3 * Linux INET6 implementation
6 * Pedro Roque <roque@di.fc.ul.pt>
10 * linux/net/ipv4/tcp_input.c
11 * linux/net/ipv4/tcp_output.c
14 * Hideaki YOSHIFUJI : sin6_scope_id support
15 * YOSHIFUJI Hideaki @USAGI and: Support IPV6_V6ONLY socket option, which
16 * Alexey Kuznetsov allow both IPv4 and IPv6 sockets to bind
17 * a single port at the same time.
18 * YOSHIFUJI Hideaki @USAGI: convert /proc/net/tcp6 to seq_file.
20 * This program is free software; you can redistribute it and/or
21 * modify it under the terms of the GNU General Public License
22 * as published by the Free Software Foundation; either version
23 * 2 of the License, or (at your option) any later version.
26 #include <linux/bottom_half.h>
27 #include <linux/module.h>
28 #include <linux/errno.h>
29 #include <linux/types.h>
30 #include <linux/socket.h>
31 #include <linux/sockios.h>
32 #include <linux/net.h>
33 #include <linux/jiffies.h>
35 #include <linux/in6.h>
36 #include <linux/netdevice.h>
37 #include <linux/init.h>
38 #include <linux/jhash.h>
39 #include <linux/ipsec.h>
40 #include <linux/times.h>
41 #include <linux/slab.h>
42 #include <linux/uaccess.h>
43 #include <linux/ipv6.h>
44 #include <linux/icmpv6.h>
45 #include <linux/random.h>
48 #include <net/ndisc.h>
49 #include <net/inet6_hashtables.h>
50 #include <net/inet6_connection_sock.h>
52 #include <net/transp_v6.h>
53 #include <net/addrconf.h>
54 #include <net/ip6_route.h>
55 #include <net/ip6_checksum.h>
56 #include <net/inet_ecn.h>
57 #include <net/protocol.h>
60 #include <net/dsfield.h>
61 #include <net/timewait_sock.h>
62 #include <net/inet_common.h>
63 #include <net/secure_seq.h>
64 #include <net/busy_poll.h>
66 #include <linux/proc_fs.h>
67 #include <linux/seq_file.h>
69 #include <crypto/hash.h>
70 #include <linux/scatterlist.h>
72 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
73 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
74 struct request_sock *req);
76 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
78 static const struct inet_connection_sock_af_ops ipv6_mapped;
79 static const struct inet_connection_sock_af_ops ipv6_specific;
80 #ifdef CONFIG_TCP_MD5SIG
81 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
82 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
84 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
85 const struct in6_addr *addr)
91 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
93 struct dst_entry *dst = skb_dst(skb);
95 if (dst && dst_hold_safe(dst)) {
96 const struct rt6_info *rt = (const struct rt6_info *)dst;
99 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
100 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
104 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
106 return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
107 ipv6_hdr(skb)->saddr.s6_addr32,
109 tcp_hdr(skb)->source);
112 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
115 struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
116 struct inet_sock *inet = inet_sk(sk);
117 struct inet_connection_sock *icsk = inet_csk(sk);
118 struct ipv6_pinfo *np = inet6_sk(sk);
119 struct tcp_sock *tp = tcp_sk(sk);
120 struct in6_addr *saddr = NULL, *final_p, final;
121 struct ipv6_txoptions *opt;
123 struct dst_entry *dst;
127 if (addr_len < SIN6_LEN_RFC2133)
130 if (usin->sin6_family != AF_INET6)
131 return -EAFNOSUPPORT;
133 memset(&fl6, 0, sizeof(fl6));
136 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
137 IP6_ECN_flow_init(fl6.flowlabel);
138 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
139 struct ip6_flowlabel *flowlabel;
140 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
143 fl6_sock_release(flowlabel);
148 * connect() to INADDR_ANY means loopback (BSD'ism).
151 if (ipv6_addr_any(&usin->sin6_addr))
152 usin->sin6_addr.s6_addr[15] = 0x1;
154 addr_type = ipv6_addr_type(&usin->sin6_addr);
156 if (addr_type & IPV6_ADDR_MULTICAST)
159 if (addr_type&IPV6_ADDR_LINKLOCAL) {
160 if (addr_len >= sizeof(struct sockaddr_in6) &&
161 usin->sin6_scope_id) {
162 /* If interface is set while binding, indices
165 if (sk->sk_bound_dev_if &&
166 sk->sk_bound_dev_if != usin->sin6_scope_id)
169 sk->sk_bound_dev_if = usin->sin6_scope_id;
172 /* Connect to link-local address requires an interface */
173 if (!sk->sk_bound_dev_if)
177 if (tp->rx_opt.ts_recent_stamp &&
178 !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
179 tp->rx_opt.ts_recent = 0;
180 tp->rx_opt.ts_recent_stamp = 0;
184 sk->sk_v6_daddr = usin->sin6_addr;
185 np->flow_label = fl6.flowlabel;
191 if (addr_type == IPV6_ADDR_MAPPED) {
192 u32 exthdrlen = icsk->icsk_ext_hdr_len;
193 struct sockaddr_in sin;
195 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
197 if (__ipv6_only_sock(sk))
200 sin.sin_family = AF_INET;
201 sin.sin_port = usin->sin6_port;
202 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
204 icsk->icsk_af_ops = &ipv6_mapped;
205 sk->sk_backlog_rcv = tcp_v4_do_rcv;
206 #ifdef CONFIG_TCP_MD5SIG
207 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
210 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
213 icsk->icsk_ext_hdr_len = exthdrlen;
214 icsk->icsk_af_ops = &ipv6_specific;
215 sk->sk_backlog_rcv = tcp_v6_do_rcv;
216 #ifdef CONFIG_TCP_MD5SIG
217 tp->af_specific = &tcp_sock_ipv6_specific;
221 np->saddr = sk->sk_v6_rcv_saddr;
226 if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
227 saddr = &sk->sk_v6_rcv_saddr;
229 fl6.flowi6_proto = IPPROTO_TCP;
230 fl6.daddr = sk->sk_v6_daddr;
231 fl6.saddr = saddr ? *saddr : np->saddr;
232 fl6.flowi6_oif = sk->sk_bound_dev_if;
233 fl6.flowi6_mark = sk->sk_mark;
234 fl6.fl6_dport = usin->sin6_port;
235 fl6.fl6_sport = inet->inet_sport;
237 opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
238 final_p = fl6_update_dst(&fl6, opt, &final);
240 security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
242 dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
250 sk->sk_v6_rcv_saddr = *saddr;
253 /* set the source address */
255 inet->inet_rcv_saddr = LOOPBACK4_IPV6;
