net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65 #include <net/tcp_memcontrol.h>
  66
  67 #include <asm/uaccess.h>
  68
  69 #include <linux/proc_fs.h>
  70 #include <linux/seq_file.h>
  71
  72 #include <linux/crypto.h>
  73 #include <linux/scatterlist.h>
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  77                                       struct request_sock *req);
  78
  79 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  80
  81 static const struct inet_connection_sock_af_ops ipv6_mapped;
  82 static const struct inet_connection_sock_af_ops ipv6_specific;
  83 #ifdef CONFIG_TCP_MD5SIG
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  85 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  86 #else
  87 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  88                                                    const struct in6_addr *addr)
  89 {
  90         return NULL;
  91 }
  92 #endif
  93
  94 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  95 {
  96         struct dst_entry *dst = skb_dst(skb);
  97         const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99         dst_hold(dst);
 100         sk->sk_rx_dst = dst;
 101         inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102         if (rt->rt6i_node)
 103                 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 104 }
 105
 106 static void tcp_v6_hash(struct sock *sk)
 107 {
 108         if (sk->sk_state != TCP_CLOSE) {
 109                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 110                         tcp_prot.hash(sk);
 111                         return;
 112                 }
 113                 local_bh_disable();
 114                 __inet6_hash(sk, NULL);
 115                 local_bh_enable();
 116         }
 117 }
 118
 119 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 120 {
 121         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 122                                             ipv6_hdr(skb)->saddr.s6_addr32,
 123                                             tcp_hdr(skb)->dest,
 124                                             tcp_hdr(skb)->source);
 125 }
 126
 127 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 128                           int addr_len)
 129 {
 130         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 131         struct inet_sock *inet = inet_sk(sk);
 132         struct inet_connection_sock *icsk = inet_csk(sk);
 133         struct ipv6_pinfo *np = inet6_sk(sk);
 134         struct tcp_sock *tp = tcp_sk(sk);
 135         struct in6_addr *saddr = NULL, *final_p, final;
 136         struct rt6_info *rt;
 137         struct flowi6 fl6;
 138         struct dst_entry *dst;
 139         int addr_type;
 140         int err;
 141
 142         if (addr_len < SIN6_LEN_RFC2133)
 143                 return -EINVAL;
 144
 145         if (usin->sin6_family != AF_INET6)
 146                 return -EAFNOSUPPORT;
 147
 148         memset(&fl6, 0, sizeof(fl6));
 149
 150         if (np->sndflow) {
 151                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 152                 IP6_ECN_flow_init(fl6.flowlabel);
 153                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 154                         struct ip6_flowlabel *flowlabel;
 155                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 156                         if (flowlabel == NULL)
 157                                 return -EINVAL;
 158                         usin->sin6_addr = flowlabel->dst;
 159                         fl6_sock_release(flowlabel);
 160                 }
 161         }
 162
 163         /*
 164          *      connect() to INADDR_ANY means loopback (BSD'ism).
 165          */
 166
 167         if(ipv6_addr_any(&usin->sin6_addr))
 168                 usin->sin6_addr.s6_addr[15] = 0x1;
 169
 170         addr_type = ipv6_addr_type(&usin->sin6_addr);
 171
 172         if(addr_type & IPV6_ADDR_MULTICAST)
 173                 return -ENETUNREACH;
 174
 175         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 176                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 177                     usin->sin6_scope_id) {
 178                         /* If interface is set while binding, indices
 179                          * must coincide.
 180                          */
 181                         if (sk->sk_bound_dev_if &&
 182                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 183                                 return -EINVAL;
 184
 185                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 186                 }
 187
 188                 /* Connect to link-local address requires an interface */
 189                 if (!sk->sk_bound_dev_if)
 190                         return -EINVAL;
 191         }
 192
 193         if (tp->rx_opt.ts_recent_stamp &&
 194             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 195                 tp->rx_opt.ts_recent = 0;
 196                 tp->rx_opt.ts_recent_stamp = 0;
 197                 tp->write_seq = 0;
 198         }
 199
 200         np->daddr = usin->sin6_addr;
 201         np->flow_label = fl6.flowlabel;
 202
 203         /*
 204          *      TCP over IPv4
 205          */
 206
 207         if (addr_type == IPV6_ADDR_MAPPED) {
 208                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 209                 struct sockaddr_in sin;
 210
 211                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 212
 213                 if (__ipv6_only_sock(sk))
 214                         return -ENETUNREACH;
 215
 216                 sin.sin_family = AF_INET;
 217                 sin.sin_port = usin->sin6_port;
 218                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 219
 220                 icsk->icsk_af_ops = &ipv6_mapped;
 221                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 224 #endif
 225
 226                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 227
 228                 if (err) {
 229                         icsk->icsk_ext_hdr_len = exthdrlen;
 230                         icsk->icsk_af_ops = &ipv6_specific;
 231                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 232 #ifdef CONFIG_TCP_MD5SIG
 233                         tp->af_specific = &tcp_sock_ipv6_specific;
 234 #endif
 235                         goto failure;
 236                 } else {
 237                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 238                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 239                                                &np->rcv_saddr);
 240                 }
 241
 242                 return err;
 243         }
 244
 245         if (!ipv6_addr_any(&np->rcv_saddr))
 246                 saddr = &np->rcv_saddr;
 247
 248         fl6.flowi6_proto = IPPROTO_TCP;
 249         fl6.daddr = np->daddr;
 250         fl6.saddr = saddr ? *saddr : np->saddr;
 251         fl6.flowi6_oif = sk->sk_bound_dev_if;
 252         fl6.flowi6_mark = sk->sk_mark;
 253         fl6.fl6_dport = usin->sin6_port;
 254         fl6.fl6_sport = inet->inet_sport;
 255
 256         final_p = fl6_update_dst(&fl6, np->opt, &final);
 257
 258         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 259
 260         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 261         if (IS_ERR(dst)) {
 262                 err = PTR_ERR(dst);
 263                 goto failure;
 264         }
 265
 266         if (saddr == NULL) {
 267                 saddr = &fl6.saddr;
 268                 np->rcv_saddr = *saddr;
 269         }
 270
 271         /* set the source address */
 272         np->saddr = *saddr;
 273         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 274
 275         sk->sk_gso_type = SKB_GSO_TCPV6;
 276         __ip6_dst_store(sk, dst, NULL, NULL);
 277
 278         rt = (struct rt6_info *) dst;
 279         if (tcp_death_row.sysctl_tw_recycle &&
 280             !tp->rx_opt.ts_recent_stamp &&
 281             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr))
 282                 tcp_fetch_timewait_stamp(sk, dst);
 283
 284         icsk->icsk_ext_hdr_len = 0;
 285         if (np->opt)
 286                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 287                                           np->opt->opt_nflen);
 288
 289         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 290
 291         inet->inet_dport = usin->sin6_port;
 292
 293         tcp_set_state(sk, TCP_SYN_SENT);
 294         err = inet6_hash_connect(&tcp_death_row, sk);
 295         if (err)
 296                 goto late_failure;
 297
 298         if (!tp->write_seq && likely(!tp->repair))
 299                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 300                                                              np->daddr.s6_addr32,
 301                                                              inet->inet_sport,
 302                                                              inet->inet_dport);
 303
 304         err = tcp_connect(sk);
 305         if (err)
 306                 goto late_failure;
 307
 308         return 0;
 309
 310 late_failure:
 311         tcp_set_state(sk, TCP_CLOSE);
 312         __sk_dst_reset(sk);
 313 failure:
 314         inet->inet_dport = 0;
 315         sk->sk_route_caps = 0;
 316         return err;
 317 }
 318
 319 static void tcp_v6_mtu_reduced(struct sock *sk)
 320 {
 321         struct dst_entry *dst;
 322
 323         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 324                 return;
 325
 326         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 327         if (!dst)
 328                 return;
 329
 330         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 331                 tcp_sync_mss(sk, dst_mtu(dst));
 332                 tcp_simple_retransmit(sk);
 333         }
 334 }
 335
 336 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 337                 u8 type, u8 code, int offset, __be32 info)
 338 {
 339         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 340         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 341         struct ipv6_pinfo *np;
 342         struct sock *sk;
 343         int err;
 344         struct tcp_sock *tp;
 345         __u32 seq;
 346         struct net *net = dev_net(skb->dev);
 347
 348         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 349                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 350
 351         if (sk == NULL) {
 352                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 353                                    ICMP6_MIB_INERRORS);
 354                 return;
 355         }
 356
 357         if (sk->sk_state == TCP_TIME_WAIT) {
 358                 inet_twsk_put(inet_twsk(sk));
 359                 return;
 360         }
 361
 362         bh_lock_sock(sk);
 363         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 364                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 365
 366         if (sk->sk_state == TCP_CLOSE)
 367                 goto out;
 368
 369         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 370                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 371                 goto out;
 372         }
 373
 374         tp = tcp_sk(sk);
 375         seq = ntohl(th->seq);
 376         if (sk->sk_state != TCP_LISTEN &&
 377             !between(seq, tp->snd_una, tp->snd_nxt)) {
 378                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 379                 goto out;
 380         }
 381
 382         np = inet6_sk(sk);
 383
 384         if (type == NDISC_REDIRECT) {
 385                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 386
 387                 if (dst)
 388                         dst->ops->redirect(dst, sk, skb);
 389         }
 390
 391         if (type == ICMPV6_PKT_TOOBIG) {
 392                 /* We are not interested in TCP_LISTEN and open_requests
 393                  * (SYN-ACKs send out by Linux are always <576bytes so
 394                  * they should go through unfragmented).
