */
1476
1477         if (skb->protocol == htons(ETH_P_IP))
1478                 return tcp_v4_do_rcv(sk, skb);
1479
1480 #ifdef CONFIG_TCP_MD5SIG
1481         if (tcp_v6_inbound_md5_hash (sk, skb))
1482                 goto discard;
1483 #endif
1484
1485         if (sk_filter(sk, skb))
1486                 goto discard;
1487
1488         /*
1489          *      socket locking is here for SMP purposes as backlog rcv
1490          *      is currently called with bh processing disabled.
1491          */
1492
1493         /* Do Stevens' IPV6_PKTOPTIONS.
1494
1495            Yes, guys, it is the only place in our code, where we
1496            may make it not affecting IPv4.
1497            The rest of code is protocol independent,
1498            and I do not like idea to uglify IPv4.
1499
1500            Actually, all the idea behind IPV6_PKTOPTIONS
1501            looks not very well thought. For now we latch
1502            options, received in the last packet, enqueued
1503            by tcp. Feel free to propose better solution.
1504                                                --ANK (980728)
1505          */
1506         if (np->rxopt.all)
1507                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1508
1509         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1510                 sock_rps_save_rxhash(sk, skb);
1511                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1512                         goto reset;
1513                 if (opt_skb)
1514                         goto ipv6_pktoptions;
1515                 return 0;
1516         }
1517
1518         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1519                 goto csum_err;
1520
1521         if (sk->sk_state == TCP_LISTEN) {
1522                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1523                 if (!nsk)
1524                         goto discard;
1525
1526                 /*
1527                  * Queue it on the new socket if the new socket is active,
1528                  * otherwise we just shortcircuit this and continue with
1529                  * the new socket..
1530                  */
1531                 if(nsk != sk) {
1532                         sock_rps_save_rxhash(nsk, skb);
1533                         if (tcp_child_process(sk, nsk, skb))
1534                                 goto reset;
1535                         if (opt_skb)
1536                                 __kfree_skb(opt_skb);
1537                         return 0;
1538                 }
1539         } else
1540                 sock_rps_save_rxhash(sk, skb);
1541
1542         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1543                 goto reset;
1544         if (opt_skb)
1545                 goto ipv6_pktoptions;
1546         return 0;
1547
1548 reset:
1549         tcp_v6_send_reset(sk, skb);
1550 discard:
1551         if (opt_skb)
1552                 __kfree_skb(opt_skb);
1553         kfree_skb(skb);
1554         return 0;
1555 csum_err:
1556         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1557         goto discard;
1558
1559
1560 ipv6_pktoptions:
1561         /* Do you ask, what is it?
1562
1563            1. skb was enqueued by tcp.
1564            2. skb is added to tail of read queue, rather than out of order.
1565            3. socket is not in passive state.
1566            4. Finally, it really contains options, which user wants to receive.
1567          */
1568         tp = tcp_sk(sk);
1569         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1570             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1571                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1572                         np->mcast_oif = inet6_iif(opt_skb);
1573                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1574                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1575                 if (np->rxopt.bits.rxtclass)
1576                         np->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
1577                 if (ipv6_opt_accepted(sk, opt_skb)) {
1578                         skb_set_owner_r(opt_skb, sk);
1579                         opt_skb = xchg(&np->pktoptions, opt_skb);
1580                 } else {
1581                         __kfree_skb(opt_skb);
1582                         opt_skb = xchg(&np->pktoptions, NULL);
1583                 }
1584         }
1585
1586         kfree_skb(opt_skb);
1587         return 0;
1588 }
1589
1590 static int tcp_v6_rcv(struct sk_buff *skb)
1591 {
1592         const struct tcphdr *th;
1593         const struct ipv6hdr *hdr;
1594         struct sock *sk;
1595         int ret;
1596         struct net *net = dev_net(skb->dev);
1597
1598         if (skb->pkt_type != PACKET_HOST)
1599                 goto discard_it;
1600
1601         /*
1602          *      Count it even if it's bad.
