net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65 #include <net/tcp_memcontrol.h>
  66 #include <net/busy_poll.h>
  67
  68 #include <linux/proc_fs.h>
  69 #include <linux/seq_file.h>
  70
  71 #include <linux/crypto.h>
  72 #include <linux/scatterlist.h>
  73
  74 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80 static const struct inet_connection_sock_af_ops ipv6_mapped;
  81 static const struct inet_connection_sock_af_ops ipv6_specific;
  82 #ifdef CONFIG_TCP_MD5SIG
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  85 #else
  86 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  87                                                    const struct in6_addr *addr)
  88 {
  89         return NULL;
  90 }
  91 #endif
  92
  93 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  94 {
  95         struct dst_entry *dst = skb_dst(skb);
  96         const struct rt6_info *rt = (const struct rt6_info *)dst;
  97
  98         dst_hold(dst);
  99         sk->sk_rx_dst = dst;
 100         inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 101         if (rt->rt6i_node)
 102                 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 103 }
 104
 105 static void tcp_v6_hash(struct sock *sk)
 106 {
 107         if (sk->sk_state != TCP_CLOSE) {
 108                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 109                         tcp_prot.hash(sk);
 110                         return;
 111                 }
 112                 local_bh_disable();
 113                 __inet6_hash(sk, NULL);
 114                 local_bh_enable();
 115         }
 116 }
 117
 118 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 119 {
 120         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 121                                             ipv6_hdr(skb)->saddr.s6_addr32,
 122                                             tcp_hdr(skb)->dest,
 123                                             tcp_hdr(skb)->source);
 124 }
 125
 126 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 127                           int addr_len)
 128 {
 129         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 130         struct inet_sock *inet = inet_sk(sk);
 131         struct inet_connection_sock *icsk = inet_csk(sk);
 132         struct ipv6_pinfo *np = inet6_sk(sk);
 133         struct tcp_sock *tp = tcp_sk(sk);
 134         struct in6_addr *saddr = NULL, *final_p, final;
 135         struct rt6_info *rt;
 136         struct flowi6 fl6;
 137         struct dst_entry *dst;
 138         int addr_type;
 139         int err;
 140
 141         if (addr_len < SIN6_LEN_RFC2133)
 142                 return -EINVAL;
 143
 144         if (usin->sin6_family != AF_INET6)
 145                 return -EAFNOSUPPORT;
 146
 147         memset(&fl6, 0, sizeof(fl6));
 148
 149         if (np->sndflow) {
 150                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 151                 IP6_ECN_flow_init(fl6.flowlabel);
 152                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 153                         struct ip6_flowlabel *flowlabel;
 154                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 155                         if (flowlabel == NULL)
 156                                 return -EINVAL;
 157                         fl6_sock_release(flowlabel);
 158                 }
 159         }
 160
 161         /*
 162          *      connect() to INADDR_ANY means loopback (BSD'ism).
 163          */
 164
 165         if (ipv6_addr_any(&usin->sin6_addr))
 166                 usin->sin6_addr.s6_addr[15] = 0x1;
 167
 168         addr_type = ipv6_addr_type(&usin->sin6_addr);
 169
 170         if (addr_type & IPV6_ADDR_MULTICAST)
 171                 return -ENETUNREACH;
 172
 173         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 174                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 175                     usin->sin6_scope_id) {
 176                         /* If interface is set while binding, indices
 177                          * must coincide.
 178                          */
 179                         if (sk->sk_bound_dev_if &&
 180                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 181                                 return -EINVAL;
 182
 183                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 184                 }
 185
 186                 /* Connect to link-local address requires an interface */
 187                 if (!sk->sk_bound_dev_if)
 188                         return -EINVAL;
 189         }
 190
 191         if (tp->rx_opt.ts_recent_stamp &&
 192             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 193                 tp->rx_opt.ts_recent = 0;
 194                 tp->rx_opt.ts_recent_stamp = 0;
 195                 tp->write_seq = 0;
 196         }
 197
 198         sk->sk_v6_daddr = usin->sin6_addr;
 199         np->flow_label = fl6.flowlabel;
 200
 201         /*
 202          *      TCP over IPv4
 203          */
 204
 205         if (addr_type == IPV6_ADDR_MAPPED) {
 206                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 207                 struct sockaddr_in sin;
 208
 209                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 210
 211                 if (__ipv6_only_sock(sk))
 212                         return -ENETUNREACH;
 213
 214                 sin.sin_family = AF_INET;
 215                 sin.sin_port = usin->sin6_port;
 216                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 217
 218                 icsk->icsk_af_ops = &ipv6_mapped;
 219                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 220 #ifdef CONFIG_TCP_MD5SIG
 221                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 222 #endif
 223
 224                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 225
 226                 if (err) {
 227                         icsk->icsk_ext_hdr_len = exthdrlen;
 228                         icsk->icsk_af_ops = &ipv6_specific;
 229                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 230 #ifdef CONFIG_TCP_MD5SIG
 231                         tp->af_specific = &tcp_sock_ipv6_specific;
 232 #endif
 233                         goto failure;
 234                 } else {
 235                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 236                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 237                                                &sk->sk_v6_rcv_saddr);
 238                 }
 239
 240                 return err;
 241         }
 242
 243         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 244                 saddr = &sk->sk_v6_rcv_saddr;
 245
 246         fl6.flowi6_proto = IPPROTO_TCP;
 247         fl6.daddr = sk->sk_v6_daddr;
 248         fl6.saddr = saddr ? *saddr : np->saddr;
 249         fl6.flowi6_oif = sk->sk_bound_dev_if;
 250         fl6.flowi6_mark = sk->sk_mark;
 251         fl6.fl6_dport = usin->sin6_port;
 252         fl6.fl6_sport = inet->inet_sport;
 253
 254         final_p = fl6_update_dst(&fl6, np->opt, &final);
 255
 256         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 257
 258         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 259         if (IS_ERR(dst)) {
 260                 err = PTR_ERR(dst);
 261                 goto failure;
 262         }
 263
 264         if (saddr == NULL) {
 265                 saddr = &fl6.saddr;
 266                 sk->sk_v6_rcv_saddr = *saddr;
 267         }
 268
 269         /* set the source address */
 270         np->saddr = *saddr;
 271         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 272
 273         sk->sk_gso_type = SKB_GSO_TCPV6;
 274         __ip6_dst_store(sk, dst, NULL, NULL);
 275
 276         rt = (struct rt6_info *) dst;
 277         if (tcp_death_row.sysctl_tw_recycle &&
 278             !tp->rx_opt.ts_recent_stamp &&
 279             ipv6_addr_equal(&rt->rt6i_dst.addr, &sk->sk_v6_daddr))
 280                 tcp_fetch_timewait_stamp(sk, dst);
 281
 282         icsk->icsk_ext_hdr_len = 0;
 283         if (np->opt)
 284                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 285                                           np->opt->opt_nflen);
 286
 287         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 288
 289         inet->inet_dport = usin->sin6_port;
 290
 291         tcp_set_state(sk, TCP_SYN_SENT);
 292         err = inet6_hash_connect(&tcp_death_row, sk);
 293         if (err)
 294                 goto late_failure;
 295
 296         if (!tp->write_seq && likely(!tp->repair))
 297                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 298                                                              sk->sk_v6_daddr.s6_addr32,
 299                                                              inet->inet_sport,
 300                                                              inet->inet_dport);
 301
 302         err = tcp_connect(sk);
 303         if (err)
 304                 goto late_failure;
 305
 306         return 0;
 307
 308 late_failure:
 309         tcp_set_state(sk, TCP_CLOSE);
 310         __sk_dst_reset(sk);
 311 failure:
 312         inet->inet_dport = 0;
 313         sk->sk_route_caps = 0;
 314         return err;
 315 }
 316
 317 static void tcp_v6_mtu_reduced(struct sock *sk)
 318 {
 319         struct dst_entry *dst;
 320
 321         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 322                 return;
 323
 324         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 325         if (!dst)
 326                 return;
 327
 328         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 329                 tcp_sync_mss(sk, dst_mtu(dst));
 330                 tcp_simple_retransmit(sk);
 331         }
 332 }
 333
 334 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 335                 u8 type, u8 code, int offset, __be32 info)
 336 {
 337         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 338         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 339         struct ipv6_pinfo *np;
 340         struct sock *sk;
 341         int err;
 342         struct tcp_sock *tp;
 343         __u32 seq;
 344         struct net *net = dev_net(skb->dev);
 345
 346         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 347                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 348
 349         if (sk == NULL) {
 350                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 351                                    ICMP6_MIB_INERRORS);
 352                 return;
 353         }
 354
 355         if (sk->sk_state == TCP_TIME_WAIT) {
 356                 inet_twsk_put(inet_twsk(sk));
 357                 return;
 358         }
 359
 360         bh_lock_sock(sk);
 361         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 362                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 363
 364         if (sk->sk_state == TCP_CLOSE)
 365                 goto out;
 366
 367         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 368                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 369                 goto out;
 370         }
 371
 372         tp = tcp_sk(sk);
 373         seq = ntohl(th->seq);
 374         if (sk->sk_state != TCP_LISTEN &&
 375             !between(seq, tp->snd_una, tp->snd_nxt)) {
 376                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 377                 goto out;
 378         }
 379
 380         np = inet6_sk(sk);
 381
 382         if (type == NDISC_REDIRECT) {
 383                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 384
 385                 if (dst)
 386                         dst->ops->redirect(dst, sk, skb);
 387                 goto out;
 388         }
 389
 390         if (type == ICMPV6_PKT_TOOBIG) {
 391                 /* We are not interested in TCP_LISTEN and open_requests
 392                  * (SYN-ACKs send out by Linux are always <576bytes so
 393                  * they should go through unfragmented).
