net/ipv6/tcp_ipv6.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      TCP over IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *
   9  *      Based on:
  10  *      linux/net/ipv4/tcp.c
  11  *      linux/net/ipv4/tcp_input.c
  12  *      linux/net/ipv4/tcp_output.c
  13  *
  14  *      Fixes:
  15  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  16  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  17  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  18  *                                      a single port at the same time.
  19  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  20  */
  21
  22 #include <linux/bottom_half.h>
  23 #include <linux/module.h>
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/jiffies.h>
  30 #include <linux/in.h>
  31 #include <linux/in6.h>
  32 #include <linux/netdevice.h>
  33 #include <linux/init.h>
  34 #include <linux/jhash.h>
  35 #include <linux/ipsec.h>
  36 #include <linux/times.h>
  37 #include <linux/slab.h>
  38 #include <linux/uaccess.h>
  39 #include <linux/ipv6.h>
  40 #include <linux/icmpv6.h>
  41 #include <linux/random.h>
  42 #include <linux/indirect_call_wrapper.h>
  43
  44 #include <net/tcp.h>
  45 #include <net/ndisc.h>
  46 #include <net/inet6_hashtables.h>
  47 #include <net/inet6_connection_sock.h>
  48 #include <net/ipv6.h>
  49 #include <net/transp_v6.h>
  50 #include <net/addrconf.h>
  51 #include <net/ip6_route.h>
  52 #include <net/ip6_checksum.h>
  53 #include <net/inet_ecn.h>
  54 #include <net/protocol.h>
  55 #include <net/xfrm.h>
  56 #include <net/snmp.h>
  57 #include <net/dsfield.h>
  58 #include <net/timewait_sock.h>
  59 #include <net/inet_common.h>
  60 #include <net/secure_seq.h>
  61 #include <net/busy_poll.h>
  62
  63 #include <linux/proc_fs.h>
  64 #include <linux/seq_file.h>
  65
  66 #include <crypto/hash.h>
  67 #include <linux/scatterlist.h>
  68
  69 #include <trace/events/tcp.h>
  70
  71 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  72 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  73                                       struct request_sock *req);
  74
  75 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  76
  77 static const struct inet_connection_sock_af_ops ipv6_mapped;
  78 static const struct inet_connection_sock_af_ops ipv6_specific;
  79 #ifdef CONFIG_TCP_MD5SIG
  80 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  81 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  82 #else
  83 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  84                                                    const struct in6_addr *addr)
  85 {
  86         return NULL;
  87 }
  88 #endif
  89
  90 /* Helper returning the inet6 address from a given tcp socket.
  91  * It can be used in TCP stack instead of inet6_sk(sk).
  92  * This avoids a dereference and allow compiler optimizations.
  93  * It is a specialized version of inet6_sk_generic().
  94  */
  95 static struct ipv6_pinfo *tcp_inet6_sk(const struct sock *sk)
  96 {
  97         unsigned int offset = sizeof(struct tcp6_sock) - sizeof(struct ipv6_pinfo);
  98
  99         return (struct ipv6_pinfo *)(((u8 *)sk) + offset);
 100 }
 101
 102 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 103 {
 104         struct dst_entry *dst = skb_dst(skb);
 105
 106         if (dst && dst_hold_safe(dst)) {
 107                 const struct rt6_info *rt = (const struct rt6_info *)dst;
 108
 109                 sk->sk_rx_dst = dst;
 110                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 111                 tcp_inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 112         }
 113 }
 114
 115 static u32 tcp_v6_init_seq(const struct sk_buff *skb)
 116 {
 117         return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
 118                                 ipv6_hdr(skb)->saddr.s6_addr32,
 119                                 tcp_hdr(skb)->dest,
 120                                 tcp_hdr(skb)->source);
 121 }
 122
 123 static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
 124 {
 125         return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
 126                                    ipv6_hdr(skb)->saddr.s6_addr32);
 127 }
 128
 129 static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
 130                               int addr_len)
 131 {
 132         /* This check is replicated from tcp_v6_connect() and intended to
 133          * prevent BPF program called below from accessing bytes that are out
 134          * of the bound specified by user in addr_len.
 135          */
 136         if (addr_len < SIN6_LEN_RFC2133)
 137                 return -EINVAL;
 138
 139         sock_owned_by_me(sk);
 140
 141         return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr);
 142 }
 143
 144 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 145                           int addr_len)
 146 {
 147         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 148         struct inet_sock *inet = inet_sk(sk);
 149         struct inet_connection_sock *icsk = inet_csk(sk);
 150         struct ipv6_pinfo *np = tcp_inet6_sk(sk);
 151         struct tcp_sock *tp = tcp_sk(sk);
 152         struct in6_addr *saddr = NULL, *final_p, final;
 153         struct ipv6_txoptions *opt;
 154         struct flowi6 fl6;
 155         struct dst_entry *dst;
 156         int addr_type;
 157         int err;
 158         struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
 159
 160         if (addr_len < SIN6_LEN_RFC2133)
 161                 return -EINVAL;
 162
 163         if (usin->sin6_family != AF_INET6)
 164                 return -EAFNOSUPPORT;
 165
 166         memset(&fl6, 0, sizeof(fl6));
 167
 168         if (np->sndflow) {
 169                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 170                 IP6_ECN_flow_init(fl6.flowlabel);
 171                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 172                         struct ip6_flowlabel *flowlabel;
 173                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 174                         if (IS_ERR(flowlabel))
 175                                 return -EINVAL;
 176                         fl6_sock_release(flowlabel);
 177                 }
 178         }
 179
 180         /*
 181          *      connect() to INADDR_ANY means loopback (BSD'ism).
 182          */
 183
 184         if (ipv6_addr_any(&usin->sin6_addr)) {
 185                 if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
 186                         ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
 187                                                &usin->sin6_addr);
 188                 else
 189                         usin->sin6_addr = in6addr_loopback;
 190         }
 191
 192         addr_type = ipv6_addr_type(&usin->sin6_addr);
 193
 194         if (addr_type & IPV6_ADDR_MULTICAST)
 195                 return -ENETUNREACH;
 196
 197         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 198                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 199                     usin->sin6_scope_id) {
 200                         /* If interface is set while binding, indices
 201                          * must coincide.
