net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65
  66 #include <asm/uaccess.h>
  67
  68 #include <linux/proc_fs.h>
  69 #include <linux/seq_file.h>
  70
  71 #include <linux/crypto.h>
  72 #include <linux/scatterlist.h>
  73
  74 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79 static void     __tcp_v6_send_check(struct sk_buff *skb,
  80                                     const struct in6_addr *saddr,
  81                                     const struct in6_addr *daddr);
  82
  83 static const struct inet_connection_sock_af_ops ipv6_mapped;
  84 static const struct inet_connection_sock_af_ops ipv6_specific;
  85 #ifdef CONFIG_TCP_MD5SIG
  86 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  87 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  88 #else
  89 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  90                                                    const struct in6_addr *addr)
  91 {
  92         return NULL;
  93 }
  94 #endif
  95
  96 static void tcp_v6_hash(struct sock *sk)
  97 {
  98         if (sk->sk_state != TCP_CLOSE) {
  99                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 100                         tcp_prot.hash(sk);
 101                         return;
 102                 }
 103                 local_bh_disable();
 104                 __inet6_hash(sk, NULL);
 105                 local_bh_enable();
 106         }
 107 }
 108
 109 static __inline__ __sum16 tcp_v6_check(int len,
 110                                    const struct in6_addr *saddr,
 111                                    const struct in6_addr *daddr,
 112                                    __wsum base)
 113 {
 114         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 115 }
 116
 117 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 118 {
 119         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 120                                             ipv6_hdr(skb)->saddr.s6_addr32,
 121                                             tcp_hdr(skb)->dest,
 122                                             tcp_hdr(skb)->source);
 123 }
 124
 125 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 126                           int addr_len)
 127 {
 128         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 129         struct inet_sock *inet = inet_sk(sk);
 130         struct inet_connection_sock *icsk = inet_csk(sk);
 131         struct ipv6_pinfo *np = inet6_sk(sk);
 132         struct tcp_sock *tp = tcp_sk(sk);
 133         struct in6_addr *saddr = NULL, *final_p, final;
 134         struct rt6_info *rt;
 135         struct flowi6 fl6;
 136         struct dst_entry *dst;
 137         int addr_type;
 138         int err;
 139
 140         if (addr_len < SIN6_LEN_RFC2133)
 141                 return -EINVAL;
 142
 143         if (usin->sin6_family != AF_INET6)
 144                 return -EAFNOSUPPORT;
 145
 146         memset(&fl6, 0, sizeof(fl6));
 147
 148         if (np->sndflow) {
 149                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 150                 IP6_ECN_flow_init(fl6.flowlabel);
 151                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 152                         struct ip6_flowlabel *flowlabel;
 153                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 154                         if (flowlabel == NULL)
 155                                 return -EINVAL;
 156                         usin->sin6_addr = flowlabel->dst;
 157                         fl6_sock_release(flowlabel);
 158                 }
 159         }
 160
 161         /*
 162          *      connect() to INADDR_ANY means loopback (BSD'ism).
 163          */
 164
 165         if(ipv6_addr_any(&usin->sin6_addr))
 166                 usin->sin6_addr.s6_addr[15] = 0x1;
 167
 168         addr_type = ipv6_addr_type(&usin->sin6_addr);
 169
 170         if(addr_type & IPV6_ADDR_MULTICAST)
 171                 return -ENETUNREACH;
 172
 173         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 174                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 175                     usin->sin6_scope_id) {
 176                         /* If interface is set while binding, indices
 177                          * must coincide.