 395                  */
 396                 if (sk->sk_state == TCP_LISTEN)
 397                         goto out;
 398
 399                 tp->mtu_info = ntohl(info);
 400                 if (!sock_owned_by_user(sk))
 401                         tcp_v6_mtu_reduced(sk);
 402                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 403                                            &tp->tsq_flags))
 404                         sock_hold(sk);
 405                 goto out;
 406         }
 407
 408         icmpv6_err_convert(type, code, &err);
 409
 410         /* Might be for an request_sock */
 411         switch (sk->sk_state) {
 412                 struct request_sock *req, **prev;
 413         case TCP_LISTEN:
 414                 if (sock_owned_by_user(sk))
 415                         goto out;
 416
 417                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 418                                            &hdr->saddr, inet6_iif(skb));
 419                 if (!req)
 420                         goto out;
 421
 422                 /* ICMPs are not backlogged, hence we cannot get
 423                  * an established socket here.
 424                  */
 425                 WARN_ON(req->sk != NULL);
 426
 427                 if (seq != tcp_rsk(req)->snt_isn) {
 428                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 429                         goto out;
 430                 }
 431
 432                 inet_csk_reqsk_queue_drop(sk, req, prev);
 433                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 434                 goto out;
 435
 436         case TCP_SYN_SENT:
 437         case TCP_SYN_RECV:  /* Cannot happen.
 438                                It can, it SYNs are crossed. --ANK */
 439                 if (!sock_owned_by_user(sk)) {
 440                         sk->sk_err = err;
 441                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 442
 443                         tcp_done(sk);
 444                 } else
 445                         sk->sk_err_soft = err;
 446                 goto out;
 447         }
 448
 449         if (!sock_owned_by_user(sk) && np->recverr) {
 450                 sk->sk_err = err;
 451                 sk->sk_error_report(sk);
 452         } else
 453                 sk->sk_err_soft = err;
 454
 455 out:
 456         bh_unlock_sock(sk);
 457         sock_put(sk);
 458 }
 459
 460
 461 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 462                               struct flowi6 *fl6,
 463                               struct request_sock *req,
 464                               u16 queue_mapping)
 465 {
 466         struct inet6_request_sock *treq = inet6_rsk(req);
 467         struct ipv6_pinfo *np = inet6_sk(sk);
 468         struct sk_buff * skb;
 469         int err = -ENOMEM;
 470
 471         /* First, grab a route. */
 472         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 473                 goto done;
 474
 475         skb = tcp_make_synack(sk, dst, req, NULL);
 476
 477         if (skb) {
 478                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 479
 480                 fl6->daddr = treq->rmt_addr;
 481                 skb_set_queue_mapping(skb, queue_mapping);
 482                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 483                 err = net_xmit_eval(err);
 484         }
 485
 486 done:
 487         return err;
 488 }
 489
 490 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
 491 {
 492         struct flowi6 fl6;
 493         int res;
 494
 495         res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
 496         if (!res)
 497                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 498         return res;
 499 }
 500
 501 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 502 {
 503         kfree_skb(inet6_rsk(req)->pktopts);
 504 }
 505
 506 #ifdef CONFIG_TCP_MD5SIG
 507 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 508                                                    const struct in6_addr *addr)
 509 {
 510         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 511 }
 512
 513 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 514                                                 struct sock *addr_sk)
 515 {
 516         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 517 }
 518
 519 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 520                                                       struct request_sock *req)
 521 {
 522         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 523 }
 524
 525 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 526                                   int optlen)
 527 {
 528         struct tcp_md5sig cmd;
 529         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 530
 531         if (optlen < sizeof(cmd))
 532                 return -EINVAL;
 533
 534         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 535                 return -EFAULT;
 536
 537         if (sin6->sin6_family != AF_INET6)
 538                 return -EINVAL;
 539
 540         if (!cmd.tcpm_keylen) {
 541                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 542                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 543                                               AF_INET);
 544                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 545                                       AF_INET6);
 546         }
 547
 548         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 549                 return -EINVAL;
 550
 551         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 552                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 553                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 554
 555         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 556                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 557 }
 558
 559 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 560                                         const struct in6_addr *daddr,
 561                                         const struct in6_addr *saddr, int nbytes)
 562 {
 563         struct tcp6_pseudohdr *bp;
 564         struct scatterlist sg;
 565
 566         bp = &hp->md5_blk.ip6;
 567         /* 1. TCP pseudo-header (RFC2460) */
 568         bp->saddr = *saddr;
 569         bp->daddr = *daddr;
 570         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 571         bp->len = cpu_to_be32(nbytes);
 572
 573         sg_init_one(&sg, bp, sizeof(*bp));
 574         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 575 }
 576
 577 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 578                                const struct in6_addr *daddr, struct in6_addr *saddr,
 579                                const struct tcphdr *th)
 580 {
 581         struct tcp_md5sig_pool *hp;
 582         struct hash_desc *desc;
 583
 584         hp = tcp_get_md5sig_pool();
 585         if (!hp)
 586                 goto clear_hash_noput;
 587         desc = &hp->md5_desc;
 588
 589         if (crypto_hash_init(desc))
 590                 goto clear_hash;
 591         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 592                 goto clear_hash;
 593         if (tcp_md5_hash_header(hp, th))
 594                 goto clear_hash;
 595         if (tcp_md5_hash_key(hp, key))
 596                 goto clear_hash;
 597         if (crypto_hash_final(desc, md5_hash))
 598                 goto clear_hash;
 599
 600         tcp_put_md5sig_pool();
 601         return 0;
 602
 603 clear_hash:
 604         tcp_put_md5sig_pool();
 605 clear_hash_noput:
 606         memset(md5_hash, 0, 16);
 607         return 1;
 608 }
 609
 610 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 611                                const struct sock *sk,
 612                                const struct request_sock *req,
 613                                const struct sk_buff *skb)
 614 {
 615         const struct in6_addr *saddr, *daddr;
 616         struct tcp_md5sig_pool *hp;
 617         struct hash_desc *desc;
 618         const struct tcphdr *th = tcp_hdr(skb);
 619
 620         if (sk) {
 621                 saddr = &inet6_sk(sk)->saddr;