 394                  */
 395                 if (sk->sk_state == TCP_LISTEN)
 396                         goto out;
 397
 398                 if (!ip6_sk_accept_pmtu(sk))
 399                         goto out;
 400
 401                 tp->mtu_info = ntohl(info);
 402                 if (!sock_owned_by_user(sk))
 403                         tcp_v6_mtu_reduced(sk);
 404                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 405                                            &tp->tsq_flags))
 406                         sock_hold(sk);
 407                 goto out;
 408         }
 409
 410         icmpv6_err_convert(type, code, &err);
 411
 412         /* Might be for an request_sock */
 413         switch (sk->sk_state) {
 414                 struct request_sock *req, **prev;
 415         case TCP_LISTEN:
 416                 if (sock_owned_by_user(sk))
 417                         goto out;
 418
 419                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 420                                            &hdr->saddr, inet6_iif(skb));
 421                 if (!req)
 422                         goto out;
 423
 424                 /* ICMPs are not backlogged, hence we cannot get
 425                  * an established socket here.
 426                  */
 427                 WARN_ON(req->sk != NULL);
 428
 429                 if (seq != tcp_rsk(req)->snt_isn) {
 430                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 431                         goto out;
 432                 }
 433
 434                 inet_csk_reqsk_queue_drop(sk, req, prev);
 435                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 436                 goto out;
 437
 438         case TCP_SYN_SENT:
 439         case TCP_SYN_RECV:  /* Cannot happen.
 440                                It can, it SYNs are crossed. --ANK */
 441                 if (!sock_owned_by_user(sk)) {
 442                         sk->sk_err = err;
 443                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 444
 445                         tcp_done(sk);
 446                 } else
 447                         sk->sk_err_soft = err;
 448                 goto out;
 449         }
 450
 451         if (!sock_owned_by_user(sk) && np->recverr) {
 452                 sk->sk_err = err;
 453                 sk->sk_error_report(sk);
 454         } else
 455                 sk->sk_err_soft = err;
 456
 457 out:
 458         bh_unlock_sock(sk);
 459         sock_put(sk);
 460 }
 461
 462
 463 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 464                               struct flowi6 *fl6,
 465                               struct request_sock *req,
 466                               u16 queue_mapping)
 467 {
 468         struct inet_request_sock *ireq = inet_rsk(req);
 469         struct ipv6_pinfo *np = inet6_sk(sk);
 470         struct sk_buff *skb;
 471         int err = -ENOMEM;
 472
 473         /* First, grab a route. */
 474         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 475                 goto done;
 476
 477         skb = tcp_make_synack(sk, dst, req, NULL);
 478
 479         if (skb) {
 480                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 481                                     &ireq->ir_v6_rmt_addr);
 482
 483                 fl6->daddr = ireq->ir_v6_rmt_addr;
 484                 if (np->repflow && (ireq->pktopts != NULL))
 485                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 486
 487                 skb_set_queue_mapping(skb, queue_mapping);
 488                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 489                 err = net_xmit_eval(err);
 490         }
 491
 492 done:
 493         return err;
 494 }
 495
 496 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
 497 {
 498         struct flowi6 fl6;
 499         int res;
 500
 501         res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
 502         if (!res) {
 503                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 504                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
 505         }
 506         return res;
 507 }
 508
 509 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 510 {
 511         kfree_skb(inet_rsk(req)->pktopts);
 512 }
 513
 514 #ifdef CONFIG_TCP_MD5SIG
 515 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 516                                                    const struct in6_addr *addr)
 517 {
 518         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 519 }
 520
 521 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 522                                                 struct sock *addr_sk)
 523 {
 524         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 525 }
 526
 527 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 528                                                       struct request_sock *req)
 529 {
 530         return tcp_v6_md5_do_lookup(sk, &inet_rsk(req)->ir_v6_rmt_addr);
 531 }
 532
 533 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 534                                  int optlen)
 535 {
 536         struct tcp_md5sig cmd;
 537         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 538
 539         if (optlen < sizeof(cmd))
 540                 return -EINVAL;
 541
 542         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 543                 return -EFAULT;
 544
 545         if (sin6->sin6_family != AF_INET6)
 546                 return -EINVAL;
 547
 548         if (!cmd.tcpm_keylen) {
 549                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 550                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 551                                               AF_INET);
 552                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 553                                       AF_INET6);
 554         }
 555
 556         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 557                 return -EINVAL;
 558
 559         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 560                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 561                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 562
 563         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 564                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 565 }
 566
 567 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 568                                         const struct in6_addr *daddr,
 569                                         const struct in6_addr *saddr, int nbytes)
 570 {
 571         struct tcp6_pseudohdr *bp;
 572         struct scatterlist sg;
 573
 574         bp = &hp->md5_blk.ip6;
 575         /* 1. TCP pseudo-header (RFC2460) */
 576         bp->saddr = *saddr;
 577         bp->daddr = *daddr;
 578         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 579         bp->len = cpu_to_be32(nbytes);
 580
 581         sg_init_one(&sg, bp, sizeof(*bp));
 582         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 583 }
 584
 585 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 586                                const struct in6_addr *daddr, struct in6_addr *saddr,
 587                                const struct tcphdr *th)
 588 {
 589         struct tcp_md5sig_pool *hp;
 590         struct hash_desc *desc;
 591
 592         hp = tcp_get_md5sig_pool();
 593         if (!hp)
 594                 goto clear_hash_noput;
 595         desc = &hp->md5_desc;
 596
 597         if (crypto_hash_init(desc))
 598                 goto clear_hash;
 599         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 600                 goto clear_hash;
 601         if (tcp_md5_hash_header(hp, th))
 602                 goto clear_hash;
 603         if (tcp_md5_hash_key(hp, key))
 604                 goto clear_hash;
 605         if (crypto_hash_final(desc, md5_hash))
 606                 goto clear_hash;
 607
 608         tcp_put_md5sig_pool();
 609         return 0;
 610
 611 clear_hash:
 612         tcp_put_md5sig_pool();
 613 clear_hash_noput:
 614         memset(md5_hash, 0, 16);
 615         return 1;
 616 }
 617
 618 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 619                                const struct sock *sk,
 620                                const struct request_sock *req,
 621                                const struct sk_buff *skb)
 622 {
 623         const struct in6_addr *saddr, *daddr;
 624         struct tcp_md5sig_pool *hp;