 178                          */
 179                         if (sk->sk_bound_dev_if &&
 180                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 181                                 return -EINVAL;
 182
 183                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 184                 }
 185
 186                 /* Connect to link-local address requires an interface */
 187                 if (!sk->sk_bound_dev_if)
 188                         return -EINVAL;
 189         }
 190
 191         if (tp->rx_opt.ts_recent_stamp &&
 192             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 193                 tp->rx_opt.ts_recent = 0;
 194                 tp->rx_opt.ts_recent_stamp = 0;
 195                 tp->write_seq = 0;
 196         }
 197
 198         np->daddr = usin->sin6_addr;
 199         np->flow_label = fl6.flowlabel;
 200
 201         /*
 202          *      TCP over IPv4
 203          */
 204
 205         if (addr_type == IPV6_ADDR_MAPPED) {
 206                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 207                 struct sockaddr_in sin;
 208
 209                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 210
 211                 if (__ipv6_only_sock(sk))
 212                         return -ENETUNREACH;
 213
 214                 sin.sin_family = AF_INET;
 215                 sin.sin_port = usin->sin6_port;
 216                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 217
 218                 icsk->icsk_af_ops = &ipv6_mapped;
 219                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 220 #ifdef CONFIG_TCP_MD5SIG
 221                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 222 #endif
 223
 224                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 225
 226                 if (err) {
 227                         icsk->icsk_ext_hdr_len = exthdrlen;
 228                         icsk->icsk_af_ops = &ipv6_specific;
 229                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 230 #ifdef CONFIG_TCP_MD5SIG
 231                         tp->af_specific = &tcp_sock_ipv6_specific;
 232 #endif
 233                         goto failure;
 234                 } else {
 235                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 236                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 237                                                &np->rcv_saddr);
 238                 }
 239
 240                 return err;
 241         }
 242
 243         if (!ipv6_addr_any(&np->rcv_saddr))
 244                 saddr = &np->rcv_saddr;
 245
 246         fl6.flowi6_proto = IPPROTO_TCP;
 247         fl6.daddr = np->daddr;
 248         fl6.saddr = saddr ? *saddr : np->saddr;
 249         fl6.flowi6_oif = sk->sk_bound_dev_if;
 250         fl6.flowi6_mark = sk->sk_mark;
 251         fl6.fl6_dport = usin->sin6_port;
 252         fl6.fl6_sport = inet->inet_sport;
 253
 254         final_p = fl6_update_dst(&fl6, np->opt, &final);
 255
 256         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 257
 258         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 259         if (IS_ERR(dst)) {
 260                 err = PTR_ERR(dst);
 261                 goto failure;
 262         }
 263
 264         if (saddr == NULL) {
 265                 saddr = &fl6.saddr;
 266                 np->rcv_saddr = *saddr;
 267         }
 268
 269         /* set the source address */
 270         np->saddr = *saddr;
 271         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 272
 273         sk->sk_gso_type = SKB_GSO_TCPV6;
 274         __ip6_dst_store(sk, dst, NULL, NULL);
 275
 276         rt = (struct rt6_info *) dst;
 277         if (tcp_death_row.sysctl_tw_recycle &&
 278             !tp->rx_opt.ts_recent_stamp &&
 279             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
 280                 struct inet_peer *peer = rt6_get_peer(rt);
 281                 /*
 282                  * VJ's idea. We save last timestamp seen from
 283                  * the destination in peer table, when entering state
 284                  * TIME-WAIT * and initialize rx_opt.ts_recent from it,
 285                  * when trying new connection.
 286                  */
 287                 if (peer) {
 288                         inet_peer_refcheck(peer);
 289                         if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
 290                                 tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
 291                                 tp->rx_opt.ts_recent = peer->tcp_ts;
 292                         }
 293                 }
 294         }
 295
 296         icsk->icsk_ext_hdr_len = 0;
 297         if (np->opt)
 298                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 299                                           np->opt->opt_nflen);
 300
 301         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 302
 303         inet->inet_dport = usin->sin6_port;
 304
 305         tcp_set_state(sk, TCP_SYN_SENT);
 306         err = inet6_hash_connect(&tcp_death_row, sk);
 307         if (err)
 308                 goto late_failure;
 309
 310         if (!tp->write_seq)
 311                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 312                                                              np->daddr.s6_addr32,
 313                                                              inet->inet_sport,
