net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/config.h>
  30 #include <linux/errno.h>
  31 #include <linux/types.h>
  32 #include <linux/socket.h>
  33 #include <linux/sockios.h>
  34 #include <linux/net.h>
  35 #include <linux/jiffies.h>
  36 #include <linux/in.h>
  37 #include <linux/in6.h>
  38 #include <linux/netdevice.h>
  39 #include <linux/init.h>
  40 #include <linux/jhash.h>
  41 #include <linux/ipsec.h>
  42 #include <linux/times.h>
  43
  44 #include <linux/ipv6.h>
  45 #include <linux/icmpv6.h>
  46 #include <linux/random.h>
  47
  48 #include <net/tcp.h>
  49 #include <net/ndisc.h>
  50 #include <net/inet6_hashtables.h>
  51 #include <net/inet6_connection_sock.h>
  52 #include <net/ipv6.h>
  53 #include <net/transp_v6.h>
  54 #include <net/addrconf.h>
  55 #include <net/ip6_route.h>
  56 #include <net/ip6_checksum.h>
  57 #include <net/inet_ecn.h>
  58 #include <net/protocol.h>
  59 #include <net/xfrm.h>
  60 #include <net/addrconf.h>
  61 #include <net/snmp.h>
  62 #include <net/dsfield.h>
  63 #include <net/timewait_sock.h>
  64
  65 #include <asm/uaccess.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 static void     tcp_v6_send_reset(struct sk_buff *skb);
  71 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
  72 static void     tcp_v6_send_check(struct sock *sk, int len,
  73                                   struct sk_buff *skb);
  74
  75 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  76
  77 static struct inet_connection_sock_af_ops ipv6_mapped;
  78 static struct inet_connection_sock_af_ops ipv6_specific;
  79
  80 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
  81 {
  82         return inet_csk_get_port(&tcp_hashinfo, sk, snum,
  83                                  inet6_csk_bind_conflict);
  84 }
  85
  86 static void tcp_v6_hash(struct sock *sk)
  87 {
  88         if (sk->sk_state != TCP_CLOSE) {
  89                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  90                         tcp_prot.hash(sk);
  91                         return;
  92                 }
  93                 local_bh_disable();
  94                 __inet6_hash(&tcp_hashinfo, sk);
  95                 local_bh_enable();
  96         }
  97 }
  98
  99 static __inline__ u16 tcp_v6_check(struct tcphdr *th, int len,
 100                                    struct in6_addr *saddr,
 101                                    struct in6_addr *daddr,
 102                                    unsigned long base)
 103 {
 104         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 105 }
 106
 107 static __u32 tcp_v6_init_sequence(struct sock *sk, struct sk_buff *skb)
 108 {
 109         if (skb->protocol == htons(ETH_P_IPV6)) {
 110                 return secure_tcpv6_sequence_number(skb->nh.ipv6h->daddr.s6_addr32,
 111                                                     skb->nh.ipv6h->saddr.s6_addr32,
 112                                                     skb->h.th->dest,
 113                                                     skb->h.th->source);
 114         } else {
 115                 return secure_tcp_sequence_number(skb->nh.iph->daddr,
 116                                                   skb->nh.iph->saddr,
 117                                                   skb->h.th->dest,
 118                                                   skb->h.th->source);
 119         }
 120 }
 121
 122 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 123                           int addr_len)
 124 {
 125         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 126         struct inet_sock *inet = inet_sk(sk);
 127         struct inet_connection_sock *icsk = inet_csk(sk);
 128         struct ipv6_pinfo *np = inet6_sk(sk);
 129         struct tcp_sock *tp = tcp_sk(sk);
 130         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 131         struct flowi fl;
 132         struct dst_entry *dst;
 133         int addr_type;
 134         int err;
 135
 136         if (addr_len < SIN6_LEN_RFC2133)
 137                 return -EINVAL;
 138
 139         if (usin->sin6_family != AF_INET6)
 140                 return(-EAFNOSUPPORT);
 141
 142         memset(&fl, 0, sizeof(fl));
 143
 144         if (np->sndflow) {
 145                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 146                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 147                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 148                         struct ip6_flowlabel *flowlabel;
 149                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 150                         if (flowlabel == NULL)
 151                                 return -EINVAL;
 152                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 153                         fl6_sock_release(flowlabel);
 154                 }
 155         }
 156
 157         /*
 158          *      connect() to INADDR_ANY means loopback (BSD'ism).
 159          */
 160
 161         if(ipv6_addr_any(&usin->sin6_addr))
 162                 usin->sin6_addr.s6_addr[15] = 0x1;
 163
 164         addr_type = ipv6_addr_type(&usin->sin6_addr);
 165
 166         if(addr_type & IPV6_ADDR_MULTICAST)
 167                 return -ENETUNREACH;
 168
 169         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 170                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 171                     usin->sin6_scope_id) {
 172                         /* If interface is set while binding, indices
 173                          * must coincide.
