net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64
  65 #include <asm/uaccess.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 #include <linux/crypto.h>
  71 #include <linux/scatterlist.h>
  72
  73 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  75                                       struct request_sock *req);
  76
  77 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  78 static void     __tcp_v6_send_check(struct sk_buff *skb,
  79                                     struct in6_addr *saddr,
  80                                     struct in6_addr *daddr);
  81
  82 static const struct inet_connection_sock_af_ops ipv6_mapped;
  83 static const struct inet_connection_sock_af_ops ipv6_specific;
  84 #ifdef CONFIG_TCP_MD5SIG
  85 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  86 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  87 #else
  88 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  89                                                    struct in6_addr *addr)
  90 {
  91         return NULL;
  92 }
  93 #endif
  94
  95 static void tcp_v6_hash(struct sock *sk)
  96 {
  97         if (sk->sk_state != TCP_CLOSE) {
  98                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  99                         tcp_prot.hash(sk);
 100                         return;
 101                 }
 102                 local_bh_disable();
 103                 __inet6_hash(sk, NULL);
 104                 local_bh_enable();
 105         }
 106 }
 107
 108 static __inline__ __sum16 tcp_v6_check(int len,
 109                                    struct in6_addr *saddr,
 110                                    struct in6_addr *daddr,
 111                                    __wsum base)
 112 {
 113         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 114 }
 115
 116 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 117 {
 118         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 119                                             ipv6_hdr(skb)->saddr.s6_addr32,
 120                                             tcp_hdr(skb)->dest,
 121                                             tcp_hdr(skb)->source);
 122 }
 123
 124 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 125                           int addr_len)
 126 {
 127         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 128         struct inet_sock *inet = inet_sk(sk);
 129         struct inet_connection_sock *icsk = inet_csk(sk);
 130         struct ipv6_pinfo *np = inet6_sk(sk);
 131         struct tcp_sock *tp = tcp_sk(sk);
 132         struct in6_addr *saddr = NULL, *final_p, final;
 133         struct rt6_info *rt;
 134         struct flowi fl;
 135         struct dst_entry *dst;
 136         int addr_type;
 137         int err;
 138
 139         if (addr_len < SIN6_LEN_RFC2133)
 140                 return -EINVAL;
 141
 142         if (usin->sin6_family != AF_INET6)
 143                 return -EAFNOSUPPORT;
 144
 145         memset(&fl, 0, sizeof(fl));
 146
 147         if (np->sndflow) {
 148                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 149                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 150                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 151                         struct ip6_flowlabel *flowlabel;
 152                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 153                         if (flowlabel == NULL)
 154                                 return -EINVAL;
 155                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 156                         fl6_sock_release(flowlabel);
 157                 }
 158         }
 159
 160         /*
 161          *      connect() to INADDR_ANY means loopback (BSD'ism).
 162          */
 163
 164         if(ipv6_addr_any(&usin->sin6_addr))
 165                 usin->sin6_addr.s6_addr[15] = 0x1;
 166
 167         addr_type = ipv6_addr_type(&usin->sin6_addr);
 168
 169         if(addr_type & IPV6_ADDR_MULTICAST)
 170                 return -ENETUNREACH;
 171
 172         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 173                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 174                     usin->sin6_scope_id) {
 175                         /* If interface is set while binding, indices
 176                          * must coincide.
 177                          */
 178                         if (sk->sk_bound_dev_if &&
 179                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 180                                 return -EINVAL;
 181
 182                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 183                 }
 184
 185                 /* Connect to link-local address requires an interface */
 186                 if (!sk->sk_bound_dev_if)
 187                         return -EINVAL;
 188         }
 189
 190         if (tp->rx_opt.ts_recent_stamp &&
 191             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 192                 tp->rx_opt.ts_recent = 0;
 193                 tp->rx_opt.ts_recent_stamp = 0;
 194                 tp->write_seq = 0;
 195         }
 196
 197         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 198         np->flow_label = fl.fl6_flowlabel;
 199
 200         /*
 201          *      TCP over IPv4
 202          */
 203
 204         if (addr_type == IPV6_ADDR_MAPPED) {
 205                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 206                 struct sockaddr_in sin;
 207
 208                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 209
 210                 if (__ipv6_only_sock(sk))
 211                         return -ENETUNREACH;
 212
 213                 sin.sin_family = AF_INET;
 214                 sin.sin_port = usin->sin6_port;
 215                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 216
 217                 icsk->icsk_af_ops = &ipv6_mapped;
 218                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 219 #ifdef CONFIG_TCP_MD5SIG
 220                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 221 #endif
 222
 223                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 224
 225                 if (err) {
 226                         icsk->icsk_ext_hdr_len = exthdrlen;
 227                         icsk->icsk_af_ops = &ipv6_specific;
 228                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 229 #ifdef CONFIG_TCP_MD5SIG
 230                         tp->af_specific = &tcp_sock_ipv6_specific;
 231 #endif
 232                         goto failure;
 233                 } else {
 234                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 235                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 236                                                &np->rcv_saddr);
 237                 }
 238
 239                 return err;
 240         }
 241
 242         if (!ipv6_addr_any(&np->rcv_saddr))
 243                 saddr = &np->rcv_saddr;
 244
 245         fl.proto = IPPROTO_TCP;
 246         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 247         ipv6_addr_copy(&fl.fl6_src,
 248                        (saddr ? saddr : &np->saddr));
 249         fl.oif = sk->sk_bound_dev_if;
 250         fl.mark = sk->sk_mark;
 251         fl.fl_ip_dport = usin->sin6_port;
 252         fl.fl_ip_sport = inet->inet_sport;
 253
 254         final_p = fl6_update_dst(&fl, np->opt, &final);
 255
 256         security_sk_classify_flow(sk, &fl);
 257
 258         err = ip6_dst_lookup(sk, &dst, &fl);
 259         if (err)
 260                 goto failure;
 261         if (final_p)
 262                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 263
 264         err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
 265         if (err < 0) {
 266                 if (err == -EREMOTE)
 267                         err = ip6_dst_blackhole(sk, &dst, &fl);
 268                 if (err < 0)
 269                         goto failure;
 270         }
 271
 272         if (saddr == NULL) {
 273                 saddr = &fl.fl6_src;
 274                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 275         }
 276
 277         /* set the source address */
 278         ipv6_addr_copy(&np->saddr, saddr);
 279         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 280
 281         sk->sk_gso_type = SKB_GSO_TCPV6;
 282         __ip6_dst_store(sk, dst, NULL, NULL);
 283
 284         rt = (struct rt6_info *) dst;
 285         if (tcp_death_row.sysctl_tw_recycle &&
 286             !tp->rx_opt.ts_recent_stamp &&
 287             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
 288                 struct inet_peer *peer = rt6_get_peer(rt);
 289                 /*
 290                  * VJ's idea. We save last timestamp seen from
 291                  * the destination in peer table, when entering state
 292                  * TIME-WAIT * and initialize rx_opt.ts_recent from it,
 293                  * when trying new connection.
 294                  */
 295                 if (peer) {
 296                         inet_peer_refcheck(peer);
 297                         if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
 298                                 tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
 299                                 tp->rx_opt.ts_recent = peer->tcp_ts;
 300                         }
 301                 }
 302         }
 303
 304         icsk->icsk_ext_hdr_len = 0;
 305         if (np->opt)
 306                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 307                                           np->opt->opt_nflen);
 308
 309         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 310
 311         inet->inet_dport = usin->sin6_port;
 312
 313         tcp_set_state(sk, TCP_SYN_SENT);
 314         err = inet6_hash_connect(&tcp_death_row, sk);
 315         if (err)
 316                 goto late_failure;
 317
 318         if (!tp->write_seq)
 319                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 320                                                              np->daddr.s6_addr32,
 321                                                              inet->inet_sport,
 322                                                              inet->inet_dport);
 323
 324         err = tcp_connect(sk);
 325         if (err)
 326                 goto late_failure;
 327
 328         return 0;
 329
 330 late_failure:
 331         tcp_set_state(sk, TCP_CLOSE);
 332         __sk_dst_reset(sk);
 333 failure:
 334         inet->inet_dport = 0;
 335         sk->sk_route_caps = 0;
 336         return err;
 337 }
 338
 339 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 340                 u8 type, u8 code, int offset, __be32 info)
 341 {
 342         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 343         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 344         struct ipv6_pinfo *np;
 345         struct sock *sk;
 346         int err;
 347         struct tcp_sock *tp;
 348         __u32 seq;
 349         struct net *net = dev_net(skb->dev);
 350
 351         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 352                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 353
 354         if (sk == NULL) {
 355                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 356                                    ICMP6_MIB_INERRORS);
 357                 return;
 358         }
 359
 360         if (sk->sk_state == TCP_TIME_WAIT) {
 361                 inet_twsk_put(inet_twsk(sk));
 362                 return;
 363         }
 364
 365         bh_lock_sock(sk);
 366         if (sock_owned_by_user(sk))
 367                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 368
 369         if (sk->sk_state == TCP_CLOSE)
 370                 goto out;
 371
 372         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 373                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 374                 goto out;
 375         }
 376
 377         tp = tcp_sk(sk);
 378         seq = ntohl(th->seq);
 379         if (sk->sk_state != TCP_LISTEN &&
 380             !between(seq, tp->snd_una, tp->snd_nxt)) {
 381                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 382                 goto out;
 383         }
 384
 385         np = inet6_sk(sk);
 386
 387         if (type == ICMPV6_PKT_TOOBIG) {
 388                 struct dst_entry *dst = NULL;
 389
 390                 if (sock_owned_by_user(sk))
 391                         goto out;
 392                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 393                         goto out;
 394
 395                 /* icmp should have updated the destination cache entry */
 396                 dst = __sk_dst_check(sk, np->dst_cookie);
 397
 398                 if (dst == NULL) {
 399                         struct inet_sock *inet = inet_sk(sk);
 400                         struct flowi fl;
 401
 402                         /* BUGGG_FUTURE: Again, it is not clear how
 403                            to handle rthdr case. Ignore this complexity
 404                            for now.