 625         struct hash_desc *desc;
 626         const struct tcphdr *th = tcp_hdr(skb);
 627
 628         if (sk) {
 629                 saddr = &inet6_sk(sk)->saddr;
 630                 daddr = &sk->sk_v6_daddr;
 631         } else if (req) {
 632                 saddr = &inet_rsk(req)->ir_v6_loc_addr;
 633                 daddr = &inet_rsk(req)->ir_v6_rmt_addr;
 634         } else {
 635                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 636                 saddr = &ip6h->saddr;
 637                 daddr = &ip6h->daddr;
 638         }
 639
 640         hp = tcp_get_md5sig_pool();
 641         if (!hp)
 642                 goto clear_hash_noput;
 643         desc = &hp->md5_desc;
 644
 645         if (crypto_hash_init(desc))
 646                 goto clear_hash;
 647
 648         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 649                 goto clear_hash;
 650         if (tcp_md5_hash_header(hp, th))
 651                 goto clear_hash;
 652         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 653                 goto clear_hash;
 654         if (tcp_md5_hash_key(hp, key))
 655                 goto clear_hash;
 656         if (crypto_hash_final(desc, md5_hash))
 657                 goto clear_hash;
 658
 659         tcp_put_md5sig_pool();
 660         return 0;
 661
 662 clear_hash:
 663         tcp_put_md5sig_pool();
 664 clear_hash_noput:
 665         memset(md5_hash, 0, 16);
 666         return 1;
 667 }
 668
 669 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 670 {
 671         const __u8 *hash_location = NULL;
 672         struct tcp_md5sig_key *hash_expected;
 673         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 674         const struct tcphdr *th = tcp_hdr(skb);
 675         int genhash;
 676         u8 newhash[16];
 677
 678         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 679         hash_location = tcp_parse_md5sig_option(th);
 680
 681         /* We've parsed the options - do we have a hash? */
 682         if (!hash_expected && !hash_location)
 683                 return 0;
 684
 685         if (hash_expected && !hash_location) {
 686                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 687                 return 1;
 688         }
 689
 690         if (!hash_expected && hash_location) {
 691                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 692                 return 1;
 693         }
 694
 695         /* check the signature */
 696         genhash = tcp_v6_md5_hash_skb(newhash,
 697                                       hash_expected,
 698                                       NULL, NULL, skb);
 699
 700         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 701                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 702                                      genhash ? "failed" : "mismatch",
 703                                      &ip6h->saddr, ntohs(th->source),
 704                                      &ip6h->daddr, ntohs(th->dest));
 705                 return 1;
 706         }
 707         return 0;
 708 }
 709 #endif
 710
 711 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 712         .family         =       AF_INET6,
 713         .obj_size       =       sizeof(struct tcp6_request_sock),
 714         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 715         .send_ack       =       tcp_v6_reqsk_send_ack,
 716         .destructor     =       tcp_v6_reqsk_destructor,
 717         .send_reset     =       tcp_v6_send_reset,
 718         .syn_ack_timeout =      tcp_syn_ack_timeout,
 719 };
 720
 721 #ifdef CONFIG_TCP_MD5SIG
 722 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 723         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 724         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 725 };
 726 #endif
 727
 728 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 729                                  u32 tsval, u32 tsecr,
 730                                  struct tcp_md5sig_key *key, int rst, u8 tclass,
 731                                  u32 label)
 732 {
 733         const struct tcphdr *th = tcp_hdr(skb);
 734         struct tcphdr *t1;
 735         struct sk_buff *buff;
 736         struct flowi6 fl6;
 737         struct net *net = dev_net(skb_dst(skb)->dev);
 738         struct sock *ctl_sk = net->ipv6.tcp_sk;
 739         unsigned int tot_len = sizeof(struct tcphdr);
 740         struct dst_entry *dst;
 741         __be32 *topt;
 742
 743         if (tsecr)
 744                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 745 #ifdef CONFIG_TCP_MD5SIG
 746         if (key)
 747                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 748 #endif
 749
 750         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 751                          GFP_ATOMIC);
 752         if (buff == NULL)
 753                 return;
 754
 755         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 756
 757         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 758         skb_reset_transport_header(buff);
 759
 760         /* Swap the send and the receive. */
 761         memset(t1, 0, sizeof(*t1));
 762         t1->dest = th->source;
 763         t1->source = th->dest;
 764         t1->doff = tot_len / 4;
 765         t1->seq = htonl(seq);
 766         t1->ack_seq = htonl(ack);
 767         t1->ack = !rst || !th->ack;
 768         t1->rst = rst;
 769         t1->window = htons(win);
 770
 771         topt = (__be32 *)(t1 + 1);
 772
 773         if (tsecr) {
 774                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 775                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 776                 *topt++ = htonl(tsval);
 777                 *topt++ = htonl(tsecr);
 778         }
 779
 780 #ifdef CONFIG_TCP_MD5SIG
 781         if (key) {
 782                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 783                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 784                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 785                                     &ipv6_hdr(skb)->saddr,
 786                                     &ipv6_hdr(skb)->daddr, t1);
 787         }
 788 #endif
 789
 790         memset(&fl6, 0, sizeof(fl6));
 791         fl6.daddr = ipv6_hdr(skb)->saddr;
 792         fl6.saddr = ipv6_hdr(skb)->daddr;
 793         fl6.flowlabel = label;
 794
 795         buff->ip_summed = CHECKSUM_PARTIAL;
 796         buff->csum = 0;
 797
 798         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 799
 800         fl6.flowi6_proto = IPPROTO_TCP;
 801         if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
 802                 fl6.flowi6_oif = inet6_iif(skb);
 803         fl6.fl6_dport = t1->dest;
 804         fl6.fl6_sport = t1->source;
 805         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 806
 807         /* Pass a socket to ip6_dst_lookup either it is for RST
 808          * Underlying function will use this to retrieve the network
 809          * namespace
 810          */
 811         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 812         if (!IS_ERR(dst)) {
 813                 skb_dst_set(buff, dst);
 814                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 815                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 816                 if (rst)
 817                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 818                 return;
 819         }
 820
 821         kfree_skb(buff);
 822 }
 823
 824 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 825 {
 826         const struct tcphdr *th = tcp_hdr(skb);
 827         u32 seq = 0, ack_seq = 0;
 828         struct tcp_md5sig_key *key = NULL;
 829 #ifdef CONFIG_TCP_MD5SIG
 830         const __u8 *hash_location = NULL;
 831         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 832         unsigned char newhash[16];
 833         int genhash;
 834         struct sock *sk1 = NULL;
 835 #endif
 836
 837         if (th->rst)
 838                 return;
 839
 840         if (!ipv6_unicast_destination(skb))
 841                 return;
 842
 843 #ifdef CONFIG_TCP_MD5SIG
 844         hash_location = tcp_parse_md5sig_option(th);
 845         if (!sk && hash_location) {
 846                 /*
 847                  * active side is lost. Try to find listening socket through
 848                  * source port, and then find md5 key through listening socket.