257 sk->sk_gso_type = SKB_GSO_TCPV6;
258 ip6_dst_store(sk, dst, NULL, NULL);
260 if (tcp_death_row.sysctl_tw_recycle &&
261 !tp->rx_opt.ts_recent_stamp &&
262 ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
263 tcp_fetch_timewait_stamp(sk, dst);
265 icsk->icsk_ext_hdr_len = 0;
267 icsk->icsk_ext_hdr_len = opt->opt_flen +
270 tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
272 inet->inet_dport = usin->sin6_port;
274 tcp_set_state(sk, TCP_SYN_SENT);
275 err = inet6_hash_connect(&tcp_death_row, sk);
281 if (!tp->write_seq && likely(!tp->repair))
282 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
283 sk->sk_v6_daddr.s6_addr32,
287 err = tcp_connect(sk);
294 tcp_set_state(sk, TCP_CLOSE);
297 inet->inet_dport = 0;
298 sk->sk_route_caps = 0;
302 static void tcp_v6_mtu_reduced(struct sock *sk)
304 struct dst_entry *dst;
306 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
309 dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
313 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
314 tcp_sync_mss(sk, dst_mtu(dst));
315 tcp_simple_retransmit(sk);
319 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
320 u8 type, u8 code, int offset, __be32 info)
322 const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
323 const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
324 struct net *net = dev_net(skb->dev);
325 struct request_sock *fastopen;
326 struct ipv6_pinfo *np;
333 sk = __inet6_lookup_established(net, &tcp_hashinfo,
334 &hdr->daddr, th->dest,
335 &hdr->saddr, ntohs(th->source),
339 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
344 if (sk->sk_state == TCP_TIME_WAIT) {
345 inet_twsk_put(inet_twsk(sk));
348 seq = ntohl(th->seq);
349 fatal = icmpv6_err_convert(type, code, &err);
350 if (sk->sk_state == TCP_NEW_SYN_RECV)
351 return tcp_req_err(sk, seq, fatal);
354 if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
355 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
357 if (sk->sk_state == TCP_CLOSE)
360 if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
361 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
366 /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
367 fastopen = tp->fastopen_rsk;
368 snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
369 if (sk->sk_state != TCP_LISTEN &&
370 !between(seq, snd_una, tp->snd_nxt)) {
371 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
377 if (type == NDISC_REDIRECT) {
378 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
381 dst->ops->redirect(dst, sk, skb);
385 if (type == ICMPV6_PKT_TOOBIG) {
386 /* We are not interested in TCP_LISTEN and open_requests
387 * (SYN-ACKs send out by Linux are always <576bytes so
388 * they should go through unfragmented).
390 if (sk->sk_state == TCP_LISTEN)
393 if (!ip6_sk_accept_pmtu(sk))
396 tp->mtu_info = ntohl(info);
397 if (!sock_owned_by_user(sk))
398 tcp_v6_mtu_reduced(sk);
399 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
406 /* Might be for an request_sock */
407 switch (sk->sk_state) {
410 /* Only in fast or simultaneous open. If a fast open socket is
411 * is already accepted it is treated as a connected one below.
413 if (fastopen && !fastopen->sk)
416 if (!sock_owned_by_user(sk)) {
418 sk->sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */
422 sk->sk_err_soft = err;
426 if (!sock_owned_by_user(sk) && np->recverr) {
428 sk->sk_error_report(sk);
430 sk->sk_err_soft = err;
438 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
440 struct request_sock *req,
441 struct tcp_fastopen_cookie *foc,
442 enum tcp_synack_type synack_type)
444 struct inet_request_sock *ireq = inet_rsk(req);
445 struct ipv6_pinfo *np = inet6_sk(sk);
446 struct ipv6_txoptions *opt;
447 struct flowi6 *fl6 = &fl->u.ip6;
451 /* First, grab a route. */
452 if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
453 IPPROTO_TCP)) == NULL)
456 skb = tcp_make_synack(sk, dst, req, foc, synack_type);
459 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
460 &ireq->ir_v6_rmt_addr);
462 fl6->daddr = ireq->ir_v6_rmt_addr;
463 if (np->repflow && ireq->pktopts)
464 fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
467 opt = ireq->ipv6_opt;
469 opt = rcu_dereference(np->opt);
470 err = ip6_xmit(sk, skb, fl6, opt, np->tclass);
472 err = net_xmit_eval(err);
480 static void tcp_v6_reqsk_destructor(struct request_sock *req)
482 kfree(inet_rsk(req)->ipv6_opt);
483 kfree_skb(inet_rsk(req)->pktopts);
486 #ifdef CONFIG_TCP_MD5SIG
487 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
488 const struct in6_addr *addr)
490 return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
493 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
494 const struct sock *addr_sk)
496 return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
499 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
502 struct tcp_md5sig cmd;
503 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
505 if (optlen < sizeof(cmd))
508 if (copy_from_user(&cmd, optval, sizeof(cmd)))
511 if (sin6->sin6_family != AF_INET6)
514 if (!cmd.tcpm_keylen) {
515 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
516 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
518 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
522 if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
525 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
526 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
527 AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
529 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
530 AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
533 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
534 const struct in6_addr *daddr,
535 const struct in6_addr *saddr,
536 const struct tcphdr *th, int nbytes)
538 struct tcp6_pseudohdr *bp;
539 struct scatterlist sg;
543 /* 1. TCP pseudo-header (RFC2460) */
546 bp->protocol = cpu_to_be32(IPPROTO_TCP);
547 bp->len = cpu_to_be32(nbytes);
549 _th = (struct tcphdr *)(bp + 1);
550 memcpy(_th, th, sizeof(*th));
553 sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