 405                          */
 406                         memset(&fl, 0, sizeof(fl));
 407                         fl.proto = IPPROTO_TCP;
 408                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 409                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 410                         fl.oif = sk->sk_bound_dev_if;
 411                         fl.mark = sk->sk_mark;
 412                         fl.fl_ip_dport = inet->inet_dport;
 413                         fl.fl_ip_sport = inet->inet_sport;
 414                         security_skb_classify_flow(skb, &fl);
 415
 416                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 417                                 sk->sk_err_soft = -err;
 418                                 goto out;
 419                         }
 420
 421                         if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
 422                                 sk->sk_err_soft = -err;
 423                                 goto out;
 424                         }
 425
 426                 } else
 427                         dst_hold(dst);
 428
 429                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 430                         tcp_sync_mss(sk, dst_mtu(dst));
 431                         tcp_simple_retransmit(sk);
 432                 } /* else let the usual retransmit timer handle it */
 433                 dst_release(dst);
 434                 goto out;
 435         }
 436
 437         icmpv6_err_convert(type, code, &err);
 438
 439         /* Might be for an request_sock */
 440         switch (sk->sk_state) {
 441                 struct request_sock *req, **prev;
 442         case TCP_LISTEN:
 443                 if (sock_owned_by_user(sk))
 444                         goto out;
 445
 446                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 447                                            &hdr->saddr, inet6_iif(skb));
 448                 if (!req)
 449                         goto out;
 450
 451                 /* ICMPs are not backlogged, hence we cannot get
 452                  * an established socket here.
 453                  */
 454                 WARN_ON(req->sk != NULL);
 455
 456                 if (seq != tcp_rsk(req)->snt_isn) {
 457                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 458                         goto out;
 459                 }
 460
 461                 inet_csk_reqsk_queue_drop(sk, req, prev);
 462                 goto out;
 463
 464         case TCP_SYN_SENT:
 465         case TCP_SYN_RECV:  /* Cannot happen.
 466                                It can, it SYNs are crossed. --ANK */
 467                 if (!sock_owned_by_user(sk)) {
 468                         sk->sk_err = err;
 469                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 470
 471                         tcp_done(sk);
 472                 } else
 473                         sk->sk_err_soft = err;
 474                 goto out;
 475         }
 476
 477         if (!sock_owned_by_user(sk) && np->recverr) {
 478                 sk->sk_err = err;
 479                 sk->sk_error_report(sk);
 480         } else
 481                 sk->sk_err_soft = err;
 482
 483 out:
 484         bh_unlock_sock(sk);
 485         sock_put(sk);
 486 }
 487
 488
 489 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 490                               struct request_values *rvp)
 491 {
 492         struct inet6_request_sock *treq = inet6_rsk(req);
 493         struct ipv6_pinfo *np = inet6_sk(sk);
 494         struct sk_buff * skb;
 495         struct ipv6_txoptions *opt = NULL;
 496         struct in6_addr * final_p, final;
 497         struct flowi fl;
 498         struct dst_entry *dst;
 499         int err = -1;
 500
 501         memset(&fl, 0, sizeof(fl));
 502         fl.proto = IPPROTO_TCP;
 503         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 504         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 505         fl.fl6_flowlabel = 0;
 506         fl.oif = treq->iif;
 507         fl.mark = sk->sk_mark;
 508         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 509         fl.fl_ip_sport = inet_rsk(req)->loc_port;
 510         security_req_classify_flow(req, &fl);
 511
 512         opt = np->opt;
 513         final_p = fl6_update_dst(&fl, opt, &final);
 514
 515         err = ip6_dst_lookup(sk, &dst, &fl);
 516         if (err)
 517                 goto done;
 518         if (final_p)
 519                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 520         if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
 521                 goto done;
 522
 523         skb = tcp_make_synack(sk, dst, req, rvp);
 524         if (skb) {
 525                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 526
 527                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 528                 err = ip6_xmit(sk, skb, &fl, opt);
 529                 err = net_xmit_eval(err);
 530         }
 531
 532 done:
 533         if (opt && opt != np->opt)
 534                 sock_kfree_s(sk, opt, opt->tot_len);
 535         dst_release(dst);
 536         return err;
 537 }
 538
 539 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 540                              struct request_values *rvp)
 541 {
 542         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 543         return tcp_v6_send_synack(sk, req, rvp);
 544 }
 545
 546 static inline void syn_flood_warning(struct sk_buff *skb)
 547 {
 548 #ifdef CONFIG_SYN_COOKIES
 549         if (sysctl_tcp_syncookies)
 550                 printk(KERN_INFO
 551                        "TCPv6: Possible SYN flooding on port %d. "
 552                        "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
 553         else
 554 #endif
 555                 printk(KERN_INFO
 556                        "TCPv6: Possible SYN flooding on port %d. "
 557                        "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
 558 }
 559
 560 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 561 {
 562         kfree_skb(inet6_rsk(req)->pktopts);
 563 }
 564
 565 #ifdef CONFIG_TCP_MD5SIG
 566 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 567                                                    struct in6_addr *addr)
 568 {
 569         struct tcp_sock *tp = tcp_sk(sk);
 570         int i;
 571
 572         BUG_ON(tp == NULL);
 573
 574         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 575                 return NULL;
 576
 577         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 578                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
 579                         return &tp->md5sig_info->keys6[i].base;
 580         }
 581         return NULL;
 582 }
 583
 584 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 585                                                 struct sock *addr_sk)
 586 {
 587         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 588 }
 589
 590 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 591                                                       struct request_sock *req)
 592 {
 593         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 594 }
 595
 596 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 597                              char *newkey, u8 newkeylen)
 598 {
 599         /* Add key to the list */
 600         struct tcp_md5sig_key *key;
 601         struct tcp_sock *tp = tcp_sk(sk);
 602         struct tcp6_md5sig_key *keys;
 603
 604         key = tcp_v6_md5_do_lookup(sk, peer);
 605         if (key) {
 606                 /* modify existing entry - just update that one */
 607                 kfree(key->key);
 608                 key->key = newkey;
 609                 key->keylen = newkeylen;
 610         } else {
 611                 /* reallocate new list if current one is full. */
 612                 if (!tp->md5sig_info) {
 613                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 614                         if (!tp->md5sig_info) {
 615                                 kfree(newkey);
 616                                 return -ENOMEM;
 617                         }
 618                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 619                 }
 620                 if (tcp_alloc_md5sig_pool(sk) == NULL) {
 621                         kfree(newkey);
 622                         return -ENOMEM;
 623                 }
 624                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 625                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 626                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 627
 628                         if (!keys) {
 629                                 tcp_free_md5sig_pool();
 630                                 kfree(newkey);
 631                                 return -ENOMEM;
 632                         }
 633
 634                         if (tp->md5sig_info->entries6)
 635                                 memmove(keys, tp->md5sig_info->keys6,
 636                                         (sizeof (tp->md5sig_info->keys6[0]) *
 637                                          tp->md5sig_info->entries6));
 638
 639                         kfree(tp->md5sig_info->keys6);
 640                         tp->md5sig_info->keys6 = keys;
 641                         tp->md5sig_info->alloced6++;
 642                 }
 643
 644                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 645                                peer);
 646                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 647                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 648
 649                 tp->md5sig_info->entries6++;
 650         }
 651         return 0;
 652 }
 653