1603          */
1604         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1605
1606         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1607                 goto discard_it;
1608
1609         th = tcp_hdr(skb);
1610
1611         if (th->doff < sizeof(struct tcphdr)/4)
1612                 goto bad_packet;
1613         if (!pskb_may_pull(skb, th->doff*4))
1614                 goto discard_it;
1615
1616         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1617                 goto bad_packet;
1618
1619         th = tcp_hdr(skb);
1620         hdr = ipv6_hdr(skb);
1621         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1622         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1623                                     skb->len - th->doff*4);
1624         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1625         TCP_SKB_CB(skb)->when = 0;
1626         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1627         TCP_SKB_CB(skb)->sacked = 0;
1628
1629         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1630         if (!sk)
1631                 goto no_tcp_socket;
1632
1633 process:
1634         if (sk->sk_state == TCP_TIME_WAIT)
1635                 goto do_time_wait;
1636
1637         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1638                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1639                 goto discard_and_relse;
1640         }
1641
1642         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1643                 goto discard_and_relse;
1644
1645         if (sk_filter(sk, skb))
1646                 goto discard_and_relse;
1647
1648         skb->dev = NULL;
1649
1650         bh_lock_sock_nested(sk);
1651         ret = 0;
1652         if (!sock_owned_by_user(sk)) {
1653 #ifdef CONFIG_NET_DMA
1654                 struct tcp_sock *tp = tcp_sk(sk);
1655                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1656                         tp->ucopy.dma_chan = net_dma_find_channel();
1657                 if (tp->ucopy.dma_chan)
1658                         ret = tcp_v6_do_rcv(sk, skb);
1659                 else
1660 #endif
1661                 {
1662                         if (!tcp_prequeue(sk, skb))
1663                                 ret = tcp_v6_do_rcv(sk, skb);
1664                 }
1665         } else if (unlikely(sk_add_backlog(sk, skb))) {
1666                 bh_unlock_sock(sk);
1667                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1668                 goto discard_and_relse;
1669         }
1670         bh_unlock_sock(sk);
1671
1672         sock_put(sk);
1673         return ret ? -1 : 0;
1674
1675 no_tcp_socket:
1676         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1677                 goto discard_it;
1678
1679         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1680 bad_packet:
1681                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1682         } else {
1683                 tcp_v6_send_reset(NULL, skb);
1684         }
1685
1686 discard_it:
1687
1688         /*
1689          *      Discard frame
1690          */
1691
1692         kfree_skb(skb);
1693         return 0;
1694
1695 discard_and_relse:
1696         sock_put(sk);
1697         goto discard_it;
1698
1699 do_time_wait:
1700         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1701                 inet_twsk_put(inet_twsk(sk));
1702                 goto discard_it;
1703         }
1704
1705         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1706                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1707                 inet_twsk_put(inet_twsk(sk));
1708                 goto discard_it;
1709         }
1710
1711         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1712         case TCP_TW_SYN:
1713         {
1714                 struct sock *sk2;
1715
1716                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1717                                             &ipv6_hdr(skb)->daddr,
1718                                             ntohs(th->dest), inet6_iif(skb));
1719                 if (sk2 != NULL) {
1720                         struct inet_timewait_sock *tw = inet_twsk(sk);
1721                         inet_twsk_deschedule(tw, &tcp_death_row);
1722                         inet_twsk_put(tw);
1723                         sk = sk2;
1724                         goto process;
1725                 }
1726                 /* Fall through to ACK */
1727         }
1728         case TCP_TW_ACK:
1729                 tcp_v6_timewait_ack(sk, skb);
1730                 break;
1731         case TCP_TW_RST:
1732                 goto no_tcp_socket;
1733         case TCP_TW_SUCCESS:;
1734         }
1735         goto discard_it;
1736 }
1737