 622                 daddr = &inet6_sk(sk)->daddr;
 623         } else if (req) {
 624                 saddr = &inet6_rsk(req)->loc_addr;
 625                 daddr = &inet6_rsk(req)->rmt_addr;
 626         } else {
 627                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 628                 saddr = &ip6h->saddr;
 629                 daddr = &ip6h->daddr;
 630         }
 631
 632         hp = tcp_get_md5sig_pool();
 633         if (!hp)
 634                 goto clear_hash_noput;
 635         desc = &hp->md5_desc;
 636
 637         if (crypto_hash_init(desc))
 638                 goto clear_hash;
 639
 640         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 641                 goto clear_hash;
 642         if (tcp_md5_hash_header(hp, th))
 643                 goto clear_hash;
 644         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 645                 goto clear_hash;
 646         if (tcp_md5_hash_key(hp, key))
 647                 goto clear_hash;
 648         if (crypto_hash_final(desc, md5_hash))
 649                 goto clear_hash;
 650
 651         tcp_put_md5sig_pool();
 652         return 0;
 653
 654 clear_hash:
 655         tcp_put_md5sig_pool();
 656 clear_hash_noput:
 657         memset(md5_hash, 0, 16);
 658         return 1;
 659 }
 660
 661 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 662 {
 663         const __u8 *hash_location = NULL;
 664         struct tcp_md5sig_key *hash_expected;
 665         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 666         const struct tcphdr *th = tcp_hdr(skb);
 667         int genhash;
 668         u8 newhash[16];
 669
 670         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 671         hash_location = tcp_parse_md5sig_option(th);
 672
 673         /* We've parsed the options - do we have a hash? */
 674         if (!hash_expected && !hash_location)
 675                 return 0;
 676
 677         if (hash_expected && !hash_location) {
 678                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 679                 return 1;
 680         }
 681
 682         if (!hash_expected && hash_location) {
 683                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 684                 return 1;
 685         }
 686
 687         /* check the signature */
 688         genhash = tcp_v6_md5_hash_skb(newhash,
 689                                       hash_expected,
 690                                       NULL, NULL, skb);
 691
 692         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 693                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 694                                      genhash ? "failed" : "mismatch",
 695                                      &ip6h->saddr, ntohs(th->source),
 696                                      &ip6h->daddr, ntohs(th->dest));
 697                 return 1;
 698         }
 699         return 0;
 700 }
 701 #endif
 702
 703 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 704         .family         =       AF_INET6,
 705         .obj_size       =       sizeof(struct tcp6_request_sock),
 706         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 707         .send_ack       =       tcp_v6_reqsk_send_ack,
 708         .destructor     =       tcp_v6_reqsk_destructor,
 709         .send_reset     =       tcp_v6_send_reset,
 710         .syn_ack_timeout =      tcp_syn_ack_timeout,
 711 };
 712
 713 #ifdef CONFIG_TCP_MD5SIG
 714 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 715         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 716         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 717 };
 718 #endif
 719
 720 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 721                                  u32 tsval, u32 tsecr,
 722                                  struct tcp_md5sig_key *key, int rst, u8 tclass)
 723 {
 724         const struct tcphdr *th = tcp_hdr(skb);
 725         struct tcphdr *t1;
 726         struct sk_buff *buff;
 727         struct flowi6 fl6;
 728         struct net *net = dev_net(skb_dst(skb)->dev);
 729         struct sock *ctl_sk = net->ipv6.tcp_sk;
 730         unsigned int tot_len = sizeof(struct tcphdr);
 731         struct dst_entry *dst;
 732         __be32 *topt;
 733
 734         if (tsecr)
 735                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 736 #ifdef CONFIG_TCP_MD5SIG
 737         if (key)
 738                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 739 #endif
 740
 741         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 742                          GFP_ATOMIC);
 743         if (buff == NULL)
 744                 return;
 745
 746         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 747
 748         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 749         skb_reset_transport_header(buff);
 750
 751         /* Swap the send and the receive. */
 752         memset(t1, 0, sizeof(*t1));
 753         t1->dest = th->source;
 754         t1->source = th->dest;
 755         t1->doff = tot_len / 4;
 756         t1->seq = htonl(seq);
 757         t1->ack_seq = htonl(ack);
 758         t1->ack = !rst || !th->ack;
 759         t1->rst = rst;
 760         t1->window = htons(win);
 761
 762         topt = (__be32 *)(t1 + 1);
 763
 764         if (tsecr) {
 765                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 766                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 767                 *topt++ = htonl(tsval);
 768                 *topt++ = htonl(tsecr);
 769         }
 770
 771 #ifdef CONFIG_TCP_MD5SIG
 772         if (key) {
 773                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 774                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 775                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 776                                     &ipv6_hdr(skb)->saddr,
 777                                     &ipv6_hdr(skb)->daddr, t1);
 778         }
 779 #endif
 780
 781         memset(&fl6, 0, sizeof(fl6));
 782         fl6.daddr = ipv6_hdr(skb)->saddr;
 783         fl6.saddr = ipv6_hdr(skb)->daddr;
 784
 785         buff->ip_summed = CHECKSUM_PARTIAL;
 786         buff->csum = 0;
 787
 788         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 789
 790         fl6.flowi6_proto = IPPROTO_TCP;
 791         if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
 792                 fl6.flowi6_oif = inet6_iif(skb);
 793         fl6.fl6_dport = t1->dest;
 794         fl6.fl6_sport = t1->source;
 795         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 796
 797         /* Pass a socket to ip6_dst_lookup either it is for RST
 798          * Underlying function will use this to retrieve the network
 799          * namespace
 800          */
 801         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
 802         if (!IS_ERR(dst)) {
 803                 skb_dst_set(buff, dst);
 804                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 805                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 806                 if (rst)
 807                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 808                 return;
 809         }
 810
 811         kfree_skb(buff);
 812 }
 813
 814 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 815 {
 816         const struct tcphdr *th = tcp_hdr(skb);
 817         u32 seq = 0, ack_seq = 0;
 818         struct tcp_md5sig_key *key = NULL;
 819 #ifdef CONFIG_TCP_MD5SIG
 820         const __u8 *hash_location = NULL;
 821         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 822         unsigned char newhash[16];
 823         int genhash;
 824         struct sock *sk1 = NULL;
 825 #endif
 826
 827         if (th->rst)
 828                 return;
 829
 830         if (!ipv6_unicast_destination(skb))
 831                 return;
 832
 833 #ifdef CONFIG_TCP_MD5SIG
 834         hash_location = tcp_parse_md5sig_option(th);
 835         if (!sk && hash_location) {
 836                 /*
 837                  * active side is lost. Try to find listening socket through
 838                  * source port, and then find md5 key through listening socket.