 174                          */
 175                         if (sk->sk_bound_dev_if &&
 176                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 177                                 return -EINVAL;
 178
 179                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 180                 }
 181
 182                 /* Connect to link-local address requires an interface */
 183                 if (!sk->sk_bound_dev_if)
 184                         return -EINVAL;
 185         }
 186
 187         if (tp->rx_opt.ts_recent_stamp &&
 188             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 189                 tp->rx_opt.ts_recent = 0;
 190                 tp->rx_opt.ts_recent_stamp = 0;
 191                 tp->write_seq = 0;
 192         }
 193
 194         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 195         np->flow_label = fl.fl6_flowlabel;
 196
 197         /*
 198          *      TCP over IPv4
 199          */
 200
 201         if (addr_type == IPV6_ADDR_MAPPED) {
 202                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 203                 struct sockaddr_in sin;
 204
 205                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 206
 207                 if (__ipv6_only_sock(sk))
 208                         return -ENETUNREACH;
 209
 210                 sin.sin_family = AF_INET;
 211                 sin.sin_port = usin->sin6_port;
 212                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 213
 214                 icsk->icsk_af_ops = &ipv6_mapped;
 215                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 216
 217                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 218
 219                 if (err) {
 220                         icsk->icsk_ext_hdr_len = exthdrlen;
 221                         icsk->icsk_af_ops = &ipv6_specific;
 222                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 223                         goto failure;
 224                 } else {
 225                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 226                                       inet->saddr);
 227                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 228                                       inet->rcv_saddr);
 229                 }
 230
 231                 return err;
 232         }
 233
 234         if (!ipv6_addr_any(&np->rcv_saddr))
 235                 saddr = &np->rcv_saddr;
 236
 237         fl.proto = IPPROTO_TCP;
 238         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 239         ipv6_addr_copy(&fl.fl6_src,
 240                        (saddr ? saddr : &np->saddr));
 241         fl.oif = sk->sk_bound_dev_if;
 242         fl.fl_ip_dport = usin->sin6_port;
 243         fl.fl_ip_sport = inet->sport;
 244
 245         if (np->opt && np->opt->srcrt) {
 246                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 247                 ipv6_addr_copy(&final, &fl.fl6_dst);
 248                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 249                 final_p = &final;
 250         }
 251
 252         err = ip6_dst_lookup(sk, &dst, &fl);
 253         if (err)
 254                 goto failure;
 255         if (final_p)
 256                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 257
 258         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 259                 goto failure;
 260
 261         if (saddr == NULL) {
 262                 saddr = &fl.fl6_src;
 263                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 264         }
 265
 266         /* set the source address */
 267         ipv6_addr_copy(&np->saddr, saddr);
 268         inet->rcv_saddr = LOOPBACK4_IPV6;
 269
 270         ip6_dst_store(sk, dst, NULL);
 271         sk->sk_route_caps = dst->dev->features &
 272                 ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
 273
 274         icsk->icsk_ext_hdr_len = 0;
 275         if (np->opt)
 276                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 277                                           np->opt->opt_nflen);
 278
 279         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 280
 281         inet->dport = usin->sin6_port;
 282
 283         tcp_set_state(sk, TCP_SYN_SENT);
 284         err = inet6_hash_connect(&tcp_death_row, sk);
 285         if (err)
 286                 goto late_failure;
 287
 288         if (!tp->write_seq)
 289                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 290                                                              np->daddr.s6_addr32,
 291                                                              inet->sport,
 292                                                              inet->dport);
 293
 294         err = tcp_connect(sk);
 295         if (err)
 296                 goto late_failure;
 297
 298         return 0;
 299
 300 late_failure:
 301         tcp_set_state(sk, TCP_CLOSE);
 302         __sk_dst_reset(sk);
 303 failure:
 304         inet->dport = 0;
 305         sk->sk_route_caps = 0;
 306         return err;
 307 }
 308
 309 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 310                 int type, int code, int offset, __u32 info)
 311 {
 312         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 313         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 314         struct ipv6_pinfo *np;
 315         struct sock *sk;
 316         int err;
 317         struct tcp_sock *tp;
 318         __u32 seq;
 319
 320         sk = inet6_lookup(&tcp_hashinfo, &hdr->daddr, th->dest, &hdr->saddr,
 321                           th->source, skb->dev->ifindex);
 322
 323         if (sk == NULL) {
 324                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 325                 return;
 326         }
 327
 328         if (sk->sk_state == TCP_TIME_WAIT) {
 329                 inet_twsk_put((struct inet_timewait_sock *)sk);
 330                 return;
 331         }
 332
 333         bh_lock_sock(sk);
 334         if (sock_owned_by_user(sk))
 335                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 336
 337         if (sk->sk_state == TCP_CLOSE)
 338                 goto out;
 339
 340         tp = tcp_sk(sk);
 341         seq = ntohl(th->seq);
 342         if (sk->sk_state != TCP_LISTEN &&
 343             !between(seq, tp->snd_una, tp->snd_nxt)) {
 344                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 345                 goto out;
 346         }
 347
 348         np = inet6_sk(sk);
 349
 350         if (type == ICMPV6_PKT_TOOBIG) {
 351                 struct dst_entry *dst = NULL;
 352
 353                 if (sock_owned_by_user(sk))
 354                         goto out;
 355                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 356                         goto out;
 357
 358                 /* icmp should have updated the destination cache entry */
 359                 dst = __sk_dst_check(sk, np->dst_cookie);
 360
 361                 if (dst == NULL) {
 362                         struct inet_sock *inet = inet_sk(sk);
 363                         struct flowi fl;
 364
 365                         /* BUGGG_FUTURE: Again, it is not clear how
 366                            to handle rthdr case. Ignore this complexity
 367                            for now.
 368                          */
 369                         memset(&fl, 0, sizeof(fl));
 370                         fl.proto = IPPROTO_TCP;
 371                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 372                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 373                         fl.oif = sk->sk_bound_dev_if;
 374                         fl.fl_ip_dport = inet->dport;
 375                         fl.fl_ip_sport = inet->sport;
 376
 377                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 378                                 sk->sk_err_soft = -err;
 379                                 goto out;
 380                         }
 381
 382                         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 383                                 sk->sk_err_soft = -err;
 384                                 goto out;
 385                         }
 386
 387                 } else
 388                         dst_hold(dst);
 389
 390                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 391                         tcp_sync_mss(sk, dst_mtu(dst));
 392                         tcp_simple_retransmit(sk);
 393                 } /* else let the usual retransmit timer handle it */
 394                 dst_release(dst);
 395                 goto out;
 396         }
 397
 398         icmpv6_err_convert(type, code, &err);
 399
 400         /* Might be for an request_sock */
 401         switch (sk->sk_state) {
 402                 struct request_sock *req, **prev;
 403         case TCP_LISTEN:
 404                 if (sock_owned_by_user(sk))
 405                         goto out;
 406
 407                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 408                                            &hdr->saddr, inet6_iif(skb));
 409                 if (!req)
 410                         goto out;
 411
 412                 /* ICMPs are not backlogged, hence we cannot get
 413                  * an established socket here.
 414                  */
 415                 BUG_TRAP(req->sk == NULL);
 416
 417                 if (seq != tcp_rsk(req)->snt_isn) {
 418                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 419                         goto out;
 420                 }
 421
 422                 inet_csk_reqsk_queue_drop(sk, req, prev);
 423                 goto out;
 424
 425         case TCP_SYN_SENT:
 426         case TCP_SYN_RECV:  /* Cannot happen.