 654 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 655                                u8 *newkey, __u8 newkeylen)
 656 {
 657         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 658                                  newkey, newkeylen);
 659 }
 660
 661 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
 662 {
 663         struct tcp_sock *tp = tcp_sk(sk);
 664         int i;
 665
 666         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 667                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
 668                         /* Free the key */
 669                         kfree(tp->md5sig_info->keys6[i].base.key);
 670                         tp->md5sig_info->entries6--;
 671
 672                         if (tp->md5sig_info->entries6 == 0) {
 673                                 kfree(tp->md5sig_info->keys6);
 674                                 tp->md5sig_info->keys6 = NULL;
 675                                 tp->md5sig_info->alloced6 = 0;
 676                         } else {
 677                                 /* shrink the database */
 678                                 if (tp->md5sig_info->entries6 != i)
 679                                         memmove(&tp->md5sig_info->keys6[i],
 680                                                 &tp->md5sig_info->keys6[i+1],
 681                                                 (tp->md5sig_info->entries6 - i)
 682                                                 * sizeof (tp->md5sig_info->keys6[0]));
 683                         }
 684                         tcp_free_md5sig_pool();
 685                         return 0;
 686                 }
 687         }
 688         return -ENOENT;
 689 }
 690
 691 static void tcp_v6_clear_md5_list (struct sock *sk)
 692 {
 693         struct tcp_sock *tp = tcp_sk(sk);
 694         int i;
 695
 696         if (tp->md5sig_info->entries6) {
 697                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 698                         kfree(tp->md5sig_info->keys6[i].base.key);
 699                 tp->md5sig_info->entries6 = 0;
 700                 tcp_free_md5sig_pool();
 701         }
 702
 703         kfree(tp->md5sig_info->keys6);
 704         tp->md5sig_info->keys6 = NULL;
 705         tp->md5sig_info->alloced6 = 0;
 706
 707         if (tp->md5sig_info->entries4) {
 708                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 709                         kfree(tp->md5sig_info->keys4[i].base.key);
 710                 tp->md5sig_info->entries4 = 0;
 711                 tcp_free_md5sig_pool();
 712         }
 713
 714         kfree(tp->md5sig_info->keys4);
 715         tp->md5sig_info->keys4 = NULL;
 716         tp->md5sig_info->alloced4 = 0;
 717 }
 718
 719 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 720                                   int optlen)
 721 {
 722         struct tcp_md5sig cmd;
 723         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 724         u8 *newkey;
 725
 726         if (optlen < sizeof(cmd))
 727                 return -EINVAL;
 728
 729         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 730                 return -EFAULT;
 731
 732         if (sin6->sin6_family != AF_INET6)
 733                 return -EINVAL;
 734
 735         if (!cmd.tcpm_keylen) {
 736                 if (!tcp_sk(sk)->md5sig_info)
 737                         return -ENOENT;
 738                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 739                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 740                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 741         }
 742
 743         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 744                 return -EINVAL;
 745
 746         if (!tcp_sk(sk)->md5sig_info) {
 747                 struct tcp_sock *tp = tcp_sk(sk);
 748                 struct tcp_md5sig_info *p;
 749
 750                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 751                 if (!p)
 752                         return -ENOMEM;
 753
 754                 tp->md5sig_info = p;
 755                 sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 756         }
 757
 758         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 759         if (!newkey)
 760                 return -ENOMEM;
 761         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 762                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 763                                          newkey, cmd.tcpm_keylen);
 764         }
 765         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 766 }
 767
 768 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 769                                         struct in6_addr *daddr,
 770                                         struct in6_addr *saddr, int nbytes)
 771 {
 772         struct tcp6_pseudohdr *bp;
 773         struct scatterlist sg;
 774
 775         bp = &hp->md5_blk.ip6;
 776         /* 1. TCP pseudo-header (RFC2460) */
 777         ipv6_addr_copy(&bp->saddr, saddr);
 778         ipv6_addr_copy(&bp->daddr, daddr);
 779         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 780         bp->len = cpu_to_be32(nbytes);
 781
 782         sg_init_one(&sg, bp, sizeof(*bp));
 783         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 784 }
 785
 786 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 787                                struct in6_addr *daddr, struct in6_addr *saddr,
 788                                struct tcphdr *th)
 789 {
 790         struct tcp_md5sig_pool *hp;
 791         struct hash_desc *desc;
 792
 793         hp = tcp_get_md5sig_pool();
 794         if (!hp)
 795                 goto clear_hash_noput;
 796         desc = &hp->md5_desc;
 797
 798         if (crypto_hash_init(desc))
 799                 goto clear_hash;
 800         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 801                 goto clear_hash;
 802         if (tcp_md5_hash_header(hp, th))
 803                 goto clear_hash;
 804         if (tcp_md5_hash_key(hp, key))
 805                 goto clear_hash;
 806         if (crypto_hash_final(desc, md5_hash))
 807                 goto clear_hash;
 808
 809         tcp_put_md5sig_pool();
 810         return 0;
 811
 812 clear_hash:
 813         tcp_put_md5sig_pool();
 814 clear_hash_noput:
 815         memset(md5_hash, 0, 16);
 816         return 1;
 817 }
 818
 819 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 820                                struct sock *sk, struct request_sock *req,
 821                                struct sk_buff *skb)
 822 {
 823         struct in6_addr *saddr, *daddr;
 824         struct tcp_md5sig_pool *hp;
 825         struct hash_desc *desc;
 826         struct tcphdr *th = tcp_hdr(skb);
 827
 828         if (sk) {
 829                 saddr = &inet6_sk(sk)->saddr;
 830                 daddr = &inet6_sk(sk)->daddr;
 831         } else if (req) {
 832                 saddr = &inet6_rsk(req)->loc_addr;
 833                 daddr = &inet6_rsk(req)->rmt_addr;
 834         } else {
 835                 struct ipv6hdr *ip6h = ipv6_hdr(skb);
 836                 saddr = &ip6h->saddr;
 837                 daddr = &ip6h->daddr;
 838         }
 839
 840         hp = tcp_get_md5sig_pool();
 841         if (!hp)
 842                 goto clear_hash_noput;
 843         desc = &hp->md5_desc;
 844
 845         if (crypto_hash_init(desc))
 846                 goto clear_hash;
 847
 848         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 849                 goto clear_hash;
 850         if (tcp_md5_hash_header(hp, th))
 851                 goto clear_hash;
 852         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 853                 goto clear_hash;
 854         if (tcp_md5_hash_key(hp, key))
 855                 goto clear_hash;
 856         if (crypto_hash_final(desc, md5_hash))
 857                 goto clear_hash;
 858
 859         tcp_put_md5sig_pool();
 860         return 0;
 861
 862 clear_hash:
 863         tcp_put_md5sig_pool();
 864 clear_hash_noput:
 865         memset(md5_hash, 0, 16);
 866         return 1;
 867 }
 868
 869 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 870 {
 871         __u8 *hash_location = NULL;
 872         struct tcp_md5sig_key *hash_expected;
 873         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 874         struct tcphdr *th = tcp_hdr(skb);
 875         int genhash;
 876         u8 newhash[16];
 877
 878         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 879         hash_location = tcp_parse_md5sig_option(th);
 880
 881         /* We've parsed the options - do we have a hash? */
 882         if (!hash_expected && !hash_location)
 883                 return 0;
 884
 885         if (hash_expected && !hash_location) {
 886                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 887                 return 1;
 888         }
 889
 890         if (!hash_expected && hash_location) {
 891                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 892                 return 1;
 893         }
 894
 895         /* check the signature */
 896         genhash = tcp_v6_md5_hash_skb(newhash,
 897                                       hash_expected,
 898                                       NULL, NULL, skb);
 899
 900         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 901                 if (net_ratelimit()) {
 902                         printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 903                                genhash ? "failed" : "mismatch",
 904                                &ip6h->saddr, ntohs(th->source),
 905                                &ip6h->daddr, ntohs(th->dest));
 906                 }
 907                 return 1;
 908         }
 909         return 0;
 910 }
 911 #endif
 912
 913 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 914         .family         =       AF_INET6,