 839                  * we are not loose security here:
 840                  * Incoming packet is checked with md5 hash with finding key,
 841                  * no RST generated if md5 hash doesn't match.
 842                  */
 843                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 844                                            &tcp_hashinfo, &ipv6h->saddr,
 845                                            th->source, &ipv6h->daddr,
 846                                            ntohs(th->source), inet6_iif(skb));
 847                 if (!sk1)
 848                         return;
 849
 850                 rcu_read_lock();
 851                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 852                 if (!key)
 853                         goto release_sk1;
 854
 855                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 856                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 857                         goto release_sk1;
 858         } else {
 859                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 860         }
 861 #endif
 862
 863         if (th->ack)
 864                 seq = ntohl(th->ack_seq);
 865         else
 866                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 867                           (th->doff << 2);
 868
 869         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0);
 870
 871 #ifdef CONFIG_TCP_MD5SIG
 872 release_sk1:
 873         if (sk1) {
 874                 rcu_read_unlock();
 875                 sock_put(sk1);
 876         }
 877 #endif
 878 }
 879
 880 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 881                             u32 win, u32 tsval, u32 tsecr,
 882                             struct tcp_md5sig_key *key, u8 tclass)
 883 {
 884         tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass);
 885 }
 886
 887 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 888 {
 889         struct inet_timewait_sock *tw = inet_twsk(sk);
 890         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 891
 892         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 893                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 894                         tcp_time_stamp + tcptw->tw_ts_offset,
 895                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
 896                         tw->tw_tclass);
 897
 898         inet_twsk_put(tw);
 899 }
 900
 901 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 902                                   struct request_sock *req)
 903 {
 904         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
 905                         req->rcv_wnd, tcp_time_stamp, req->ts_recent,
 906                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 907 }
 908
 909
 910 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 911 {
 912         struct request_sock *req, **prev;
 913         const struct tcphdr *th = tcp_hdr(skb);
 914         struct sock *nsk;
 915
 916         /* Find possible connection requests. */
 917         req = inet6_csk_search_req(sk, &prev, th->source,
 918                                    &ipv6_hdr(skb)->saddr,
 919                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 920         if (req)
 921                 return tcp_check_req(sk, skb, req, prev, false);
 922
 923         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 924                         &ipv6_hdr(skb)->saddr, th->source,
 925                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 926
 927         if (nsk) {
 928                 if (nsk->sk_state != TCP_TIME_WAIT) {
 929                         bh_lock_sock(nsk);
 930                         return nsk;
 931                 }
 932                 inet_twsk_put(inet_twsk(nsk));
 933                 return NULL;
 934         }
 935
 936 #ifdef CONFIG_SYN_COOKIES
 937         if (!th->syn)
 938                 sk = cookie_v6_check(sk, skb);
 939 #endif
 940         return sk;
 941 }
 942
 943 /* FIXME: this is substantially similar to the ipv4 code.
 944  * Can some kind of merge be done? -- erics
 945  */
 946 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 947 {
 948         struct tcp_options_received tmp_opt;
 949         struct request_sock *req;
 950         struct inet6_request_sock *treq;
 951         struct ipv6_pinfo *np = inet6_sk(sk);
 952         struct tcp_sock *tp = tcp_sk(sk);
 953         __u32 isn = TCP_SKB_CB(skb)->when;
 954         struct dst_entry *dst = NULL;
 955         struct flowi6 fl6;
 956         bool want_cookie = false;
 957
 958         if (skb->protocol == htons(ETH_P_IP))
 959                 return tcp_v4_conn_request(sk, skb);
 960
 961         if (!ipv6_unicast_destination(skb))
 962                 goto drop;
 963
 964         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
 965                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
 966                 if (!want_cookie)
 967                         goto drop;
 968         }
 969
 970         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
 971                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 972                 goto drop;
 973         }
 974
 975         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 976         if (req == NULL)
 977                 goto drop;
 978
 979 #ifdef CONFIG_TCP_MD5SIG
 980         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
 981 #endif
 982
 983         tcp_clear_options(&tmp_opt);
 984         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 985         tmp_opt.user_mss = tp->rx_opt.user_mss;
 986         tcp_parse_options(skb, &tmp_opt, 0, NULL);
 987
 988         if (want_cookie && !tmp_opt.saw_tstamp)
 989                 tcp_clear_options(&tmp_opt);
 990
 991         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
 992         tcp_openreq_init(req, &tmp_opt, skb);
 993
 994         treq = inet6_rsk(req);
 995         treq->rmt_addr = ipv6_hdr(skb)->saddr;
 996         treq->loc_addr = ipv6_hdr(skb)->daddr;
 997         if (!want_cookie || tmp_opt.tstamp_ok)
 998                 TCP_ECN_create_request(req, skb, sock_net(sk));
 999
1000         treq->iif = sk->sk_bound_dev_if;
1001
1002         /* So that link locals have meaning */
1003         if (!sk->sk_bound_dev_if &&
1004             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1005                 treq->iif = inet6_iif(skb);
1006
1007         if (!isn) {
1008                 if (ipv6_opt_accepted(sk, skb) ||
1009                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1010                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1011                         atomic_inc(&skb->users);
1012                         treq->pktopts = skb;
1013                 }
1014
1015                 if (want_cookie) {
1016                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1017                         req->cookie_ts = tmp_opt.tstamp_ok;
1018                         goto have_isn;
1019                 }
1020
1021                 /* VJ's idea. We save last timestamp seen
1022                  * from the destination in peer table, when entering
1023                  * state TIME-WAIT, and check against it before
1024                  * accepting new connection request.
1025                  *
1026                  * If "isn" is not zero, this request hit alive
1027                  * timewait bucket, so that all the necessary checks
1028                  * are made in the function processing timewait state.
1029                  */
1030                 if (tmp_opt.saw_tstamp &&
1031                     tcp_death_row.sysctl_tw_recycle &&
1032                     (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1033                         if (!tcp_peer_is_proven(req, dst, true)) {
1034                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1035                                 goto drop_and_release;
1036                         }
1037                 }
1038                 /* Kill the following clause, if you dislike this way. */
1039                 else if (!sysctl_tcp_syncookies &&
1040                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1041                           (sysctl_max_syn_backlog >> 2)) &&
1042                          !tcp_peer_is_proven(req, dst, false)) {
1043                         /* Without syncookies last quarter of
1044                          * backlog is filled with destinations,
1045                          * proven to be alive.
1046                          * It means that we continue to communicate
1047                          * to destinations, already remembered
1048                          * to the moment of synflood.