 314                                                              inet->inet_dport);
 315
 316         err = tcp_connect(sk);
 317         if (err)
 318                 goto late_failure;
 319
 320         return 0;
 321
 322 late_failure:
 323         tcp_set_state(sk, TCP_CLOSE);
 324         __sk_dst_reset(sk);
 325 failure:
 326         inet->inet_dport = 0;
 327         sk->sk_route_caps = 0;
 328         return err;
 329 }
 330
 331 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 332                 u8 type, u8 code, int offset, __be32 info)
 333 {
 334         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 335         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 336         struct ipv6_pinfo *np;
 337         struct sock *sk;
 338         int err;
 339         struct tcp_sock *tp;
 340         __u32 seq;
 341         struct net *net = dev_net(skb->dev);
 342
 343         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 344                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 345
 346         if (sk == NULL) {
 347                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 348                                    ICMP6_MIB_INERRORS);
 349                 return;
 350         }
 351
 352         if (sk->sk_state == TCP_TIME_WAIT) {
 353                 inet_twsk_put(inet_twsk(sk));
 354                 return;
 355         }
 356
 357         bh_lock_sock(sk);
 358         if (sock_owned_by_user(sk))
 359                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 360
 361         if (sk->sk_state == TCP_CLOSE)
 362                 goto out;
 363
 364         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 365                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 366                 goto out;
 367         }
 368
 369         tp = tcp_sk(sk);
 370         seq = ntohl(th->seq);
 371         if (sk->sk_state != TCP_LISTEN &&
 372             !between(seq, tp->snd_una, tp->snd_nxt)) {
 373                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 374                 goto out;
 375         }
 376
 377         np = inet6_sk(sk);
 378
 379         if (type == ICMPV6_PKT_TOOBIG) {
 380                 struct dst_entry *dst;
 381
 382                 if (sock_owned_by_user(sk))
 383                         goto out;
 384                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 385                         goto out;
 386
 387                 /* icmp should have updated the destination cache entry */
 388                 dst = __sk_dst_check(sk, np->dst_cookie);
 389
 390                 if (dst == NULL) {
 391                         struct inet_sock *inet = inet_sk(sk);
 392                         struct flowi6 fl6;
 393
 394                         /* BUGGG_FUTURE: Again, it is not clear how
 395                            to handle rthdr case. Ignore this complexity
 396                            for now.
 397                          */
 398                         memset(&fl6, 0, sizeof(fl6));
 399                         fl6.flowi6_proto = IPPROTO_TCP;
 400                         fl6.daddr = np->daddr;
 401                         fl6.saddr = np->saddr;
 402                         fl6.flowi6_oif = sk->sk_bound_dev_if;
 403                         fl6.flowi6_mark = sk->sk_mark;
 404                         fl6.fl6_dport = inet->inet_dport;
 405                         fl6.fl6_sport = inet->inet_sport;
 406                         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 407
 408                         dst = ip6_dst_lookup_flow(sk, &fl6, NULL, false);
 409                         if (IS_ERR(dst)) {
 410                                 sk->sk_err_soft = -PTR_ERR(dst);
 411                                 goto out;
 412                         }
 413
 414                 } else
 415                         dst_hold(dst);
 416
 417                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 418                         tcp_sync_mss(sk, dst_mtu(dst));
 419                         tcp_simple_retransmit(sk);
 420                 } /* else let the usual retransmit timer handle it */
 421                 dst_release(dst);
 422                 goto out;
 423         }
 424
 425         icmpv6_err_convert(type, code, &err);
 426
 427         /* Might be for an request_sock */
 428         switch (sk->sk_state) {
 429                 struct request_sock *req, **prev;
 430         case TCP_LISTEN:
 431                 if (sock_owned_by_user(sk))
 432                         goto out;
 433
 434                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 435                                            &hdr->saddr, inet6_iif(skb));
 436                 if (!req)
 437                         goto out;
 438
 439                 /* ICMPs are not backlogged, hence we cannot get
 440                  * an established socket here.
 441                  */
 442                 WARN_ON(req->sk != NULL);
 443
 444                 if (seq != tcp_rsk(req)->snt_isn) {
 445                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 446                         goto out;
 447                 }
 448
 449                 inet_csk_reqsk_queue_drop(sk, req, prev);
 450                 goto out;
 451
 452         case TCP_SYN_SENT:
 453         case TCP_SYN_RECV:  /* Cannot happen.