554 ahash_request_set_crypt(hp->md5_req, &sg, NULL,
555 sizeof(*bp) + sizeof(*th));
556 return crypto_ahash_update(hp->md5_req);
559 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
560 const struct in6_addr *daddr, struct in6_addr *saddr,
561 const struct tcphdr *th)
563 struct tcp_md5sig_pool *hp;
564 struct ahash_request *req;
566 hp = tcp_get_md5sig_pool();
568 goto clear_hash_noput;
571 if (crypto_ahash_init(req))
573 if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
575 if (tcp_md5_hash_key(hp, key))
577 ahash_request_set_crypt(req, NULL, md5_hash, 0);
578 if (crypto_ahash_final(req))
581 tcp_put_md5sig_pool();
585 tcp_put_md5sig_pool();
587 memset(md5_hash, 0, 16);
591 static int tcp_v6_md5_hash_skb(char *md5_hash,
592 const struct tcp_md5sig_key *key,
593 const struct sock *sk,
594 const struct sk_buff *skb)
596 const struct in6_addr *saddr, *daddr;
597 struct tcp_md5sig_pool *hp;
598 struct ahash_request *req;
599 const struct tcphdr *th = tcp_hdr(skb);
601 if (sk) { /* valid for establish/request sockets */
602 saddr = &sk->sk_v6_rcv_saddr;
603 daddr = &sk->sk_v6_daddr;
605 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
606 saddr = &ip6h->saddr;
607 daddr = &ip6h->daddr;
610 hp = tcp_get_md5sig_pool();
612 goto clear_hash_noput;
615 if (crypto_ahash_init(req))
618 if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
620 if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
622 if (tcp_md5_hash_key(hp, key))
624 ahash_request_set_crypt(req, NULL, md5_hash, 0);
625 if (crypto_ahash_final(req))
628 tcp_put_md5sig_pool();
632 tcp_put_md5sig_pool();
634 memset(md5_hash, 0, 16);
640 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
641 const struct sk_buff *skb)
643 #ifdef CONFIG_TCP_MD5SIG
644 const __u8 *hash_location = NULL;
645 struct tcp_md5sig_key *hash_expected;
646 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
647 const struct tcphdr *th = tcp_hdr(skb);
651 hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
652 hash_location = tcp_parse_md5sig_option(th);
654 /* We've parsed the options - do we have a hash? */
655 if (!hash_expected && !hash_location)
658 if (hash_expected && !hash_location) {
659 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
663 if (!hash_expected && hash_location) {
664 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
668 /* check the signature */
669 genhash = tcp_v6_md5_hash_skb(newhash,
673 if (genhash || memcmp(hash_location, newhash, 16) != 0) {
674 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
675 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
676 genhash ? "failed" : "mismatch",
677 &ip6h->saddr, ntohs(th->source),
678 &ip6h->daddr, ntohs(th->dest));
685 static void tcp_v6_init_req(struct request_sock *req,
686 const struct sock *sk_listener,
689 struct inet_request_sock *ireq = inet_rsk(req);
690 const struct ipv6_pinfo *np = inet6_sk(sk_listener);
692 ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
693 ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
695 /* So that link locals have meaning */
696 if (!sk_listener->sk_bound_dev_if &&
697 ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
698 ireq->ir_iif = tcp_v6_iif(skb);
700 if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
701 (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
702 np->rxopt.bits.rxinfo ||
703 np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
704 np->rxopt.bits.rxohlim || np->repflow)) {
705 atomic_inc(&skb->users);
710 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
712 const struct request_sock *req,
717 return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
720 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
722 .obj_size = sizeof(struct tcp6_request_sock),
723 .rtx_syn_ack = tcp_rtx_synack,
724 .send_ack = tcp_v6_reqsk_send_ack,
725 .destructor = tcp_v6_reqsk_destructor,
726 .send_reset = tcp_v6_send_reset,
727 .syn_ack_timeout = tcp_syn_ack_timeout,
730 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
731 .mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) -
732 sizeof(struct ipv6hdr),
733 #ifdef CONFIG_TCP_MD5SIG
734 .req_md5_lookup = tcp_v6_md5_lookup,
735 .calc_md5_hash = tcp_v6_md5_hash_skb,
737 .init_req = tcp_v6_init_req,
738 #ifdef CONFIG_SYN_COOKIES
739 .cookie_init_seq = cookie_v6_init_sequence,
741 .route_req = tcp_v6_route_req,
742 .init_seq = tcp_v6_init_sequence,
743 .send_synack = tcp_v6_send_synack,
746 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
747 u32 ack, u32 win, u32 tsval, u32 tsecr,
748 int oif, struct tcp_md5sig_key *key, int rst,
749 u8 tclass, __be32 label)
751 const struct tcphdr *th = tcp_hdr(skb);
753 struct sk_buff *buff;
755 struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
756 struct sock *ctl_sk = net->ipv6.tcp_sk;
757 unsigned int tot_len = sizeof(struct tcphdr);
758 struct dst_entry *dst;
762 tot_len += TCPOLEN_TSTAMP_ALIGNED;
763 #ifdef CONFIG_TCP_MD5SIG
765 tot_len += TCPOLEN_MD5SIG_ALIGNED;
768 buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
773 skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
775 t1 = (struct tcphdr *) skb_push(buff, tot_len);
776 skb_reset_transport_header(buff);
778 /* Swap the send and the receive. */
779 memset(t1, 0, sizeof(*t1));
780 t1->dest = th->source;
781 t1->source = th->dest;
782 t1->doff = tot_len / 4;
783 t1->seq = htonl(seq);
784 t1->ack_seq = htonl(ack);
785 t1->ack = !rst || !th->ack;
787 t1->window = htons(win);
789 topt = (__be32 *)(t1 + 1);
792 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
793 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
794 *topt++ = htonl(tsval);
795 *topt++ = htonl(tsecr);
798 #ifdef CONFIG_TCP_MD5SIG
800 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
801 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
802 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
803 &ipv6_hdr(skb)->saddr,
804 &ipv6_hdr(skb)->daddr, t1);
808 memset(&fl6, 0, sizeof(fl6));
809 fl6.daddr = ipv6_hdr(skb)->saddr;