1049                          */
1050                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1051                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1052                         goto drop_and_release;
1053                 }
1054
1055                 isn = tcp_v6_init_sequence(skb);
1056         }
1057 have_isn:
1058         tcp_rsk(req)->snt_isn = isn;
1059
1060         if (security_inet_conn_request(sk, skb, req))
1061                 goto drop_and_release;
1062
1063         if (tcp_v6_send_synack(sk, dst, &fl6, req,
1064                                skb_get_queue_mapping(skb)) ||
1065             want_cookie)
1066                 goto drop_and_free;
1067
1068         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1069         tcp_rsk(req)->listener = NULL;
1070         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1071         return 0;
1072
1073 drop_and_release:
1074         dst_release(dst);
1075 drop_and_free:
1076         reqsk_free(req);
1077 drop:
1078         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1079         return 0; /* don't send reset */
1080 }
1081
1082 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1083                                           struct request_sock *req,
1084                                           struct dst_entry *dst)
1085 {
1086         struct inet6_request_sock *treq;
1087         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1088         struct tcp6_sock *newtcp6sk;
1089         struct inet_sock *newinet;
1090         struct tcp_sock *newtp;
1091         struct sock *newsk;
1092 #ifdef CONFIG_TCP_MD5SIG
1093         struct tcp_md5sig_key *key;
1094 #endif
1095         struct flowi6 fl6;
1096
1097         if (skb->protocol == htons(ETH_P_IP)) {
1098                 /*
1099                  *      v6 mapped
1100                  */
1101
1102                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1103
1104                 if (newsk == NULL)
1105                         return NULL;
1106
1107                 newtcp6sk = (struct tcp6_sock *)newsk;
1108                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1109
1110                 newinet = inet_sk(newsk);
1111                 newnp = inet6_sk(newsk);
1112                 newtp = tcp_sk(newsk);
1113
1114                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1115
1116                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1117
1118                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1119
1120                 newnp->rcv_saddr = newnp->saddr;
1121
1122                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1123                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1124 #ifdef CONFIG_TCP_MD5SIG
1125                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1126 #endif
1127
1128                 newnp->ipv6_ac_list = NULL;
1129                 newnp->ipv6_fl_list = NULL;
1130                 newnp->pktoptions  = NULL;
1131                 newnp->opt         = NULL;
1132                 newnp->mcast_oif   = inet6_iif(skb);
1133                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1134                 newnp->rcv_tclass  = ipv6_get_dsfield(ipv6_hdr(skb));
1135
1136                 /*
1137                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1138                  * here, tcp_create_openreq_child now does this for us, see the comment in
1139                  * that function for the gory details. -acme
1140                  */
1141
1142                 /* It is tricky place. Until this moment IPv4 tcp
1143                    worked with IPv6 icsk.icsk_af_ops.
1144                    Sync it now.
1145                  */
1146                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1147
1148                 return newsk;
1149         }
1150
1151         treq = inet6_rsk(req);
1152
1153         if (sk_acceptq_is_full(sk))
1154                 goto out_overflow;
1155
1156         if (!dst) {
1157                 dst = inet6_csk_route_req(sk, &fl6, req);
1158                 if (!dst)
1159                         goto out;
1160         }
1161
1162         newsk = tcp_create_openreq_child(sk, req, skb);
1163         if (newsk == NULL)
1164                 goto out_nonewsk;
1165
1166         /*
1167          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1168          * count here, tcp_create_openreq_child now does this for us, see the
1169          * comment in that function for the gory details. -acme
1170          */
1171
1172         newsk->sk_gso_type = SKB_GSO_TCPV6;
1173         __ip6_dst_store(newsk, dst, NULL, NULL);
1174         inet6_sk_rx_dst_set(newsk, skb);
1175
1176         newtcp6sk = (struct tcp6_sock *)newsk;
1177         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1178
1179         newtp = tcp_sk(newsk);
1180         newinet = inet_sk(newsk);
1181         newnp = inet6_sk(newsk);
1182
1183         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1184
1185         newnp->daddr = treq->rmt_addr;
1186         newnp->saddr = treq->loc_addr;
1187         newnp->rcv_saddr = treq->loc_addr;
1188         newsk->sk_bound_dev_if = treq->iif;
1189
1190         /* Now IPv6 options...
1191
1192            First: no IPv4 options.
1193          */
1194         newinet->inet_opt = NULL;
1195         newnp->ipv6_ac_list = NULL;
1196         newnp->ipv6_fl_list = NULL;
1197
1198         /* Clone RX bits */
1199         newnp->rxopt.all = np->rxopt.all;
1200
1201         /* Clone pktoptions received with SYN */
1202         newnp->pktoptions = NULL;
1203         if (treq->pktopts != NULL) {
1204                 newnp->pktoptions = skb_clone(treq->pktopts,
1205                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1206                 consume_skb(treq->pktopts);
1207                 treq->pktopts = NULL;
1208                 if (newnp->pktoptions)
1209                         skb_set_owner_r(newnp->pktoptions, newsk);
1210         }
1211         newnp->opt        = NULL;
1212         newnp->mcast_oif  = inet6_iif(skb);
1213         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1214         newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1215
1216         /* Clone native IPv6 options from listening socket (if any)
1217
1218            Yes, keeping reference count would be much more clever,
1219            but we make one more one thing there: reattach optmem
1220            to newsk.
1221          */
1222         if (np->opt)
1223                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1224
1225         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1226         if (newnp->opt)
1227                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1228                                                      newnp->opt->opt_flen);
1229
1230         tcp_mtup_init(newsk);
1231         tcp_sync_mss(newsk, dst_mtu(dst));
1232         newtp->advmss = dst_metric_advmss(dst);
1233         if (tcp_sk(sk)->rx_opt.user_mss &&
1234             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1235                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1236
1237         tcp_initialize_rcv_mss(newsk);
1238         tcp_synack_rtt_meas(newsk, req);
1239         newtp->total_retrans = req->num_retrans;
1240
1241         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1242         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1243
1244 #ifdef CONFIG_TCP_MD5SIG
1245         /* Copy over the MD5 key from the original socket */
1246         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1247                 /* We're using one, so create a matching key
1248                  * on the newsk structure. If we fail to get
1249                  * memory, then we end up not copying the key
1250                  * across. Shucks.
1251                  */
1252                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1253                                AF_INET6, key->key, key->keylen,
1254                                sk_gfp_atomic(sk, GFP_ATOMIC));
1255         }
1256 #endif
1257
1258         if (__inet_inherit_port(sk, newsk) < 0) {
1259                 inet_csk_prepare_forced_close(newsk);
1260                 tcp_done(newsk);
1261                 goto out;
1262         }
1263         __inet6_hash(newsk, NULL);
1264
1265         return newsk;
1266
1267 out_overflow:
1268         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1269 out_nonewsk:
1270         dst_release(dst);
1271 out:
1272         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1273         return NULL;
1274 }
1275
1276 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1277 {
1278         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1279                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1280                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1281                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1282                         return 0;
1283                 }
1284         }
1285
1286         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1287                                               &ipv6_hdr(skb)->saddr,
1288                                               &ipv6_hdr(skb)->daddr, 0));
1289
1290         if (skb->len <= 76) {
1291                 return __skb_checksum_complete(skb);
1292         }
1293         return 0;
1294 }
1295
1296 /* The socket must have it's spinlock held when we get
1297  * here.
1298  *
1299  * We have a potential double-lock case here, so even when
1300  * doing backlog processing we use the BH locking scheme.
1301  * This is because we cannot sleep with the original spinlock
1302  * held.
1303  */
1304 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1305 {
1306         struct ipv6_pinfo *np = inet6_sk(sk);
1307         struct tcp_sock *tp;
1308         struct sk_buff *opt_skb = NULL;
1309
1310         /* Imagine: socket is IPv6. IPv4 packet arrives,
1311            goes to IPv4 receive handler and backlogged.
1312            From backlog it always goes here. Kerboom...
1313            Fortunately, tcp_rcv_established and rcv_established
1314            handle them correctly, but it is not case with
1315            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1316          */
1317
1318         if (skb->protocol == htons(ETH_P_IP))
1319                 return tcp_v4_do_rcv(sk, skb);
1320
1321 #ifdef CONFIG_TCP_MD5SIG
1322         if (tcp_v6_inbound_md5_hash (sk, skb))
1323                 goto discard;
1324 #endif
1325
1326         if (sk_filter(sk, skb))
1327                 goto discard;
1328
1329         /*
1330          *      socket locking is here for SMP purposes as backlog rcv
1331          *      is currently called with bh processing disabled.