 915         .obj_size       =       sizeof(struct tcp6_request_sock),
 916         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 917         .send_ack       =       tcp_v6_reqsk_send_ack,
 918         .destructor     =       tcp_v6_reqsk_destructor,
 919         .send_reset     =       tcp_v6_send_reset,
 920         .syn_ack_timeout =      tcp_syn_ack_timeout,
 921 };
 922
 923 #ifdef CONFIG_TCP_MD5SIG
 924 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 925         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 926         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 927 };
 928 #endif
 929
 930 static void __tcp_v6_send_check(struct sk_buff *skb,
 931                                 struct in6_addr *saddr, struct in6_addr *daddr)
 932 {
 933         struct tcphdr *th = tcp_hdr(skb);
 934
 935         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 936                 th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
 937                 skb->csum_start = skb_transport_header(skb) - skb->head;
 938                 skb->csum_offset = offsetof(struct tcphdr, check);
 939         } else {
 940                 th->check = tcp_v6_check(skb->len, saddr, daddr,
 941                                          csum_partial(th, th->doff << 2,
 942                                                       skb->csum));
 943         }
 944 }
 945
 946 static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 947 {
 948         struct ipv6_pinfo *np = inet6_sk(sk);
 949
 950         __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
 951 }
 952
 953 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 954 {
 955         struct ipv6hdr *ipv6h;
 956         struct tcphdr *th;
 957
 958         if (!pskb_may_pull(skb, sizeof(*th)))
 959                 return -EINVAL;
 960
 961         ipv6h = ipv6_hdr(skb);
 962         th = tcp_hdr(skb);
 963
 964         th->check = 0;
 965         skb->ip_summed = CHECKSUM_PARTIAL;
 966         __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
 967         return 0;
 968 }
 969
 970 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 971                                          struct sk_buff *skb)
 972 {
 973         struct ipv6hdr *iph = skb_gro_network_header(skb);
 974
 975         switch (skb->ip_summed) {
 976         case CHECKSUM_COMPLETE:
 977                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
 978                                   skb->csum)) {
 979                         skb->ip_summed = CHECKSUM_UNNECESSARY;
 980                         break;
 981                 }
 982
 983                 /* fall through */
 984         case CHECKSUM_NONE:
 985                 NAPI_GRO_CB(skb)->flush = 1;
 986                 return NULL;
 987         }
 988
 989         return tcp_gro_receive(head, skb);
 990 }
 991
 992 static int tcp6_gro_complete(struct sk_buff *skb)
 993 {
 994         struct ipv6hdr *iph = ipv6_hdr(skb);
 995         struct tcphdr *th = tcp_hdr(skb);
 996
 997         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
 998                                   &iph->saddr, &iph->daddr, 0);
 999         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
1000
1001         return tcp_gro_complete(skb);
1002 }
1003
1004 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
1005                                  u32 ts, struct tcp_md5sig_key *key, int rst)
1006 {
1007         struct tcphdr *th = tcp_hdr(skb), *t1;
1008         struct sk_buff *buff;
1009         struct flowi fl;
1010         struct net *net = dev_net(skb_dst(skb)->dev);
1011         struct sock *ctl_sk = net->ipv6.tcp_sk;
1012         unsigned int tot_len = sizeof(struct tcphdr);
1013         struct dst_entry *dst;
1014         __be32 *topt;
1015
1016         if (ts)
1017                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
1018 #ifdef CONFIG_TCP_MD5SIG
1019         if (key)
1020                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1021 #endif
1022
1023         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1024                          GFP_ATOMIC);
1025         if (buff == NULL)
1026                 return;
1027
1028         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1029
1030         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1031         skb_reset_transport_header(buff);
1032
1033         /* Swap the send and the receive. */
1034         memset(t1, 0, sizeof(*t1));
1035         t1->dest = th->source;
1036         t1->source = th->dest;
1037         t1->doff = tot_len / 4;
1038         t1->seq = htonl(seq);
1039         t1->ack_seq = htonl(ack);
1040         t1->ack = !rst || !th->ack;
1041         t1->rst = rst;
1042         t1->window = htons(win);
1043
1044         topt = (__be32 *)(t1 + 1);
1045
1046         if (ts) {
1047                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1048                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1049                 *topt++ = htonl(tcp_time_stamp);
1050                 *topt++ = htonl(ts);
1051         }
1052
1053 #ifdef CONFIG_TCP_MD5SIG
1054         if (key) {
1055                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1056                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1057                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
1058                                     &ipv6_hdr(skb)->saddr,
1059                                     &ipv6_hdr(skb)->daddr, t1);
1060         }
1061 #endif
1062
1063         memset(&fl, 0, sizeof(fl));
1064         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1065         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1066
1067         buff->ip_summed = CHECKSUM_PARTIAL;
1068         buff->csum = 0;
1069
1070         __tcp_v6_send_check(buff, &fl.fl6_src, &fl.fl6_dst);
1071
1072         fl.proto = IPPROTO_TCP;
1073         fl.oif = inet6_iif(skb);
1074         fl.fl_ip_dport = t1->dest;
1075         fl.fl_ip_sport = t1->source;
1076         security_skb_classify_flow(skb, &fl);
1077
1078         /* Pass a socket to ip6_dst_lookup either it is for RST
1079          * Underlying function will use this to retrieve the network
1080          * namespace
1081          */
1082         if (!ip6_dst_lookup(ctl_sk, &dst, &fl)) {
1083                 if (xfrm_lookup(net, &dst, &fl, NULL, 0) >= 0) {
1084                         skb_dst_set(buff, dst);
1085                         ip6_xmit(ctl_sk, buff, &fl, NULL);
1086                         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
1087                         if (rst)
1088                                 TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
1089                         return;
1090                 }
1091         }
1092
1093         kfree_skb(buff);
1094 }
1095
1096 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
1097 {
1098         struct tcphdr *th = tcp_hdr(skb);
1099         u32 seq = 0, ack_seq = 0;
1100         struct tcp_md5sig_key *key = NULL;
1101
1102         if (th->rst)
1103                 return;
1104
1105         if (!ipv6_unicast_destination(skb))
1106                 return;
1107
1108 #ifdef CONFIG_TCP_MD5SIG
1109         if (sk)
1110                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1111 #endif
1112
1113         if (th->ack)
1114                 seq = ntohl(th->ack_seq);
1115         else
1116                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
1117                           (th->doff << 2);
1118
1119         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1);
1120 }
1121
1122 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
1123                             struct tcp_md5sig_key *key)
1124 {
1125         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0);
1126 }
1127
1128 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1129 {
1130         struct inet_timewait_sock *tw = inet_twsk(sk);
1131         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1132
1133         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1134                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1135                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw));
1136
1137         inet_twsk_put(tw);
1138 }
1139
1140 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1141                                   struct request_sock *req)
1142 {
1143         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1144                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
1145 }
1146
1147
1148 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1149 {
1150         struct request_sock *req, **prev;
1151         const struct tcphdr *th = tcp_hdr(skb);
1152         struct sock *nsk;
1153
1154         /* Find possible connection requests. */
1155         req = inet6_csk_search_req(sk, &prev, th->source,
1156                                    &ipv6_hdr(skb)->saddr,
1157                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1158         if (req)
1159                 return tcp_check_req(sk, skb, req, prev);
1160
1161         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1162                         &ipv6_hdr(skb)->saddr, th->source,
1163                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1164
1165         if (nsk) {
1166                 if (nsk->sk_state != TCP_TIME_WAIT) {
1167                         bh_lock_sock(nsk);
1168                         return nsk;
1169                 }
1170                 inet_twsk_put(inet_twsk(nsk));
1171                 return NULL;
1172         }
1173
1174 #ifdef CONFIG_SYN_COOKIES
1175         if (!th->syn)
1176                 sk = cookie_v6_check(sk, skb);
1177 #endif
1178         return sk;
1179 }
1180
1181 /* FIXME: this is substantially similar to the ipv4 code.