 427                                It can, it SYNs are crossed. --ANK */
 428                 if (!sock_owned_by_user(sk)) {
 429                         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 430                         sk->sk_err = err;
 431                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 432
 433                         tcp_done(sk);
 434                 } else
 435                         sk->sk_err_soft = err;
 436                 goto out;
 437         }
 438
 439         if (!sock_owned_by_user(sk) && np->recverr) {
 440                 sk->sk_err = err;
 441                 sk->sk_error_report(sk);
 442         } else
 443                 sk->sk_err_soft = err;
 444
 445 out:
 446         bh_unlock_sock(sk);
 447         sock_put(sk);
 448 }
 449
 450
 451 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 452                               struct dst_entry *dst)
 453 {
 454         struct inet6_request_sock *treq = inet6_rsk(req);
 455         struct ipv6_pinfo *np = inet6_sk(sk);
 456         struct sk_buff * skb;
 457         struct ipv6_txoptions *opt = NULL;
 458         struct in6_addr * final_p = NULL, final;
 459         struct flowi fl;
 460         int err = -1;
 461
 462         memset(&fl, 0, sizeof(fl));
 463         fl.proto = IPPROTO_TCP;
 464         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 465         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 466         fl.fl6_flowlabel = 0;
 467         fl.oif = treq->iif;
 468         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 469         fl.fl_ip_sport = inet_sk(sk)->sport;
 470
 471         if (dst == NULL) {
 472                 opt = np->opt;
 473                 if (opt == NULL &&
 474                     np->rxopt.bits.osrcrt == 2 &&
 475                     treq->pktopts) {
 476                         struct sk_buff *pktopts = treq->pktopts;
 477                         struct inet6_skb_parm *rxopt = IP6CB(pktopts);
 478                         if (rxopt->srcrt)
 479                                 opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(pktopts->nh.raw + rxopt->srcrt));
 480                 }
 481
 482                 if (opt && opt->srcrt) {
 483                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 484                         ipv6_addr_copy(&final, &fl.fl6_dst);
 485                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 486                         final_p = &final;
 487                 }
 488
 489                 err = ip6_dst_lookup(sk, &dst, &fl);
 490                 if (err)
 491                         goto done;
 492                 if (final_p)
 493                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 494                 if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 495                         goto done;
 496         }
 497
 498         skb = tcp_make_synack(sk, dst, req);
 499         if (skb) {
 500                 struct tcphdr *th = skb->h.th;
 501
 502                 th->check = tcp_v6_check(th, skb->len,
 503                                          &treq->loc_addr, &treq->rmt_addr,
 504                                          csum_partial((char *)th, skb->len, skb->csum));
 505
 506                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 507                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 508                 if (err == NET_XMIT_CN)
 509                         err = 0;
 510         }
 511
 512 done:
 513         if (opt && opt != np->opt)
 514                 sock_kfree_s(sk, opt, opt->tot_len);
 515         return err;
 516 }
 517
 518 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 519 {
 520         if (inet6_rsk(req)->pktopts)
 521                 kfree_skb(inet6_rsk(req)->pktopts);
 522 }
 523
 524 static struct request_sock_ops tcp6_request_sock_ops = {
 525         .family         =       AF_INET6,
 526         .obj_size       =       sizeof(struct tcp6_request_sock),
 527         .rtx_syn_ack    =       tcp_v6_send_synack,
 528         .send_ack       =       tcp_v6_reqsk_send_ack,
 529         .destructor     =       tcp_v6_reqsk_destructor,
 530         .send_reset     =       tcp_v6_send_reset
 531 };
 532
 533 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 534         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 535         .twsk_unique    = tcp_twsk_unique,
 536 };
 537
 538 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 539 {
 540         struct ipv6_pinfo *np = inet6_sk(sk);
 541         struct tcphdr *th = skb->h.th;
 542
 543         if (skb->ip_summed == CHECKSUM_HW) {
 544                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 545                 skb->csum = offsetof(struct tcphdr, check);
 546         } else {
 547                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 548                                             csum_partial((char *)th, th->doff<<2,
 549                                                          skb->csum));
 550         }
 551 }
 552
 553
 554 static void tcp_v6_send_reset(struct sk_buff *skb)
 555 {
 556         struct tcphdr *th = skb->h.th, *t1;
 557         struct sk_buff *buff;
 558         struct flowi fl;
 559
 560         if (th->rst)
 561                 return;
 562
 563         if (!ipv6_unicast_destination(skb))
 564                 return;
 565
 566         /*
 567          * We need to grab some memory, and put together an RST,
 568          * and then put it into the queue to be sent.
 569          */
 570
 571         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + sizeof(struct tcphdr),
 572                          GFP_ATOMIC);
 573         if (buff == NULL)
 574                 return;
 575
 576         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + sizeof(struct tcphdr));
 577
 578         t1 = (struct tcphdr *) skb_push(buff,sizeof(struct tcphdr));
 579
 580         /* Swap the send and the receive. */
 581         memset(t1, 0, sizeof(*t1));
 582         t1->dest = th->source;
 583         t1->source = th->dest;
 584         t1->doff = sizeof(*t1)/4;
 585         t1->rst = 1;
 586
 587         if(th->ack) {
 588                 t1->seq = th->ack_seq;
 589         } else {
 590                 t1->ack = 1;
 591                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
 592                                     + skb->len - (th->doff<<2));
 593         }
 594
 595         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
 596
 597         memset(&fl, 0, sizeof(fl));
 598         ipv6_addr_copy(&fl.fl6_dst, &skb->nh.ipv6h->saddr);
 599         ipv6_addr_copy(&fl.fl6_src, &skb->nh.ipv6h->daddr);
 600
 601         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
 602                                     sizeof(*t1), IPPROTO_TCP,
 603                                     buff->csum);
 604
 605         fl.proto = IPPROTO_TCP;
 606         fl.oif = inet6_iif(skb);
 607         fl.fl_ip_dport = t1->dest;
 608         fl.fl_ip_sport = t1->source;
 609
 610         /* sk = NULL, but it is safe for now. RST socket required. */
 611         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 612
 613                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
 614                         ip6_xmit(NULL, buff, &fl, NULL, 0);
 615                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
 616                         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
 617                         return;
 618                 }
 619         }
 620
 621         kfree_skb(buff);
 622 }
 623
 624 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
 625 {
 626         struct tcphdr *th = skb->h.th, *t1;
 627         struct sk_buff *buff;
 628         struct flowi fl;
 629         int tot_len = sizeof(struct tcphdr);
 630
 631         if (ts)
 632                 tot_len += 3*4;
 633
 634         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 635                          GFP_ATOMIC);
 636         if (buff == NULL)
 637                 return;
 638
 639         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 640
 641         t1 = (struct tcphdr *) skb_push(buff,tot_len);
 642
 643         /* Swap the send and the receive. */
 644         memset(t1, 0, sizeof(*t1));
 645         t1->dest = th->source;
 646         t1->source = th->dest;
 647         t1->doff = tot_len/4;
 648         t1->seq = htonl(seq);
 649         t1->ack_seq = htonl(ack);
 650         t1->ack = 1;