1332          */
1333
1334         /* Do Stevens' IPV6_PKTOPTIONS.
1335
1336            Yes, guys, it is the only place in our code, where we
1337            may make it not affecting IPv4.
1338            The rest of code is protocol independent,
1339            and I do not like idea to uglify IPv4.
1340
1341            Actually, all the idea behind IPV6_PKTOPTIONS
1342            looks not very well thought. For now we latch
1343            options, received in the last packet, enqueued
1344            by tcp. Feel free to propose better solution.
1345                                                --ANK (980728)
1346          */
1347         if (np->rxopt.all)
1348                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1349
1350         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1351                 struct dst_entry *dst = sk->sk_rx_dst;
1352
1353                 sock_rps_save_rxhash(sk, skb);
1354                 if (dst) {
1355                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1356                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1357                                 dst_release(dst);
1358                                 sk->sk_rx_dst = NULL;
1359                         }
1360                 }
1361
1362                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1363                         goto reset;
1364                 if (opt_skb)
1365                         goto ipv6_pktoptions;
1366                 return 0;
1367         }
1368
1369         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1370                 goto csum_err;
1371
1372         if (sk->sk_state == TCP_LISTEN) {
1373                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1374                 if (!nsk)
1375                         goto discard;
1376
1377                 /*
1378                  * Queue it on the new socket if the new socket is active,
1379                  * otherwise we just shortcircuit this and continue with
1380                  * the new socket..
1381                  */
1382                 if(nsk != sk) {
1383                         sock_rps_save_rxhash(nsk, skb);
1384                         if (tcp_child_process(sk, nsk, skb))
1385                                 goto reset;
1386                         if (opt_skb)
1387                                 __kfree_skb(opt_skb);
1388                         return 0;
1389                 }
1390         } else
1391                 sock_rps_save_rxhash(sk, skb);
1392
1393         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1394                 goto reset;
1395         if (opt_skb)
1396                 goto ipv6_pktoptions;
1397         return 0;
1398
1399 reset:
1400         tcp_v6_send_reset(sk, skb);
1401 discard:
1402         if (opt_skb)
1403                 __kfree_skb(opt_skb);
1404         kfree_skb(skb);
1405         return 0;
1406 csum_err:
1407         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1408         goto discard;
1409
1410
1411 ipv6_pktoptions:
1412         /* Do you ask, what is it?
1413
1414            1. skb was enqueued by tcp.
1415            2. skb is added to tail of read queue, rather than out of order.
1416            3. socket is not in passive state.
1417            4. Finally, it really contains options, which user wants to receive.
1418          */
1419         tp = tcp_sk(sk);
1420         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1421             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1422                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1423                         np->mcast_oif = inet6_iif(opt_skb);
1424                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1425                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1426                 if (np->rxopt.bits.rxtclass)
1427                         np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1428                 if (ipv6_opt_accepted(sk, opt_skb)) {
1429                         skb_set_owner_r(opt_skb, sk);
1430                         opt_skb = xchg(&np->pktoptions, opt_skb);
1431                 } else {
1432                         __kfree_skb(opt_skb);
1433                         opt_skb = xchg(&np->pktoptions, NULL);
1434                 }
1435         }
1436
1437         kfree_skb(opt_skb);
1438         return 0;
1439 }
1440
1441 static int tcp_v6_rcv(struct sk_buff *skb)
1442 {
1443         const struct tcphdr *th;
1444         const struct ipv6hdr *hdr;
1445         struct sock *sk;
1446         int ret;
1447         struct net *net = dev_net(skb->dev);
1448
1449         if (skb->pkt_type != PACKET_HOST)
1450                 goto discard_it;
1451
1452         /*
1453          *      Count it even if it's bad.
1454          */
1455         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1456
1457         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1458                 goto discard_it;
1459
1460         th = tcp_hdr(skb);
1461
1462         if (th->doff < sizeof(struct tcphdr)/4)
1463                 goto bad_packet;
1464         if (!pskb_may_pull(skb, th->doff*4))
1465                 goto discard_it;
1466
1467         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1468                 goto bad_packet;
1469
1470         th = tcp_hdr(skb);
1471         hdr = ipv6_hdr(skb);
1472         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1473         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1474                                     skb->len - th->doff*4);
1475         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1476         TCP_SKB_CB(skb)->when = 0;
1477         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1478         TCP_SKB_CB(skb)->sacked = 0;
1479
1480         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1481         if (!sk)
1482                 goto no_tcp_socket;
1483
1484 process:
1485         if (sk->sk_state == TCP_TIME_WAIT)
1486                 goto do_time_wait;
1487
1488         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1489                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1490                 goto discard_and_relse;
1491         }
1492
1493         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1494                 goto discard_and_relse;
1495
1496         if (sk_filter(sk, skb))
1497                 goto discard_and_relse;
1498
1499         skb->dev = NULL;
1500
1501         bh_lock_sock_nested(sk);
1502         ret = 0;
1503         if (!sock_owned_by_user(sk)) {
1504 #ifdef CONFIG_NET_DMA
1505                 struct tcp_sock *tp = tcp_sk(sk);
1506                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1507                         tp->ucopy.dma_chan = net_dma_find_channel();
1508                 if (tp->ucopy.dma_chan)
1509                         ret = tcp_v6_do_rcv(sk, skb);
1510                 else
1511 #endif
1512                 {
1513                         if (!tcp_prequeue(sk, skb))
1514                                 ret = tcp_v6_do_rcv(sk, skb);
1515                 }
1516         } else if (unlikely(sk_add_backlog(sk, skb,
1517                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1518                 bh_unlock_sock(sk);
1519                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1520                 goto discard_and_relse;
1521         }
1522         bh_unlock_sock(sk);
1523
1524         sock_put(sk);
1525         return ret ? -1 : 0;
1526
1527 no_tcp_socket:
1528         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1529                 goto discard_it;
1530
1531         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1532 bad_packet:
1533                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1534         } else {
1535                 tcp_v6_send_reset(NULL, skb);
1536         }
1537
1538 discard_it:
1539
1540         /*
1541          *      Discard frame
1542          */
1543
1544         kfree_skb(skb);
1545         return 0;
1546
1547 discard_and_relse:
1548         sock_put(sk);
1549         goto discard_it;
1550
1551 do_time_wait:
1552         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1553                 inet_twsk_put(inet_twsk(sk));
1554                 goto discard_it;
1555         }
1556
1557         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1558                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1559                 inet_twsk_put(inet_twsk(sk));
1560                 goto discard_it;
1561         }
1562
1563         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1564         case TCP_TW_SYN:
1565         {
1566                 struct sock *sk2;
1567