 202                          */
 203                         if (!sk_dev_equal_l3scope(sk, usin->sin6_scope_id))
 204                                 return -EINVAL;
 205
 206                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 207                 }
 208
 209                 /* Connect to link-local address requires an interface */
 210                 if (!sk->sk_bound_dev_if)
 211                         return -EINVAL;
 212         }
 213
 214         if (tp->rx_opt.ts_recent_stamp &&
 215             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 216                 tp->rx_opt.ts_recent = 0;
 217                 tp->rx_opt.ts_recent_stamp = 0;
 218                 tp->write_seq = 0;
 219         }
 220
 221         sk->sk_v6_daddr = usin->sin6_addr;
 222         np->flow_label = fl6.flowlabel;
 223
 224         /*
 225          *      TCP over IPv4
 226          */
 227
 228         if (addr_type & IPV6_ADDR_MAPPED) {
 229                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 230                 struct sockaddr_in sin;
 231
 232                 if (__ipv6_only_sock(sk))
 233                         return -ENETUNREACH;
 234
 235                 sin.sin_family = AF_INET;
 236                 sin.sin_port = usin->sin6_port;
 237                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 238
 239                 icsk->icsk_af_ops = &ipv6_mapped;
 240                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 241 #ifdef CONFIG_TCP_MD5SIG
 242                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 243 #endif
 244
 245                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 246
 247                 if (err) {
 248                         icsk->icsk_ext_hdr_len = exthdrlen;
 249                         icsk->icsk_af_ops = &ipv6_specific;
 250                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 251 #ifdef CONFIG_TCP_MD5SIG
 252                         tp->af_specific = &tcp_sock_ipv6_specific;
 253 #endif
 254                         goto failure;
 255                 }
 256                 np->saddr = sk->sk_v6_rcv_saddr;
 257
 258                 return err;
 259         }
 260
 261         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 262                 saddr = &sk->sk_v6_rcv_saddr;
 263
 264         fl6.flowi6_proto = IPPROTO_TCP;
 265         fl6.daddr = sk->sk_v6_daddr;
 266         fl6.saddr = saddr ? *saddr : np->saddr;
 267         fl6.flowi6_oif = sk->sk_bound_dev_if;
 268         fl6.flowi6_mark = sk->sk_mark;
 269         fl6.fl6_dport = usin->sin6_port;
 270         fl6.fl6_sport = inet->inet_sport;
 271         fl6.flowi6_uid = sk->sk_uid;
 272
 273         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 274         final_p = fl6_update_dst(&fl6, opt, &final);
 275
 276         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 277
 278         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 279         if (IS_ERR(dst)) {
 280                 err = PTR_ERR(dst);
 281                 goto failure;
 282         }
 283
 284         if (!saddr) {
 285                 saddr = &fl6.saddr;
 286                 sk->sk_v6_rcv_saddr = *saddr;
 287         }
 288
 289         /* set the source address */
 290         np->saddr = *saddr;
 291         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 292
 293         sk->sk_gso_type = SKB_GSO_TCPV6;
 294         ip6_dst_store(sk, dst, NULL, NULL);
 295
 296         icsk->icsk_ext_hdr_len = 0;
 297         if (opt)
 298                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 299                                          opt->opt_nflen;
 300
 301         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 302
 303         inet->inet_dport = usin->sin6_port;
 304
 305         tcp_set_state(sk, TCP_SYN_SENT);
 306         err = inet6_hash_connect(tcp_death_row, sk);
 307         if (err)
 308                 goto late_failure;
 309
 310         sk_set_txhash(sk);
 311
 312         if (likely(!tp->repair)) {
 313                 if (!tp->write_seq)
 314                         tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
 315                                                          sk->sk_v6_daddr.s6_addr32,
 316                                                          inet->inet_sport,
 317                                                          inet->inet_dport);
 318                 tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
 319                                                    np->saddr.s6_addr32,
 320                                                    sk->sk_v6_daddr.s6_addr32);
 321         }
 322
 323         if (tcp_fastopen_defer_connect(sk, &err))
 324                 return err;
 325         if (err)
 326                 goto late_failure;
 327
 328         err = tcp_connect(sk);
 329         if (err)
 330                 goto late_failure;
 331
 332         return 0;
 333
 334 late_failure:
 335         tcp_set_state(sk, TCP_CLOSE);
 336 failure:
 337         inet->inet_dport = 0;
 338         sk->sk_route_caps = 0;
 339         return err;
 340 }
 341
 342 static void tcp_v6_mtu_reduced(struct sock *sk)
 343 {
 344         struct dst_entry *dst;
 345
 346         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 347                 return;
 348
 349         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 350         if (!dst)
 351                 return;
 352
 353         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 354                 tcp_sync_mss(sk, dst_mtu(dst));
 355                 tcp_simple_retransmit(sk);
 356         }
 357 }
 358
 359 static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 360                 u8 type, u8 code, int offset, __be32 info)
 361 {
 362         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 363         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 364         struct net *net = dev_net(skb->dev);
 365         struct request_sock *fastopen;
 366         struct ipv6_pinfo *np;
 367         struct tcp_sock *tp;
 368         __u32 seq, snd_una;
 369         struct sock *sk;
 370         bool fatal;
 371         int err;
 372
 373         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 374                                         &hdr->daddr, th->dest,
 375                                         &hdr->saddr, ntohs(th->source),
 376                                         skb->dev->ifindex, inet6_sdif(skb));
 377
 378         if (!sk) {
 379                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 380                                   ICMP6_MIB_INERRORS);
 381                 return -ENOENT;
 382         }
 383
 384         if (sk->sk_state == TCP_TIME_WAIT) {
 385                 inet_twsk_put(inet_twsk(sk));
 386                 return 0;
 387         }
 388         seq = ntohl(th->seq);
 389         fatal = icmpv6_err_convert(type, code, &err);
 390         if (sk->sk_state == TCP_NEW_SYN_RECV) {
 391                 tcp_req_err(sk, seq, fatal);
 392                 return 0;
 393         }
 394
 395         bh_lock_sock(sk);
 396         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 397                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 398
 399         if (sk->sk_state == TCP_CLOSE)
 400                 goto out;
 401
 402         if (ipv6_hdr(skb)->hop_limit < tcp_inet6_sk(sk)->min_hopcount) {
 403                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 404                 goto out;
 405         }
 406
 407         tp = tcp_sk(sk);
 408         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 409         fastopen = tp->fastopen_rsk;
 410         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 411         if (sk->sk_state != TCP_LISTEN &&
 412             !between(seq, snd_una, tp->snd_nxt)) {
 413                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 414                 goto out;
 415         }
 416
 417         np = tcp_inet6_sk(sk);
 418
 419         if (type == NDISC_REDIRECT) {
 420                 if (!sock_owned_by_user(sk)) {
 421                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 422
 423                         if (dst)
 424                                 dst->ops->redirect(dst, sk, skb);
 425                 }
 426                 goto out;
 427         }
 428
 429         if (type == ICMPV6_PKT_TOOBIG) {
 430                 /* We are not interested in TCP_LISTEN and open_requests
 431                  * (SYN-ACKs send out by Linux are always <576bytes so
 432                  * they should go through unfragmented).
 433                  */
 434                 if (sk->sk_state == TCP_LISTEN)
 435                         goto out;
 436
 437                 if (!ip6_sk_accept_pmtu(sk))
 438                         goto out;
 439
 440                 tp->mtu_info = ntohl(info);
 441                 if (!sock_owned_by_user(sk))
 442                         tcp_v6_mtu_reduced(sk);
 443                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 444                                            &sk->sk_tsq_flags))
 445                         sock_hold(sk);
 446                 goto out;
 447         }
 448
 449
 450         /* Might be for an request_sock */
 451         switch (sk->sk_state) {
 452         case TCP_SYN_SENT:
 453         case TCP_SYN_RECV:
 454                 /* Only in fast or simultaneous open. If a fast open socket is
 455                  * is already accepted it is treated as a connected one below.
 456                  */
 457                 if (fastopen && !fastopen->sk)
 458                         break;
 459
 460                 if (!sock_owned_by_user(sk)) {
 461                         sk->sk_err = err;
 462                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 463
 464                         tcp_done(sk);
 465                 } else
 466                         sk->sk_err_soft = err;
 467                 goto out;
 468         }
 469
 470         if (!sock_owned_by_user(sk) && np->recverr) {
 471                 sk->sk_err = err;
 472                 sk->sk_error_report(sk);
 473         } else
 474                 sk->sk_err_soft = err;
 475
 476 out:
 477         bh_unlock_sock(sk);
 478         sock_put(sk);
 479         return 0;
 480 }
 481
 482
 483 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 484                               struct flowi *fl,
 485                               struct request_sock *req,
 486                               struct tcp_fastopen_cookie *foc,
 487                               enum tcp_synack_type synack_type)
 488 {
 489         struct inet_request_sock *ireq = inet_rsk(req);
 490         struct ipv6_pinfo *np = tcp_inet6_sk(sk);
 491         struct ipv6_txoptions *opt;
 492         struct flowi6 *fl6 = &fl->u.ip6;
 493         struct sk_buff *skb;
 494         int err = -ENOMEM;
 495
 496         /* First, grab a route. */
 497         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 498                                                IPPROTO_TCP)) == NULL)
 499                 goto done;
 500
 501         skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 502
 503         if (skb) {
 504                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 505                                     &ireq->ir_v6_rmt_addr);
 506
 507                 fl6->daddr = ireq->ir_v6_rmt_addr;