 651         t1->window = htons(win);
 652
 653         if (ts) {
 654                 u32 *ptr = (u32*)(t1 + 1);
 655                 *ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 656                                (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 657                 *ptr++ = htonl(tcp_time_stamp);
 658                 *ptr = htonl(ts);
 659         }
 660
 661         buff->csum = csum_partial((char *)t1, tot_len, 0);
 662
 663         memset(&fl, 0, sizeof(fl));
 664         ipv6_addr_copy(&fl.fl6_dst, &skb->nh.ipv6h->saddr);
 665         ipv6_addr_copy(&fl.fl6_src, &skb->nh.ipv6h->daddr);
 666
 667         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
 668                                     tot_len, IPPROTO_TCP,
 669                                     buff->csum);
 670
 671         fl.proto = IPPROTO_TCP;
 672         fl.oif = inet6_iif(skb);
 673         fl.fl_ip_dport = t1->dest;
 674         fl.fl_ip_sport = t1->source;
 675
 676         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 677                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
 678                         ip6_xmit(NULL, buff, &fl, NULL, 0);
 679                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
 680                         return;
 681                 }
 682         }
 683
 684         kfree_skb(buff);
 685 }
 686
 687 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 688 {
 689         struct inet_timewait_sock *tw = inet_twsk(sk);
 690         const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 691
 692         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 693                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 694                         tcptw->tw_ts_recent);
 695
 696         inet_twsk_put(tw);
 697 }
 698
 699 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 700 {
 701         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
 702 }
 703
 704
 705 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 706 {
 707         struct request_sock *req, **prev;
 708         const struct tcphdr *th = skb->h.th;
 709         struct sock *nsk;
 710
 711         /* Find possible connection requests. */
 712         req = inet6_csk_search_req(sk, &prev, th->source,
 713                                    &skb->nh.ipv6h->saddr,
 714                                    &skb->nh.ipv6h->daddr, inet6_iif(skb));
 715         if (req)
 716                 return tcp_check_req(sk, skb, req, prev);
 717
 718         nsk = __inet6_lookup_established(&tcp_hashinfo, &skb->nh.ipv6h->saddr,
 719                                          th->source, &skb->nh.ipv6h->daddr,
 720                                          ntohs(th->dest), inet6_iif(skb));
 721
 722         if (nsk) {
 723                 if (nsk->sk_state != TCP_TIME_WAIT) {
 724                         bh_lock_sock(nsk);
 725                         return nsk;
 726                 }
 727                 inet_twsk_put((struct inet_timewait_sock *)nsk);
 728                 return NULL;
 729         }
 730
 731 #if 0 /*def CONFIG_SYN_COOKIES*/
 732         if (!th->rst && !th->syn && th->ack)
 733                 sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
 734 #endif
 735         return sk;
 736 }
 737
 738 /* FIXME: this is substantially similar to the ipv4 code.
 739  * Can some kind of merge be done? -- erics
 740  */
 741 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 742 {
 743         struct inet6_request_sock *treq;
 744         struct ipv6_pinfo *np = inet6_sk(sk);
 745         struct tcp_options_received tmp_opt;
 746         struct tcp_sock *tp = tcp_sk(sk);
 747         struct request_sock *req = NULL;
 748         __u32 isn = TCP_SKB_CB(skb)->when;
 749
 750         if (skb->protocol == htons(ETH_P_IP))
 751                 return tcp_v4_conn_request(sk, skb);
 752
 753         if (!ipv6_unicast_destination(skb))
 754                 goto drop;
 755
 756         /*
 757          *      There are no SYN attacks on IPv6, yet...
 758          */
 759         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
 760                 if (net_ratelimit())
 761                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
 762                 goto drop;
 763         }
 764
 765         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
 766                 goto drop;
 767
 768         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 769         if (req == NULL)
 770                 goto drop;
 771
 772         tcp_clear_options(&tmp_opt);
 773         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 774         tmp_opt.user_mss = tp->rx_opt.user_mss;
 775
 776         tcp_parse_options(skb, &tmp_opt, 0);
 777
 778         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
 779         tcp_openreq_init(req, &tmp_opt, skb);
 780
 781         treq = inet6_rsk(req);
 782         ipv6_addr_copy(&treq->rmt_addr, &skb->nh.ipv6h->saddr);
 783         ipv6_addr_copy(&treq->loc_addr, &skb->nh.ipv6h->daddr);
 784         TCP_ECN_create_request(req, skb->h.th);
 785         treq->pktopts = NULL;
 786         if (ipv6_opt_accepted(sk, skb) ||
 787             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
 788             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
 789                 atomic_inc(&skb->users);
 790                 treq->pktopts = skb;
 791         }
 792         treq->iif = sk->sk_bound_dev_if;
 793
 794         /* So that link locals have meaning */
 795         if (!sk->sk_bound_dev_if &&
 796             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
 797                 treq->iif = inet6_iif(skb);
 798
 799         if (isn == 0)
 800                 isn = tcp_v6_init_sequence(sk,skb);
 801
 802         tcp_rsk(req)->snt_isn = isn;
 803
 804         if (tcp_v6_send_synack(sk, req, NULL))
 805                 goto drop;
 806
 807         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
 808         return 0;
 809
 810 drop:
 811         if (req)
 812                 reqsk_free(req);
 813
 814         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 815         return 0; /* don't send reset */
 816 }
 817
 818 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 819                                           struct request_sock *req,
 820                                           struct dst_entry *dst)
 821 {
 822         struct inet6_request_sock *treq = inet6_rsk(req);
 823         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
 824         struct tcp6_sock *newtcp6sk;
 825         struct inet_sock *newinet;
 826         struct tcp_sock *newtp;
 827         struct sock *newsk;
 828         struct ipv6_txoptions *opt;
 829
 830         if (skb->protocol == htons(ETH_P_IP)) {
 831                 /*
 832                  *      v6 mapped
 833                  */
 834
 835                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
 836
 837                 if (newsk == NULL)
 838                         return NULL;
 839
 840                 newtcp6sk = (struct tcp6_sock *)newsk;
 841                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
 842
 843                 newinet = inet_sk(newsk);
 844                 newnp = inet6_sk(newsk);
 845                 newtp = tcp_sk(newsk);
 846
 847                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 848
 849                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
 850                               newinet->daddr);
 851
 852                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
 853                               newinet->saddr);
 854
 855                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
 856
 857                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
 858                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
 859                 newnp->pktoptions  = NULL;
 860                 newnp->opt         = NULL;
 861                 newnp->mcast_oif   = inet6_iif(skb);
 862                 newnp->mcast_hops  = skb->nh.ipv6h->hop_limit;
 863
 864                 /*
 865                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
 866                  * here, tcp_create_openreq_child now does this for us, see the comment in
 867                  * that function for the gory details. -acme
 868                  */
 869
 870                 /* It is tricky place. Until this moment IPv4 tcp
 871                    worked with IPv6 icsk.icsk_af_ops.