 454                                It can, it SYNs are crossed. --ANK */
 455                 if (!sock_owned_by_user(sk)) {
 456                         sk->sk_err = err;
 457                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 458
 459                         tcp_done(sk);
 460                 } else
 461                         sk->sk_err_soft = err;
 462                 goto out;
 463         }
 464
 465         if (!sock_owned_by_user(sk) && np->recverr) {
 466                 sk->sk_err = err;
 467                 sk->sk_error_report(sk);
 468         } else
 469                 sk->sk_err_soft = err;
 470
 471 out:
 472         bh_unlock_sock(sk);
 473         sock_put(sk);
 474 }
 475
 476
 477 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 478                               struct request_values *rvp)
 479 {
 480         struct inet6_request_sock *treq = inet6_rsk(req);
 481         struct ipv6_pinfo *np = inet6_sk(sk);
 482         struct sk_buff * skb;
 483         struct ipv6_txoptions *opt = NULL;
 484         struct in6_addr * final_p, final;
 485         struct flowi6 fl6;
 486         struct dst_entry *dst;
 487         int err;
 488
 489         memset(&fl6, 0, sizeof(fl6));
 490         fl6.flowi6_proto = IPPROTO_TCP;
 491         fl6.daddr = treq->rmt_addr;
 492         fl6.saddr = treq->loc_addr;
 493         fl6.flowlabel = 0;
 494         fl6.flowi6_oif = treq->iif;
 495         fl6.flowi6_mark = sk->sk_mark;
 496         fl6.fl6_dport = inet_rsk(req)->rmt_port;
 497         fl6.fl6_sport = inet_rsk(req)->loc_port;
 498         security_req_classify_flow(req, flowi6_to_flowi(&fl6));
 499
 500         opt = np->opt;
 501         final_p = fl6_update_dst(&fl6, opt, &final);
 502
 503         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
 504         if (IS_ERR(dst)) {
 505                 err = PTR_ERR(dst);
 506                 dst = NULL;
 507                 goto done;
 508         }
 509         skb = tcp_make_synack(sk, dst, req, rvp);
 510         err = -ENOMEM;
 511         if (skb) {
 512                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 513
 514                 fl6.daddr = treq->rmt_addr;
 515                 err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
 516                 err = net_xmit_eval(err);
 517         }
 518
 519 done:
 520         if (opt && opt != np->opt)
 521                 sock_kfree_s(sk, opt, opt->tot_len);
 522         dst_release(dst);
 523         return err;
 524 }
 525
 526 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 527                              struct request_values *rvp)
 528 {
 529         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 530         return tcp_v6_send_synack(sk, req, rvp);
 531 }
 532
 533 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 534 {
 535         kfree_skb(inet6_rsk(req)->pktopts);
 536 }
 537
 538 #ifdef CONFIG_TCP_MD5SIG
 539 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 540                                                    const struct in6_addr *addr)
 541 {
 542         struct tcp_sock *tp = tcp_sk(sk);
 543         int i;
 544
 545         BUG_ON(tp == NULL);
 546
 547         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 548                 return NULL;
 549
 550         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 551                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
 552                         return &tp->md5sig_info->keys6[i].base;
 553         }
 554         return NULL;
 555 }
 556
 557 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 558                                                 struct sock *addr_sk)
 559 {
 560         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 561 }
 562
 563 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 564                                                       struct request_sock *req)
 565 {
 566         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 567 }
 568
 569 static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
 570                              char *newkey, u8 newkeylen)
 571 {
 572         /* Add key to the list */
 573         struct tcp_md5sig_key *key;
 574         struct tcp_sock *tp = tcp_sk(sk);
 575         struct tcp6_md5sig_key *keys;
 576
 577         key = tcp_v6_md5_do_lookup(sk, peer);
 578         if (key) {
 579                 /* modify existing entry - just update that one */
 580                 kfree(key->key);
 581                 key->key = newkey;
 582                 key->keylen = newkeylen;
 583         } else {
 584                 /* reallocate new list if current one is full. */
 585                 if (!tp->md5sig_info) {
 586                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 587                         if (!tp->md5sig_info) {
 588                                 kfree(newkey);
 589                                 return -ENOMEM;
 590                         }
 591                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 592                 }
 593                 if (tp->md5sig_info->entries6 == 0 &&
 594                         tcp_alloc_md5sig_pool(sk) == NULL) {
 595                         kfree(newkey);
 596                         return -ENOMEM;
 597                 }
 598                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 599                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 600                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 601
 602                         if (!keys) {
 603                                 kfree(newkey);
 604                                 if (tp->md5sig_info->entries6 == 0)