1568                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1569                                             &ipv6_hdr(skb)->saddr, th->source,
1570                                             &ipv6_hdr(skb)->daddr,
1571                                             ntohs(th->dest), inet6_iif(skb));
1572                 if (sk2 != NULL) {
1573                         struct inet_timewait_sock *tw = inet_twsk(sk);
1574                         inet_twsk_deschedule(tw, &tcp_death_row);
1575                         inet_twsk_put(tw);
1576                         sk = sk2;
1577                         goto process;
1578                 }
1579                 /* Fall through to ACK */
1580         }
1581         case TCP_TW_ACK:
1582                 tcp_v6_timewait_ack(sk, skb);
1583                 break;
1584         case TCP_TW_RST:
1585                 goto no_tcp_socket;
1586         case TCP_TW_SUCCESS:;
1587         }
1588         goto discard_it;
1589 }
1590
1591 static void tcp_v6_early_demux(struct sk_buff *skb)
1592 {
1593         const struct ipv6hdr *hdr;
1594         const struct tcphdr *th;
1595         struct sock *sk;
1596
1597         if (skb->pkt_type != PACKET_HOST)
1598                 return;
1599
1600         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1601                 return;
1602
1603         hdr = ipv6_hdr(skb);
1604         th = tcp_hdr(skb);
1605
1606         if (th->doff < sizeof(struct tcphdr) / 4)
1607                 return;
1608
1609         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1610                                         &hdr->saddr, th->source,
1611                                         &hdr->daddr, ntohs(th->dest),
1612                                         inet6_iif(skb));
1613         if (sk) {
1614                 skb->sk = sk;
1615                 skb->destructor = sock_edemux;
1616                 if (sk->sk_state != TCP_TIME_WAIT) {
1617                         struct dst_entry *dst = sk->sk_rx_dst;
1618
1619                         if (dst)
1620                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1621                         if (dst &&
1622                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1623                                 skb_dst_set_noref(skb, dst);
1624                 }
1625         }
1626 }
1627
1628 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1629         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1630         .twsk_unique    = tcp_twsk_unique,
1631         .twsk_destructor= tcp_twsk_destructor,
1632 };
1633
1634 static const struct inet_connection_sock_af_ops ipv6_specific = {
1635         .queue_xmit        = inet6_csk_xmit,
1636         .send_check        = tcp_v6_send_check,
1637         .rebuild_header    = inet6_sk_rebuild_header,
1638         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1639         .conn_request      = tcp_v6_conn_request,
1640         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1641         .net_header_len    = sizeof(struct ipv6hdr),
1642         .net_frag_header_len = sizeof(struct frag_hdr),
1643         .setsockopt        = ipv6_setsockopt,
1644         .getsockopt        = ipv6_getsockopt,
1645         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1646         .sockaddr_len      = sizeof(struct sockaddr_in6),
1647         .bind_conflict     = inet6_csk_bind_conflict,
1648 #ifdef CONFIG_COMPAT
1649         .compat_setsockopt = compat_ipv6_setsockopt,
1650         .compat_getsockopt = compat_ipv6_getsockopt,
1651 #endif
1652 };
1653
1654 #ifdef CONFIG_TCP_MD5SIG
1655 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1656         .md5_lookup     =       tcp_v6_md5_lookup,
1657         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1658         .md5_parse      =       tcp_v6_parse_md5_keys,
1659 };
1660 #endif
1661
1662 /*
1663  *      TCP over IPv4 via INET6 API
1664  */
1665
1666 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1667         .queue_xmit        = ip_queue_xmit,
1668         .send_check        = tcp_v4_send_check,
1669         .rebuild_header    = inet_sk_rebuild_header,
1670         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1671         .conn_request      = tcp_v6_conn_request,
1672         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1673         .net_header_len    = sizeof(struct iphdr),
1674         .setsockopt        = ipv6_setsockopt,
1675         .getsockopt        = ipv6_getsockopt,
1676         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1677         .sockaddr_len      = sizeof(struct sockaddr_in6),
1678         .bind_conflict     = inet6_csk_bind_conflict,
1679 #ifdef CONFIG_COMPAT
1680         .compat_setsockopt = compat_ipv6_setsockopt,
1681         .compat_getsockopt = compat_ipv6_getsockopt,
1682 #endif
1683 };
1684
1685 #ifdef CONFIG_TCP_MD5SIG
1686 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1687         .md5_lookup     =       tcp_v4_md5_lookup,
1688         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1689         .md5_parse      =       tcp_v6_parse_md5_keys,
1690 };
1691 #endif
1692
1693 /* NOTE: A lot of things set to zero explicitly by call to
1694  *       sk_alloc() so need not be done here.
1695  */
1696 static int tcp_v6_init_sock(struct sock *sk)
1697 {
1698         struct inet_connection_sock *icsk = inet_csk(sk);
1699
1700         tcp_init_sock(sk);
1701
1702         icsk->icsk_af_ops = &ipv6_specific;
1703
1704 #ifdef CONFIG_TCP_MD5SIG
1705         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1706 #endif
1707
1708         return 0;
1709 }
1710
1711 static void tcp_v6_destroy_sock(struct sock *sk)
1712 {
1713         tcp_v4_destroy_sock(sk);
1714         inet6_destroy_sock(sk);
1715 }
1716
1717 #ifdef CONFIG_PROC_FS
1718 /* Proc filesystem TCPv6 sock list dumping. */
1719 static void get_openreq6(struct seq_file *seq,
1720                          const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1721 {
1722         int ttd = req->expires - jiffies;
1723         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1724         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1725
1726         if (ttd < 0)
1727                 ttd = 0;
1728
1729         seq_printf(seq,
1730                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1731                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1732                    i,
1733                    src->s6_addr32[0], src->s6_addr32[1],
1734                    src->s6_addr32[2], src->s6_addr32[3],
1735                    ntohs(inet_rsk(req)->loc_port),
1736                    dest->s6_addr32[0], dest->s6_addr32[1],
1737                    dest->s6_addr32[2], dest->s6_addr32[3],
1738                    ntohs(inet_rsk(req)->rmt_port),
1739                    TCP_SYN_RECV,
1740                    0,0, /* could print option size, but that is af dependent. */
1741                    1,   /* timers active (only the expire timer) */
1742                    jiffies_to_clock_t(ttd),
1743                    req->num_timeout,
1744                    from_kuid_munged(seq_user_ns(seq), uid),
1745                    0,  /* non standard timer */
1746                    0, /* open_requests have no inode */
1747                    0, req);
1748 }
1749
1750 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1751 {
1752         const struct in6_addr *dest, *src;
1753         __u16 destp, srcp;
1754         int timer_active;
1755         unsigned long timer_expires;
1756         const struct inet_sock *inet = inet_sk(sp);
1757         const struct tcp_sock *tp = tcp_sk(sp);
1758         const struct inet_connection_sock *icsk = inet_csk(sp);
1759         const struct ipv6_pinfo *np = inet6_sk(sp);
1760
1761         dest  = &np->daddr;
1762         src   = &np->rcv_saddr;
1763         destp = ntohs(inet->inet_dport);
1764         srcp  = ntohs(inet->inet_sport);
1765
1766         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1767                 timer_active    = 1;
1768                 timer_expires   = icsk->icsk_timeout;
1769         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1770                 timer_active    = 4;
1771                 timer_expires   = icsk->icsk_timeout;
1772         } else if (timer_pending(&sp->sk_timer)) {
1773                 timer_active    = 2;
1774                 timer_expires   = sp->sk_timer.expires;
1775         } else {
1776                 timer_active    = 0;
1777                 timer_expires = jiffies;
1778         }
1779
1780         seq_printf(seq,
1781                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1782                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
1783                    i,
1784                    src->s6_addr32[0], src->s6_addr32[1],