 508                 if (np->repflow && ireq->pktopts)
 509                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 510
 511                 rcu_read_lock();
 512                 opt = ireq->ipv6_opt;
 513                 if (!opt)
 514                         opt = rcu_dereference(np->opt);
 515                 err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
 516                 rcu_read_unlock();
 517                 err = net_xmit_eval(err);
 518         }
 519
 520 done:
 521         return err;
 522 }
 523
 524
 525 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 526 {
 527         kfree(inet_rsk(req)->ipv6_opt);
 528         kfree_skb(inet_rsk(req)->pktopts);
 529 }
 530
 531 #ifdef CONFIG_TCP_MD5SIG
 532 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 533                                                    const struct in6_addr *addr)
 534 {
 535         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 536 }
 537
 538 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 539                                                 const struct sock *addr_sk)
 540 {
 541         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 542 }
 543
 544 static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
 545                                  char __user *optval, int optlen)
 546 {
 547         struct tcp_md5sig cmd;
 548         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 549         u8 prefixlen;
 550
 551         if (optlen < sizeof(cmd))
 552                 return -EINVAL;
 553
 554         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 555                 return -EFAULT;
 556
 557         if (sin6->sin6_family != AF_INET6)
 558                 return -EINVAL;
 559
 560         if (optname == TCP_MD5SIG_EXT &&
 561             cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
 562                 prefixlen = cmd.tcpm_prefixlen;
 563                 if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
 564                                         prefixlen > 32))
 565                         return -EINVAL;
 566         } else {
 567                 prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
 568         }
 569
 570         if (!cmd.tcpm_keylen) {
 571                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 572                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 573                                               AF_INET, prefixlen);
 574                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 575                                       AF_INET6, prefixlen);
 576         }
 577
 578         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 579                 return -EINVAL;
 580
 581         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 582                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 583                                       AF_INET, prefixlen, cmd.tcpm_key,
 584                                       cmd.tcpm_keylen, GFP_KERNEL);
 585
 586         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 587                               AF_INET6, prefixlen, cmd.tcpm_key,
 588                               cmd.tcpm_keylen, GFP_KERNEL);
 589 }
 590
 591 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 592                                    const struct in6_addr *daddr,
 593                                    const struct in6_addr *saddr,
 594                                    const struct tcphdr *th, int nbytes)
 595 {
 596         struct tcp6_pseudohdr *bp;
 597         struct scatterlist sg;
 598         struct tcphdr *_th;
 599
 600         bp = hp->scratch;
 601         /* 1. TCP pseudo-header (RFC2460) */
 602         bp->saddr = *saddr;
 603         bp->daddr = *daddr;
 604         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 605         bp->len = cpu_to_be32(nbytes);
 606
 607         _th = (struct tcphdr *)(bp + 1);
 608         memcpy(_th, th, sizeof(*th));
 609         _th->check = 0;
 610
 611         sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 612         ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 613                                 sizeof(*bp) + sizeof(*th));
 614         return crypto_ahash_update(hp->md5_req);
 615 }
 616
 617 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 618                                const struct in6_addr *daddr, struct in6_addr *saddr,
 619                                const struct tcphdr *th)
 620 {
 621         struct tcp_md5sig_pool *hp;
 622         struct ahash_request *req;
 623
 624         hp = tcp_get_md5sig_pool();
 625         if (!hp)
 626                 goto clear_hash_noput;
 627         req = hp->md5_req;
 628
 629         if (crypto_ahash_init(req))
 630                 goto clear_hash;
 631         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 632                 goto clear_hash;
 633         if (tcp_md5_hash_key(hp, key))
 634                 goto clear_hash;
 635         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 636         if (crypto_ahash_final(req))
 637                 goto clear_hash;
 638
 639         tcp_put_md5sig_pool();
 640         return 0;
 641
 642 clear_hash:
 643         tcp_put_md5sig_pool();
 644 clear_hash_noput:
 645         memset(md5_hash, 0, 16);
 646         return 1;
 647 }
 648
 649 static int tcp_v6_md5_hash_skb(char *md5_hash,
 650                                const struct tcp_md5sig_key *key,
 651                                const struct sock *sk,
 652                                const struct sk_buff *skb)
 653 {
 654         const struct in6_addr *saddr, *daddr;
 655         struct tcp_md5sig_pool *hp;
 656         struct ahash_request *req;
 657         const struct tcphdr *th = tcp_hdr(skb);
 658
 659         if (sk) { /* valid for establish/request sockets */
 660                 saddr = &sk->sk_v6_rcv_saddr;
 661                 daddr = &sk->sk_v6_daddr;
 662         } else {
 663                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 664                 saddr = &ip6h->saddr;
 665                 daddr = &ip6h->daddr;
 666         }
 667
 668         hp = tcp_get_md5sig_pool();
 669         if (!hp)
 670                 goto clear_hash_noput;
 671         req = hp->md5_req;
 672
 673         if (crypto_ahash_init(req))
 674                 goto clear_hash;
 675
 676         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 677                 goto clear_hash;
 678         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 679                 goto clear_hash;
 680         if (tcp_md5_hash_key(hp, key))
 681                 goto clear_hash;
 682         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 683         if (crypto_ahash_final(req))
 684                 goto clear_hash;
 685
 686         tcp_put_md5sig_pool();
 687         return 0;
 688
 689 clear_hash:
 690         tcp_put_md5sig_pool();
 691 clear_hash_noput:
 692         memset(md5_hash, 0, 16);
 693         return 1;
 694 }
 695
 696 #endif
 697
 698 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 699                                     const struct sk_buff *skb)
 700 {
 701 #ifdef CONFIG_TCP_MD5SIG
 702         const __u8 *hash_location = NULL;
 703         struct tcp_md5sig_key *hash_expected;
 704         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 705         const struct tcphdr *th = tcp_hdr(skb);
 706         int genhash;
 707         u8 newhash[16];
 708
 709         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 710         hash_location = tcp_parse_md5sig_option(th);
 711
 712         /* We've parsed the options - do we have a hash? */
 713         if (!hash_expected && !hash_location)
 714                 return false;
 715
 716         if (hash_expected && !hash_location) {
 717                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 718                 return true;
 719         }
 720
 721         if (!hash_expected && hash_location) {
 722                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 723                 return true;
 724         }
 725
 726         /* check the signature */
 727         genhash = tcp_v6_md5_hash_skb(newhash,
 728                                       hash_expected,
 729                                       NULL, skb);
 730
 731         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 732                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 733                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 734                                      genhash ? "failed" : "mismatch",
 735                                      &ip6h->saddr, ntohs(th->source),
 736                                      &ip6h->daddr, ntohs(th->dest));
 737                 return true;
 738         }
 739 #endif
 740         return false;
 741 }
 742
 743 static void tcp_v6_init_req(struct request_sock *req,
 744                             const struct sock *sk_listener,
 745                             struct sk_buff *skb)
 746 {
 747         bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
 748         struct inet_request_sock *ireq = inet_rsk(req);
 749         const struct ipv6_pinfo *np = tcp_inet6_sk(sk_listener);
 750
 751         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 752         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 753
 754         /* So that link locals have meaning */
 755         if ((!sk_listener->sk_bound_dev_if || l3_slave) &&
 756             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 757                 ireq->ir_iif = tcp_v6_iif(skb);
 758
 759         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 760             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 761              np->rxopt.bits.rxinfo ||
 762              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 763              np->rxopt.bits.rxohlim || np->repflow)) {
 764                 refcount_inc(&skb->users);
 765                 ireq->pktopts = skb;
 766         }
 767 }
 768
 769 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 770                                           struct flowi *fl,
 771                                           const struct request_sock *req)
 772 {
 773         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 774 }
 775
 776 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 777         .family         =       AF_INET6,
 778         .obj_size       =       sizeof(struct tcp6_request_sock),
 779         .rtx_syn_ack    =       tcp_rtx_synack,
 780         .send_ack       =       tcp_v6_reqsk_send_ack,
 781         .destructor     =       tcp_v6_reqsk_destructor,
 782         .send_reset     =       tcp_v6_send_reset,
 783         .syn_ack_timeout =      tcp_syn_ack_timeout,
 784 };
 785
 786 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 787         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 788                                 sizeof(struct ipv6hdr),
 789 #ifdef CONFIG_TCP_MD5SIG
 790         .req_md5_lookup =       tcp_v6_md5_lookup,
 791         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 792 #endif
 793         .init_req       =       tcp_v6_init_req,
 794 #ifdef CONFIG_SYN_COOKIES
 795         .cookie_init_seq =      cookie_v6_init_sequence,
 796 #endif
 797         .route_req      =       tcp_v6_route_req,
 798         .init_seq       =       tcp_v6_init_seq,