 872                    Sync it now.
 873                  */
 874                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
 875
 876                 return newsk;
 877         }
 878
 879         opt = np->opt;
 880
 881         if (sk_acceptq_is_full(sk))
 882                 goto out_overflow;
 883
 884         if (np->rxopt.bits.osrcrt == 2 &&
 885             opt == NULL && treq->pktopts) {
 886                 struct inet6_skb_parm *rxopt = IP6CB(treq->pktopts);
 887                 if (rxopt->srcrt)
 888                         opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr *)(treq->pktopts->nh.raw + rxopt->srcrt));
 889         }
 890
 891         if (dst == NULL) {
 892                 struct in6_addr *final_p = NULL, final;
 893                 struct flowi fl;
 894
 895                 memset(&fl, 0, sizeof(fl));
 896                 fl.proto = IPPROTO_TCP;
 897                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 898                 if (opt && opt->srcrt) {
 899                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 900                         ipv6_addr_copy(&final, &fl.fl6_dst);
 901                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 902                         final_p = &final;
 903                 }
 904                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 905                 fl.oif = sk->sk_bound_dev_if;
 906                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 907                 fl.fl_ip_sport = inet_sk(sk)->sport;
 908
 909                 if (ip6_dst_lookup(sk, &dst, &fl))
 910                         goto out;
 911
 912                 if (final_p)
 913                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 914
 915                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 916                         goto out;
 917         }
 918
 919         newsk = tcp_create_openreq_child(sk, req, skb);
 920         if (newsk == NULL)
 921                 goto out;
 922
 923         /*
 924          * No need to charge this sock to the relevant IPv6 refcnt debug socks
 925          * count here, tcp_create_openreq_child now does this for us, see the
 926          * comment in that function for the gory details. -acme
 927          */
 928
 929         ip6_dst_store(newsk, dst, NULL);
 930         newsk->sk_route_caps = dst->dev->features &
 931                 ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
 932
 933         newtcp6sk = (struct tcp6_sock *)newsk;
 934         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
 935
 936         newtp = tcp_sk(newsk);
 937         newinet = inet_sk(newsk);
 938         newnp = inet6_sk(newsk);
 939
 940         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 941
 942         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
 943         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
 944         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
 945         newsk->sk_bound_dev_if = treq->iif;
 946
 947         /* Now IPv6 options...
 948
 949            First: no IPv4 options.
 950          */
 951         newinet->opt = NULL;
 952
 953         /* Clone RX bits */
 954         newnp->rxopt.all = np->rxopt.all;
 955
 956         /* Clone pktoptions received with SYN */
 957         newnp->pktoptions = NULL;
 958         if (treq->pktopts != NULL) {
 959                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
 960                 kfree_skb(treq->pktopts);
 961                 treq->pktopts = NULL;
 962                 if (newnp->pktoptions)
 963                         skb_set_owner_r(newnp->pktoptions, newsk);
 964         }
 965         newnp->opt        = NULL;
 966         newnp->mcast_oif  = inet6_iif(skb);
 967         newnp->mcast_hops = skb->nh.ipv6h->hop_limit;
 968
 969         /* Clone native IPv6 options from listening socket (if any)
 970
 971            Yes, keeping reference count would be much more clever,
 972            but we make one more one thing there: reattach optmem
 973            to newsk.
 974          */
 975         if (opt) {
 976                 newnp->opt = ipv6_dup_options(newsk, opt);
 977                 if (opt != np->opt)
 978                         sock_kfree_s(sk, opt, opt->tot_len);
 979         }
 980
 981         inet_csk(newsk)->icsk_ext_hdr_len = 0;
 982         if (newnp->opt)
 983                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
 984                                                      newnp->opt->opt_flen);
 985
 986         tcp_sync_mss(newsk, dst_mtu(dst));
 987         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
 988         tcp_initialize_rcv_mss(newsk);
 989
 990         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
 991
 992         __inet6_hash(&tcp_hashinfo, newsk);
 993         inet_inherit_port(&tcp_hashinfo, sk, newsk);
 994
 995         return newsk;
 996
 997 out_overflow:
 998         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
 999 out:
1000         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
1001         if (opt && opt != np->opt)
1002                 sock_kfree_s(sk, opt, opt->tot_len);
1003         dst_release(dst);
1004         return NULL;
1005 }
1006
1007 static int tcp_v6_checksum_init(struct sk_buff *skb)
1008 {
1009         if (skb->ip_summed == CHECKSUM_HW) {
1010                 if (!tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1011                                   &skb->nh.ipv6h->daddr,skb->csum)) {
1012                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1013                         return 0;
1014                 }
1015         }
1016
1017         skb->csum = ~tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1018                                   &skb->nh.ipv6h->daddr, 0);
1019
1020         if (skb->len <= 76) {
1021                 return __skb_checksum_complete(skb);
1022         }
1023         return 0;
1024 }
1025
1026 /* The socket must have it's spinlock held when we get
1027  * here.
1028  *
1029  * We have a potential double-lock case here, so even when
1030  * doing backlog processing we use the BH locking scheme.
1031  * This is because we cannot sleep with the original spinlock
1032  * held.
1033  */
1034 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1035 {
1036         struct ipv6_pinfo *np = inet6_sk(sk);
1037         struct tcp_sock *tp;
1038         struct sk_buff *opt_skb = NULL;
1039
1040         /* Imagine: socket is IPv6. IPv4 packet arrives,
1041            goes to IPv4 receive handler and backlogged.
1042            From backlog it always goes here. Kerboom...
1043            Fortunately, tcp_rcv_established and rcv_established
1044            handle them correctly, but it is not case with
1045            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1046          */
1047
1048         if (skb->protocol == htons(ETH_P_IP))
1049                 return tcp_v4_do_rcv(sk, skb);
1050
1051         if (sk_filter(sk, skb, 0))
1052                 goto discard;
1053
1054         /*
1055          *      socket locking is here for SMP purposes as backlog rcv
1056          *      is currently called with bh processing disabled.
1057          */
1058
1059         /* Do Stevens' IPV6_PKTOPTIONS.