810 fl6.saddr = ipv6_hdr(skb)->daddr;
811 fl6.flowlabel = label;
813 buff->ip_summed = CHECKSUM_PARTIAL;
816 __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
818 fl6.flowi6_proto = IPPROTO_TCP;
819 if (rt6_need_strict(&fl6.daddr) && !oif)
820 fl6.flowi6_oif = tcp_v6_iif(skb);
822 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
825 fl6.flowi6_oif = oif;
828 fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
829 fl6.fl6_dport = t1->dest;
830 fl6.fl6_sport = t1->source;
831 security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
833 /* Pass a socket to ip6_dst_lookup either it is for RST
834 * Underlying function will use this to retrieve the network
837 dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
839 skb_dst_set(buff, dst);
840 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
841 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
843 TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
850 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
852 const struct tcphdr *th = tcp_hdr(skb);
853 u32 seq = 0, ack_seq = 0;
854 struct tcp_md5sig_key *key = NULL;
855 #ifdef CONFIG_TCP_MD5SIG
856 const __u8 *hash_location = NULL;
857 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
858 unsigned char newhash[16];
860 struct sock *sk1 = NULL;
867 /* If sk not NULL, it means we did a successful lookup and incoming
868 * route had to be correct. prequeue might have dropped our dst.
870 if (!sk && !ipv6_unicast_destination(skb))
873 #ifdef CONFIG_TCP_MD5SIG
875 hash_location = tcp_parse_md5sig_option(th);
876 if (sk && sk_fullsock(sk)) {
877 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
878 } else if (hash_location) {
880 * active side is lost. Try to find listening socket through
881 * source port, and then find md5 key through listening socket.
882 * we are not loose security here:
883 * Incoming packet is checked with md5 hash with finding key,
884 * no RST generated if md5 hash doesn't match.
886 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
887 &tcp_hashinfo, NULL, 0,
889 th->source, &ipv6h->daddr,
890 ntohs(th->source), tcp_v6_iif(skb));
894 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
898 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
899 if (genhash || memcmp(hash_location, newhash, 16) != 0)
905 seq = ntohl(th->ack_seq);
907 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
910 oif = sk ? sk->sk_bound_dev_if : 0;
911 tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
913 #ifdef CONFIG_TCP_MD5SIG
919 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
920 u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
921 struct tcp_md5sig_key *key, u8 tclass,
924 tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
928 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
930 struct inet_timewait_sock *tw = inet_twsk(sk);
931 struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
933 tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
934 tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
935 tcp_time_stamp + tcptw->tw_ts_offset,
936 tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
937 tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
942 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
943 struct request_sock *req)
945 /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
946 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
949 * The window field (SEG.WND) of every outgoing segment, with the
950 * exception of <SYN> segments, MUST be right-shifted by
951 * Rcv.Wind.Shift bits:
953 tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
954 tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
955 tcp_rsk(req)->rcv_nxt,
956 req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
957 tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
958 tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
963 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
965 #ifdef CONFIG_SYN_COOKIES
966 const struct tcphdr *th = tcp_hdr(skb);
969 sk = cookie_v6_check(sk, skb);
974 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
976 if (skb->protocol == htons(ETH_P_IP))
977 return tcp_v4_conn_request(sk, skb);
979 if (!ipv6_unicast_destination(skb))
982 return tcp_conn_request(&tcp6_request_sock_ops,
983 &tcp_request_sock_ipv6_ops, sk, skb);
987 return 0; /* don't send reset */
990 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
991 struct request_sock *req,
992 struct dst_entry *dst,
993 struct request_sock *req_unhash,
996 struct inet_request_sock *ireq;
997 struct ipv6_pinfo *newnp;
998 const struct ipv6_pinfo *np = inet6_sk(sk);
999 struct ipv6_txoptions *opt;
1000 struct tcp6_sock *newtcp6sk;
1001 struct inet_sock *newinet;
1002 struct tcp_sock *newtp;
1004 #ifdef CONFIG_TCP_MD5SIG
1005 struct tcp_md5sig_key *key;
1009 if (skb->protocol == htons(ETH_P_IP)) {
1014 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1015 req_unhash, own_req);
1020 newtcp6sk = (struct tcp6_sock *)newsk;
1021 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1023 newinet = inet_sk(newsk);
1024 newnp = inet6_sk(newsk);
1025 newtp = tcp_sk(newsk);
1027 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1029 newnp->saddr = newsk->sk_v6_rcv_saddr;
1031 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1032 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1033 #ifdef CONFIG_TCP_MD5SIG
1034 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1037 newnp->ipv6_ac_list = NULL;
1038 newnp->ipv6_fl_list = NULL;
1039 newnp->pktoptions = NULL;
1041 newnp->mcast_oif = tcp_v6_iif(skb);
1042 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1043 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1045 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1048 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1049 * here, tcp_create_openreq_child now does this for us, see the comment in
1050 * that function for the gory details. -acme
1053 /* It is tricky place. Until this moment IPv4 tcp
1054 worked with IPv6 icsk.icsk_af_ops.