 799         .init_ts_off    =       tcp_v6_init_ts_off,
 800         .send_synack    =       tcp_v6_send_synack,
 801 };
 802
 803 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 804                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 805                                  int oif, struct tcp_md5sig_key *key, int rst,
 806                                  u8 tclass, __be32 label)
 807 {
 808         const struct tcphdr *th = tcp_hdr(skb);
 809         struct tcphdr *t1;
 810         struct sk_buff *buff;
 811         struct flowi6 fl6;
 812         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 813         struct sock *ctl_sk = net->ipv6.tcp_sk;
 814         unsigned int tot_len = sizeof(struct tcphdr);
 815         struct dst_entry *dst;
 816         __be32 *topt;
 817         __u32 mark = 0;
 818
 819         if (tsecr)
 820                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 821 #ifdef CONFIG_TCP_MD5SIG
 822         if (key)
 823                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 824 #endif
 825
 826         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 827                          GFP_ATOMIC);
 828         if (!buff)
 829                 return;
 830
 831         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 832
 833         t1 = skb_push(buff, tot_len);
 834         skb_reset_transport_header(buff);
 835
 836         /* Swap the send and the receive. */
 837         memset(t1, 0, sizeof(*t1));
 838         t1->dest = th->source;
 839         t1->source = th->dest;
 840         t1->doff = tot_len / 4;
 841         t1->seq = htonl(seq);
 842         t1->ack_seq = htonl(ack);
 843         t1->ack = !rst || !th->ack;
 844         t1->rst = rst;
 845         t1->window = htons(win);
 846
 847         topt = (__be32 *)(t1 + 1);
 848
 849         if (tsecr) {
 850                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 851                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 852                 *topt++ = htonl(tsval);
 853                 *topt++ = htonl(tsecr);
 854         }
 855
 856 #ifdef CONFIG_TCP_MD5SIG
 857         if (key) {
 858                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 859                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 860                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 861                                     &ipv6_hdr(skb)->saddr,
 862                                     &ipv6_hdr(skb)->daddr, t1);
 863         }
 864 #endif
 865
 866         memset(&fl6, 0, sizeof(fl6));
 867         fl6.daddr = ipv6_hdr(skb)->saddr;
 868         fl6.saddr = ipv6_hdr(skb)->daddr;
 869         fl6.flowlabel = label;
 870
 871         buff->ip_summed = CHECKSUM_PARTIAL;
 872         buff->csum = 0;
 873
 874         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 875
 876         fl6.flowi6_proto = IPPROTO_TCP;
 877         if (rt6_need_strict(&fl6.daddr) && !oif)
 878                 fl6.flowi6_oif = tcp_v6_iif(skb);
 879         else {
 880                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 881                         oif = skb->skb_iif;
 882
 883                 fl6.flowi6_oif = oif;
 884         }
 885
 886         if (sk) {
 887                 if (sk->sk_state == TCP_TIME_WAIT) {
 888                         mark = inet_twsk(sk)->tw_mark;
 889                         /* autoflowlabel relies on buff->hash */
 890                         skb_set_hash(buff, inet_twsk(sk)->tw_txhash,
 891                                      PKT_HASH_TYPE_L4);
 892                 } else {
 893                         mark = sk->sk_mark;
 894                 }
 895                 buff->tstamp = tcp_transmit_time(sk);
 896         }
 897         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark) ?: mark;
 898         fl6.fl6_dport = t1->dest;
 899         fl6.fl6_sport = t1->source;
 900         fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 901         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 902
 903         /* Pass a socket to ip6_dst_lookup either it is for RST
 904          * Underlying function will use this to retrieve the network
 905          * namespace
 906          */
 907         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 908         if (!IS_ERR(dst)) {
 909                 skb_dst_set(buff, dst);
 910                 ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
 911                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 912                 if (rst)
 913                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 914                 return;
 915         }
 916
 917         kfree_skb(buff);
 918 }
 919
 920 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 921 {
 922         const struct tcphdr *th = tcp_hdr(skb);
 923         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 924         u32 seq = 0, ack_seq = 0;
 925         struct tcp_md5sig_key *key = NULL;
 926 #ifdef CONFIG_TCP_MD5SIG
 927         const __u8 *hash_location = NULL;
 928         unsigned char newhash[16];
 929         int genhash;
 930         struct sock *sk1 = NULL;
 931 #endif
 932         __be32 label = 0;
 933         struct net *net;
 934         int oif = 0;
 935
 936         if (th->rst)
 937                 return;
 938
 939         /* If sk not NULL, it means we did a successful lookup and incoming
 940          * route had to be correct. prequeue might have dropped our dst.
 941          */
 942         if (!sk && !ipv6_unicast_destination(skb))
 943                 return;
 944
 945         net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 946 #ifdef CONFIG_TCP_MD5SIG
 947         rcu_read_lock();
 948         hash_location = tcp_parse_md5sig_option(th);
 949         if (sk && sk_fullsock(sk)) {
 950                 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 951         } else if (hash_location) {
 952                 /*
 953                  * active side is lost. Try to find listening socket through
 954                  * source port, and then find md5 key through listening socket.
 955                  * we are not loose security here:
 956                  * Incoming packet is checked with md5 hash with finding key,
 957                  * no RST generated if md5 hash doesn't match.
 958                  */
 959                 sk1 = inet6_lookup_listener(net,
 960                                            &tcp_hashinfo, NULL, 0,
 961                                            &ipv6h->saddr,
 962                                            th->source, &ipv6h->daddr,
 963                                            ntohs(th->source),
 964                                            tcp_v6_iif_l3_slave(skb),
 965                                            tcp_v6_sdif(skb));
 966                 if (!sk1)
 967                         goto out;
 968
 969                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 970                 if (!key)
 971                         goto out;
 972
 973                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 974                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 975                         goto out;
 976         }
 977 #endif
 978
 979         if (th->ack)
 980                 seq = ntohl(th->ack_seq);
 981         else
 982                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 983                           (th->doff << 2);
 984
 985         if (sk) {
 986                 oif = sk->sk_bound_dev_if;
 987                 if (sk_fullsock(sk)) {
 988                         const struct ipv6_pinfo *np = tcp_inet6_sk(sk);
 989
 990                         trace_tcp_send_reset(sk, skb);
 991                         if (np->repflow)
 992                                 label = ip6_flowlabel(ipv6h);
 993                 }
 994                 if (sk->sk_state == TCP_TIME_WAIT)
 995                         label = cpu_to_be32(inet_twsk(sk)->tw_flowlabel);
 996         } else {
 997                 if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_TCP_RESET)
 998                         label = ip6_flowlabel(ipv6h);
 999         }
1000
1001         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0,
1002                              label);
1003
1004 #ifdef CONFIG_TCP_MD5SIG
1005 out:
1006         rcu_read_unlock();
1007 #endif
1008 }
1009
1010 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
1011                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
1012                             struct tcp_md5sig_key *key, u8 tclass,
1013                             __be32 label)
1014 {
1015         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
1016                              tclass, label);
1017 }
1018
1019 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1020 {
1021         struct inet_timewait_sock *tw = inet_twsk(sk);
1022         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1023
1024         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1025                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1026                         tcp_time_stamp_raw() + tcptw->tw_ts_offset,
1027                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
1028                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
1029
1030         inet_twsk_put(tw);
1031 }
1032
1033 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
1034                                   struct request_sock *req)
1035 {
1036         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
1037          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
1038          */
1039         /* RFC 7323 2.3
1040          * The window field (SEG.WND) of every outgoing segment, with the
1041          * exception of <SYN> segments, MUST be right-shifted by
1042          * Rcv.Wind.Shift bits:
1043          */
1044         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
1045                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
1046                         tcp_rsk(req)->rcv_nxt,
1047                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1048                         tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1049                         req->ts_recent, sk->sk_bound_dev_if,
1050                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
1051                         0, 0);
1052 }
1053
1054
1055 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
1056 {
1057 #ifdef CONFIG_SYN_COOKIES
1058         const struct tcphdr *th = tcp_hdr(skb);
1059
1060         if (!th->syn)
1061                 sk = cookie_v6_check(sk, skb);
1062 #endif
1063         return sk;
1064 }
1065
1066 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1067 {
1068         if (skb->protocol == htons(ETH_P_IP))
1069                 return tcp_v4_conn_request(sk, skb);
1070
1071         if (!ipv6_unicast_destination(skb))
1072                 goto drop;
1073
1074         return tcp_conn_request(&tcp6_request_sock_ops,
1075                                 &tcp_request_sock_ipv6_ops, sk, skb);
1076
1077 drop:
1078         tcp_listendrop(sk);
1079         return 0; /* don't send reset */
1080 }
1081
1082 static void tcp_v6_restore_cb(struct sk_buff *skb)
1083 {
1084         /* We need to move header back to the beginning if xfrm6_policy_check()
1085          * and tcp_v6_fill_cb() are going to be called again.