1060
1061            Yes, guys, it is the only place in our code, where we
1062            may make it not affecting IPv4.
1063            The rest of code is protocol independent,
1064            and I do not like idea to uglify IPv4.
1065
1066            Actually, all the idea behind IPV6_PKTOPTIONS
1067            looks not very well thought. For now we latch
1068            options, received in the last packet, enqueued
1069            by tcp. Feel free to propose better solution.
1070                                                --ANK (980728)
1071          */
1072         if (np->rxopt.all)
1073                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1074
1075         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1076                 TCP_CHECK_TIMER(sk);
1077                 if (tcp_rcv_established(sk, skb, skb->h.th, skb->len))
1078                         goto reset;
1079                 TCP_CHECK_TIMER(sk);
1080                 if (opt_skb)
1081                         goto ipv6_pktoptions;
1082                 return 0;
1083         }
1084
1085         if (skb->len < (skb->h.th->doff<<2) || tcp_checksum_complete(skb))
1086                 goto csum_err;
1087
1088         if (sk->sk_state == TCP_LISTEN) {
1089                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1090                 if (!nsk)
1091                         goto discard;
1092
1093                 /*
1094                  * Queue it on the new socket if the new socket is active,
1095                  * otherwise we just shortcircuit this and continue with
1096                  * the new socket..
1097                  */
1098                 if(nsk != sk) {
1099                         if (tcp_child_process(sk, nsk, skb))
1100                                 goto reset;
1101                         if (opt_skb)
1102                                 __kfree_skb(opt_skb);
1103                         return 0;
1104                 }
1105         }
1106
1107         TCP_CHECK_TIMER(sk);
1108         if (tcp_rcv_state_process(sk, skb, skb->h.th, skb->len))
1109                 goto reset;
1110         TCP_CHECK_TIMER(sk);
1111         if (opt_skb)
1112                 goto ipv6_pktoptions;
1113         return 0;
1114
1115 reset:
1116         tcp_v6_send_reset(skb);
1117 discard:
1118         if (opt_skb)
1119                 __kfree_skb(opt_skb);
1120         kfree_skb(skb);
1121         return 0;
1122 csum_err:
1123         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1124         goto discard;
1125
1126
1127 ipv6_pktoptions:
1128         /* Do you ask, what is it?
1129
1130            1. skb was enqueued by tcp.
1131            2. skb is added to tail of read queue, rather than out of order.
1132            3. socket is not in passive state.
1133            4. Finally, it really contains options, which user wants to receive.
1134          */
1135         tp = tcp_sk(sk);
1136         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1137             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1138                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1139                         np->mcast_oif = inet6_iif(opt_skb);
1140                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1141                         np->mcast_hops = opt_skb->nh.ipv6h->hop_limit;
1142                 if (ipv6_opt_accepted(sk, opt_skb)) {
1143                         skb_set_owner_r(opt_skb, sk);
1144                         opt_skb = xchg(&np->pktoptions, opt_skb);
1145                 } else {
1146                         __kfree_skb(opt_skb);
1147                         opt_skb = xchg(&np->pktoptions, NULL);
1148                 }
1149         }
1150
1151         if (opt_skb)
1152                 kfree_skb(opt_skb);
1153         return 0;
1154 }
1155
1156 static int tcp_v6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
1157 {
1158         struct sk_buff *skb = *pskb;
1159         struct tcphdr *th;
1160         struct sock *sk;
1161         int ret;
1162
1163         if (skb->pkt_type != PACKET_HOST)
1164                 goto discard_it;
1165
1166         /*
1167          *      Count it even if it's bad.
1168          */
1169         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1170
1171         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1172                 goto discard_it;
1173
1174         th = skb->h.th;
1175
1176         if (th->doff < sizeof(struct tcphdr)/4)
1177                 goto bad_packet;
1178         if (!pskb_may_pull(skb, th->doff*4))
1179                 goto discard_it;
1180
1181         if ((skb->ip_summed != CHECKSUM_UNNECESSARY &&
1182              tcp_v6_checksum_init(skb)))
1183                 goto bad_packet;
1184
1185         th = skb->h.th;
1186         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1187         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1188                                     skb->len - th->doff*4);
1189         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1190         TCP_SKB_CB(skb)->when = 0;
1191         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(skb->nh.ipv6h);
1192         TCP_SKB_CB(skb)->sacked = 0;
1193
1194         sk = __inet6_lookup(&tcp_hashinfo, &skb->nh.ipv6h->saddr, th->source,
1195                             &skb->nh.ipv6h->daddr, ntohs(th->dest),
1196                             inet6_iif(skb));
1197
1198         if (!sk)
1199                 goto no_tcp_socket;
1200
1201 process:
1202         if (sk->sk_state == TCP_TIME_WAIT)
1203                 goto do_time_wait;
1204
1205         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1206                 goto discard_and_relse;
1207
1208         if (sk_filter(sk, skb, 0))
1209                 goto discard_and_relse;
1210
1211         skb->dev = NULL;
1212
1213         bh_lock_sock(sk);
1214         ret = 0;
1215         if (!sock_owned_by_user(sk)) {
1216                 if (!tcp_prequeue(sk, skb))
1217                         ret = tcp_v6_do_rcv(sk, skb);
1218         } else
1219                 sk_add_backlog(sk, skb);
1220         bh_unlock_sock(sk);
1221
1222         sock_put(sk);
1223         return ret ? -1 : 0;
1224
1225 no_tcp_socket:
1226         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1227                 goto discard_it;
1228
1229         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1230 bad_packet:
1231                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1232         } else {
1233                 tcp_v6_send_reset(skb);
1234         }
1235
1236 discard_it:
1237
1238         /*
1239          *      Discard frame
1240          */
1241
1242         kfree_skb(skb);
1243         return 0;
1244
1245 discard_and_relse:
1246         sock_put(sk);
1247         goto discard_it;
1248
1249 do_time_wait:
1250         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1251                 inet_twsk_put((struct inet_timewait_sock *)sk);
1252                 goto discard_it;
1253         }
1254
1255         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1256                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1257                 inet_twsk_put((struct inet_timewait_sock *)sk);