 849                  * we are not loose security here:
 850                  * Incoming packet is checked with md5 hash with finding key,
 851                  * no RST generated if md5 hash doesn't match.
 852                  */
 853                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 854                                            &tcp_hashinfo, &ipv6h->saddr,
 855                                            th->source, &ipv6h->daddr,
 856                                            ntohs(th->source), inet6_iif(skb));
 857                 if (!sk1)
 858                         return;
 859
 860                 rcu_read_lock();
 861                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 862                 if (!key)
 863                         goto release_sk1;
 864
 865                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 866                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 867                         goto release_sk1;
 868         } else {
 869                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 870         }
 871 #endif
 872
 873         if (th->ack)
 874                 seq = ntohl(th->ack_seq);
 875         else
 876                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 877                           (th->doff << 2);
 878
 879         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0, 0);
 880
 881 #ifdef CONFIG_TCP_MD5SIG
 882 release_sk1:
 883         if (sk1) {
 884                 rcu_read_unlock();
 885                 sock_put(sk1);
 886         }
 887 #endif
 888 }
 889
 890 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 891                             u32 win, u32 tsval, u32 tsecr,
 892                             struct tcp_md5sig_key *key, u8 tclass,
 893                             u32 label)
 894 {
 895         tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass,
 896                              label);
 897 }
 898
 899 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 900 {
 901         struct inet_timewait_sock *tw = inet_twsk(sk);
 902         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 903
 904         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 905                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 906                         tcp_time_stamp + tcptw->tw_ts_offset,
 907                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
 908                         tw->tw_tclass, (tw->tw_flowlabel << 12));
 909
 910         inet_twsk_put(tw);
 911 }
 912
 913 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 914                                   struct request_sock *req)
 915 {
 916         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
 917                         req->rcv_wnd, tcp_time_stamp, req->ts_recent,
 918                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 919                         0, 0);
 920 }
 921
 922
 923 static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
 924 {
 925         struct request_sock *req, **prev;
 926         const struct tcphdr *th = tcp_hdr(skb);
 927         struct sock *nsk;
 928
 929         /* Find possible connection requests. */
 930         req = inet6_csk_search_req(sk, &prev, th->source,
 931                                    &ipv6_hdr(skb)->saddr,
 932                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 933         if (req)
 934                 return tcp_check_req(sk, skb, req, prev, false);
 935
 936         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 937                         &ipv6_hdr(skb)->saddr, th->source,
 938                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 939
 940         if (nsk) {
 941                 if (nsk->sk_state != TCP_TIME_WAIT) {
 942                         bh_lock_sock(nsk);
 943                         return nsk;
 944                 }
 945                 inet_twsk_put(inet_twsk(nsk));
 946                 return NULL;
 947         }
 948
 949 #ifdef CONFIG_SYN_COOKIES
 950         if (!th->syn)
 951                 sk = cookie_v6_check(sk, skb);
 952 #endif
 953         return sk;
 954 }
 955
 956 /* FIXME: this is substantially similar to the ipv4 code.
 957  * Can some kind of merge be done? -- erics
 958  */
 959 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 960 {
 961         struct tcp_options_received tmp_opt;
 962         struct request_sock *req;
 963         struct inet_request_sock *ireq;
 964         struct ipv6_pinfo *np = inet6_sk(sk);
 965         struct tcp_sock *tp = tcp_sk(sk);
 966         __u32 isn = TCP_SKB_CB(skb)->when;
 967         struct dst_entry *dst = NULL;
 968         struct flowi6 fl6;
 969         bool want_cookie = false;
 970
 971         if (skb->protocol == htons(ETH_P_IP))
 972                 return tcp_v4_conn_request(sk, skb);
 973
 974         if (!ipv6_unicast_destination(skb))
 975                 goto drop;
 976
 977         if ((sysctl_tcp_syncookies == 2 ||
 978              inet_csk_reqsk_queue_is_full(sk)) && !isn) {
 979                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
 980                 if (!want_cookie)
 981                         goto drop;
 982         }
 983
 984         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
 985                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 986                 goto drop;
 987         }
 988
 989         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 990         if (req == NULL)
 991                 goto drop;
 992
 993 #ifdef CONFIG_TCP_MD5SIG
 994         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
 995 #endif
 996
 997         tcp_clear_options(&tmp_opt);
 998         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 999         tmp_opt.user_mss = tp->rx_opt.user_mss;
1000         tcp_parse_options(skb, &tmp_opt, 0, NULL);
1001
1002         if (want_cookie && !tmp_opt.saw_tstamp)
1003                 tcp_clear_options(&tmp_opt);
1004
1005         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1006         tcp_openreq_init(req, &tmp_opt, skb);
1007
1008         ireq = inet_rsk(req);
1009         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
1010         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
1011         if (!want_cookie || tmp_opt.tstamp_ok)
1012                 TCP_ECN_create_request(req, skb, sock_net(sk));
1013
1014         ireq->ir_iif = sk->sk_bound_dev_if;
1015
1016         /* So that link locals have meaning */
1017         if (!sk->sk_bound_dev_if &&
1018             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
1019                 ireq->ir_iif = inet6_iif(skb);
1020
1021         if (!isn) {
1022                 if (ipv6_opt_accepted(sk, skb) ||
1023                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1024                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim ||
1025                     np->repflow) {
1026                         atomic_inc(&skb->users);
1027                         ireq->pktopts = skb;
1028                 }
1029
1030                 if (want_cookie) {
1031                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1032                         req->cookie_ts = tmp_opt.tstamp_ok;
1033                         goto have_isn;
1034                 }
1035
1036                 /* VJ's idea. We save last timestamp seen
1037                  * from the destination in peer table, when entering
1038                  * state TIME-WAIT, and check against it before
1039                  * accepting new connection request.
1040                  *
1041                  * If "isn" is not zero, this request hit alive
1042                  * timewait bucket, so that all the necessary checks
1043                  * are made in the function processing timewait state.
1044                  */
1045                 if (tmp_opt.saw_tstamp &&
1046                     tcp_death_row.sysctl_tw_recycle &&
1047                     (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1048                         if (!tcp_peer_is_proven(req, dst, true)) {
1049                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1050                                 goto drop_and_release;
1051                         }
1052                 }
1053                 /* Kill the following clause, if you dislike this way. */
1054                 else if (!sysctl_tcp_syncookies &&
1055                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1056                           (sysctl_max_syn_backlog >> 2)) &&
1057                          !tcp_peer_is_proven(req, dst, false)) {
1058                         /* Without syncookies last quarter of
1059                          * backlog is filled with destinations,
1060                          * proven to be alive.
1061                          * It means that we continue to communicate
1062                          * to destinations, already remembered
1063                          * to the moment of synflood.