1086          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1087          */
1088         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1089                 sizeof(struct inet6_skb_parm));
1090 }
1091
1092 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1093                                          struct request_sock *req,
1094                                          struct dst_entry *dst,
1095                                          struct request_sock *req_unhash,
1096                                          bool *own_req)
1097 {
1098         struct inet_request_sock *ireq;
1099         struct ipv6_pinfo *newnp;
1100         const struct ipv6_pinfo *np = tcp_inet6_sk(sk);
1101         struct ipv6_txoptions *opt;
1102         struct inet_sock *newinet;
1103         struct tcp_sock *newtp;
1104         struct sock *newsk;
1105 #ifdef CONFIG_TCP_MD5SIG
1106         struct tcp_md5sig_key *key;
1107 #endif
1108         struct flowi6 fl6;
1109
1110         if (skb->protocol == htons(ETH_P_IP)) {
1111                 /*
1112                  *      v6 mapped
1113                  */
1114
1115                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1116                                              req_unhash, own_req);
1117
1118                 if (!newsk)
1119                         return NULL;
1120
1121                 inet_sk(newsk)->pinet6 = tcp_inet6_sk(newsk);
1122
1123                 newinet = inet_sk(newsk);
1124                 newnp = tcp_inet6_sk(newsk);
1125                 newtp = tcp_sk(newsk);
1126
1127                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1128
1129                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1130
1131                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1132                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1133 #ifdef CONFIG_TCP_MD5SIG
1134                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1135 #endif
1136
1137                 newnp->ipv6_mc_list = NULL;
1138                 newnp->ipv6_ac_list = NULL;
1139                 newnp->ipv6_fl_list = NULL;
1140                 newnp->pktoptions  = NULL;
1141                 newnp->opt         = NULL;
1142                 newnp->mcast_oif   = inet_iif(skb);
1143                 newnp->mcast_hops  = ip_hdr(skb)->ttl;
1144                 newnp->rcv_flowinfo = 0;
1145                 if (np->repflow)
1146                         newnp->flow_label = 0;
1147
1148                 /*
1149                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1150                  * here, tcp_create_openreq_child now does this for us, see the comment in
1151                  * that function for the gory details. -acme
1152                  */
1153
1154                 /* It is tricky place. Until this moment IPv4 tcp
1155                    worked with IPv6 icsk.icsk_af_ops.
1156                    Sync it now.
1157                  */
1158                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1159
1160                 return newsk;
1161         }
1162
1163         ireq = inet_rsk(req);
1164
1165         if (sk_acceptq_is_full(sk))
1166                 goto out_overflow;
1167
1168         if (!dst) {
1169                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1170                 if (!dst)
1171                         goto out;
1172         }
1173
1174         newsk = tcp_create_openreq_child(sk, req, skb);
1175         if (!newsk)
1176                 goto out_nonewsk;
1177
1178         /*
1179          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1180          * count here, tcp_create_openreq_child now does this for us, see the
1181          * comment in that function for the gory details. -acme
1182          */
1183
1184         newsk->sk_gso_type = SKB_GSO_TCPV6;
1185         ip6_dst_store(newsk, dst, NULL, NULL);
1186         inet6_sk_rx_dst_set(newsk, skb);
1187
1188         inet_sk(newsk)->pinet6 = tcp_inet6_sk(newsk);
1189
1190         newtp = tcp_sk(newsk);
1191         newinet = inet_sk(newsk);
1192         newnp = tcp_inet6_sk(newsk);
1193
1194         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1195
1196         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1197         newnp->saddr = ireq->ir_v6_loc_addr;
1198         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1199         newsk->sk_bound_dev_if = ireq->ir_iif;
1200
1201         /* Now IPv6 options...
1202
1203            First: no IPv4 options.
1204          */
1205         newinet->inet_opt = NULL;
1206         newnp->ipv6_mc_list = NULL;
1207         newnp->ipv6_ac_list = NULL;
1208         newnp->ipv6_fl_list = NULL;
1209
1210         /* Clone RX bits */
1211         newnp->rxopt.all = np->rxopt.all;
1212
1213         newnp->pktoptions = NULL;
1214         newnp->opt        = NULL;
1215         newnp->mcast_oif  = tcp_v6_iif(skb);
1216         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1217         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1218         if (np->repflow)
1219                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1220
1221         /* Clone native IPv6 options from listening socket (if any)
1222
1223            Yes, keeping reference count would be much more clever,
1224            but we make one more one thing there: reattach optmem
1225            to newsk.
1226          */
1227         opt = ireq->ipv6_opt;
1228         if (!opt)
1229                 opt = rcu_dereference(np->opt);
1230         if (opt) {
1231                 opt = ipv6_dup_options(newsk, opt);
1232                 RCU_INIT_POINTER(newnp->opt, opt);
1233         }
1234         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1235         if (opt)
1236                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1237                                                     opt->opt_flen;
1238
1239         tcp_ca_openreq_child(newsk, dst);
1240
1241         tcp_sync_mss(newsk, dst_mtu(dst));
1242         newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
1243
1244         tcp_initialize_rcv_mss(newsk);
1245
1246         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1247         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1248
1249 #ifdef CONFIG_TCP_MD5SIG
1250         /* Copy over the MD5 key from the original socket */
1251         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1252         if (key) {
1253                 /* We're using one, so create a matching key
1254                  * on the newsk structure. If we fail to get
1255                  * memory, then we end up not copying the key
1256                  * across. Shucks.
1257                  */
1258                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1259                                AF_INET6, 128, key->key, key->keylen,
1260                                sk_gfp_mask(sk, GFP_ATOMIC));
1261         }
1262 #endif
1263
1264         if (__inet_inherit_port(sk, newsk) < 0) {
1265                 inet_csk_prepare_forced_close(newsk);
1266                 tcp_done(newsk);
1267                 goto out;
1268         }
1269         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1270         if (*own_req) {
1271                 tcp_move_syn(newtp, req);
1272
1273                 /* Clone pktoptions received with SYN, if we own the req */
1274                 if (ireq->pktopts) {
1275                         newnp->pktoptions = skb_clone(ireq->pktopts,
1276                                                       sk_gfp_mask(sk, GFP_ATOMIC));
1277                         consume_skb(ireq->pktopts);
1278                         ireq->pktopts = NULL;
1279                         if (newnp->pktoptions) {
1280                                 tcp_v6_restore_cb(newnp->pktoptions);
1281                                 skb_set_owner_r(newnp->pktoptions, newsk);
1282                         }
1283                 }
1284         }
1285
1286         return newsk;
1287
1288 out_overflow:
1289         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1290 out_nonewsk:
1291         dst_release(dst);
1292 out:
1293         tcp_listendrop(sk);
1294         return NULL;
1295 }
1296
1297 /* The socket must have it's spinlock held when we get
1298  * here, unless it is a TCP_LISTEN socket.
1299  *
1300  * We have a potential double-lock case here, so even when
1301  * doing backlog processing we use the BH locking scheme.
1302  * This is because we cannot sleep with the original spinlock
1303  * held.
1304  */
1305 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1306 {
1307         struct ipv6_pinfo *np = tcp_inet6_sk(sk);
1308         struct sk_buff *opt_skb = NULL;
1309         struct tcp_sock *tp;
1310
1311         /* Imagine: socket is IPv6. IPv4 packet arrives,
1312            goes to IPv4 receive handler and backlogged.
1313            From backlog it always goes here. Kerboom...
1314            Fortunately, tcp_rcv_established and rcv_established
1315            handle them correctly, but it is not case with
1316            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1317          */
1318
1319         if (skb->protocol == htons(ETH_P_IP))
1320                 return tcp_v4_do_rcv(sk, skb);
1321
1322         /*
1323          *      socket locking is here for SMP purposes as backlog rcv
1324          *      is currently called with bh processing disabled.
1325          */
1326
1327         /* Do Stevens' IPV6_PKTOPTIONS.
1328
1329            Yes, guys, it is the only place in our code, where we
1330            may make it not affecting IPv4.
1331            The rest of code is protocol independent,
1332            and I do not like idea to uglify IPv4.
1333
1334            Actually, all the idea behind IPV6_PKTOPTIONS
1335            looks not very well thought. For now we latch
1336            options, received in the last packet, enqueued
1337            by tcp. Feel free to propose better solution.