1738 static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
1739 {
1740         struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
1741         struct ipv6_pinfo *np = inet6_sk(sk);
1742         struct inet_peer *peer;
1743
1744         if (!rt ||
1745             !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
1746                 peer = inet_getpeer_v6(&np->daddr, 1);
1747                 *release_it = true;
1748         } else {
1749                 if (!rt->rt6i_peer)
1750                         rt6_bind_peer(rt, 1);
1751                 peer = rt->rt6i_peer;
1752                 *release_it = false;
1753         }
1754
1755         return peer;
1756 }
1757
1758 static void *tcp_v6_tw_get_peer(struct sock *sk)
1759 {
1760         const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
1761         const struct inet_timewait_sock *tw = inet_twsk(sk);
1762
1763         if (tw->tw_family == AF_INET)
1764                 return tcp_v4_tw_get_peer(sk);
1765
1766         return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
1767 }
1768
1769 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1770         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1771         .twsk_unique    = tcp_twsk_unique,
1772         .twsk_destructor= tcp_twsk_destructor,
1773         .twsk_getpeer   = tcp_v6_tw_get_peer,
1774 };
1775
1776 static const struct inet_connection_sock_af_ops ipv6_specific = {
1777         .queue_xmit        = inet6_csk_xmit,
1778         .send_check        = tcp_v6_send_check,
1779         .rebuild_header    = inet6_sk_rebuild_header,
1780         .conn_request      = tcp_v6_conn_request,
1781         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1782         .get_peer          = tcp_v6_get_peer,
1783         .net_header_len    = sizeof(struct ipv6hdr),
1784         .setsockopt        = ipv6_setsockopt,
1785         .getsockopt        = ipv6_getsockopt,
1786         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1787         .sockaddr_len      = sizeof(struct sockaddr_in6),
1788         .bind_conflict     = inet6_csk_bind_conflict,
1789 #ifdef CONFIG_COMPAT
1790         .compat_setsockopt = compat_ipv6_setsockopt,
1791         .compat_getsockopt = compat_ipv6_getsockopt,
1792 #endif
1793 };
1794
1795 #ifdef CONFIG_TCP_MD5SIG
1796 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1797         .md5_lookup     =       tcp_v6_md5_lookup,
1798         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1799         .md5_parse      =       tcp_v6_parse_md5_keys,
1800 };
1801 #endif
1802
1803 /*
1804  *      TCP over IPv4 via INET6 API
1805  */
1806
1807 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1808         .queue_xmit        = ip_queue_xmit,
1809         .send_check        = tcp_v4_send_check,
1810         .rebuild_header    = inet_sk_rebuild_header,
1811         .conn_request      = tcp_v6_conn_request,
1812         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1813         .get_peer          = tcp_v4_get_peer,
1814         .net_header_len    = sizeof(struct iphdr),
1815         .setsockopt        = ipv6_setsockopt,
1816         .getsockopt        = ipv6_getsockopt,
1817         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1818         .sockaddr_len      = sizeof(struct sockaddr_in6),
1819         .bind_conflict     = inet6_csk_bind_conflict,
1820 #ifdef CONFIG_COMPAT
1821         .compat_setsockopt = compat_ipv6_setsockopt,
1822         .compat_getsockopt = compat_ipv6_getsockopt,
1823 #endif
1824 };
1825
1826 #ifdef CONFIG_TCP_MD5SIG
1827 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1828         .md5_lookup     =       tcp_v4_md5_lookup,
1829         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1830         .md5_parse      =       tcp_v6_parse_md5_keys,
1831 };
1832 #endif
1833
1834 /* NOTE: A lot of things set to zero explicitly by call to
1835  *       sk_alloc() so need not be done here.
1836  */
1837 static int tcp_v6_init_sock(struct sock *sk)
1838 {
1839         struct inet_connection_sock *icsk = inet_csk(sk);
1840         struct tcp_sock *tp = tcp_sk(sk);
1841
1842         skb_queue_head_init(&tp->out_of_order_queue);
1843         tcp_init_xmit_timers(sk);
1844         tcp_prequeue_init(tp);
1845
1846         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1847         tp->mdev = TCP_TIMEOUT_INIT;
1848
1849         /* So many TCP implementations out there (incorrectly) count the
1850          * initial SYN frame in their delayed-ACK and congestion control
1851          * algorithms that we must have the following bandaid to talk
1852          * efficiently to them.  -DaveM
1853          */
1854         tp->snd_cwnd = 2;
1855
1856         /* See draft-stevens-tcpca-spec-01 for discussion of the
1857          * initialization of these values.