1064                          */
1065                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1066                                        &ireq->ir_v6_rmt_addr, ntohs(tcp_hdr(skb)->source));
1067                         goto drop_and_release;
1068                 }
1069
1070                 isn = tcp_v6_init_sequence(skb);
1071         }
1072 have_isn:
1073         tcp_rsk(req)->snt_isn = isn;
1074
1075         if (security_inet_conn_request(sk, skb, req))
1076                 goto drop_and_release;
1077
1078         if (tcp_v6_send_synack(sk, dst, &fl6, req,
1079                                skb_get_queue_mapping(skb)) ||
1080             want_cookie)
1081                 goto drop_and_free;
1082
1083         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1084         tcp_rsk(req)->listener = NULL;
1085         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1086         return 0;
1087
1088 drop_and_release:
1089         dst_release(dst);
1090 drop_and_free:
1091         reqsk_free(req);
1092 drop:
1093         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1094         return 0; /* don't send reset */
1095 }
1096
1097 static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1098                                          struct request_sock *req,
1099                                          struct dst_entry *dst)
1100 {
1101         struct inet_request_sock *ireq;
1102         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1103         struct tcp6_sock *newtcp6sk;
1104         struct inet_sock *newinet;
1105         struct tcp_sock *newtp;
1106         struct sock *newsk;
1107 #ifdef CONFIG_TCP_MD5SIG
1108         struct tcp_md5sig_key *key;
1109 #endif
1110         struct flowi6 fl6;
1111
1112         if (skb->protocol == htons(ETH_P_IP)) {
1113                 /*
1114                  *      v6 mapped
1115                  */
1116
1117                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1118
1119                 if (newsk == NULL)
1120                         return NULL;
1121
1122                 newtcp6sk = (struct tcp6_sock *)newsk;
1123                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1124
1125                 newinet = inet_sk(newsk);
1126                 newnp = inet6_sk(newsk);
1127                 newtp = tcp_sk(newsk);
1128
1129                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1130
1131                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newsk->sk_v6_daddr);
1132
1133                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1134
1135                 newsk->sk_v6_rcv_saddr = newnp->saddr;
1136
1137                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1138                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1139 #ifdef CONFIG_TCP_MD5SIG
1140                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1141 #endif
1142
1143                 newnp->ipv6_ac_list = NULL;
1144                 newnp->ipv6_fl_list = NULL;
1145                 newnp->pktoptions  = NULL;
1146                 newnp->opt         = NULL;
1147                 newnp->mcast_oif   = inet6_iif(skb);
1148                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1149                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1150                 if (np->repflow)
1151                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1152
1153                 /*
1154                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1155                  * here, tcp_create_openreq_child now does this for us, see the comment in
1156                  * that function for the gory details. -acme
1157                  */
1158
1159                 /* It is tricky place. Until this moment IPv4 tcp
1160                    worked with IPv6 icsk.icsk_af_ops.
1161                    Sync it now.
1162                  */
1163                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1164
1165                 return newsk;
1166         }
1167
1168         ireq = inet_rsk(req);
1169
1170         if (sk_acceptq_is_full(sk))
1171                 goto out_overflow;
1172
1173         if (!dst) {
1174                 dst = inet6_csk_route_req(sk, &fl6, req);
1175                 if (!dst)
1176                         goto out;
1177         }
1178
1179         newsk = tcp_create_openreq_child(sk, req, skb);
1180         if (newsk == NULL)
1181                 goto out_nonewsk;
1182
1183         /*
1184          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1185          * count here, tcp_create_openreq_child now does this for us, see the
1186          * comment in that function for the gory details. -acme
1187          */
1188
1189         newsk->sk_gso_type = SKB_GSO_TCPV6;
1190         __ip6_dst_store(newsk, dst, NULL, NULL);
1191         inet6_sk_rx_dst_set(newsk, skb);
1192
1193         newtcp6sk = (struct tcp6_sock *)newsk;
1194         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1195
1196         newtp = tcp_sk(newsk);
1197         newinet = inet_sk(newsk);
1198         newnp = inet6_sk(newsk);
1199
1200         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1201
1202         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1203         newnp->saddr = ireq->ir_v6_loc_addr;
1204         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1205         newsk->sk_bound_dev_if = ireq->ir_iif;
1206
1207         /* Now IPv6 options...
1208
1209            First: no IPv4 options.
1210          */
1211         newinet->inet_opt = NULL;
1212         newnp->ipv6_ac_list = NULL;
1213         newnp->ipv6_fl_list = NULL;
1214
1215         /* Clone RX bits */
1216         newnp->rxopt.all = np->rxopt.all;
1217
1218         /* Clone pktoptions received with SYN */
1219         newnp->pktoptions = NULL;
1220         if (ireq->pktopts != NULL) {
1221                 newnp->pktoptions = skb_clone(ireq->pktopts,
1222                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1223                 consume_skb(ireq->pktopts);
1224                 ireq->pktopts = NULL;
1225                 if (newnp->pktoptions)
1226                         skb_set_owner_r(newnp->pktoptions, newsk);
1227         }
1228         newnp->opt        = NULL;
1229         newnp->mcast_oif  = inet6_iif(skb);
1230         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1231         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1232         if (np->repflow)
1233                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1234
1235         /* Clone native IPv6 options from listening socket (if any)
1236
1237            Yes, keeping reference count would be much more clever,
1238            but we make one more one thing there: reattach optmem
1239            to newsk.
1240          */
1241         if (np->opt)
1242                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1243
1244         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1245         if (newnp->opt)
1246                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1247                                                      newnp->opt->opt_flen);
1248
1249         tcp_sync_mss(newsk, dst_mtu(dst));
1250         newtp->advmss = dst_metric_advmss(dst);
1251         if (tcp_sk(sk)->rx_opt.user_mss &&
1252             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1253                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1254
1255         tcp_initialize_rcv_mss(newsk);
1256
1257         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1258         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1259
1260 #ifdef CONFIG_TCP_MD5SIG
1261         /* Copy over the MD5 key from the original socket */
1262         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1263         if (key != NULL) {
1264                 /* We're using one, so create a matching key
1265                  * on the newsk structure. If we fail to get
1266                  * memory, then we end up not copying the key
1267                  * across. Shucks.
1268                  */
1269                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1270                                AF_INET6, key->key, key->keylen,
1271                                sk_gfp_atomic(sk, GFP_ATOMIC));
1272         }
1273 #endif
1274
1275         if (__inet_inherit_port(sk, newsk) < 0) {
1276                 inet_csk_prepare_forced_close(newsk);
1277                 tcp_done(newsk);
1278                 goto out;
1279         }
1280         __inet6_hash(newsk, NULL);
1281
1282         return newsk;
1283
1284 out_overflow:
1285         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1286 out_nonewsk:
1287         dst_release(dst);
1288 out:
1289         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1290         return NULL;
1291 }
1292
1293 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1294 {
1295         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1296                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1297                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1298                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1299                         return 0;
1300                 }
1301         }
1302
1303         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1304                                               &ipv6_hdr(skb)->saddr,
1305                                               &ipv6_hdr(skb)->daddr, 0));
1306
1307         if (skb->len <= 76)
1308                 return __skb_checksum_complete(skb);
1309         return 0;
1310 }
1311
1312 /* The socket must have it's spinlock held when we get
1313  * here.
1314  *
1315  * We have a potential double-lock case here, so even when
1316  * doing backlog processing we use the BH locking scheme.
1317  * This is because we cannot sleep with the original spinlock
1318  * held.
1319  */
1320 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1321 {
1322         struct ipv6_pinfo *np = inet6_sk(sk);
1323         struct tcp_sock *tp;
1324         struct sk_buff *opt_skb = NULL;
1325
1326         /* Imagine: socket is IPv6. IPv4 packet arrives,
1327            goes to IPv4 receive handler and backlogged.
1328            From backlog it always goes here. Kerboom...
1329            Fortunately, tcp_rcv_established and rcv_established
1330            handle them correctly, but it is not case with
1331            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1332          */
1333
1334         if (skb->protocol == htons(ETH_P_IP))
1335                 return tcp_v4_do_rcv(sk, skb);
1336
1337 #ifdef CONFIG_TCP_MD5SIG
1338         if (tcp_v6_inbound_md5_hash(sk, skb))
1339                 goto discard;
1340 #endif
1341
1342         if (sk_filter(sk, skb))
1343                 goto discard;
1344
1345         /*
1346          *      socket locking is here for SMP purposes as backlog rcv
1347          *      is currently called with bh processing disabled.