1338                                                --ANK (980728)
1339          */
1340         if (np->rxopt.all)
1341                 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1342
1343         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1344                 struct dst_entry *dst = sk->sk_rx_dst;
1345
1346                 sock_rps_save_rxhash(sk, skb);
1347                 sk_mark_napi_id(sk, skb);
1348                 if (dst) {
1349                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1350                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1351                                 dst_release(dst);
1352                                 sk->sk_rx_dst = NULL;
1353                         }
1354                 }
1355
1356                 tcp_rcv_established(sk, skb);
1357                 if (opt_skb)
1358                         goto ipv6_pktoptions;
1359                 return 0;
1360         }
1361
1362         if (tcp_checksum_complete(skb))
1363                 goto csum_err;
1364
1365         if (sk->sk_state == TCP_LISTEN) {
1366                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1367
1368                 if (!nsk)
1369                         goto discard;
1370
1371                 if (nsk != sk) {
1372                         if (tcp_child_process(sk, nsk, skb))
1373                                 goto reset;
1374                         if (opt_skb)
1375                                 __kfree_skb(opt_skb);
1376                         return 0;
1377                 }
1378         } else
1379                 sock_rps_save_rxhash(sk, skb);
1380
1381         if (tcp_rcv_state_process(sk, skb))
1382                 goto reset;
1383         if (opt_skb)
1384                 goto ipv6_pktoptions;
1385         return 0;
1386
1387 reset:
1388         tcp_v6_send_reset(sk, skb);
1389 discard:
1390         if (opt_skb)
1391                 __kfree_skb(opt_skb);
1392         kfree_skb(skb);
1393         return 0;
1394 csum_err:
1395         TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1396         TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1397         goto discard;
1398
1399
1400 ipv6_pktoptions:
1401         /* Do you ask, what is it?
1402
1403            1. skb was enqueued by tcp.
1404            2. skb is added to tail of read queue, rather than out of order.
1405            3. socket is not in passive state.
1406            4. Finally, it really contains options, which user wants to receive.
1407          */
1408         tp = tcp_sk(sk);
1409         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1410             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1411                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1412                         np->mcast_oif = tcp_v6_iif(opt_skb);
1413                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1414                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1415                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1416                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1417                 if (np->repflow)
1418                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1419                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1420                         skb_set_owner_r(opt_skb, sk);
1421                         tcp_v6_restore_cb(opt_skb);
1422                         opt_skb = xchg(&np->pktoptions, opt_skb);
1423                 } else {
1424                         __kfree_skb(opt_skb);
1425                         opt_skb = xchg(&np->pktoptions, NULL);
1426                 }
1427         }
1428
1429         kfree_skb(opt_skb);
1430         return 0;
1431 }
1432
1433 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1434                            const struct tcphdr *th)
1435 {
1436         /* This is tricky: we move IP6CB at its correct location into
1437          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1438          * _decode_session6() uses IP6CB().
1439          * barrier() makes sure compiler won't play aliasing games.
1440          */
1441         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1442                 sizeof(struct inet6_skb_parm));
1443         barrier();
1444
1445         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1446         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1447                                     skb->len - th->doff*4);
1448         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1449         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1450         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1451         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1452         TCP_SKB_CB(skb)->sacked = 0;
1453         TCP_SKB_CB(skb)->has_rxtstamp =
1454                         skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
1455 }
1456
1457 INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb)
1458 {
1459         struct sk_buff *skb_to_free;
1460         int sdif = inet6_sdif(skb);
1461         const struct tcphdr *th;
1462         const struct ipv6hdr *hdr;
1463         bool refcounted;
1464         struct sock *sk;
1465         int ret;
1466         struct net *net = dev_net(skb->dev);
1467
1468         if (skb->pkt_type != PACKET_HOST)
1469                 goto discard_it;
1470
1471         /*
1472          *      Count it even if it's bad.
1473          */
1474         __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1475
1476         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1477                 goto discard_it;
1478
1479         th = (const struct tcphdr *)skb->data;
1480
1481         if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1482                 goto bad_packet;
1483         if (!pskb_may_pull(skb, th->doff*4))
1484                 goto discard_it;
1485
1486         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1487                 goto csum_error;
1488
1489         th = (const struct tcphdr *)skb->data;
1490         hdr = ipv6_hdr(skb);
1491
1492 lookup:
1493         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1494                                 th->source, th->dest, inet6_iif(skb), sdif,
1495                                 &refcounted);
1496         if (!sk)
1497                 goto no_tcp_socket;
1498
1499 process:
1500         if (sk->sk_state == TCP_TIME_WAIT)
1501                 goto do_time_wait;
1502
1503         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1504                 struct request_sock *req = inet_reqsk(sk);
1505                 bool req_stolen = false;
1506                 struct sock *nsk;
1507
1508                 sk = req->rsk_listener;
1509                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1510                         sk_drops_add(sk, skb);
1511                         reqsk_put(req);
1512                         goto discard_it;
1513                 }
1514                 if (tcp_checksum_complete(skb)) {
1515                         reqsk_put(req);
1516                         goto csum_error;
1517                 }
1518                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1519                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1520                         goto lookup;
1521                 }
1522                 sock_hold(sk);
1523                 refcounted = true;
1524                 nsk = NULL;
1525                 if (!tcp_filter(sk, skb)) {
1526                         th = (const struct tcphdr *)skb->data;
1527                         hdr = ipv6_hdr(skb);
1528                         tcp_v6_fill_cb(skb, hdr, th);
1529                         nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
1530                 }
1531                 if (!nsk) {
1532                         reqsk_put(req);
1533                         if (req_stolen) {
1534                                 /* Another cpu got exclusive access to req
1535                                  * and created a full blown socket.
1536                                  * Try to feed this packet to this socket
1537                                  * instead of discarding it.
1538                                  */
1539                                 tcp_v6_restore_cb(skb);
1540                                 sock_put(sk);
1541                                 goto lookup;
1542                         }
1543                         goto discard_and_relse;
1544                 }
1545                 if (nsk == sk) {
1546                         reqsk_put(req);
1547                         tcp_v6_restore_cb(skb);
1548                 } else if (tcp_child_process(sk, nsk, skb)) {
1549                         tcp_v6_send_reset(nsk, skb);
1550                         goto discard_and_relse;
1551                 } else {
1552                         sock_put(sk);
1553                         return 0;
1554                 }
1555         }
1556         if (hdr->hop_limit < tcp_inet6_sk(sk)->min_hopcount) {
1557                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1558                 goto discard_and_relse;
1559         }
1560
1561         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1562                 goto discard_and_relse;
1563
1564         if (tcp_v6_inbound_md5_hash(sk, skb))
1565                 goto discard_and_relse;
1566
1567         if (tcp_filter(sk, skb))
1568                 goto discard_and_relse;
1569         th = (const struct tcphdr *)skb->data;
1570         hdr = ipv6_hdr(skb);
1571         tcp_v6_fill_cb(skb, hdr, th);
1572
1573         skb->dev = NULL;
1574
1575         if (sk->sk_state == TCP_LISTEN) {
1576                 ret = tcp_v6_do_rcv(sk, skb);
1577                 goto put_and_return;
1578         }
1579
1580         sk_incoming_cpu_update(sk);
1581
1582         bh_lock_sock_nested(sk);
1583         tcp_segs_in(tcp_sk(sk), skb);
1584         ret = 0;
1585         if (!sock_owned_by_user(sk)) {
1586                 skb_to_free = sk->sk_rx_skb_cache;
1587                 sk->sk_rx_skb_cache = NULL;
1588                 ret = tcp_v6_do_rcv(sk, skb);
1589         } else {
1590                 if (tcp_add_backlog(sk, skb))
1591                         goto discard_and_relse;
1592                 skb_to_free = NULL;
1593         }
1594         bh_unlock_sock(sk);
1595         if (skb_to_free)
1596                 __kfree_skb(skb_to_free);
1597 put_and_return:
1598         if (refcounted)
1599                 sock_put(sk);
1600         return ret ? -1 : 0;
1601
1602 no_tcp_socket:
1603         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1604                 goto discard_it;