 605                                         tcp_free_md5sig_pool();
 606                                 return -ENOMEM;
 607                         }
 608
 609                         if (tp->md5sig_info->entries6)
 610                                 memmove(keys, tp->md5sig_info->keys6,
 611                                         (sizeof (tp->md5sig_info->keys6[0]) *
 612                                          tp->md5sig_info->entries6));
 613
 614                         kfree(tp->md5sig_info->keys6);
 615                         tp->md5sig_info->keys6 = keys;
 616                         tp->md5sig_info->alloced6++;
 617                 }
 618
 619                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr = *peer;
 620                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 621                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 622
 623                 tp->md5sig_info->entries6++;
 624         }
 625         return 0;
 626 }
 627
 628 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 629                                u8 *newkey, __u8 newkeylen)
 630 {
 631         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 632                                  newkey, newkeylen);
 633 }
 634
 635 static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
 636 {
 637         struct tcp_sock *tp = tcp_sk(sk);
 638         int i;
 639
 640         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 641                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
 642                         /* Free the key */
 643                         kfree(tp->md5sig_info->keys6[i].base.key);
 644                         tp->md5sig_info->entries6--;
 645
 646                         if (tp->md5sig_info->entries6 == 0) {
 647                                 kfree(tp->md5sig_info->keys6);
 648                                 tp->md5sig_info->keys6 = NULL;
 649                                 tp->md5sig_info->alloced6 = 0;
 650                                 tcp_free_md5sig_pool();
 651                         } else {
 652                                 /* shrink the database */
 653                                 if (tp->md5sig_info->entries6 != i)
 654                                         memmove(&tp->md5sig_info->keys6[i],
 655                                                 &tp->md5sig_info->keys6[i+1],
 656                                                 (tp->md5sig_info->entries6 - i)
 657                                                 * sizeof (tp->md5sig_info->keys6[0]));
 658                         }
 659                         return 0;
 660                 }
 661         }
 662         return -ENOENT;
 663 }
 664
 665 static void tcp_v6_clear_md5_list (struct sock *sk)
 666 {
 667         struct tcp_sock *tp = tcp_sk(sk);
 668         int i;
 669
 670         if (tp->md5sig_info->entries6) {
 671                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 672                         kfree(tp->md5sig_info->keys6[i].base.key);
 673                 tp->md5sig_info->entries6 = 0;
 674                 tcp_free_md5sig_pool();
 675         }
 676
 677         kfree(tp->md5sig_info->keys6);
 678         tp->md5sig_info->keys6 = NULL;
 679         tp->md5sig_info->alloced6 = 0;
 680
 681         if (tp->md5sig_info->entries4) {
 682                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 683                         kfree(tp->md5sig_info->keys4[i].base.key);
 684                 tp->md5sig_info->entries4 = 0;
 685                 tcp_free_md5sig_pool();
 686         }
 687
 688         kfree(tp->md5sig_info->keys4);
 689         tp->md5sig_info->keys4 = NULL;
 690         tp->md5sig_info->alloced4 = 0;
 691 }
 692
 693 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 694                                   int optlen)
 695 {
 696         struct tcp_md5sig cmd;
 697         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 698         u8 *newkey;
 699
 700         if (optlen < sizeof(cmd))
 701                 return -EINVAL;
 702
 703         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 704                 return -EFAULT;
 705
 706         if (sin6->sin6_family != AF_INET6)
 707                 return -EINVAL;
 708
 709         if (!cmd.tcpm_keylen) {
 710                 if (!tcp_sk(sk)->md5sig_info)
 711                         return -ENOENT;
 712                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 713                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 714                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 715         }
 716
 717         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 718                 return -EINVAL;
 719
 720         if (!tcp_sk(sk)->md5sig_info) {
 721                 struct tcp_sock *tp = tcp_sk(sk);
 722                 struct tcp_md5sig_info *p;
 723
 724                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 725                 if (!p)
 726                         return -ENOMEM;
 727
 728                 tp->md5sig_info = p;
 729                 sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 730         }
 731
 732         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 733         if (!newkey)
 734                 return -ENOMEM;
 735         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 736                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 737                                          newkey, cmd.tcpm_keylen);
 738         }
 739         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 740 }
 741