1057 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1062 ireq = inet_rsk(req);
1064 if (sk_acceptq_is_full(sk))
1068 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1073 newsk = tcp_create_openreq_child(sk, req, skb);
1078 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1079 * count here, tcp_create_openreq_child now does this for us, see the
1080 * comment in that function for the gory details. -acme
1083 newsk->sk_gso_type = SKB_GSO_TCPV6;
1084 ip6_dst_store(newsk, dst, NULL, NULL);
1085 inet6_sk_rx_dst_set(newsk, skb);
1087 newtcp6sk = (struct tcp6_sock *)newsk;
1088 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1090 newtp = tcp_sk(newsk);
1091 newinet = inet_sk(newsk);
1092 newnp = inet6_sk(newsk);
1094 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1096 newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1097 newnp->saddr = ireq->ir_v6_loc_addr;
1098 newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1099 newsk->sk_bound_dev_if = ireq->ir_iif;
1101 /* Now IPv6 options...
1103 First: no IPv4 options.
1105 newinet->inet_opt = NULL;
1106 newnp->ipv6_ac_list = NULL;
1107 newnp->ipv6_fl_list = NULL;
1110 newnp->rxopt.all = np->rxopt.all;
1112 newnp->pktoptions = NULL;
1114 newnp->mcast_oif = tcp_v6_iif(skb);
1115 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1116 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1118 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1120 /* Clone native IPv6 options from listening socket (if any)
1122 Yes, keeping reference count would be much more clever,
1123 but we make one more one thing there: reattach optmem
1126 opt = ireq->ipv6_opt;
1128 opt = rcu_dereference(np->opt);
1130 opt = ipv6_dup_options(newsk, opt);
1131 RCU_INIT_POINTER(newnp->opt, opt);
1133 inet_csk(newsk)->icsk_ext_hdr_len = 0;
1135 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1138 tcp_ca_openreq_child(newsk, dst);
1140 tcp_sync_mss(newsk, dst_mtu(dst));
1141 newtp->advmss = dst_metric_advmss(dst);
1142 if (tcp_sk(sk)->rx_opt.user_mss &&
1143 tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1144 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1146 tcp_initialize_rcv_mss(newsk);
1148 newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1149 newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1151 #ifdef CONFIG_TCP_MD5SIG
1152 /* Copy over the MD5 key from the original socket */
1153 key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1155 /* We're using one, so create a matching key
1156 * on the newsk structure. If we fail to get
1157 * memory, then we end up not copying the key
1160 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1161 AF_INET6, key->key, key->keylen,
1162 sk_gfp_mask(sk, GFP_ATOMIC));
1166 if (__inet_inherit_port(sk, newsk) < 0) {
1167 inet_csk_prepare_forced_close(newsk);
1171 *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1173 tcp_move_syn(newtp, req);
1175 /* Clone pktoptions received with SYN, if we own the req */
1176 if (ireq->pktopts) {
1177 newnp->pktoptions = skb_clone(ireq->pktopts,
1178 sk_gfp_mask(sk, GFP_ATOMIC));
1179 consume_skb(ireq->pktopts);
1180 ireq->pktopts = NULL;
1181 if (newnp->pktoptions)
1182 skb_set_owner_r(newnp->pktoptions, newsk);
1189 __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1197 static void tcp_v6_restore_cb(struct sk_buff *skb)
1199 /* We need to move header back to the beginning if xfrm6_policy_check()
1200 * and tcp_v6_fill_cb() are going to be called again.
1201 * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1203 memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1204 sizeof(struct inet6_skb_parm));
1207 /* The socket must have it's spinlock held when we get
1208 * here, unless it is a TCP_LISTEN socket.
1210 * We have a potential double-lock case here, so even when
1211 * doing backlog processing we use the BH locking scheme.
1212 * This is because we cannot sleep with the original spinlock
1215 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1217 struct ipv6_pinfo *np = inet6_sk(sk);
1218 struct tcp_sock *tp;
1219 struct sk_buff *opt_skb = NULL;
1221 /* Imagine: socket is IPv6. IPv4 packet arrives,
1222 goes to IPv4 receive handler and backlogged.
1223 From backlog it always goes here. Kerboom...
1224 Fortunately, tcp_rcv_established and rcv_established
1225 handle them correctly, but it is not case with
1226 tcp_v6_hnd_req and tcp_v6_send_reset(). --ANK
1229 if (skb->protocol == htons(ETH_P_IP))
1230 return tcp_v4_do_rcv(sk, skb);
1232 if (sk_filter(sk, skb))
1236 * socket locking is here for SMP purposes as backlog rcv
1237 * is currently called with bh processing disabled.
1240 /* Do Stevens' IPV6_PKTOPTIONS.
1242 Yes, guys, it is the only place in our code, where we
1243 may make it not affecting IPv4.
1244 The rest of code is protocol independent,
1245 and I do not like idea to uglify IPv4.
1247 Actually, all the idea behind IPV6_PKTOPTIONS
1248 looks not very well thought. For now we latch
1249 options, received in the last packet, enqueued
1250 by tcp. Feel free to propose better solution.
1254 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1256 if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1257 struct dst_entry *dst = sk->sk_rx_dst;
1259 sock_rps_save_rxhash(sk, skb);
1260 sk_mark_napi_id(sk, skb);
1262 if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1263 dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1265 sk->sk_rx_dst = NULL;
1269 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1271 goto ipv6_pktoptions;
1275 if (tcp_checksum_complete(skb))
1278 if (sk->sk_state == TCP_LISTEN) {
1279 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1285 sock_rps_save_rxhash(nsk, skb);
1286 sk_mark_napi_id(nsk, skb);
1287 if (tcp_child_process(sk, nsk, skb))
1290 __kfree_skb(opt_skb);
1294 sock_rps_save_rxhash(sk, skb);
1296 if (tcp_rcv_state_process(sk, skb))
1299 goto ipv6_pktoptions;
1303 tcp_v6_send_reset(sk, skb);
1306 __kfree_skb(opt_skb);
1310 TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1311 TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1316 /* Do you ask, what is it?