1858          */
1859         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
1860         tp->snd_cwnd_clamp = ~0;
1861         tp->mss_cache = TCP_MSS_DEFAULT;
1862
1863         tp->reordering = sysctl_tcp_reordering;
1864
1865         sk->sk_state = TCP_CLOSE;
1866
1867         icsk->icsk_af_ops = &ipv6_specific;
1868         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1869         icsk->icsk_sync_mss = tcp_sync_mss;
1870         sk->sk_write_space = sk_stream_write_space;
1871         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1872
1873 #ifdef CONFIG_TCP_MD5SIG
1874         tp->af_specific = &tcp_sock_ipv6_specific;
1875 #endif
1876
1877         /* TCP Cookie Transactions */
1878         if (sysctl_tcp_cookie_size > 0) {
1879                 /* Default, cookies without s_data_payload. */
1880                 tp->cookie_values =
1881                         kzalloc(sizeof(*tp->cookie_values),
1882                                 sk->sk_allocation);
1883                 if (tp->cookie_values != NULL)
1884                         kref_init(&tp->cookie_values->kref);
1885         }
1886         /* Presumed zeroed, in order of appearance:
1887          *      cookie_in_always, cookie_out_never,
1888          *      s_data_constant, s_data_in, s_data_out
1889          */
1890         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1891         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1892
1893         local_bh_disable();
1894         sock_update_memcg(sk);
1895         sk_sockets_allocated_inc(sk);
1896         local_bh_enable();
1897
1898         return 0;
1899 }
1900
1901 static void tcp_v6_destroy_sock(struct sock *sk)
1902 {
1903         tcp_v4_destroy_sock(sk);
1904         inet6_destroy_sock(sk);
1905 }
1906
1907 #ifdef CONFIG_PROC_FS
1908 /* Proc filesystem TCPv6 sock list dumping. */
1909 static void get_openreq6(struct seq_file *seq,
1910                          const struct sock *sk, struct request_sock *req, int i, int uid)
1911 {
1912         int ttd = req->expires - jiffies;
1913         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1914         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1915
1916         if (ttd < 0)
1917                 ttd = 0;
1918
1919         seq_printf(seq,
1920                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1921                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1922                    i,
1923                    src->s6_addr32[0], src->s6_addr32[1],
1924                    src->s6_addr32[2], src->s6_addr32[3],
1925                    ntohs(inet_rsk(req)->loc_port),
1926                    dest->s6_addr32[0], dest->s6_addr32[1],
1927                    dest->s6_addr32[2], dest->s6_addr32[3],
1928                    ntohs(inet_rsk(req)->rmt_port),
1929                    TCP_SYN_RECV,
1930                    0,0, /* could print option size, but that is af dependent. */
1931                    1,   /* timers active (only the expire timer) */
1932                    jiffies_to_clock_t(ttd),
1933                    req->retrans,
1934                    uid,
1935                    0,  /* non standard timer */
1936                    0, /* open_requests have no inode */
1937                    0, req);
1938 }
1939
1940 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1941 {
1942         const struct in6_addr *dest, *src;
1943         __u16 destp, srcp;
1944         int timer_active;
1945         unsigned long timer_expires;
1946         const struct inet_sock *inet = inet_sk(sp);
1947         const struct tcp_sock *tp = tcp_sk(sp);
1948         const struct inet_connection_sock *icsk = inet_csk(sp);
1949         const struct ipv6_pinfo *np = inet6_sk(sp);
1950         unsigned long cmdline = __get_free_page(GFP_TEMPORARY);
1951         if (cmdline == NULL)
1952                 return;
1953
1954         dest  = &np->daddr;
1955         src   = &np->rcv_saddr;
1956         destp = ntohs(inet->inet_dport);
1957         srcp  = ntohs(inet->inet_sport);
1958
1959         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1960                 timer_active    = 1;
1961                 timer_expires   = icsk->icsk_timeout;
1962         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1963                 timer_active    = 4;
1964                 timer_expires   = icsk->icsk_timeout;
1965         } else if (timer_pending(&sp->sk_timer)) {
1966                 timer_active    = 2;
1967                 timer_expires   = sp->sk_timer.expires;
1968         } else {
1969                 timer_active    = 0;
1970                 timer_expires = jiffies;
1971         }
1972
1973         seq_printf(seq,
1974                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1975                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d %s\n",