1348          */
1349
1350         /* Do Stevens' IPV6_PKTOPTIONS.
1351
1352            Yes, guys, it is the only place in our code, where we
1353            may make it not affecting IPv4.
1354            The rest of code is protocol independent,
1355            and I do not like idea to uglify IPv4.
1356
1357            Actually, all the idea behind IPV6_PKTOPTIONS
1358            looks not very well thought. For now we latch
1359            options, received in the last packet, enqueued
1360            by tcp. Feel free to propose better solution.
1361                                                --ANK (980728)
1362          */
1363         if (np->rxopt.all)
1364                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1365
1366         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1367                 struct dst_entry *dst = sk->sk_rx_dst;
1368
1369                 sock_rps_save_rxhash(sk, skb);
1370                 if (dst) {
1371                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1372                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1373                                 dst_release(dst);
1374                                 sk->sk_rx_dst = NULL;
1375                         }
1376                 }
1377
1378                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1379                 if (opt_skb)
1380                         goto ipv6_pktoptions;
1381                 return 0;
1382         }
1383
1384         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1385                 goto csum_err;
1386
1387         if (sk->sk_state == TCP_LISTEN) {
1388                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1389                 if (!nsk)
1390                         goto discard;
1391
1392                 /*
1393                  * Queue it on the new socket if the new socket is active,
1394                  * otherwise we just shortcircuit this and continue with
1395                  * the new socket..
1396                  */
1397                 if (nsk != sk) {
1398                         sock_rps_save_rxhash(nsk, skb);
1399                         if (tcp_child_process(sk, nsk, skb))
1400                                 goto reset;
1401                         if (opt_skb)
1402                                 __kfree_skb(opt_skb);
1403                         return 0;
1404                 }
1405         } else
1406                 sock_rps_save_rxhash(sk, skb);
1407
1408         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1409                 goto reset;
1410         if (opt_skb)
1411                 goto ipv6_pktoptions;
1412         return 0;
1413
1414 reset:
1415         tcp_v6_send_reset(sk, skb);
1416 discard:
1417         if (opt_skb)
1418                 __kfree_skb(opt_skb);
1419         kfree_skb(skb);
1420         return 0;
1421 csum_err:
1422         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1423         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1424         goto discard;
1425
1426
1427 ipv6_pktoptions:
1428         /* Do you ask, what is it?
1429
1430            1. skb was enqueued by tcp.
1431            2. skb is added to tail of read queue, rather than out of order.
1432            3. socket is not in passive state.
1433            4. Finally, it really contains options, which user wants to receive.
1434          */
1435         tp = tcp_sk(sk);
1436         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1437             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1438                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1439                         np->mcast_oif = inet6_iif(opt_skb);
1440                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1441                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1442                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1443                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1444                 if (np->repflow)
1445                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1446                 if (ipv6_opt_accepted(sk, opt_skb)) {
1447                         skb_set_owner_r(opt_skb, sk);
1448                         opt_skb = xchg(&np->pktoptions, opt_skb);
1449                 } else {
1450                         __kfree_skb(opt_skb);
1451                         opt_skb = xchg(&np->pktoptions, NULL);
1452                 }
1453         }
1454
1455         kfree_skb(opt_skb);
1456         return 0;
1457 }
1458
1459 static int tcp_v6_rcv(struct sk_buff *skb)
1460 {
1461         const struct tcphdr *th;
1462         const struct ipv6hdr *hdr;
1463         struct sock *sk;
1464         int ret;
1465         struct net *net = dev_net(skb->dev);
1466
1467         if (skb->pkt_type != PACKET_HOST)
1468                 goto discard_it;
1469
1470         /*
1471          *      Count it even if it's bad.
1472          */
1473         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1474
1475         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1476                 goto discard_it;
1477
1478         th = tcp_hdr(skb);
1479
1480         if (th->doff < sizeof(struct tcphdr)/4)
1481                 goto bad_packet;
1482         if (!pskb_may_pull(skb, th->doff*4))
1483                 goto discard_it;
1484
1485         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1486                 goto csum_error;
1487
1488         th = tcp_hdr(skb);
1489         hdr = ipv6_hdr(skb);
1490         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1491         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1492                                     skb->len - th->doff*4);
1493         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1494         TCP_SKB_CB(skb)->when = 0;
1495         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1496         TCP_SKB_CB(skb)->sacked = 0;
1497
1498         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1499         if (!sk)
1500                 goto no_tcp_socket;
1501
1502 process:
1503         if (sk->sk_state == TCP_TIME_WAIT)
1504                 goto do_time_wait;
1505
1506         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1507                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1508                 goto discard_and_relse;
1509         }
1510
1511         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1512                 goto discard_and_relse;
1513
1514         if (sk_filter(sk, skb))
1515                 goto discard_and_relse;
1516
1517         sk_mark_napi_id(sk, skb);
1518         skb->dev = NULL;
1519
1520         bh_lock_sock_nested(sk);
1521         ret = 0;
1522         if (!sock_owned_by_user(sk)) {
1523 #ifdef CONFIG_NET_DMA
1524                 struct tcp_sock *tp = tcp_sk(sk);
1525                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1526                         tp->ucopy.dma_chan = net_dma_find_channel();
1527                 if (tp->ucopy.dma_chan)
1528                         ret = tcp_v6_do_rcv(sk, skb);
1529                 else
1530 #endif
1531                 {
1532                         if (!tcp_prequeue(sk, skb))
1533                                 ret = tcp_v6_do_rcv(sk, skb);
1534                 }
1535         } else if (unlikely(sk_add_backlog(sk, skb,
1536                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1537                 bh_unlock_sock(sk);
1538                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1539                 goto discard_and_relse;
1540         }
1541         bh_unlock_sock(sk);
1542
1543         sock_put(sk);
1544         return ret ? -1 : 0;
1545
1546 no_tcp_socket:
1547         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1548                 goto discard_it;
1549
1550         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1551 csum_error:
1552                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1553 bad_packet:
1554                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1555         } else {
1556                 tcp_v6_send_reset(NULL, skb);
1557         }
1558
1559 discard_it:
1560         kfree_skb(skb);
1561         return 0;
1562
1563 discard_and_relse:
1564         sock_put(sk);
1565         goto discard_it;
1566
1567 do_time_wait:
1568         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1569                 inet_twsk_put(inet_twsk(sk));
1570                 goto discard_it;
1571         }
1572
1573         if (skb->len < (th->doff<<2)) {
1574                 inet_twsk_put(inet_twsk(sk));
1575                 goto bad_packet;
1576         }
1577         if (tcp_checksum_complete(skb)) {
1578                 inet_twsk_put(inet_twsk(sk));
1579                 goto csum_error;
1580         }
1581
1582         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1583         case TCP_TW_SYN:
1584         {
1585                 struct sock *sk2;
1586