1785                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1786                    dest->s6_addr32[0], dest->s6_addr32[1],
1787                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1788                    sp->sk_state,
1789                    tp->write_seq-tp->snd_una,
1790                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1791                    timer_active,
1792                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1793                    icsk->icsk_retransmits,
1794                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1795                    icsk->icsk_probes_out,
1796                    sock_i_ino(sp),
1797                    atomic_read(&sp->sk_refcnt), sp,
1798                    jiffies_to_clock_t(icsk->icsk_rto),
1799                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1800                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1801                    tp->snd_cwnd,
1802                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1803                    );
1804 }
1805
1806 static void get_timewait6_sock(struct seq_file *seq,
1807                                struct inet_timewait_sock *tw, int i)
1808 {
1809         const struct in6_addr *dest, *src;
1810         __u16 destp, srcp;
1811         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1812         long delta = tw->tw_ttd - jiffies;
1813
1814         dest = &tw6->tw_v6_daddr;
1815         src  = &tw6->tw_v6_rcv_saddr;
1816         destp = ntohs(tw->tw_dport);
1817         srcp  = ntohs(tw->tw_sport);
1818
1819         seq_printf(seq,
1820                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1821                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1822                    i,
1823                    src->s6_addr32[0], src->s6_addr32[1],
1824                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1825                    dest->s6_addr32[0], dest->s6_addr32[1],
1826                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1827                    tw->tw_substate, 0, 0,
1828                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1829                    atomic_read(&tw->tw_refcnt), tw);
1830 }
1831
1832 static int tcp6_seq_show(struct seq_file *seq, void *v)
1833 {
1834         struct tcp_iter_state *st;
1835
1836         if (v == SEQ_START_TOKEN) {
1837                 seq_puts(seq,
1838                          "  sl  "
1839                          "local_address                         "
1840                          "remote_address                        "
1841                          "st tx_queue rx_queue tr tm->when retrnsmt"
1842                          "   uid  timeout inode\n");
1843                 goto out;
1844         }
1845         st = seq->private;
1846
1847         switch (st->state) {
1848         case TCP_SEQ_STATE_LISTENING:
1849         case TCP_SEQ_STATE_ESTABLISHED:
1850                 get_tcp6_sock(seq, v, st->num);
1851                 break;
1852         case TCP_SEQ_STATE_OPENREQ:
1853                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1854                 break;
1855         case TCP_SEQ_STATE_TIME_WAIT:
1856                 get_timewait6_sock(seq, v, st->num);
1857                 break;
1858         }
1859 out:
1860         return 0;
1861 }
1862
1863 static const struct file_operations tcp6_afinfo_seq_fops = {
1864         .owner   = THIS_MODULE,
1865         .open    = tcp_seq_open,
1866         .read    = seq_read,
1867         .llseek  = seq_lseek,
1868         .release = seq_release_net
1869 };
1870
1871 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1872         .name           = "tcp6",
1873         .family         = AF_INET6,
1874         .seq_fops       = &tcp6_afinfo_seq_fops,
1875         .seq_ops        = {
1876                 .show           = tcp6_seq_show,
1877         },
1878 };
1879
1880 int __net_init tcp6_proc_init(struct net *net)
1881 {
1882         return tcp_proc_register(net, &tcp6_seq_afinfo);
1883 }
1884
1885 void tcp6_proc_exit(struct net *net)
1886 {
1887         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1888 }
1889 #endif
1890
1891 struct proto tcpv6_prot = {
1892         .name                   = "TCPv6",
1893         .owner                  = THIS_MODULE,
1894         .close                  = tcp_close,
1895         .connect                = tcp_v6_connect,
1896         .disconnect             = tcp_disconnect,
1897         .accept                 = inet_csk_accept,
1898         .ioctl                  = tcp_ioctl,
1899         .init                   = tcp_v6_init_sock,
1900         .destroy                = tcp_v6_destroy_sock,
1901         .shutdown               = tcp_shutdown,
1902         .setsockopt             = tcp_setsockopt,
1903         .getsockopt             = tcp_getsockopt,
1904         .recvmsg                = tcp_recvmsg,
1905         .sendmsg                = tcp_sendmsg,
1906         .sendpage               = tcp_sendpage,
1907         .backlog_rcv            = tcp_v6_do_rcv,
1908         .release_cb             = tcp_release_cb,
1909         .mtu_reduced            = tcp_v6_mtu_reduced,
1910         .hash                   = tcp_v6_hash,
1911         .unhash                 = inet_unhash,
1912         .get_port               = inet_csk_get_port,
1913         .enter_memory_pressure  = tcp_enter_memory_pressure,
1914         .sockets_allocated      = &tcp_sockets_allocated,
1915         .memory_allocated       = &tcp_memory_allocated,
1916         .memory_pressure        = &tcp_memory_pressure,
1917         .orphan_count           = &tcp_orphan_count,
1918         .sysctl_wmem            = sysctl_tcp_wmem,
1919         .sysctl_rmem            = sysctl_tcp_rmem,
1920         .max_header             = MAX_TCP_HEADER,
1921         .obj_size               = sizeof(struct tcp6_sock),
1922         .slab_flags             = SLAB_DESTROY_BY_RCU,
1923         .twsk_prot              = &tcp6_timewait_sock_ops,
1924         .rsk_prot               = &tcp6_request_sock_ops,
1925         .h.hashinfo             = &tcp_hashinfo,
1926         .no_autobind            = true,
1927 #ifdef CONFIG_COMPAT
1928         .compat_setsockopt      = compat_tcp_setsockopt,
1929         .compat_getsockopt      = compat_tcp_getsockopt,
1930 #endif
1931 #ifdef CONFIG_MEMCG_KMEM
1932         .proto_cgroup           = tcp_proto_cgroup,
1933 #endif
1934 };
1935
1936 static const struct inet6_protocol tcpv6_protocol = {
1937         .early_demux    =       tcp_v6_early_demux,
1938         .handler        =       tcp_v6_rcv,
1939         .err_handler    =       tcp_v6_err,
1940         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1941 };
1942
1943 static struct inet_protosw tcpv6_protosw = {
1944         .type           =       SOCK_STREAM,
1945         .protocol       =       IPPROTO_TCP,
1946         .prot           =       &tcpv6_prot,
1947         .ops            =       &inet6_stream_ops,
1948         .no_check       =       0,
1949         .flags          =       INET_PROTOSW_PERMANENT |
1950                                 INET_PROTOSW_ICSK,
1951 };
1952
1953 static int __net_init tcpv6_net_init(struct net *net)
1954 {
1955         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1956                                     SOCK_RAW, IPPROTO_TCP, net);
1957 }
1958
1959 static void __net_exit tcpv6_net_exit(struct net *net)
1960 {
1961         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1962 }
1963
1964 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1965 {
1966         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1967 }
1968
1969 static struct pernet_operations tcpv6_net_ops = {
1970         .init       = tcpv6_net_init,
1971         .exit       = tcpv6_net_exit,
1972         .exit_batch = tcpv6_net_exit_batch,
1973 };
1974
1975 int __init tcpv6_init(void)
1976 {
1977         int ret;
1978
1979         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1980         if (ret)
1981                 goto out;
1982
1983         /* register inet6 protocol */
1984         ret = inet6_register_protosw(&tcpv6_protosw);
1985         if (ret)
1986                 goto out_tcpv6_protocol;
1987
1988         ret = register_pernet_subsys(&tcpv6_net_ops);
1989         if (ret)
1990                 goto out_tcpv6_protosw;
1991 out:
1992         return ret;
1993
1994 out_tcpv6_protosw:
1995         inet6_unregister_protosw(&tcpv6_protosw);
1996 out_tcpv6_protocol:
1997         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1998         goto out;
1999 }
2000
2001 void tcpv6_exit(void)
2002 {
2003         unregister_pernet_subsys(&tcpv6_net_ops);
2004         inet6_unregister_protosw(&tcpv6_protosw);
2005         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2006 }