1976                    i,
1977                    src->s6_addr32[0], src->s6_addr32[1],
1978                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1979                    dest->s6_addr32[0], dest->s6_addr32[1],
1980                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1981                    sp->sk_state,
1982                    tp->write_seq-tp->snd_una,
1983                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1984                    timer_active,
1985                    jiffies_to_clock_t(timer_expires - jiffies),
1986                    icsk->icsk_retransmits,
1987                    sock_i_uid(sp),
1988                    icsk->icsk_probes_out,
1989                    sock_i_ino(sp),
1990                    atomic_read(&sp->sk_refcnt), sp,
1991                    jiffies_to_clock_t(icsk->icsk_rto),
1992                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1993                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1994                    tp->snd_cwnd,
1995                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh,
1996                    sk_get_waiting_task_cmdline(sp, cmdline)
1997                    );
1998         free_page(cmdline);
1999 }
2000
2001 static void get_timewait6_sock(struct seq_file *seq,
2002                                struct inet_timewait_sock *tw, int i)
2003 {
2004         const struct in6_addr *dest, *src;
2005         __u16 destp, srcp;
2006         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2007         int ttd = tw->tw_ttd - jiffies;
2008
2009         if (ttd < 0)
2010                 ttd = 0;
2011
2012         dest = &tw6->tw_v6_daddr;
2013         src  = &tw6->tw_v6_rcv_saddr;
2014         destp = ntohs(tw->tw_dport);
2015         srcp  = ntohs(tw->tw_sport);
2016
2017         seq_printf(seq,
2018                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2019                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2020                    i,
2021                    src->s6_addr32[0], src->s6_addr32[1],
2022                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2023                    dest->s6_addr32[0], dest->s6_addr32[1],
2024                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2025                    tw->tw_substate, 0, 0,
2026                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2027                    atomic_read(&tw->tw_refcnt), tw);
2028 }
2029
2030 static int tcp6_seq_show(struct seq_file *seq, void *v)
2031 {
2032         struct tcp_iter_state *st;
2033
2034         if (v == SEQ_START_TOKEN) {
2035                 seq_puts(seq,
2036                          "  sl  "
2037                          "local_address                         "
2038                          "remote_address                        "
2039                          "st tx_queue rx_queue tr tm->when retrnsmt"
2040                          "   uid  timeout inode cmdline\n");
2041                 goto out;
2042         }
2043         st = seq->private;
2044
2045         switch (st->state) {
2046         case TCP_SEQ_STATE_LISTENING:
2047         case TCP_SEQ_STATE_ESTABLISHED:
2048                 get_tcp6_sock(seq, v, st->num);
2049                 break;
2050         case TCP_SEQ_STATE_OPENREQ:
2051                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2052                 break;
2053         case TCP_SEQ_STATE_TIME_WAIT:
2054                 get_timewait6_sock(seq, v, st->num);
2055                 break;
2056         }
2057 out:
2058         return 0;
2059 }
2060
2061 static const struct file_operations tcp6_afinfo_seq_fops = {
2062         .owner   = THIS_MODULE,
2063         .open    = tcp_seq_open,
2064         .read    = seq_read,
2065         .llseek  = seq_lseek,
2066         .release = seq_release_net
2067 };
2068
2069 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2070         .name           = "tcp6",
2071         .family         = AF_INET6,
2072         .seq_fops       = &tcp6_afinfo_seq_fops,
2073         .seq_ops        = {
2074                 .show           = tcp6_seq_show,
2075         },
2076 };
2077
2078 int __net_init tcp6_proc_init(struct net *net)
2079 {
2080         return tcp_proc_register(net, &tcp6_seq_afinfo);
2081 }
2082
2083 void tcp6_proc_exit(struct net *net)
2084 {
2085         tcp_proc_unregister(net, &tcp6_seq_afinfo);
2086 }
2087 #endif
2088
2089 static void tcp_v6_clear_sk(struct sock *sk, int size)
2090 {
2091         struct inet_sock *inet = inet_sk(sk);
2092
2093         /* we do not want to clear pinet6 field, because of RCU lookups */
2094         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
2095
2096         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