1587                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1588                                             &ipv6_hdr(skb)->saddr, th->source,
1589                                             &ipv6_hdr(skb)->daddr,
1590                                             ntohs(th->dest), inet6_iif(skb));
1591                 if (sk2 != NULL) {
1592                         struct inet_timewait_sock *tw = inet_twsk(sk);
1593                         inet_twsk_deschedule(tw, &tcp_death_row);
1594                         inet_twsk_put(tw);
1595                         sk = sk2;
1596                         goto process;
1597                 }
1598                 /* Fall through to ACK */
1599         }
1600         case TCP_TW_ACK:
1601                 tcp_v6_timewait_ack(sk, skb);
1602                 break;
1603         case TCP_TW_RST:
1604                 goto no_tcp_socket;
1605         case TCP_TW_SUCCESS:
1606                 ;
1607         }
1608         goto discard_it;
1609 }
1610
1611 static void tcp_v6_early_demux(struct sk_buff *skb)
1612 {
1613         const struct ipv6hdr *hdr;
1614         const struct tcphdr *th;
1615         struct sock *sk;
1616
1617         if (skb->pkt_type != PACKET_HOST)
1618                 return;
1619
1620         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1621                 return;
1622
1623         hdr = ipv6_hdr(skb);
1624         th = tcp_hdr(skb);
1625
1626         if (th->doff < sizeof(struct tcphdr) / 4)
1627                 return;
1628
1629         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1630                                         &hdr->saddr, th->source,
1631                                         &hdr->daddr, ntohs(th->dest),
1632                                         inet6_iif(skb));
1633         if (sk) {
1634                 skb->sk = sk;
1635                 skb->destructor = sock_edemux;
1636                 if (sk->sk_state != TCP_TIME_WAIT) {
1637                         struct dst_entry *dst = sk->sk_rx_dst;
1638
1639                         if (dst)
1640                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1641                         if (dst &&
1642                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1643                                 skb_dst_set_noref(skb, dst);
1644                 }
1645         }
1646 }
1647
1648 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1649         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1650         .twsk_unique    = tcp_twsk_unique,
1651         .twsk_destructor = tcp_twsk_destructor,
1652 };
1653
1654 static const struct inet_connection_sock_af_ops ipv6_specific = {
1655         .queue_xmit        = inet6_csk_xmit,
1656         .send_check        = tcp_v6_send_check,
1657         .rebuild_header    = inet6_sk_rebuild_header,
1658         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1659         .conn_request      = tcp_v6_conn_request,
1660         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1661         .net_header_len    = sizeof(struct ipv6hdr),
1662         .net_frag_header_len = sizeof(struct frag_hdr),
1663         .setsockopt        = ipv6_setsockopt,
1664         .getsockopt        = ipv6_getsockopt,
1665         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1666         .sockaddr_len      = sizeof(struct sockaddr_in6),
1667         .bind_conflict     = inet6_csk_bind_conflict,
1668 #ifdef CONFIG_COMPAT
1669         .compat_setsockopt = compat_ipv6_setsockopt,
1670         .compat_getsockopt = compat_ipv6_getsockopt,
1671 #endif
1672 };
1673
1674 #ifdef CONFIG_TCP_MD5SIG
1675 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1676         .md5_lookup     =       tcp_v6_md5_lookup,
1677         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1678         .md5_parse      =       tcp_v6_parse_md5_keys,
1679 };
1680 #endif
1681
1682 /*
1683  *      TCP over IPv4 via INET6 API
1684  */
1685 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1686         .queue_xmit        = ip_queue_xmit,
1687         .send_check        = tcp_v4_send_check,
1688         .rebuild_header    = inet_sk_rebuild_header,
1689         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1690         .conn_request      = tcp_v6_conn_request,
1691         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1692         .net_header_len    = sizeof(struct iphdr),
1693         .setsockopt        = ipv6_setsockopt,
1694         .getsockopt        = ipv6_getsockopt,
1695         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1696         .sockaddr_len      = sizeof(struct sockaddr_in6),
1697         .bind_conflict     = inet6_csk_bind_conflict,
1698 #ifdef CONFIG_COMPAT
1699         .compat_setsockopt = compat_ipv6_setsockopt,
1700         .compat_getsockopt = compat_ipv6_getsockopt,
1701 #endif
1702 };
1703
1704 #ifdef CONFIG_TCP_MD5SIG
1705 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1706         .md5_lookup     =       tcp_v4_md5_lookup,
1707         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1708         .md5_parse      =       tcp_v6_parse_md5_keys,
1709 };
1710 #endif
1711
1712 /* NOTE: A lot of things set to zero explicitly by call to
1713  *       sk_alloc() so need not be done here.
1714  */
1715 static int tcp_v6_init_sock(struct sock *sk)
1716 {
1717         struct inet_connection_sock *icsk = inet_csk(sk);
1718
1719         tcp_init_sock(sk);
1720
1721         icsk->icsk_af_ops = &ipv6_specific;
1722
1723 #ifdef CONFIG_TCP_MD5SIG
1724         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1725 #endif
1726
1727         return 0;
1728 }
1729
1730 static void tcp_v6_destroy_sock(struct sock *sk)
1731 {
1732         tcp_v4_destroy_sock(sk);
1733         inet6_destroy_sock(sk);
1734 }
1735
1736 #ifdef CONFIG_PROC_FS
1737 /* Proc filesystem TCPv6 sock list dumping. */
1738 static void get_openreq6(struct seq_file *seq,
1739                          const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1740 {
1741         int ttd = req->expires - jiffies;
1742         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1743         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1744
1745         if (ttd < 0)
1746                 ttd = 0;
1747
1748         seq_printf(seq,
1749                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1750                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1751                    i,
1752                    src->s6_addr32[0], src->s6_addr32[1],
1753                    src->s6_addr32[2], src->s6_addr32[3],
1754                    inet_rsk(req)->ir_num,
1755                    dest->s6_addr32[0], dest->s6_addr32[1],
1756                    dest->s6_addr32[2], dest->s6_addr32[3],
1757                    ntohs(inet_rsk(req)->ir_rmt_port),
1758                    TCP_SYN_RECV,
1759                    0, 0, /* could print option size, but that is af dependent. */
1760                    1,   /* timers active (only the expire timer) */
1761                    jiffies_to_clock_t(ttd),
1762                    req->num_timeout,
1763                    from_kuid_munged(seq_user_ns(seq), uid),
1764                    0,  /* non standard timer */
1765                    0, /* open_requests have no inode */
1766                    0, req);
1767 }
1768
1769 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1770 {
1771         const struct in6_addr *dest, *src;
1772         __u16 destp, srcp;
1773         int timer_active;
1774         unsigned long timer_expires;
1775         const struct inet_sock *inet = inet_sk(sp);
1776         const struct tcp_sock *tp = tcp_sk(sp);
1777         const struct inet_connection_sock *icsk = inet_csk(sp);
1778
1779         dest  = &sp->sk_v6_daddr;
1780         src   = &sp->sk_v6_rcv_saddr;
1781         destp = ntohs(inet->inet_dport);
1782         srcp  = ntohs(inet->inet_sport);
1783
1784         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1785                 timer_active    = 1;
1786                 timer_expires   = icsk->icsk_timeout;
1787         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1788                 timer_active    = 4;
1789                 timer_expires   = icsk->icsk_timeout;
1790         } else if (timer_pending(&sp->sk_timer)) {
1791                 timer_active    = 2;
1792                 timer_expires   = sp->sk_timer.expires;
1793         } else {
1794                 timer_active    = 0;
1795                 timer_expires = jiffies;
1796         }
1797
1798         seq_printf(seq,
1799                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1800                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1801                    i,
1802                    src->s6_addr32[0], src->s6_addr32[1],
1803                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1804                    dest->s6_addr32[0], dest->s6_addr32[1],
1805                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1806                    sp->sk_state,
1807                    tp->write_seq-tp->snd_una,
1808                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1809                    timer_active,