1182  * Can some kind of merge be done? -- erics
1183  */
1184 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1185 {
1186         struct tcp_extend_values tmp_ext;
1187         struct tcp_options_received tmp_opt;
1188         u8 *hash_location;
1189         struct request_sock *req;
1190         struct inet6_request_sock *treq;
1191         struct ipv6_pinfo *np = inet6_sk(sk);
1192         struct tcp_sock *tp = tcp_sk(sk);
1193         __u32 isn = TCP_SKB_CB(skb)->when;
1194         struct dst_entry *dst = NULL;
1195 #ifdef CONFIG_SYN_COOKIES
1196         int want_cookie = 0;
1197 #else
1198 #define want_cookie 0
1199 #endif
1200
1201         if (skb->protocol == htons(ETH_P_IP))
1202                 return tcp_v4_conn_request(sk, skb);
1203
1204         if (!ipv6_unicast_destination(skb))
1205                 goto drop;
1206
1207         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1208                 if (net_ratelimit())
1209                         syn_flood_warning(skb);
1210 #ifdef CONFIG_SYN_COOKIES
1211                 if (sysctl_tcp_syncookies)
1212                         want_cookie = 1;
1213                 else
1214 #endif
1215                 goto drop;
1216         }
1217
1218         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1219                 goto drop;
1220
1221         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1222         if (req == NULL)
1223                 goto drop;
1224
1225 #ifdef CONFIG_TCP_MD5SIG
1226         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1227 #endif
1228
1229         tcp_clear_options(&tmp_opt);
1230         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1231         tmp_opt.user_mss = tp->rx_opt.user_mss;
1232         tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1233
1234         if (tmp_opt.cookie_plus > 0 &&
1235             tmp_opt.saw_tstamp &&
1236             !tp->rx_opt.cookie_out_never &&
1237             (sysctl_tcp_cookie_size > 0 ||
1238              (tp->cookie_values != NULL &&
1239               tp->cookie_values->cookie_desired > 0))) {
1240                 u8 *c;
1241                 u32 *d;
1242                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1243                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1244
1245                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1246                         goto drop_and_free;
1247
1248                 /* Secret recipe starts with IP addresses */
1249                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1250                 *mess++ ^= *d++;
1251                 *mess++ ^= *d++;
1252                 *mess++ ^= *d++;
1253                 *mess++ ^= *d++;
1254                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1255                 *mess++ ^= *d++;
1256                 *mess++ ^= *d++;
1257                 *mess++ ^= *d++;
1258                 *mess++ ^= *d++;
1259
1260                 /* plus variable length Initiator Cookie */
1261                 c = (u8 *)mess;
1262                 while (l-- > 0)
1263                         *c++ ^= *hash_location++;
1264
1265 #ifdef CONFIG_SYN_COOKIES
1266                 want_cookie = 0;        /* not our kind of cookie */
1267 #endif
1268                 tmp_ext.cookie_out_never = 0; /* false */
1269                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1270         } else if (!tp->rx_opt.cookie_in_always) {
1271                 /* redundant indications, but ensure initialization. */
1272                 tmp_ext.cookie_out_never = 1; /* true */
1273                 tmp_ext.cookie_plus = 0;
1274         } else {
1275                 goto drop_and_free;
1276         }
1277         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1278
1279         if (want_cookie && !tmp_opt.saw_tstamp)
1280                 tcp_clear_options(&tmp_opt);
1281
1282         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1283         tcp_openreq_init(req, &tmp_opt, skb);
1284
1285         treq = inet6_rsk(req);
1286         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1287         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1288         if (!want_cookie || tmp_opt.tstamp_ok)
1289                 TCP_ECN_create_request(req, tcp_hdr(skb));
1290
1291         if (!isn) {
1292                 struct inet_peer *peer = NULL;
1293
1294                 if (ipv6_opt_accepted(sk, skb) ||
1295                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1296                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1297                         atomic_inc(&skb->users);
1298                         treq->pktopts = skb;
1299                 }
1300                 treq->iif = sk->sk_bound_dev_if;
1301
1302                 /* So that link locals have meaning */
1303                 if (!sk->sk_bound_dev_if &&
1304                     ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1305                         treq->iif = inet6_iif(skb);
1306
1307                 if (want_cookie) {
1308                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1309                         req->cookie_ts = tmp_opt.tstamp_ok;
1310                         goto have_isn;
1311                 }
1312
1313                 /* VJ's idea. We save last timestamp seen
1314                  * from the destination in peer table, when entering
1315                  * state TIME-WAIT, and check against it before
1316                  * accepting new connection request.
1317                  *
1318                  * If "isn" is not zero, this request hit alive
1319                  * timewait bucket, so that all the necessary checks
1320                  * are made in the function processing timewait state.
1321                  */
1322                 if (tmp_opt.saw_tstamp &&
1323                     tcp_death_row.sysctl_tw_recycle &&
1324                     (dst = inet6_csk_route_req(sk, req)) != NULL &&
1325                     (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
1326                     ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
1327                                     &treq->rmt_addr)) {
1328                         inet_peer_refcheck(peer);
1329                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1330                             (s32)(peer->tcp_ts - req->ts_recent) >
1331                                                         TCP_PAWS_WINDOW) {
1332                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1333                                 goto drop_and_release;
1334                         }
1335                 }
1336                 /* Kill the following clause, if you dislike this way. */
1337                 else if (!sysctl_tcp_syncookies &&
1338                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1339                           (sysctl_max_syn_backlog >> 2)) &&
1340                          (!peer || !peer->tcp_ts_stamp) &&
1341                          (!dst || !dst_metric(dst, RTAX_RTT))) {
1342                         /* Without syncookies last quarter of
1343                          * backlog is filled with destinations,
1344                          * proven to be alive.
1345                          * It means that we continue to communicate
1346                          * to destinations, already remembered
1347                          * to the moment of synflood.
1348                          */
1349                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1350                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1351                         goto drop_and_release;
1352                 }
1353
1354                 isn = tcp_v6_init_sequence(skb);
1355         }
1356 have_isn:
1357         tcp_rsk(req)->snt_isn = isn;
1358
1359         security_inet_conn_request(sk, skb, req);
1360
1361         if (tcp_v6_send_synack(sk, req,
1362                                (struct request_values *)&tmp_ext) ||
1363             want_cookie)
1364                 goto drop_and_free;
1365
1366         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1367         return 0;
1368
1369 drop_and_release:
1370         dst_release(dst);
1371 drop_and_free:
1372         reqsk_free(req);
1373 drop:
1374         return 0; /* don't send reset */
1375 }
1376
1377 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1378                                           struct request_sock *req,
1379                                           struct dst_entry *dst)
1380 {
1381         struct inet6_request_sock *treq;
1382         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1383         struct tcp6_sock *newtcp6sk;
1384         struct inet_sock *newinet;
1385         struct tcp_sock *newtp;
1386         struct sock *newsk;
1387         struct ipv6_txoptions *opt;
1388 #ifdef CONFIG_TCP_MD5SIG
1389         struct tcp_md5sig_key *key;
1390 #endif
1391
1392         if (skb->protocol == htons(ETH_P_IP)) {
1393                 /*
1394                  *      v6 mapped
1395                  */
1396
1397                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1398
1399                 if (newsk == NULL)
1400                         return NULL;
1401
1402                 newtcp6sk = (struct tcp6_sock *)newsk;
1403                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1404
1405                 newinet = inet_sk(newsk);
1406                 newnp = inet6_sk(newsk);
1407                 newtp = tcp_sk(newsk);
1408
1409                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1410
1411                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1412
1413                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1414
1415                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1416
1417                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1418                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1419 #ifdef CONFIG_TCP_MD5SIG
1420                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1421 #endif
1422
1423                 newnp->pktoptions  = NULL;
1424                 newnp->opt         = NULL;
1425                 newnp->mcast_oif   = inet6_iif(skb);
1426                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1427
1428                 /*
1429                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1430                  * here, tcp_create_openreq_child now does this for us, see the comment in
1431                  * that function for the gory details. -acme
1432                  */
1433
1434                 /* It is tricky place. Until this moment IPv4 tcp
1435                    worked with IPv6 icsk.icsk_af_ops.
1436                    Sync it now.
1437                  */
1438                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1439
1440                 return newsk;
1441         }
1442
1443         treq = inet6_rsk(req);
1444         opt = np->opt;
1445
1446         if (sk_acceptq_is_full(sk))
1447                 goto out_overflow;
1448
1449         if (!dst) {
1450                 dst = inet6_csk_route_req(sk, req);
1451                 if (!dst)
1452                         goto out;
1453         }
1454
1455         newsk = tcp_create_openreq_child(sk, req, skb);
1456         if (newsk == NULL)
1457                 goto out_nonewsk;
1458
1459         /*
1460          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1461          * count here, tcp_create_openreq_child now does this for us, see the
1462          * comment in that function for the gory details. -acme
1463          */
1464
1465         newsk->sk_gso_type = SKB_GSO_TCPV6;
1466         __ip6_dst_store(newsk, dst, NULL, NULL);
1467
1468         newtcp6sk = (struct tcp6_sock *)newsk;
1469         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1470
1471         newtp = tcp_sk(newsk);
1472         newinet = inet_sk(newsk);
1473         newnp = inet6_sk(newsk);
1474
1475         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1476
1477         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1478         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1479         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1480         newsk->sk_bound_dev_if = treq->iif;
1481
1482         /* Now IPv6 options...
1483
1484            First: no IPv4 options.
1485          */
1486         newinet->opt = NULL;
1487         newnp->ipv6_fl_list = NULL;
1488
1489         /* Clone RX bits */
1490         newnp->rxopt.all = np->rxopt.all;
1491
1492         /* Clone pktoptions received with SYN */
1493         newnp->pktoptions = NULL;
1494         if (treq->pktopts != NULL) {
1495                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1496                 kfree_skb(treq->pktopts);
1497                 treq->pktopts = NULL;
1498                 if (newnp->pktoptions)
1499                         skb_set_owner_r(newnp->pktoptions, newsk);
1500         }
1501         newnp->opt        = NULL;
1502         newnp->mcast_oif  = inet6_iif(skb);
1503         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1504
1505         /* Clone native IPv6 options from listening socket (if any)
1506
1507            Yes, keeping reference count would be much more clever,
1508            but we make one more one thing there: reattach optmem
1509            to newsk.
1510          */
1511         if (opt) {
1512                 newnp->opt = ipv6_dup_options(newsk, opt);
1513                 if (opt != np->opt)
1514                         sock_kfree_s(sk, opt, opt->tot_len);
1515         }
1516
1517         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1518         if (newnp->opt)
1519                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1520                                                      newnp->opt->opt_flen);
1521
1522         tcp_mtup_init(newsk);
1523         tcp_sync_mss(newsk, dst_mtu(dst));
1524         newtp->advmss = dst_metric_advmss(dst);
1525         tcp_initialize_rcv_mss(newsk);
1526
1527         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1528         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1529
1530 #ifdef CONFIG_TCP_MD5SIG
1531         /* Copy over the MD5 key from the original socket */
1532         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1533                 /* We're using one, so create a matching key
1534                  * on the newsk structure. If we fail to get
1535                  * memory, then we end up not copying the key
1536                  * across. Shucks.