1318 1. skb was enqueued by tcp.
1319 2. skb is added to tail of read queue, rather than out of order.
1320 3. socket is not in passive state.
1321 4. Finally, it really contains options, which user wants to receive.
1324 if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1325 !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1326 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1327 np->mcast_oif = tcp_v6_iif(opt_skb);
1328 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1329 np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1330 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1331 np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1333 np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1334 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1335 skb_set_owner_r(opt_skb, sk);
1336 tcp_v6_restore_cb(opt_skb);
1337 opt_skb = xchg(&np->pktoptions, opt_skb);
1339 __kfree_skb(opt_skb);
1340 opt_skb = xchg(&np->pktoptions, NULL);
1348 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1349 const struct tcphdr *th)
1351 /* This is tricky: we move IP6CB at its correct location into
1352 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1353 * _decode_session6() uses IP6CB().
1354 * barrier() makes sure compiler won't play aliasing games.
1356 memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1357 sizeof(struct inet6_skb_parm));
1360 TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1361 TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1362 skb->len - th->doff*4);
1363 TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1364 TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1365 TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1366 TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1367 TCP_SKB_CB(skb)->sacked = 0;
1370 static int tcp_v6_rcv(struct sk_buff *skb)
1372 const struct tcphdr *th;
1373 const struct ipv6hdr *hdr;
1377 struct net *net = dev_net(skb->dev);
1379 if (skb->pkt_type != PACKET_HOST)
1383 * Count it even if it's bad.
1385 __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1387 if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1390 th = (const struct tcphdr *)skb->data;
1392 if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1394 if (!pskb_may_pull(skb, th->doff*4))
1397 if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1400 th = (const struct tcphdr *)skb->data;
1401 hdr = ipv6_hdr(skb);
1404 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1405 th->source, th->dest, inet6_iif(skb),
1411 if (sk->sk_state == TCP_TIME_WAIT)
1414 if (sk->sk_state == TCP_NEW_SYN_RECV) {
1415 struct request_sock *req = inet_reqsk(sk);
1418 sk = req->rsk_listener;
1419 tcp_v6_fill_cb(skb, hdr, th);
1420 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1421 sk_drops_add(sk, skb);
1425 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1426 inet_csk_reqsk_queue_drop_and_put(sk, req);
1431 nsk = tcp_check_req(sk, skb, req, false);
1434 goto discard_and_relse;
1438 tcp_v6_restore_cb(skb);
1439 } else if (tcp_child_process(sk, nsk, skb)) {
1440 tcp_v6_send_reset(nsk, skb);
1441 goto discard_and_relse;
1447 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1448 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1449 goto discard_and_relse;
1452 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1453 goto discard_and_relse;
1455 tcp_v6_fill_cb(skb, hdr, th);
1457 if (tcp_v6_inbound_md5_hash(sk, skb))
1458 goto discard_and_relse;
1460 if (sk_filter(sk, skb))
1461 goto discard_and_relse;
1465 if (sk->sk_state == TCP_LISTEN) {
1466 ret = tcp_v6_do_rcv(sk, skb);
1467 goto put_and_return;
1470 sk_incoming_cpu_update(sk);
1472 bh_lock_sock_nested(sk);
1473 tcp_segs_in(tcp_sk(sk), skb);
1475 if (!sock_owned_by_user(sk)) {
1476 if (!tcp_prequeue(sk, skb))
1477 ret = tcp_v6_do_rcv(sk, skb);
1478 } else if (tcp_add_backlog(sk, skb)) {
1479 goto discard_and_relse;
1486 return ret ? -1 : 0;
1489 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1492 tcp_v6_fill_cb(skb, hdr, th);
1494 if (tcp_checksum_complete(skb)) {
1496 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1498 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1500 tcp_v6_send_reset(NULL, skb);
1508 sk_drops_add(sk, skb);
1514 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1515 inet_twsk_put(inet_twsk(sk));
1519 tcp_v6_fill_cb(skb, hdr, th);
1521 if (tcp_checksum_complete(skb)) {
1522 inet_twsk_put(inet_twsk(sk));
1526 switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1531 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1532 skb, __tcp_hdrlen(th),
1533 &ipv6_hdr(skb)->saddr, th->source,
1534 &ipv6_hdr(skb)->daddr,
1535 ntohs(th->dest), tcp_v6_iif(skb));
1537 struct inet_timewait_sock *tw = inet_twsk(sk);
1538 inet_twsk_deschedule_put(tw);
1540 tcp_v6_restore_cb(skb);
1544 /* Fall through to ACK */
1547 tcp_v6_timewait_ack(sk, skb);
1550 tcp_v6_restore_cb(skb);
1551 tcp_v6_send_reset(sk, skb);
1552 inet_twsk_deschedule_put(inet_twsk(sk));
1554 case TCP_TW_SUCCESS:
1560 static void tcp_v6_early_demux(struct sk_buff *skb)
1562 const struct ipv6hdr *hdr;
1563 const struct tcphdr *th;
1566 if (skb->pkt_type != PACKET_HOST)
1569 if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1572 hdr = ipv6_hdr(skb);
1575 if (th->doff < sizeof(struct tcphdr) / 4)
1578 /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1579 sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1580 &hdr->saddr, th->source,
1581 &hdr->daddr, ntohs(th->dest),
1585 skb->destructor = sock_edemux;
1586 if (sk_fullsock(sk)) {
1587 struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1590 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1592 inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1593 skb_dst_set_noref(skb, dst);