1258                 goto discard_it;
1259         }
1260
1261         switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
1262                                            skb, th)) {
1263         case TCP_TW_SYN:
1264         {
1265                 struct sock *sk2;
1266
1267                 sk2 = inet6_lookup_listener(&tcp_hashinfo,
1268                                             &skb->nh.ipv6h->daddr,
1269                                             ntohs(th->dest), inet6_iif(skb));
1270                 if (sk2 != NULL) {
1271                         struct inet_timewait_sock *tw = inet_twsk(sk);
1272                         inet_twsk_deschedule(tw, &tcp_death_row);
1273                         inet_twsk_put(tw);
1274                         sk = sk2;
1275                         goto process;
1276                 }
1277                 /* Fall through to ACK */
1278         }
1279         case TCP_TW_ACK:
1280                 tcp_v6_timewait_ack(sk, skb);
1281                 break;
1282         case TCP_TW_RST:
1283                 goto no_tcp_socket;
1284         case TCP_TW_SUCCESS:;
1285         }
1286         goto discard_it;
1287 }
1288
1289 static int tcp_v6_remember_stamp(struct sock *sk)
1290 {
1291         /* Alas, not yet... */
1292         return 0;
1293 }
1294
1295 static struct inet_connection_sock_af_ops ipv6_specific = {
1296         .queue_xmit     =       inet6_csk_xmit,
1297         .send_check     =       tcp_v6_send_check,
1298         .rebuild_header =       inet6_sk_rebuild_header,
1299         .conn_request   =       tcp_v6_conn_request,
1300         .syn_recv_sock  =       tcp_v6_syn_recv_sock,
1301         .remember_stamp =       tcp_v6_remember_stamp,
1302         .net_header_len =       sizeof(struct ipv6hdr),
1303
1304         .setsockopt     =       ipv6_setsockopt,
1305         .getsockopt     =       ipv6_getsockopt,
1306         .addr2sockaddr  =       inet6_csk_addr2sockaddr,
1307         .sockaddr_len   =       sizeof(struct sockaddr_in6)
1308 };
1309
1310 /*
1311  *      TCP over IPv4 via INET6 API
1312  */
1313
1314 static struct inet_connection_sock_af_ops ipv6_mapped = {
1315         .queue_xmit     =       ip_queue_xmit,
1316         .send_check     =       tcp_v4_send_check,
1317         .rebuild_header =       inet_sk_rebuild_header,
1318         .conn_request   =       tcp_v6_conn_request,
1319         .syn_recv_sock  =       tcp_v6_syn_recv_sock,
1320         .remember_stamp =       tcp_v4_remember_stamp,
1321         .net_header_len =       sizeof(struct iphdr),
1322
1323         .setsockopt     =       ipv6_setsockopt,
1324         .getsockopt     =       ipv6_getsockopt,
1325         .addr2sockaddr  =       inet6_csk_addr2sockaddr,
1326         .sockaddr_len   =       sizeof(struct sockaddr_in6)
1327 };
1328
1329
1330
1331 /* NOTE: A lot of things set to zero explicitly by call to
1332  *       sk_alloc() so need not be done here.
1333  */
1334 static int tcp_v6_init_sock(struct sock *sk)
1335 {
1336         struct inet_connection_sock *icsk = inet_csk(sk);
1337         struct tcp_sock *tp = tcp_sk(sk);
1338
1339         skb_queue_head_init(&tp->out_of_order_queue);
1340         tcp_init_xmit_timers(sk);
1341         tcp_prequeue_init(tp);
1342
1343         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1344         tp->mdev = TCP_TIMEOUT_INIT;
1345
1346         /* So many TCP implementations out there (incorrectly) count the
1347          * initial SYN frame in their delayed-ACK and congestion control
1348          * algorithms that we must have the following bandaid to talk
1349          * efficiently to them.  -DaveM
1350          */
1351         tp->snd_cwnd = 2;
1352
1353         /* See draft-stevens-tcpca-spec-01 for discussion of the
1354          * initialization of these values.
1355          */
1356         tp->snd_ssthresh = 0x7fffffff;
1357         tp->snd_cwnd_clamp = ~0;
1358         tp->mss_cache = 536;
1359
1360         tp->reordering = sysctl_tcp_reordering;
1361
1362         sk->sk_state = TCP_CLOSE;
1363
1364         icsk->icsk_af_ops = &ipv6_specific;
1365         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1366         icsk->icsk_sync_mss = tcp_sync_mss;
1367         sk->sk_write_space = sk_stream_write_space;
1368         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1369
1370         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1371         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1372
1373         atomic_inc(&tcp_sockets_allocated);
1374
1375         return 0;
1376 }
1377
1378 static int tcp_v6_destroy_sock(struct sock *sk)
1379 {
1380         tcp_v4_destroy_sock(sk);
1381         return inet6_destroy_sock(sk);
1382 }
1383
1384 /* Proc filesystem TCPv6 sock list dumping. */
1385 static void get_openreq6(struct seq_file *seq,
1386                          struct sock *sk, struct request_sock *req, int i, int uid)
1387 {
1388         int ttd = req->expires - jiffies;
1389         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1390         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1391
1392         if (ttd < 0)
1393                 ttd = 0;
1394
1395         seq_printf(seq,
1396                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1397                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1398                    i,
1399                    src->s6_addr32[0], src->s6_addr32[1],
1400                    src->s6_addr32[2], src->s6_addr32[3],
1401                    ntohs(inet_sk(sk)->sport),
1402                    dest->s6_addr32[0], dest->s6_addr32[1],
1403                    dest->s6_addr32[2], dest->s6_addr32[3],
1404                    ntohs(inet_rsk(req)->rmt_port),
1405                    TCP_SYN_RECV,
1406                    0,0, /* could print option size, but that is af dependent. */
1407                    1,   /* timers active (only the expire timer) */
1408                    jiffies_to_clock_t(ttd),
1409                    req->retrans,
1410                    uid,
1411                    0,  /* non standard timer */
1412                    0, /* open_requests have no inode */
1413                    0, req);
1414 }
1415
1416 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1417 {
1418         struct in6_addr *dest, *src;
1419         __u16 destp, srcp;
1420         int timer_active;
1421         unsigned long timer_expires;
1422         struct inet_sock *inet = inet_sk(sp);
1423         struct tcp_sock *tp = tcp_sk(sp);
1424         const struct inet_connection_sock *icsk = inet_csk(sp);
1425         struct ipv6_pinfo *np = inet6_sk(sp);
1426
1427         dest  = &np->daddr;
1428         src   = &np->rcv_saddr;
1429         destp = ntohs(inet->dport);
1430         srcp  = ntohs(inet->sport);
1431
1432         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1433                 timer_active    = 1;
1434                 timer_expires   = icsk->icsk_timeout;
1435         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1436                 timer_active    = 4;
1437                 timer_expires   = icsk->icsk_timeout;