1537                  */
1538                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1539                 if (newkey != NULL)
1540                         tcp_v6_md5_do_add(newsk, &newnp->daddr,
1541                                           newkey, key->keylen);
1542         }
1543 #endif
1544
1545         if (__inet_inherit_port(sk, newsk) < 0) {
1546                 sock_put(newsk);
1547                 goto out;
1548         }
1549         __inet6_hash(newsk, NULL);
1550
1551         return newsk;
1552
1553 out_overflow:
1554         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1555 out_nonewsk:
1556         if (opt && opt != np->opt)
1557                 sock_kfree_s(sk, opt, opt->tot_len);
1558         dst_release(dst);
1559 out:
1560         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1561         return NULL;
1562 }
1563
1564 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1565 {
1566         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1567                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1568                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1569                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1570                         return 0;
1571                 }
1572         }
1573
1574         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1575                                               &ipv6_hdr(skb)->saddr,
1576                                               &ipv6_hdr(skb)->daddr, 0));
1577
1578         if (skb->len <= 76) {
1579                 return __skb_checksum_complete(skb);
1580         }
1581         return 0;
1582 }
1583
1584 /* The socket must have it's spinlock held when we get
1585  * here.
1586  *
1587  * We have a potential double-lock case here, so even when
1588  * doing backlog processing we use the BH locking scheme.
1589  * This is because we cannot sleep with the original spinlock
1590  * held.
1591  */
1592 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1593 {
1594         struct ipv6_pinfo *np = inet6_sk(sk);
1595         struct tcp_sock *tp;
1596         struct sk_buff *opt_skb = NULL;
1597
1598         /* Imagine: socket is IPv6. IPv4 packet arrives,
1599            goes to IPv4 receive handler and backlogged.
1600            From backlog it always goes here. Kerboom...
1601            Fortunately, tcp_rcv_established and rcv_established
1602            handle them correctly, but it is not case with
1603            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1604          */
1605
1606         if (skb->protocol == htons(ETH_P_IP))
1607                 return tcp_v4_do_rcv(sk, skb);
1608
1609 #ifdef CONFIG_TCP_MD5SIG
1610         if (tcp_v6_inbound_md5_hash (sk, skb))
1611                 goto discard;
1612 #endif
1613
1614         if (sk_filter(sk, skb))
1615                 goto discard;
1616
1617         /*
1618          *      socket locking is here for SMP purposes as backlog rcv
1619          *      is currently called with bh processing disabled.
1620          */
1621
1622         /* Do Stevens' IPV6_PKTOPTIONS.
1623
1624            Yes, guys, it is the only place in our code, where we
1625            may make it not affecting IPv4.
1626            The rest of code is protocol independent,
1627            and I do not like idea to uglify IPv4.
1628
1629            Actually, all the idea behind IPV6_PKTOPTIONS
1630            looks not very well thought. For now we latch
1631            options, received in the last packet, enqueued
1632            by tcp. Feel free to propose better solution.
1633                                                --ANK (980728)
1634          */
1635         if (np->rxopt.all)
1636                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1637
1638         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1639                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1640                         goto reset;
1641                 if (opt_skb)
1642                         goto ipv6_pktoptions;
1643                 return 0;
1644         }
1645
1646         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1647                 goto csum_err;
1648
1649         if (sk->sk_state == TCP_LISTEN) {
1650                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1651                 if (!nsk)
1652                         goto discard;
1653
1654                 /*
1655                  * Queue it on the new socket if the new socket is active,
1656                  * otherwise we just shortcircuit this and continue with
1657                  * the new socket..
1658                  */
1659                 if(nsk != sk) {
1660                         if (tcp_child_process(sk, nsk, skb))
1661                                 goto reset;
1662                         if (opt_skb)
1663                                 __kfree_skb(opt_skb);
1664                         return 0;
1665                 }
1666         }
1667
1668         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1669                 goto reset;
1670         if (opt_skb)
1671                 goto ipv6_pktoptions;
1672         return 0;
1673
1674 reset:
1675         tcp_v6_send_reset(sk, skb);
1676 discard:
1677         if (opt_skb)
1678                 __kfree_skb(opt_skb);
1679         kfree_skb(skb);
1680         return 0;
1681 csum_err:
1682         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1683         goto discard;
1684
1685
1686 ipv6_pktoptions:
1687         /* Do you ask, what is it?
1688
1689            1. skb was enqueued by tcp.
1690            2. skb is added to tail of read queue, rather than out of order.
1691            3. socket is not in passive state.
1692            4. Finally, it really contains options, which user wants to receive.
1693          */
1694         tp = tcp_sk(sk);
1695         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1696             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1697                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1698                         np->mcast_oif = inet6_iif(opt_skb);
1699                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1700                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1701                 if (ipv6_opt_accepted(sk, opt_skb)) {
1702                         skb_set_owner_r(opt_skb, sk);
1703                         opt_skb = xchg(&np->pktoptions, opt_skb);
1704                 } else {
1705                         __kfree_skb(opt_skb);
1706                         opt_skb = xchg(&np->pktoptions, NULL);
1707                 }
1708         }
1709
1710         kfree_skb(opt_skb);
1711         return 0;
1712 }
1713
1714 static int tcp_v6_rcv(struct sk_buff *skb)
1715 {
1716         struct tcphdr *th;
1717         struct ipv6hdr *hdr;
1718         struct sock *sk;
1719         int ret;
1720         struct net *net = dev_net(skb->dev);
1721
1722         if (skb->pkt_type != PACKET_HOST)
1723                 goto discard_it;
1724
1725         /*
1726          *      Count it even if it's bad.
1727          */
1728         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1729
1730         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1731                 goto discard_it;
1732
1733         th = tcp_hdr(skb);
1734
1735         if (th->doff < sizeof(struct tcphdr)/4)
1736                 goto bad_packet;
1737         if (!pskb_may_pull(skb, th->doff*4))
1738                 goto discard_it;
1739
1740         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1741                 goto bad_packet;
1742
1743         th = tcp_hdr(skb);
1744         hdr = ipv6_hdr(skb);
1745         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1746         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1747                                     skb->len - th->doff*4);
1748         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1749         TCP_SKB_CB(skb)->when = 0;
1750         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
1751         TCP_SKB_CB(skb)->sacked = 0;
1752
1753         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1754         if (!sk)
1755                 goto no_tcp_socket;
1756
1757 process:
1758         if (sk->sk_state == TCP_TIME_WAIT)
1759                 goto do_time_wait;
1760
1761         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1762                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1763                 goto discard_and_relse;
1764         }
1765
1766         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1767                 goto discard_and_relse;
1768
1769         if (sk_filter(sk, skb))
1770                 goto discard_and_relse;
1771
1772         skb->dev = NULL;
1773
1774         bh_lock_sock_nested(sk);
1775         ret = 0;
1776         if (!sock_owned_by_user(sk)) {
1777 #ifdef CONFIG_NET_DMA
1778                 struct tcp_sock *tp = tcp_sk(sk);
1779                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1780                         tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
1781                 if (tp->ucopy.dma_chan)
1782                         ret = tcp_v6_do_rcv(sk, skb);
1783                 else
1784 #endif
1785                 {
1786                         if (!tcp_prequeue(sk, skb))
1787                                 ret = tcp_v6_do_rcv(sk, skb);
1788                 }
1789         } else if (unlikely(sk_add_backlog(sk, skb))) {
1790                 bh_unlock_sock(sk);
1791                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1792                 goto discard_and_relse;
1793         }
1794         bh_unlock_sock(sk);
1795
1796         sock_put(sk);
1797         return ret ? -1 : 0;
1798
1799 no_tcp_socket:
1800         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1801                 goto discard_it;
1802
1803         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1804 bad_packet:
1805                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1806         } else {
1807                 tcp_v6_send_reset(NULL, skb);