 742 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 743                                         const struct in6_addr *daddr,
 744                                         const struct in6_addr *saddr, int nbytes)
 745 {
 746         struct tcp6_pseudohdr *bp;
 747         struct scatterlist sg;
 748
 749         bp = &hp->md5_blk.ip6;
 750         /* 1. TCP pseudo-header (RFC2460) */
 751         bp->saddr = *saddr;
 752         bp->daddr = *daddr;
 753         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 754         bp->len = cpu_to_be32(nbytes);
 755
 756         sg_init_one(&sg, bp, sizeof(*bp));
 757         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 758 }
 759
 760 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 761                                const struct in6_addr *daddr, struct in6_addr *saddr,
 762                                const struct tcphdr *th)
 763 {
 764         struct tcp_md5sig_pool *hp;
 765         struct hash_desc *desc;
 766
 767         hp = tcp_get_md5sig_pool();
 768         if (!hp)
 769                 goto clear_hash_noput;
 770         desc = &hp->md5_desc;
 771
 772         if (crypto_hash_init(desc))
 773                 goto clear_hash;
 774         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 775                 goto clear_hash;
 776         if (tcp_md5_hash_header(hp, th))
 777                 goto clear_hash;
 778         if (tcp_md5_hash_key(hp, key))
 779                 goto clear_hash;
 780         if (crypto_hash_final(desc, md5_hash))
 781                 goto clear_hash;
 782
 783         tcp_put_md5sig_pool();
 784         return 0;
 785
 786 clear_hash:
 787         tcp_put_md5sig_pool();
 788 clear_hash_noput:
 789         memset(md5_hash, 0, 16);
 790         return 1;
 791 }
 792
 793 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 794                                const struct sock *sk,
 795                                const struct request_sock *req,
 796                                const struct sk_buff *skb)
 797 {
 798         const struct in6_addr *saddr, *daddr;
 799         struct tcp_md5sig_pool *hp;
 800         struct hash_desc *desc;
 801         const struct tcphdr *th = tcp_hdr(skb);
 802
 803         if (sk) {
 804                 saddr = &inet6_sk(sk)->saddr;
 805                 daddr = &inet6_sk(sk)->daddr;
 806         } else if (req) {
 807                 saddr = &inet6_rsk(req)->loc_addr;
 808                 daddr = &inet6_rsk(req)->rmt_addr;
 809         } else {
 810                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 811                 saddr = &ip6h->saddr;
 812                 daddr = &ip6h->daddr;
 813         }
 814
 815         hp = tcp_get_md5sig_pool();
 816         if (!hp)
 817                 goto clear_hash_noput;
 818         desc = &hp->md5_desc;
 819
 820         if (crypto_hash_init(desc))
 821                 goto clear_hash;
 822
 823         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 824                 goto clear_hash;
 825         if (tcp_md5_hash_header(hp, th))
 826                 goto clear_hash;
 827         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 828                 goto clear_hash;
 829         if (tcp_md5_hash_key(hp, key))
 830                 goto clear_hash;
 831         if (crypto_hash_final(desc, md5_hash))
 832                 goto clear_hash;
 833
 834         tcp_put_md5sig_pool();
 835         return 0;
 836
 837 clear_hash:
 838         tcp_put_md5sig_pool();
 839 clear_hash_noput:
 840         memset(md5_hash, 0, 16);
 841         return 1;
 842 }
 843
 844 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 845 {
 846         const __u8 *hash_location = NULL;
 847         struct tcp_md5sig_key *hash_expected;
 848         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 849         const struct tcphdr *th = tcp_hdr(skb);
 850         int genhash;
 851         u8 newhash[16];
 852
 853         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 854         hash_location = tcp_parse_md5sig_option(th);
 855
 856         /* We've parsed the options - do we have a hash? */
 857         if (!hash_expected && !hash_location)
 858                 return 0;
 859
 860         if (hash_expected && !hash_location) {
 861                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 862                 return 1;
 863         }
 864
 865         if (!hash_expected && hash_location) {
 866                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 867                 return 1;
 868         }
 869
 870         /* check the signature */
 871         genhash = tcp_v6_md5_hash_skb(newhash,
 872                                       hash_expected,
 873                                       NULL, NULL, skb);
 874
 875         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 876                 if (net_ratelimit()) {
 877                         printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 878                                genhash ? "failed" : "mismatch",
 879                                &ip6h->saddr, ntohs(th->source),
 880                                &ip6h->daddr, ntohs(th->dest));
 881                 }
 882                 return 1;
 883         }
 884         return 0;
 885 }
 886 #endif
 887
 888 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 889         .family         =       AF_INET6,
 890         .obj_size       =       sizeof(struct tcp6_request_sock),
 891         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 892         .send_ack       =       tcp_v6_reqsk_send_ack,
 893         .destructor     =       tcp_v6_reqsk_destructor,