1810                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1811                    icsk->icsk_retransmits,
1812                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1813                    icsk->icsk_probes_out,
1814                    sock_i_ino(sp),
1815                    atomic_read(&sp->sk_refcnt), sp,
1816                    jiffies_to_clock_t(icsk->icsk_rto),
1817                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1818                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1819                    tp->snd_cwnd,
1820                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1821                    );
1822 }
1823
1824 static void get_timewait6_sock(struct seq_file *seq,
1825                                struct inet_timewait_sock *tw, int i)
1826 {
1827         const struct in6_addr *dest, *src;
1828         __u16 destp, srcp;
1829         s32 delta = tw->tw_ttd - inet_tw_time_stamp();
1830
1831         dest = &tw->tw_v6_daddr;
1832         src  = &tw->tw_v6_rcv_saddr;
1833         destp = ntohs(tw->tw_dport);
1834         srcp  = ntohs(tw->tw_sport);
1835
1836         seq_printf(seq,
1837                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1838                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1839                    i,
1840                    src->s6_addr32[0], src->s6_addr32[1],
1841                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1842                    dest->s6_addr32[0], dest->s6_addr32[1],
1843                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1844                    tw->tw_substate, 0, 0,
1845                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1846                    atomic_read(&tw->tw_refcnt), tw);
1847 }
1848
1849 static int tcp6_seq_show(struct seq_file *seq, void *v)
1850 {
1851         struct tcp_iter_state *st;
1852         struct sock *sk = v;
1853
1854         if (v == SEQ_START_TOKEN) {
1855                 seq_puts(seq,
1856                          "  sl  "
1857                          "local_address                         "
1858                          "remote_address                        "
1859                          "st tx_queue rx_queue tr tm->when retrnsmt"
1860                          "   uid  timeout inode\n");
1861                 goto out;
1862         }
1863         st = seq->private;
1864
1865         switch (st->state) {
1866         case TCP_SEQ_STATE_LISTENING:
1867         case TCP_SEQ_STATE_ESTABLISHED:
1868                 if (sk->sk_state == TCP_TIME_WAIT)
1869                         get_timewait6_sock(seq, v, st->num);
1870                 else
1871                         get_tcp6_sock(seq, v, st->num);
1872                 break;
1873         case TCP_SEQ_STATE_OPENREQ:
1874                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1875                 break;
1876         }
1877 out:
1878         return 0;
1879 }
1880
1881 static const struct file_operations tcp6_afinfo_seq_fops = {
1882         .owner   = THIS_MODULE,
1883         .open    = tcp_seq_open,
1884         .read    = seq_read,
1885         .llseek  = seq_lseek,
1886         .release = seq_release_net
1887 };
1888
1889 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1890         .name           = "tcp6",
1891         .family         = AF_INET6,
1892         .seq_fops       = &tcp6_afinfo_seq_fops,
1893         .seq_ops        = {
1894                 .show           = tcp6_seq_show,
1895         },
1896 };
1897
1898 int __net_init tcp6_proc_init(struct net *net)
1899 {
1900         return tcp_proc_register(net, &tcp6_seq_afinfo);
1901 }
1902
1903 void tcp6_proc_exit(struct net *net)
1904 {
1905         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1906 }
1907 #endif
1908
1909 static void tcp_v6_clear_sk(struct sock *sk, int size)
1910 {
1911         struct inet_sock *inet = inet_sk(sk);
1912
1913         /* we do not want to clear pinet6 field, because of RCU lookups */
1914         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1915
1916         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1917         memset(&inet->pinet6 + 1, 0, size);
1918 }
1919
1920 struct proto tcpv6_prot = {
1921         .name                   = "TCPv6",
1922         .owner                  = THIS_MODULE,
1923         .close                  = tcp_close,
1924         .connect                = tcp_v6_connect,
1925         .disconnect             = tcp_disconnect,
1926         .accept                 = inet_csk_accept,
1927         .ioctl                  = tcp_ioctl,
1928         .init                   = tcp_v6_init_sock,
1929         .destroy                = tcp_v6_destroy_sock,
1930         .shutdown               = tcp_shutdown,
1931         .setsockopt             = tcp_setsockopt,
1932         .getsockopt             = tcp_getsockopt,
1933         .recvmsg                = tcp_recvmsg,
1934         .sendmsg                = tcp_sendmsg,
1935         .sendpage               = tcp_sendpage,
1936         .backlog_rcv            = tcp_v6_do_rcv,
1937         .release_cb             = tcp_release_cb,
1938         .mtu_reduced            = tcp_v6_mtu_reduced,
1939         .hash                   = tcp_v6_hash,
1940         .unhash                 = inet_unhash,
1941         .get_port               = inet_csk_get_port,
1942         .enter_memory_pressure  = tcp_enter_memory_pressure,
1943         .stream_memory_free     = tcp_stream_memory_free,
1944         .sockets_allocated      = &tcp_sockets_allocated,
1945         .memory_allocated       = &tcp_memory_allocated,
1946         .memory_pressure        = &tcp_memory_pressure,
1947         .orphan_count           = &tcp_orphan_count,
1948         .sysctl_mem             = sysctl_tcp_mem,
1949         .sysctl_wmem            = sysctl_tcp_wmem,
1950         .sysctl_rmem            = sysctl_tcp_rmem,
1951         .max_header             = MAX_TCP_HEADER,
1952         .obj_size               = sizeof(struct tcp6_sock),
1953         .slab_flags             = SLAB_DESTROY_BY_RCU,
1954         .twsk_prot              = &tcp6_timewait_sock_ops,
1955         .rsk_prot               = &tcp6_request_sock_ops,
1956         .h.hashinfo             = &tcp_hashinfo,
1957         .no_autobind            = true,
1958 #ifdef CONFIG_COMPAT
1959         .compat_setsockopt      = compat_tcp_setsockopt,
1960         .compat_getsockopt      = compat_tcp_getsockopt,
1961 #endif
1962 #ifdef CONFIG_MEMCG_KMEM
1963         .proto_cgroup           = tcp_proto_cgroup,
1964 #endif
1965         .clear_sk               = tcp_v6_clear_sk,
1966 };
1967
1968 static const struct inet6_protocol tcpv6_protocol = {
1969         .early_demux    =       tcp_v6_early_demux,
1970         .handler        =       tcp_v6_rcv,
1971         .err_handler    =       tcp_v6_err,
1972         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1973 };
1974
1975 static struct inet_protosw tcpv6_protosw = {
1976         .type           =       SOCK_STREAM,
1977         .protocol       =       IPPROTO_TCP,
1978         .prot           =       &tcpv6_prot,
1979         .ops            =       &inet6_stream_ops,
1980         .no_check       =       0,
1981         .flags          =       INET_PROTOSW_PERMANENT |
1982                                 INET_PROTOSW_ICSK,
1983 };
1984
1985 static int __net_init tcpv6_net_init(struct net *net)
1986 {
1987         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1988                                     SOCK_RAW, IPPROTO_TCP, net);
1989 }
1990
1991 static void __net_exit tcpv6_net_exit(struct net *net)
1992 {
1993         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1994 }
1995
1996 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1997 {
1998         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1999 }
2000
2001 static struct pernet_operations tcpv6_net_ops = {
2002         .init       = tcpv6_net_init,
2003         .exit       = tcpv6_net_exit,
2004         .exit_batch = tcpv6_net_exit_batch,
2005 };
2006
2007 int __init tcpv6_init(void)
2008 {
2009         int ret;
2010
2011         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2012         if (ret)
2013                 goto out;
2014
2015         /* register inet6 protocol */
2016         ret = inet6_register_protosw(&tcpv6_protosw);
2017         if (ret)
2018                 goto out_tcpv6_protocol;
2019
2020         ret = register_pernet_subsys(&tcpv6_net_ops);
2021         if (ret)
2022                 goto out_tcpv6_protosw;
2023 out:
2024         return ret;
2025
2026 out_tcpv6_protosw:
2027         inet6_unregister_protosw(&tcpv6_protosw);
2028 out_tcpv6_protocol:
2029         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2030         goto out;
2031 }
2032
2033 void tcpv6_exit(void)
2034 {
2035         unregister_pernet_subsys(&tcpv6_net_ops);
2036         inet6_unregister_protosw(&tcpv6_protosw);
2037         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2038 }