1808         }
1809
1810 discard_it:
1811
1812         /*
1813          *      Discard frame
1814          */
1815
1816         kfree_skb(skb);
1817         return 0;
1818
1819 discard_and_relse:
1820         sock_put(sk);
1821         goto discard_it;
1822
1823 do_time_wait:
1824         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1825                 inet_twsk_put(inet_twsk(sk));
1826                 goto discard_it;
1827         }
1828
1829         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1830                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1831                 inet_twsk_put(inet_twsk(sk));
1832                 goto discard_it;
1833         }
1834
1835         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1836         case TCP_TW_SYN:
1837         {
1838                 struct sock *sk2;
1839
1840                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1841                                             &ipv6_hdr(skb)->daddr,
1842                                             ntohs(th->dest), inet6_iif(skb));
1843                 if (sk2 != NULL) {
1844                         struct inet_timewait_sock *tw = inet_twsk(sk);
1845                         inet_twsk_deschedule(tw, &tcp_death_row);
1846                         inet_twsk_put(tw);
1847                         sk = sk2;
1848                         goto process;
1849                 }
1850                 /* Fall through to ACK */
1851         }
1852         case TCP_TW_ACK:
1853                 tcp_v6_timewait_ack(sk, skb);
1854                 break;
1855         case TCP_TW_RST:
1856                 goto no_tcp_socket;
1857         case TCP_TW_SUCCESS:;
1858         }
1859         goto discard_it;
1860 }
1861
1862 static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
1863 {
1864         struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
1865         struct ipv6_pinfo *np = inet6_sk(sk);
1866         struct inet_peer *peer;
1867
1868         if (!rt ||
1869             !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
1870                 peer = inet_getpeer_v6(&np->daddr, 1);
1871                 *release_it = true;
1872         } else {
1873                 if (!rt->rt6i_peer)
1874                         rt6_bind_peer(rt, 1);
1875                 peer = rt->rt6i_peer;
1876                 *release_it = false;
1877         }
1878
1879         return peer;
1880 }
1881
1882 static void *tcp_v6_tw_get_peer(struct sock *sk)
1883 {
1884         struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
1885         struct inet_timewait_sock *tw = inet_twsk(sk);
1886
1887         if (tw->tw_family == AF_INET)
1888                 return tcp_v4_tw_get_peer(sk);
1889
1890         return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
1891 }
1892
1893 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1894         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1895         .twsk_unique    = tcp_twsk_unique,
1896         .twsk_destructor= tcp_twsk_destructor,
1897         .twsk_getpeer   = tcp_v6_tw_get_peer,
1898 };
1899
1900 static const struct inet_connection_sock_af_ops ipv6_specific = {
1901         .queue_xmit        = inet6_csk_xmit,
1902         .send_check        = tcp_v6_send_check,
1903         .rebuild_header    = inet6_sk_rebuild_header,
1904         .conn_request      = tcp_v6_conn_request,
1905         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1906         .get_peer          = tcp_v6_get_peer,
1907         .net_header_len    = sizeof(struct ipv6hdr),
1908         .setsockopt        = ipv6_setsockopt,
1909         .getsockopt        = ipv6_getsockopt,
1910         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1911         .sockaddr_len      = sizeof(struct sockaddr_in6),
1912         .bind_conflict     = inet6_csk_bind_conflict,
1913 #ifdef CONFIG_COMPAT
1914         .compat_setsockopt = compat_ipv6_setsockopt,
1915         .compat_getsockopt = compat_ipv6_getsockopt,
1916 #endif
1917 };
1918
1919 #ifdef CONFIG_TCP_MD5SIG
1920 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1921         .md5_lookup     =       tcp_v6_md5_lookup,
1922         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1923         .md5_add        =       tcp_v6_md5_add_func,
1924         .md5_parse      =       tcp_v6_parse_md5_keys,
1925 };
1926 #endif
1927
1928 /*
1929  *      TCP over IPv4 via INET6 API
1930  */
1931
1932 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1933         .queue_xmit        = ip_queue_xmit,
1934         .send_check        = tcp_v4_send_check,
1935         .rebuild_header    = inet_sk_rebuild_header,
1936         .conn_request      = tcp_v6_conn_request,
1937         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1938         .get_peer          = tcp_v4_get_peer,
1939         .net_header_len    = sizeof(struct iphdr),
1940         .setsockopt        = ipv6_setsockopt,
1941         .getsockopt        = ipv6_getsockopt,
1942         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1943         .sockaddr_len      = sizeof(struct sockaddr_in6),
1944         .bind_conflict     = inet6_csk_bind_conflict,
1945 #ifdef CONFIG_COMPAT
1946         .compat_setsockopt = compat_ipv6_setsockopt,
1947         .compat_getsockopt = compat_ipv6_getsockopt,
1948 #endif
1949 };
1950
1951 #ifdef CONFIG_TCP_MD5SIG
1952 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1953         .md5_lookup     =       tcp_v4_md5_lookup,
1954         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1955         .md5_add        =       tcp_v6_md5_add_func,
1956         .md5_parse      =       tcp_v6_parse_md5_keys,
1957 };
1958 #endif
1959
1960 /* NOTE: A lot of things set to zero explicitly by call to
1961  *       sk_alloc() so need not be done here.
1962  */
1963 static int tcp_v6_init_sock(struct sock *sk)
1964 {
1965         struct inet_connection_sock *icsk = inet_csk(sk);
1966         struct tcp_sock *tp = tcp_sk(sk);
1967
1968         skb_queue_head_init(&tp->out_of_order_queue);
1969         tcp_init_xmit_timers(sk);
1970         tcp_prequeue_init(tp);
1971
1972         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1973         tp->mdev = TCP_TIMEOUT_INIT;
1974
1975         /* So many TCP implementations out there (incorrectly) count the
1976          * initial SYN frame in their delayed-ACK and congestion control
1977          * algorithms that we must have the following bandaid to talk
1978          * efficiently to them.  -DaveM
1979          */
1980         tp->snd_cwnd = 2;
1981
1982         /* See draft-stevens-tcpca-spec-01 for discussion of the
1983          * initialization of these values.
1984          */
1985         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
1986         tp->snd_cwnd_clamp = ~0;
1987         tp->mss_cache = TCP_MSS_DEFAULT;
1988
1989         tp->reordering = sysctl_tcp_reordering;
1990
1991         sk->sk_state = TCP_CLOSE;
1992
1993         icsk->icsk_af_ops = &ipv6_specific;
1994         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1995         icsk->icsk_sync_mss = tcp_sync_mss;
1996         sk->sk_write_space = sk_stream_write_space;
1997         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1998
1999 #ifdef CONFIG_TCP_MD5SIG
2000         tp->af_specific = &tcp_sock_ipv6_specific;
2001 #endif
2002
2003         /* TCP Cookie Transactions */
2004         if (sysctl_tcp_cookie_size > 0) {
2005                 /* Default, cookies without s_data_payload. */
2006                 tp->cookie_values =
2007                         kzalloc(sizeof(*tp->cookie_values),
2008                                 sk->sk_allocation);
2009                 if (tp->cookie_values != NULL)
2010                         kref_init(&tp->cookie_values->kref);
2011         }
2012         /* Presumed zeroed, in order of appearance:
2013          *      cookie_in_always, cookie_out_never,
2014          *      s_data_constant, s_data_in, s_data_out
2015          */
2016         sk->sk_sndbuf = sysctl_tcp_wmem[1];
2017         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
2018
2019         local_bh_disable();
2020         percpu_counter_inc(&tcp_sockets_allocated);
2021         local_bh_enable();
2022
2023         return 0;
2024 }
2025
2026 static void tcp_v6_destroy_sock(struct sock *sk)
2027 {
2028 #ifdef CONFIG_TCP_MD5SIG
2029         /* Clean up the MD5 key list */
2030         if (tcp_sk(sk)->md5sig_info)
2031                 tcp_v6_clear_md5_list(sk);
2032 #endif
2033         tcp_v4_destroy_sock(sk);
2034         inet6_destroy_sock(sk);
2035 }
2036
2037 #ifdef CONFIG_PROC_FS
2038 /* Proc filesystem TCPv6 sock list dumping. */
2039 static void get_openreq6(struct seq_file *seq,
2040                          struct sock *sk, struct request_sock *req, int i, int uid)
2041 {
2042         int ttd = req->expires - jiffies;
2043         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
2044         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
2045
2046         if (ttd < 0)
2047                 ttd = 0;
2048
2049         seq_printf(seq,
2050                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2051                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2052                    i,
2053                    src->s6_addr32[0], src->s6_addr32[1],
2054                    src->s6_addr32[2], src->s6_addr32[3],
2055                    ntohs(inet_rsk(req)->loc_port),
2056                    dest->s6_addr32[0], dest->s6_addr32[1],
2057                    dest->s6_addr32[2], dest->s6_addr32[3],
2058                    ntohs(inet_rsk(req)->rmt_port),
2059                    TCP_SYN_RECV,
2060                    0,0, /* could print option size, but that is af dependent. */
2061                    1,   /* timers active (only the expire timer) */
2062                    jiffies_to_clock_t(ttd),
2063                    req->retrans,
2064                    uid,
2065                    0,  /* non standard timer */
2066                    0, /* open_requests have no inode */
2067                    0, req);
2068 }
2069