1438         } else if (timer_pending(&sp->sk_timer)) {
1439                 timer_active    = 2;
1440                 timer_expires   = sp->sk_timer.expires;
1441         } else {
1442                 timer_active    = 0;
1443                 timer_expires = jiffies;
1444         }
1445
1446         seq_printf(seq,
1447                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1448                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
1449                    i,
1450                    src->s6_addr32[0], src->s6_addr32[1],
1451                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1452                    dest->s6_addr32[0], dest->s6_addr32[1],
1453                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1454                    sp->sk_state,
1455                    tp->write_seq-tp->snd_una, tp->rcv_nxt-tp->copied_seq,
1456                    timer_active,
1457                    jiffies_to_clock_t(timer_expires - jiffies),
1458                    icsk->icsk_retransmits,
1459                    sock_i_uid(sp),
1460                    icsk->icsk_probes_out,
1461                    sock_i_ino(sp),
1462                    atomic_read(&sp->sk_refcnt), sp,
1463                    icsk->icsk_rto,
1464                    icsk->icsk_ack.ato,
1465                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1466                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
1467                    );
1468 }
1469
1470 static void get_timewait6_sock(struct seq_file *seq,
1471                                struct inet_timewait_sock *tw, int i)
1472 {
1473         struct in6_addr *dest, *src;
1474         __u16 destp, srcp;
1475         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1476         int ttd = tw->tw_ttd - jiffies;
1477
1478         if (ttd < 0)
1479                 ttd = 0;
1480
1481         dest = &tw6->tw_v6_daddr;
1482         src  = &tw6->tw_v6_rcv_saddr;
1483         destp = ntohs(tw->tw_dport);
1484         srcp  = ntohs(tw->tw_sport);
1485
1486         seq_printf(seq,
1487                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1488                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1489                    i,
1490                    src->s6_addr32[0], src->s6_addr32[1],
1491                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1492                    dest->s6_addr32[0], dest->s6_addr32[1],
1493                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1494                    tw->tw_substate, 0, 0,
1495                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
1496                    atomic_read(&tw->tw_refcnt), tw);
1497 }
1498
1499 #ifdef CONFIG_PROC_FS
1500 static int tcp6_seq_show(struct seq_file *seq, void *v)
1501 {
1502         struct tcp_iter_state *st;
1503
1504         if (v == SEQ_START_TOKEN) {
1505                 seq_puts(seq,
1506                          "  sl  "
1507                          "local_address                         "
1508                          "remote_address                        "
1509                          "st tx_queue rx_queue tr tm->when retrnsmt"
1510                          "   uid  timeout inode\n");
1511                 goto out;
1512         }
1513         st = seq->private;
1514
1515         switch (st->state) {
1516         case TCP_SEQ_STATE_LISTENING:
1517         case TCP_SEQ_STATE_ESTABLISHED:
1518                 get_tcp6_sock(seq, v, st->num);
1519                 break;
1520         case TCP_SEQ_STATE_OPENREQ:
1521                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1522                 break;
1523         case TCP_SEQ_STATE_TIME_WAIT:
1524                 get_timewait6_sock(seq, v, st->num);
1525                 break;
1526         }
1527 out:
1528         return 0;
1529 }
1530
1531 static struct file_operations tcp6_seq_fops;
1532 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1533         .owner          = THIS_MODULE,
1534         .name           = "tcp6",
1535         .family         = AF_INET6,
1536         .seq_show       = tcp6_seq_show,
1537         .seq_fops       = &tcp6_seq_fops,
1538 };
1539
1540 int __init tcp6_proc_init(void)
1541 {
1542         return tcp_proc_register(&tcp6_seq_afinfo);
1543 }
1544
1545 void tcp6_proc_exit(void)
1546 {
1547         tcp_proc_unregister(&tcp6_seq_afinfo);
1548 }
1549 #endif
1550
1551 struct proto tcpv6_prot = {
1552         .name                   = "TCPv6",
1553         .owner                  = THIS_MODULE,
1554         .close                  = tcp_close,
1555         .connect                = tcp_v6_connect,
1556         .disconnect             = tcp_disconnect,
1557         .accept                 = inet_csk_accept,
1558         .ioctl                  = tcp_ioctl,
1559         .init                   = tcp_v6_init_sock,
1560         .destroy                = tcp_v6_destroy_sock,
1561         .shutdown               = tcp_shutdown,
1562         .setsockopt             = tcp_setsockopt,
1563         .getsockopt             = tcp_getsockopt,
1564         .sendmsg                = tcp_sendmsg,
1565         .recvmsg                = tcp_recvmsg,
1566         .backlog_rcv            = tcp_v6_do_rcv,
1567         .hash                   = tcp_v6_hash,
1568         .unhash                 = tcp_unhash,
1569         .get_port               = tcp_v6_get_port,
1570         .enter_memory_pressure  = tcp_enter_memory_pressure,
1571         .sockets_allocated      = &tcp_sockets_allocated,
1572         .memory_allocated       = &tcp_memory_allocated,
1573         .memory_pressure        = &tcp_memory_pressure,
1574         .orphan_count           = &tcp_orphan_count,
1575         .sysctl_mem             = sysctl_tcp_mem,
1576         .sysctl_wmem            = sysctl_tcp_wmem,
1577         .sysctl_rmem            = sysctl_tcp_rmem,
1578         .max_header             = MAX_TCP_HEADER,
1579         .obj_size               = sizeof(struct tcp6_sock),
1580         .twsk_prot              = &tcp6_timewait_sock_ops,
1581         .rsk_prot               = &tcp6_request_sock_ops,
1582 };
1583
1584 static struct inet6_protocol tcpv6_protocol = {
1585         .handler        =       tcp_v6_rcv,
1586         .err_handler    =       tcp_v6_err,
1587         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1588 };
1589
1590 static struct inet_protosw tcpv6_protosw = {
1591         .type           =       SOCK_STREAM,
1592         .protocol       =       IPPROTO_TCP,
1593         .prot           =       &tcpv6_prot,
1594         .ops            =       &inet6_stream_ops,
1595         .capability     =       -1,
1596         .no_check       =       0,
1597         .flags          =       INET_PROTOSW_PERMANENT |
1598                                 INET_PROTOSW_ICSK,
1599 };
1600
1601 void __init tcpv6_init(void)
1602 {
1603         /* register inet6 protocol */
1604         if (inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP) < 0)
1605                 printk(KERN_ERR "tcpv6_init: Could not register protocol\n");
1606         inet6_register_protosw(&tcpv6_protosw);
1607 }