1605
1606         tcp_v6_fill_cb(skb, hdr, th);
1607
1608         if (tcp_checksum_complete(skb)) {
1609 csum_error:
1610                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1611 bad_packet:
1612                 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1613         } else {
1614                 tcp_v6_send_reset(NULL, skb);
1615         }
1616
1617 discard_it:
1618         kfree_skb(skb);
1619         return 0;
1620
1621 discard_and_relse:
1622         sk_drops_add(sk, skb);
1623         if (refcounted)
1624                 sock_put(sk);
1625         goto discard_it;
1626
1627 do_time_wait:
1628         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1629                 inet_twsk_put(inet_twsk(sk));
1630                 goto discard_it;
1631         }
1632
1633         tcp_v6_fill_cb(skb, hdr, th);
1634
1635         if (tcp_checksum_complete(skb)) {
1636                 inet_twsk_put(inet_twsk(sk));
1637                 goto csum_error;
1638         }
1639
1640         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1641         case TCP_TW_SYN:
1642         {
1643                 struct sock *sk2;
1644
1645                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1646                                             skb, __tcp_hdrlen(th),
1647                                             &ipv6_hdr(skb)->saddr, th->source,
1648                                             &ipv6_hdr(skb)->daddr,
1649                                             ntohs(th->dest),
1650                                             tcp_v6_iif_l3_slave(skb),
1651                                             sdif);
1652                 if (sk2) {
1653                         struct inet_timewait_sock *tw = inet_twsk(sk);
1654                         inet_twsk_deschedule_put(tw);
1655                         sk = sk2;
1656                         tcp_v6_restore_cb(skb);
1657                         refcounted = false;
1658                         goto process;
1659                 }
1660         }
1661                 /* to ACK */
1662                 /* fall through */
1663         case TCP_TW_ACK:
1664                 tcp_v6_timewait_ack(sk, skb);
1665                 break;
1666         case TCP_TW_RST:
1667                 tcp_v6_send_reset(sk, skb);
1668                 inet_twsk_deschedule_put(inet_twsk(sk));
1669                 goto discard_it;
1670         case TCP_TW_SUCCESS:
1671                 ;
1672         }
1673         goto discard_it;
1674 }
1675
1676 INDIRECT_CALLABLE_SCOPE void tcp_v6_early_demux(struct sk_buff *skb)
1677 {
1678         const struct ipv6hdr *hdr;
1679         const struct tcphdr *th;
1680         struct sock *sk;
1681
1682         if (skb->pkt_type != PACKET_HOST)
1683                 return;
1684
1685         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1686                 return;
1687
1688         hdr = ipv6_hdr(skb);
1689         th = tcp_hdr(skb);
1690
1691         if (th->doff < sizeof(struct tcphdr) / 4)
1692                 return;
1693
1694         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1695         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1696                                         &hdr->saddr, th->source,
1697                                         &hdr->daddr, ntohs(th->dest),
1698                                         inet6_iif(skb), inet6_sdif(skb));
1699         if (sk) {
1700                 skb->sk = sk;
1701                 skb->destructor = sock_edemux;
1702                 if (sk_fullsock(sk)) {
1703                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1704
1705                         if (dst)
1706                                 dst = dst_check(dst, tcp_inet6_sk(sk)->rx_dst_cookie);
1707                         if (dst &&
1708                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1709                                 skb_dst_set_noref(skb, dst);
1710                 }
1711         }
1712 }
1713
1714 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1715         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1716         .twsk_unique    = tcp_twsk_unique,
1717         .twsk_destructor = tcp_twsk_destructor,
1718 };
1719
1720 static const struct inet_connection_sock_af_ops ipv6_specific = {
1721         .queue_xmit        = inet6_csk_xmit,
1722         .send_check        = tcp_v6_send_check,
1723         .rebuild_header    = inet6_sk_rebuild_header,
1724         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1725         .conn_request      = tcp_v6_conn_request,
1726         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1727         .net_header_len    = sizeof(struct ipv6hdr),
1728         .net_frag_header_len = sizeof(struct frag_hdr),
1729         .setsockopt        = ipv6_setsockopt,
1730         .getsockopt        = ipv6_getsockopt,
1731         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1732         .sockaddr_len      = sizeof(struct sockaddr_in6),
1733 #ifdef CONFIG_COMPAT
1734         .compat_setsockopt = compat_ipv6_setsockopt,
1735         .compat_getsockopt = compat_ipv6_getsockopt,
1736 #endif
1737         .mtu_reduced       = tcp_v6_mtu_reduced,
1738 };
1739
1740 #ifdef CONFIG_TCP_MD5SIG
1741 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1742         .md5_lookup     =       tcp_v6_md5_lookup,
1743         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1744         .md5_parse      =       tcp_v6_parse_md5_keys,
1745 };
1746 #endif
1747
1748 /*
1749  *      TCP over IPv4 via INET6 API
1750  */
1751 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1752         .queue_xmit        = ip_queue_xmit,
1753         .send_check        = tcp_v4_send_check,
1754         .rebuild_header    = inet_sk_rebuild_header,
1755         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1756         .conn_request      = tcp_v6_conn_request,
1757         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1758         .net_header_len    = sizeof(struct iphdr),
1759         .setsockopt        = ipv6_setsockopt,
1760         .getsockopt        = ipv6_getsockopt,
1761         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1762         .sockaddr_len      = sizeof(struct sockaddr_in6),
1763 #ifdef CONFIG_COMPAT
1764         .compat_setsockopt = compat_ipv6_setsockopt,
1765         .compat_getsockopt = compat_ipv6_getsockopt,
1766 #endif
1767         .mtu_reduced       = tcp_v4_mtu_reduced,
1768 };
1769
1770 #ifdef CONFIG_TCP_MD5SIG
1771 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1772         .md5_lookup     =       tcp_v4_md5_lookup,
1773         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1774         .md5_parse      =       tcp_v6_parse_md5_keys,
1775 };
1776 #endif
1777
1778 /* NOTE: A lot of things set to zero explicitly by call to
1779  *       sk_alloc() so need not be done here.
1780  */
1781 static int tcp_v6_init_sock(struct sock *sk)
1782 {
1783         struct inet_connection_sock *icsk = inet_csk(sk);
1784
1785         tcp_init_sock(sk);
1786
1787         icsk->icsk_af_ops = &ipv6_specific;
1788
1789 #ifdef CONFIG_TCP_MD5SIG
1790         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1791 #endif
1792
1793         return 0;
1794 }
1795
1796 static void tcp_v6_destroy_sock(struct sock *sk)
1797 {
1798         tcp_v4_destroy_sock(sk);
1799         inet6_destroy_sock(sk);
1800 }
1801
1802 #ifdef CONFIG_PROC_FS
1803 /* Proc filesystem TCPv6 sock list dumping. */
1804 static void get_openreq6(struct seq_file *seq,
1805                          const struct request_sock *req, int i)
1806 {
1807         long ttd = req->rsk_timer.expires - jiffies;
1808         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1809         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1810
1811         if (ttd < 0)
1812                 ttd = 0;
1813
1814         seq_printf(seq,
1815                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1816                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1817                    i,
1818                    src->s6_addr32[0], src->s6_addr32[1],
1819                    src->s6_addr32[2], src->s6_addr32[3],
1820                    inet_rsk(req)->ir_num,
1821                    dest->s6_addr32[0], dest->s6_addr32[1],
1822                    dest->s6_addr32[2], dest->s6_addr32[3],
1823                    ntohs(inet_rsk(req)->ir_rmt_port),
1824                    TCP_SYN_RECV,
1825                    0, 0, /* could print option size, but that is af dependent. */
1826                    1,   /* timers active (only the expire timer) */
1827                    jiffies_to_clock_t(ttd),
1828                    req->num_timeout,
1829                    from_kuid_munged(seq_user_ns(seq),
1830                                     sock_i_uid(req->rsk_listener)),
1831                    0,  /* non standard timer */
1832                    0, /* open_requests have no inode */
1833                    0, req);
1834 }
1835
1836 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1837 {
1838         const struct in6_addr *dest, *src;
1839         __u16 destp, srcp;
1840         int timer_active;
1841         unsigned long timer_expires;
1842         const struct inet_sock *inet = inet_sk(sp);
1843         const struct tcp_sock *tp = tcp_sk(sp);
1844         const struct inet_connection_sock *icsk = inet_csk(sp);
1845         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1846         int rx_queue;
1847         int state;
1848
1849         dest  = &sp->sk_v6_daddr;
1850         src   = &sp->sk_v6_rcv_saddr;
1851         destp = ntohs(inet->inet_dport);
1852         srcp  = ntohs(inet->inet_sport);
1853
1854         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1855             icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1856             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1857                 timer_active    = 1;
1858                 timer_expires   = icsk->icsk_timeout;
1859         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1860                 timer_active    = 4;
1861                 timer_expires   = icsk->icsk_timeout;
1862         } else if (timer_pending(&sp->sk_timer)) {
1863                 timer_active    = 2;
1864                 timer_expires   = sp->sk_timer.expires;
1865         } else {
1866                 timer_active    = 0;
1867                 timer_expires = jiffies;
1868         }
1869
1870         state = inet_sk_state_load(sp);
1871         if (state == TCP_LISTEN)
1872                 rx_queue = sp->sk_ack_backlog;
1873         else
1874                 /* Because we don't lock the socket,
1875                  * we might find a transient negative value.