2070 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
2071 {
2072         struct in6_addr *dest, *src;
2073         __u16 destp, srcp;
2074         int timer_active;
2075         unsigned long timer_expires;
2076         struct inet_sock *inet = inet_sk(sp);
2077         struct tcp_sock *tp = tcp_sk(sp);
2078         const struct inet_connection_sock *icsk = inet_csk(sp);
2079         struct ipv6_pinfo *np = inet6_sk(sp);
2080
2081         dest  = &np->daddr;
2082         src   = &np->rcv_saddr;
2083         destp = ntohs(inet->inet_dport);
2084         srcp  = ntohs(inet->inet_sport);
2085
2086         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2087                 timer_active    = 1;
2088                 timer_expires   = icsk->icsk_timeout;
2089         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2090                 timer_active    = 4;
2091                 timer_expires   = icsk->icsk_timeout;
2092         } else if (timer_pending(&sp->sk_timer)) {
2093                 timer_active    = 2;
2094                 timer_expires   = sp->sk_timer.expires;
2095         } else {
2096                 timer_active    = 0;
2097                 timer_expires = jiffies;
2098         }
2099
2100         seq_printf(seq,
2101                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2102                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
2103                    i,
2104                    src->s6_addr32[0], src->s6_addr32[1],
2105                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2106                    dest->s6_addr32[0], dest->s6_addr32[1],
2107                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2108                    sp->sk_state,
2109                    tp->write_seq-tp->snd_una,
2110                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2111                    timer_active,
2112                    jiffies_to_clock_t(timer_expires - jiffies),
2113                    icsk->icsk_retransmits,
2114                    sock_i_uid(sp),
2115                    icsk->icsk_probes_out,
2116                    sock_i_ino(sp),
2117                    atomic_read(&sp->sk_refcnt), sp,
2118                    jiffies_to_clock_t(icsk->icsk_rto),
2119                    jiffies_to_clock_t(icsk->icsk_ack.ato),
2120                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2121                    tp->snd_cwnd,
2122                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
2123                    );
2124 }
2125
2126 static void get_timewait6_sock(struct seq_file *seq,
2127                                struct inet_timewait_sock *tw, int i)
2128 {
2129         struct in6_addr *dest, *src;
2130         __u16 destp, srcp;
2131         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2132         int ttd = tw->tw_ttd - jiffies;
2133
2134         if (ttd < 0)
2135                 ttd = 0;
2136
2137         dest = &tw6->tw_v6_daddr;
2138         src  = &tw6->tw_v6_rcv_saddr;
2139         destp = ntohs(tw->tw_dport);
2140         srcp  = ntohs(tw->tw_sport);
2141
2142         seq_printf(seq,
2143                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2144                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2145                    i,
2146                    src->s6_addr32[0], src->s6_addr32[1],
2147                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2148                    dest->s6_addr32[0], dest->s6_addr32[1],
2149                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2150                    tw->tw_substate, 0, 0,
2151                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2152                    atomic_read(&tw->tw_refcnt), tw);
2153 }
2154
2155 static int tcp6_seq_show(struct seq_file *seq, void *v)
2156 {
2157         struct tcp_iter_state *st;
2158
2159         if (v == SEQ_START_TOKEN) {
2160                 seq_puts(seq,
2161                          "  sl  "
2162                          "local_address                         "
2163                          "remote_address                        "
2164                          "st tx_queue rx_queue tr tm->when retrnsmt"
2165                          "   uid  timeout inode\n");
2166                 goto out;
2167         }
2168         st = seq->private;
2169
2170         switch (st->state) {
2171         case TCP_SEQ_STATE_LISTENING:
2172         case TCP_SEQ_STATE_ESTABLISHED:
2173                 get_tcp6_sock(seq, v, st->num);
2174                 break;
2175         case TCP_SEQ_STATE_OPENREQ:
2176                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2177                 break;
2178         case TCP_SEQ_STATE_TIME_WAIT:
2179                 get_timewait6_sock(seq, v, st->num);
2180                 break;
2181         }
2182 out:
2183         return 0;
2184 }
2185
2186 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2187         .name           = "tcp6",
2188         .family         = AF_INET6,
2189         .seq_fops       = {
2190                 .owner          = THIS_MODULE,
2191         },
2192         .seq_ops        = {
2193                 .show           = tcp6_seq_show,
2194         },
2195 };
2196
2197 int __net_init tcp6_proc_init(struct net *net)
2198 {
2199         return tcp_proc_register(net, &tcp6_seq_afinfo);
2200 }
2201
2202 void tcp6_proc_exit(struct net *net)
2203 {
2204         tcp_proc_unregister(net, &tcp6_seq_afinfo);
2205 }
2206 #endif
2207
2208 struct proto tcpv6_prot = {
2209         .name                   = "TCPv6",
2210         .owner                  = THIS_MODULE,
2211         .close                  = tcp_close,
2212         .connect                = tcp_v6_connect,
2213         .disconnect             = tcp_disconnect,
2214         .accept                 = inet_csk_accept,
2215         .ioctl                  = tcp_ioctl,
2216         .init                   = tcp_v6_init_sock,
2217         .destroy                = tcp_v6_destroy_sock,
2218         .shutdown               = tcp_shutdown,
2219         .setsockopt             = tcp_setsockopt,
2220         .getsockopt             = tcp_getsockopt,
2221         .recvmsg                = tcp_recvmsg,
2222         .sendmsg                = tcp_sendmsg,
2223         .sendpage               = tcp_sendpage,
2224         .backlog_rcv            = tcp_v6_do_rcv,
2225         .hash                   = tcp_v6_hash,
2226         .unhash                 = inet_unhash,
2227         .get_port               = inet_csk_get_port,
2228         .enter_memory_pressure  = tcp_enter_memory_pressure,
2229         .sockets_allocated      = &tcp_sockets_allocated,
2230         .memory_allocated       = &tcp_memory_allocated,
2231         .memory_pressure        = &tcp_memory_pressure,
2232         .orphan_count           = &tcp_orphan_count,
2233         .sysctl_mem             = sysctl_tcp_mem,
2234         .sysctl_wmem            = sysctl_tcp_wmem,
2235         .sysctl_rmem            = sysctl_tcp_rmem,
2236         .max_header             = MAX_TCP_HEADER,
2237         .obj_size               = sizeof(struct tcp6_sock),
2238         .slab_flags             = SLAB_DESTROY_BY_RCU,
2239         .twsk_prot              = &tcp6_timewait_sock_ops,
2240         .rsk_prot               = &tcp6_request_sock_ops,
2241         .h.hashinfo             = &tcp_hashinfo,
2242         .no_autobind            = true,
2243 #ifdef CONFIG_COMPAT
2244         .compat_setsockopt      = compat_tcp_setsockopt,
2245         .compat_getsockopt      = compat_tcp_getsockopt,
2246 #endif
2247 };
2248
2249 static const struct inet6_protocol tcpv6_protocol = {
2250         .handler        =       tcp_v6_rcv,
2251         .err_handler    =       tcp_v6_err,
2252         .gso_send_check =       tcp_v6_gso_send_check,
2253         .gso_segment    =       tcp_tso_segment,
2254         .gro_receive    =       tcp6_gro_receive,
2255         .gro_complete   =       tcp6_gro_complete,
2256         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2257 };
2258
2259 static struct inet_protosw tcpv6_protosw = {
2260         .type           =       SOCK_STREAM,
2261         .protocol       =       IPPROTO_TCP,
2262         .prot           =       &tcpv6_prot,
2263         .ops            =       &inet6_stream_ops,
2264         .no_check       =       0,
2265         .flags          =       INET_PROTOSW_PERMANENT |
2266                                 INET_PROTOSW_ICSK,
2267 };
2268
2269 static int __net_init tcpv6_net_init(struct net *net)
2270 {
2271         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2272                                     SOCK_RAW, IPPROTO_TCP, net);
2273 }
2274
2275 static void __net_exit tcpv6_net_exit(struct net *net)
2276 {
2277         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2278 }
2279
2280 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2281 {
2282         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2283 }
2284
2285 static struct pernet_operations tcpv6_net_ops = {
2286         .init       = tcpv6_net_init,
2287         .exit       = tcpv6_net_exit,
2288         .exit_batch = tcpv6_net_exit_batch,
2289 };
2290
2291 int __init tcpv6_init(void)
2292 {
2293         int ret;
2294
2295         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2296         if (ret)
2297                 goto out;
2298
2299         /* register inet6 protocol */
2300         ret = inet6_register_protosw(&tcpv6_protosw);
2301         if (ret)
2302                 goto out_tcpv6_protocol;
2303
2304         ret = register_pernet_subsys(&tcpv6_net_ops);
2305         if (ret)
2306                 goto out_tcpv6_protosw;
2307 out:
2308         return ret;
2309
2310 out_tcpv6_protocol:
2311         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2312 out_tcpv6_protosw:
2313         inet6_unregister_protosw(&tcpv6_protosw);
2314         goto out;
2315 }
2316
2317 void tcpv6_exit(void)
2318 {
2319         unregister_pernet_subsys(&tcpv6_net_ops);
2320         inet6_unregister_protosw(&tcpv6_protosw);
2321         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2322 }