1598 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1599 .twsk_obj_size = sizeof(struct tcp6_timewait_sock),
1600 .twsk_unique = tcp_twsk_unique,
1601 .twsk_destructor = tcp_twsk_destructor,
1604 static const struct inet_connection_sock_af_ops ipv6_specific = {
1605 .queue_xmit = inet6_csk_xmit,
1606 .send_check = tcp_v6_send_check,
1607 .rebuild_header = inet6_sk_rebuild_header,
1608 .sk_rx_dst_set = inet6_sk_rx_dst_set,
1609 .conn_request = tcp_v6_conn_request,
1610 .syn_recv_sock = tcp_v6_syn_recv_sock,
1611 .net_header_len = sizeof(struct ipv6hdr),
1612 .net_frag_header_len = sizeof(struct frag_hdr),
1613 .setsockopt = ipv6_setsockopt,
1614 .getsockopt = ipv6_getsockopt,
1615 .addr2sockaddr = inet6_csk_addr2sockaddr,
1616 .sockaddr_len = sizeof(struct sockaddr_in6),
1617 .bind_conflict = inet6_csk_bind_conflict,
1618 #ifdef CONFIG_COMPAT
1619 .compat_setsockopt = compat_ipv6_setsockopt,
1620 .compat_getsockopt = compat_ipv6_getsockopt,
1622 .mtu_reduced = tcp_v6_mtu_reduced,
1625 #ifdef CONFIG_TCP_MD5SIG
1626 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1627 .md5_lookup = tcp_v6_md5_lookup,
1628 .calc_md5_hash = tcp_v6_md5_hash_skb,
1629 .md5_parse = tcp_v6_parse_md5_keys,
1634 * TCP over IPv4 via INET6 API
1636 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1637 .queue_xmit = ip_queue_xmit,
1638 .send_check = tcp_v4_send_check,
1639 .rebuild_header = inet_sk_rebuild_header,
1640 .sk_rx_dst_set = inet_sk_rx_dst_set,
1641 .conn_request = tcp_v6_conn_request,
1642 .syn_recv_sock = tcp_v6_syn_recv_sock,
1643 .net_header_len = sizeof(struct iphdr),
1644 .setsockopt = ipv6_setsockopt,
1645 .getsockopt = ipv6_getsockopt,
1646 .addr2sockaddr = inet6_csk_addr2sockaddr,
1647 .sockaddr_len = sizeof(struct sockaddr_in6),
1648 .bind_conflict = inet6_csk_bind_conflict,
1649 #ifdef CONFIG_COMPAT
1650 .compat_setsockopt = compat_ipv6_setsockopt,
1651 .compat_getsockopt = compat_ipv6_getsockopt,
1653 .mtu_reduced = tcp_v4_mtu_reduced,
1656 #ifdef CONFIG_TCP_MD5SIG
1657 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1658 .md5_lookup = tcp_v4_md5_lookup,
1659 .calc_md5_hash = tcp_v4_md5_hash_skb,
1660 .md5_parse = tcp_v6_parse_md5_keys,
1664 /* NOTE: A lot of things set to zero explicitly by call to
1665 * sk_alloc() so need not be done here.
1667 static int tcp_v6_init_sock(struct sock *sk)
1669 struct inet_connection_sock *icsk = inet_csk(sk);
1673 icsk->icsk_af_ops = &ipv6_specific;
1675 #ifdef CONFIG_TCP_MD5SIG
1676 tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1682 static void tcp_v6_destroy_sock(struct sock *sk)
1684 tcp_v4_destroy_sock(sk);
1685 inet6_destroy_sock(sk);
1688 #ifdef CONFIG_PROC_FS
1689 /* Proc filesystem TCPv6 sock list dumping. */
1690 static void get_openreq6(struct seq_file *seq,
1691 const struct request_sock *req, int i)
1693 long ttd = req->rsk_timer.expires - jiffies;
1694 const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1695 const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1701 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1702 "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1704 src->s6_addr32[0], src->s6_addr32[1],
1705 src->s6_addr32[2], src->s6_addr32[3],
1706 inet_rsk(req)->ir_num,
1707 dest->s6_addr32[0], dest->s6_addr32[1],
1708 dest->s6_addr32[2], dest->s6_addr32[3],
1709 ntohs(inet_rsk(req)->ir_rmt_port),
1711 0, 0, /* could print option size, but that is af dependent. */
1712 1, /* timers active (only the expire timer) */
1713 jiffies_to_clock_t(ttd),
1715 from_kuid_munged(seq_user_ns(seq),
1716 sock_i_uid(req->rsk_listener)),
1717 0, /* non standard timer */
1718 0, /* open_requests have no inode */
1722 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1724 const struct in6_addr *dest, *src;
1727 unsigned long timer_expires;
1728 const struct inet_sock *inet = inet_sk(sp);
1729 const struct tcp_sock *tp = tcp_sk(sp);
1730 const struct inet_connection_sock *icsk = inet_csk(sp);
1731 const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1735 dest = &sp->sk_v6_daddr;
1736 src = &sp->sk_v6_rcv_saddr;
1737 destp = ntohs(inet->inet_dport);
1738 srcp = ntohs(inet->inet_sport);
1740 if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1741 icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
1742 icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1744 timer_expires = icsk->icsk_timeout;
1745 } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1747 timer_expires = icsk->icsk_timeout;
1748 } else if (timer_pending(&sp->sk_timer)) {
1750 timer_expires = sp->sk_timer.expires;
1753 timer_expires = jiffies;
1756 state = sk_state_load(sp);
1757 if (state == TCP_LISTEN)
1758 rx_queue = sp->sk_ack_backlog;
1760 /* Because we don't lock the socket,
1761 * we might find a transient negative value.
1763 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1766 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1767 "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1769 src->s6_addr32[0], src->s6_addr32[1],
1770 src->s6_addr32[2], src->s6_addr32[3], srcp,
1771 dest->s6_addr32[0], dest->s6_addr32[1],
1772 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1774 tp->write_seq - tp->snd_una,
1777 jiffies_delta_to_clock_t(timer_expires - jiffies),
1778 icsk->icsk_retransmits,
1779 from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1780 icsk->icsk_probes_out,
1782 atomic_read(&sp->sk_refcnt), sp,
1783 jiffies_to_clock_t(icsk->icsk_rto),
1784 jiffies_to_clock_t(icsk->icsk_ack.ato),
1785 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1787 state == TCP_LISTEN ?