2097         memset(&inet->pinet6 + 1, 0, size);
2098 }
2099
2100 struct proto tcpv6_prot = {
2101         .name                   = "TCPv6",
2102         .owner                  = THIS_MODULE,
2103         .close                  = tcp_close,
2104         .connect                = tcp_v6_connect,
2105         .disconnect             = tcp_disconnect,
2106         .accept                 = inet_csk_accept,
2107         .ioctl                  = tcp_ioctl,
2108         .init                   = tcp_v6_init_sock,
2109         .destroy                = tcp_v6_destroy_sock,
2110         .shutdown               = tcp_shutdown,
2111         .setsockopt             = tcp_setsockopt,
2112         .getsockopt             = tcp_getsockopt,
2113         .recvmsg                = tcp_recvmsg,
2114         .sendmsg                = tcp_sendmsg,
2115         .sendpage               = tcp_sendpage,
2116         .backlog_rcv            = tcp_v6_do_rcv,
2117         .hash                   = tcp_v6_hash,
2118         .unhash                 = inet_unhash,
2119         .get_port               = inet_csk_get_port,
2120         .enter_memory_pressure  = tcp_enter_memory_pressure,
2121         .sockets_allocated      = &tcp_sockets_allocated,
2122         .memory_allocated       = &tcp_memory_allocated,
2123         .memory_pressure        = &tcp_memory_pressure,
2124         .orphan_count           = &tcp_orphan_count,
2125         .sysctl_wmem            = sysctl_tcp_wmem,
2126         .sysctl_rmem            = sysctl_tcp_rmem,
2127         .max_header             = MAX_TCP_HEADER,
2128         .obj_size               = sizeof(struct tcp6_sock),
2129         .slab_flags             = SLAB_DESTROY_BY_RCU,
2130         .twsk_prot              = &tcp6_timewait_sock_ops,
2131         .rsk_prot               = &tcp6_request_sock_ops,
2132         .h.hashinfo             = &tcp_hashinfo,
2133         .no_autobind            = true,
2134 #ifdef CONFIG_COMPAT
2135         .compat_setsockopt      = compat_tcp_setsockopt,
2136         .compat_getsockopt      = compat_tcp_getsockopt,
2137 #endif
2138 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_KMEM
2139         .proto_cgroup           = tcp_proto_cgroup,
2140 #endif
2141         .clear_sk               = tcp_v6_clear_sk,
2142 };
2143
2144 static const struct inet6_protocol tcpv6_protocol = {
2145         .handler        =       tcp_v6_rcv,
2146         .err_handler    =       tcp_v6_err,
2147         .gso_send_check =       tcp_v6_gso_send_check,
2148         .gso_segment    =       tcp_tso_segment,
2149         .gro_receive    =       tcp6_gro_receive,
2150         .gro_complete   =       tcp6_gro_complete,
2151         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2152 };
2153
2154 static struct inet_protosw tcpv6_protosw = {
2155         .type           =       SOCK_STREAM,
2156         .protocol       =       IPPROTO_TCP,
2157         .prot           =       &tcpv6_prot,
2158         .ops            =       &inet6_stream_ops,
2159         .no_check       =       0,
2160         .flags          =       INET_PROTOSW_PERMANENT |
2161                                 INET_PROTOSW_ICSK,
2162 };
2163
2164 static int __net_init tcpv6_net_init(struct net *net)
2165 {
2166         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2167                                     SOCK_RAW, IPPROTO_TCP, net);
2168 }
2169
2170 static void __net_exit tcpv6_net_exit(struct net *net)
2171 {
2172         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2173 }
2174
2175 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2176 {
2177         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2178 }
2179
2180 static struct pernet_operations tcpv6_net_ops = {
2181         .init       = tcpv6_net_init,
2182         .exit       = tcpv6_net_exit,
2183         .exit_batch = tcpv6_net_exit_batch,
2184 };
2185
2186 int __init tcpv6_init(void)
2187 {
2188         int ret;
2189
2190         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2191         if (ret)
2192                 goto out;
2193
2194         /* register inet6 protocol */
2195         ret = inet6_register_protosw(&tcpv6_protosw);
2196         if (ret)
2197                 goto out_tcpv6_protocol;
2198
2199         ret = register_pernet_subsys(&tcpv6_net_ops);
2200         if (ret)
2201                 goto out_tcpv6_protosw;
2202 out:
2203         return ret;
2204
2205 out_tcpv6_protocol:
2206         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2207 out_tcpv6_protosw:
2208         inet6_unregister_protosw(&tcpv6_protosw);
2209         goto out;
2210 }
2211
2212 void tcpv6_exit(void)
2213 {
2214         unregister_pernet_subsys(&tcpv6_net_ops);
2215         inet6_unregister_protosw(&tcpv6_protosw);
2216         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2217 }