1876                  */
1877                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1878
1879         seq_printf(seq,
1880                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1881                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1882                    i,
1883                    src->s6_addr32[0], src->s6_addr32[1],
1884                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1885                    dest->s6_addr32[0], dest->s6_addr32[1],
1886                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1887                    state,
1888                    tp->write_seq - tp->snd_una,
1889                    rx_queue,
1890                    timer_active,
1891                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1892                    icsk->icsk_retransmits,
1893                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1894                    icsk->icsk_probes_out,
1895                    sock_i_ino(sp),
1896                    refcount_read(&sp->sk_refcnt), sp,
1897                    jiffies_to_clock_t(icsk->icsk_rto),
1898                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1899                    (icsk->icsk_ack.quick << 1) | inet_csk_in_pingpong_mode(sp),
1900                    tp->snd_cwnd,
1901                    state == TCP_LISTEN ?
1902                         fastopenq->max_qlen :
1903                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1904                    );
1905 }
1906
1907 static void get_timewait6_sock(struct seq_file *seq,
1908                                struct inet_timewait_sock *tw, int i)
1909 {
1910         long delta = tw->tw_timer.expires - jiffies;
1911         const struct in6_addr *dest, *src;
1912         __u16 destp, srcp;
1913
1914         dest = &tw->tw_v6_daddr;
1915         src  = &tw->tw_v6_rcv_saddr;
1916         destp = ntohs(tw->tw_dport);
1917         srcp  = ntohs(tw->tw_sport);
1918
1919         seq_printf(seq,
1920                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1921                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1922                    i,
1923                    src->s6_addr32[0], src->s6_addr32[1],
1924                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1925                    dest->s6_addr32[0], dest->s6_addr32[1],
1926                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1927                    tw->tw_substate, 0, 0,
1928                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1929                    refcount_read(&tw->tw_refcnt), tw);
1930 }
1931
1932 static int tcp6_seq_show(struct seq_file *seq, void *v)
1933 {
1934         struct tcp_iter_state *st;
1935         struct sock *sk = v;
1936
1937         if (v == SEQ_START_TOKEN) {
1938                 seq_puts(seq,
1939                          "  sl  "
1940                          "local_address                         "
1941                          "remote_address                        "
1942                          "st tx_queue rx_queue tr tm->when retrnsmt"
1943                          "   uid  timeout inode\n");
1944                 goto out;
1945         }
1946         st = seq->private;
1947
1948         if (sk->sk_state == TCP_TIME_WAIT)
1949                 get_timewait6_sock(seq, v, st->num);
1950         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1951                 get_openreq6(seq, v, st->num);
1952         else
1953                 get_tcp6_sock(seq, v, st->num);
1954 out:
1955         return 0;
1956 }
1957
1958 static const struct seq_operations tcp6_seq_ops = {
1959         .show           = tcp6_seq_show,
1960         .start          = tcp_seq_start,
1961         .next           = tcp_seq_next,
1962         .stop           = tcp_seq_stop,
1963 };
1964
1965 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1966         .family         = AF_INET6,
1967 };
1968
1969 int __net_init tcp6_proc_init(struct net *net)
1970 {
1971         if (!proc_create_net_data("tcp6", 0444, net->proc_net, &tcp6_seq_ops,
1972                         sizeof(struct tcp_iter_state), &tcp6_seq_afinfo))
1973                 return -ENOMEM;
1974         return 0;
1975 }
1976
1977 void tcp6_proc_exit(struct net *net)
1978 {
1979         remove_proc_entry("tcp6", net->proc_net);
1980 }
1981 #endif
1982
1983 struct proto tcpv6_prot = {
1984         .name                   = "TCPv6",
1985         .owner                  = THIS_MODULE,
1986         .close                  = tcp_close,
1987         .pre_connect            = tcp_v6_pre_connect,
1988         .connect                = tcp_v6_connect,
1989         .disconnect             = tcp_disconnect,
1990         .accept                 = inet_csk_accept,
1991         .ioctl                  = tcp_ioctl,
1992         .init                   = tcp_v6_init_sock,
1993         .destroy                = tcp_v6_destroy_sock,
1994         .shutdown               = tcp_shutdown,
1995         .setsockopt             = tcp_setsockopt,
1996         .getsockopt             = tcp_getsockopt,
1997         .keepalive              = tcp_set_keepalive,
1998         .recvmsg                = tcp_recvmsg,
1999         .sendmsg                = tcp_sendmsg,
2000         .sendpage               = tcp_sendpage,
2001         .backlog_rcv            = tcp_v6_do_rcv,
2002         .release_cb             = tcp_release_cb,
2003         .hash                   = inet6_hash,
2004         .unhash                 = inet_unhash,
2005         .get_port               = inet_csk_get_port,
2006         .enter_memory_pressure  = tcp_enter_memory_pressure,
2007         .leave_memory_pressure  = tcp_leave_memory_pressure,
2008         .stream_memory_free     = tcp_stream_memory_free,
2009         .sockets_allocated      = &tcp_sockets_allocated,
2010         .memory_allocated       = &tcp_memory_allocated,
2011         .memory_pressure        = &tcp_memory_pressure,
2012         .orphan_count           = &tcp_orphan_count,
2013         .sysctl_mem             = sysctl_tcp_mem,
2014         .sysctl_wmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_wmem),
2015         .sysctl_rmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_rmem),
2016         .max_header             = MAX_TCP_HEADER,
2017         .obj_size               = sizeof(struct tcp6_sock),
2018         .slab_flags             = SLAB_TYPESAFE_BY_RCU,
2019         .twsk_prot              = &tcp6_timewait_sock_ops,
2020         .rsk_prot               = &tcp6_request_sock_ops,
2021         .h.hashinfo             = &tcp_hashinfo,
2022         .no_autobind            = true,
2023 #ifdef CONFIG_COMPAT
2024         .compat_setsockopt      = compat_tcp_setsockopt,
2025         .compat_getsockopt      = compat_tcp_getsockopt,
2026 #endif
2027         .diag_destroy           = tcp_abort,
2028 };
2029
2030 /* thinking of making this const? Don't.
2031  * early_demux can change based on sysctl.
2032  */
2033 static struct inet6_protocol tcpv6_protocol = {
2034         .early_demux    =       tcp_v6_early_demux,
2035         .early_demux_handler =  tcp_v6_early_demux,
2036         .handler        =       tcp_v6_rcv,
2037         .err_handler    =       tcp_v6_err,
2038         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2039 };
2040
2041 static struct inet_protosw tcpv6_protosw = {
2042         .type           =       SOCK_STREAM,
2043         .protocol       =       IPPROTO_TCP,
2044         .prot           =       &tcpv6_prot,
2045         .ops            =       &inet6_stream_ops,
2046         .flags          =       INET_PROTOSW_PERMANENT |
2047                                 INET_PROTOSW_ICSK,
2048 };
2049
2050 static int __net_init tcpv6_net_init(struct net *net)
2051 {
2052         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2053                                     SOCK_RAW, IPPROTO_TCP, net);
2054 }
2055
2056 static void __net_exit tcpv6_net_exit(struct net *net)
2057 {
2058         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2059 }
2060
2061 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2062 {
2063         inet_twsk_purge(&tcp_hashinfo, AF_INET6);
2064 }
2065
2066 static struct pernet_operations tcpv6_net_ops = {
2067         .init       = tcpv6_net_init,
2068         .exit       = tcpv6_net_exit,
2069         .exit_batch = tcpv6_net_exit_batch,
2070 };
2071
2072 int __init tcpv6_init(void)
2073 {
2074         int ret;
2075
2076         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2077         if (ret)
2078                 goto out;
2079
2080         /* register inet6 protocol */
2081         ret = inet6_register_protosw(&tcpv6_protosw);
2082         if (ret)
2083                 goto out_tcpv6_protocol;
2084
2085         ret = register_pernet_subsys(&tcpv6_net_ops);
2086         if (ret)
2087                 goto out_tcpv6_protosw;
2088 out:
2089         return ret;
2090
2091 out_tcpv6_protosw:
2092         inet6_unregister_protosw(&tcpv6_protosw);
2093 out_tcpv6_protocol:
2094         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2095         goto out;
2096 }
2097
2098 void tcpv6_exit(void)
2099 {
2100         unregister_pernet_subsys(&tcpv6_net_ops);
2101         inet6_unregister_protosw(&tcpv6_protosw);
2102         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2103 }