1788 fastopenq->max_qlen :
1789 (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1793 static void get_timewait6_sock(struct seq_file *seq,
1794 struct inet_timewait_sock *tw, int i)
1796 long delta = tw->tw_timer.expires - jiffies;
1797 const struct in6_addr *dest, *src;
1800 dest = &tw->tw_v6_daddr;
1801 src = &tw->tw_v6_rcv_saddr;
1802 destp = ntohs(tw->tw_dport);
1803 srcp = ntohs(tw->tw_sport);
1806 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1807 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1809 src->s6_addr32[0], src->s6_addr32[1],
1810 src->s6_addr32[2], src->s6_addr32[3], srcp,
1811 dest->s6_addr32[0], dest->s6_addr32[1],
1812 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1813 tw->tw_substate, 0, 0,
1814 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1815 atomic_read(&tw->tw_refcnt), tw);
1818 static int tcp6_seq_show(struct seq_file *seq, void *v)
1820 struct tcp_iter_state *st;
1821 struct sock *sk = v;
1823 if (v == SEQ_START_TOKEN) {
1828 "st tx_queue rx_queue tr tm->when retrnsmt"
1829 " uid timeout inode\n");
1834 if (sk->sk_state == TCP_TIME_WAIT)
1835 get_timewait6_sock(seq, v, st->num);
1836 else if (sk->sk_state == TCP_NEW_SYN_RECV)
1837 get_openreq6(seq, v, st->num);
1839 get_tcp6_sock(seq, v, st->num);
1844 static const struct file_operations tcp6_afinfo_seq_fops = {
1845 .owner = THIS_MODULE,
1846 .open = tcp_seq_open,
1848 .llseek = seq_lseek,
1849 .release = seq_release_net
1852 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1855 .seq_fops = &tcp6_afinfo_seq_fops,
1857 .show = tcp6_seq_show,
1861 int __net_init tcp6_proc_init(struct net *net)
1863 return tcp_proc_register(net, &tcp6_seq_afinfo);
1866 void tcp6_proc_exit(struct net *net)
1868 tcp_proc_unregister(net, &tcp6_seq_afinfo);
1872 struct proto tcpv6_prot = {
1874 .owner = THIS_MODULE,
1876 .connect = tcp_v6_connect,
1877 .disconnect = tcp_disconnect,
1878 .accept = inet_csk_accept,
1880 .init = tcp_v6_init_sock,
1881 .destroy = tcp_v6_destroy_sock,
1882 .shutdown = tcp_shutdown,
1883 .setsockopt = tcp_setsockopt,
1884 .getsockopt = tcp_getsockopt,
1885 .recvmsg = tcp_recvmsg,
1886 .sendmsg = tcp_sendmsg,
1887 .sendpage = tcp_sendpage,
1888 .backlog_rcv = tcp_v6_do_rcv,
1889 .release_cb = tcp_release_cb,
1891 .unhash = inet_unhash,
1892 .get_port = inet_csk_get_port,
1893 .enter_memory_pressure = tcp_enter_memory_pressure,
1894 .stream_memory_free = tcp_stream_memory_free,
1895 .sockets_allocated = &tcp_sockets_allocated,
1896 .memory_allocated = &tcp_memory_allocated,
1897 .memory_pressure = &tcp_memory_pressure,
1898 .orphan_count = &tcp_orphan_count,
1899 .sysctl_mem = sysctl_tcp_mem,
1900 .sysctl_wmem = sysctl_tcp_wmem,
1901 .sysctl_rmem = sysctl_tcp_rmem,
1902 .max_header = MAX_TCP_HEADER,
1903 .obj_size = sizeof(struct tcp6_sock),
1904 .slab_flags = SLAB_DESTROY_BY_RCU,
1905 .twsk_prot = &tcp6_timewait_sock_ops,
1906 .rsk_prot = &tcp6_request_sock_ops,
1907 .h.hashinfo = &tcp_hashinfo,
1908 .no_autobind = true,
1909 #ifdef CONFIG_COMPAT
1910 .compat_setsockopt = compat_tcp_setsockopt,
1911 .compat_getsockopt = compat_tcp_getsockopt,
1913 .diag_destroy = tcp_abort,
1916 static const struct inet6_protocol tcpv6_protocol = {
1917 .early_demux = tcp_v6_early_demux,
1918 .handler = tcp_v6_rcv,
1919 .err_handler = tcp_v6_err,
1920 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1923 static struct inet_protosw tcpv6_protosw = {
1924 .type = SOCK_STREAM,
1925 .protocol = IPPROTO_TCP,
1926 .prot = &tcpv6_prot,
1927 .ops = &inet6_stream_ops,
1928 .flags = INET_PROTOSW_PERMANENT |
1932 static int __net_init tcpv6_net_init(struct net *net)
1934 return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1935 SOCK_RAW, IPPROTO_TCP, net);
1938 static void __net_exit tcpv6_net_exit(struct net *net)
1940 inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1943 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1945 inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1948 static struct pernet_operations tcpv6_net_ops = {
1949 .init = tcpv6_net_init,
1950 .exit = tcpv6_net_exit,
1951 .exit_batch = tcpv6_net_exit_batch,
1954 int __init tcpv6_init(void)
1958 ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1962 /* register inet6 protocol */
1963 ret = inet6_register_protosw(&tcpv6_protosw);
1965 goto out_tcpv6_protocol;
1967 ret = register_pernet_subsys(&tcpv6_net_ops);
1969 goto out_tcpv6_protosw;
1974 inet6_unregister_protosw(&tcpv6_protosw);
1976 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1980 void tcpv6_exit(void)
1982 unregister_pernet_subsys(&tcpv6_net_ops);
1983 inet6_unregister_protosw(&tcpv6_protosw);
1984 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);