 894         .send_reset     =       tcp_v6_send_reset,
 895         .syn_ack_timeout =      tcp_syn_ack_timeout,
 896 };
 897
 898 #ifdef CONFIG_TCP_MD5SIG
 899 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 900         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 901         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 902 };
 903 #endif
 904
 905 static void __tcp_v6_send_check(struct sk_buff *skb,
 906                                 const struct in6_addr *saddr, const struct in6_addr *daddr)
 907 {
 908         struct tcphdr *th = tcp_hdr(skb);
 909
 910         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 911                 th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
 912                 skb->csum_start = skb_transport_header(skb) - skb->head;
 913                 skb->csum_offset = offsetof(struct tcphdr, check);
 914         } else {
 915                 th->check = tcp_v6_check(skb->len, saddr, daddr,
 916                                          csum_partial(th, th->doff << 2,
 917                                                       skb->csum));
 918         }
 919 }
 920
 921 static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 922 {
 923         struct ipv6_pinfo *np = inet6_sk(sk);
 924
 925         __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
 926 }
 927
 928 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 929 {
 930         const struct ipv6hdr *ipv6h;
 931         struct tcphdr *th;
 932
 933         if (!pskb_may_pull(skb, sizeof(*th)))
 934                 return -EINVAL;
 935
 936         ipv6h = ipv6_hdr(skb);
 937         th = tcp_hdr(skb);
 938
 939         th->check = 0;
 940         skb->ip_summed = CHECKSUM_PARTIAL;
 941         __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
 942         return 0;
 943 }
 944
 945 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 946                                          struct sk_buff *skb)
 947 {
 948         const struct ipv6hdr *iph = skb_gro_network_header(skb);
 949
 950         switch (skb->ip_summed) {
 951         case CHECKSUM_COMPLETE:
 952                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
 953                                   skb->csum)) {
 954                         skb->ip_summed = CHECKSUM_UNNECESSARY;
 955                         break;
 956                 }
 957
 958                 /* fall through */
 959         case CHECKSUM_NONE:
 960                 NAPI_GRO_CB(skb)->flush = 1;
 961                 return NULL;
 962         }
 963
 964         return tcp_gro_receive(head, skb);
 965 }
 966
 967 static int tcp6_gro_complete(struct sk_buff *skb)
 968 {
 969         const struct ipv6hdr *iph = ipv6_hdr(skb);
 970         struct tcphdr *th = tcp_hdr(skb);
 971
 972         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
 973                                   &iph->saddr, &iph->daddr, 0);
 974         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
 975
 976         return tcp_gro_complete(skb);
 977 }
 978
 979 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 980                                  u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
 981 {
 982         const struct tcphdr *th = tcp_hdr(skb);
 983         struct tcphdr *t1;
 984         struct sk_buff *buff;
 985         struct flowi6 fl6;
 986         struct net *net = dev_net(skb_dst(skb)->dev);
 987         struct sock *ctl_sk = net->ipv6.tcp_sk;
 988         unsigned int tot_len = sizeof(struct tcphdr);
 989         struct dst_entry *dst;
 990         __be32 *topt;
 991
 992         if (ts)
 993                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 994 #ifdef CONFIG_TCP_MD5SIG
 995         if (key)
 996                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 997 #endif
 998
 999         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1000                          GFP_ATOMIC);
1001         if (buff == NULL)
1002                 return;
1003
1004         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1005
1006         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1007         skb_reset_transport_header(buff);
1008
1009         /* Swap the send and the receive. */
1010         memset(t1, 0, sizeof(*t1));
1011         t1->dest = th->source;
1012         t1->source = th->dest;
1013         t1->doff = tot_len / 4;
1014         t1->seq = htonl(seq);
1015         t1->ack_seq = htonl(ack);
1016         t1->ack = !rst || !th->ack;
1017         t1->rst = rst;
1018         t1->window = htons(win);
1019
1020         topt = (__be32 *)(t1 + 1);
1021
1022         if (ts) {
1023                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1024                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1025                 *topt++ = htonl(tcp_time_stamp);
1026                 *topt++ = htonl(ts);
1027         }
1028
1029 #ifdef CONFIG_TCP_MD5SIG
1030         if (key) {
1031                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1032                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1033                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
1034                                     &ipv6_hdr(skb)->saddr,
1035                                     &ipv6_hdr(skb)->daddr, t1);
1036         }
1037 #endif
1038
1039         memset(&fl6, 0, sizeof(fl6));
1040         fl6.daddr = ipv6_hdr(skb)->saddr;
1041         fl6.saddr = ipv6_hdr(skb)->daddr;
1042
1043         buff->ip_summed = CHECKSUM_PARTIAL;
1044         buff->csum = 0;
1045
1046         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
1047
1048         fl6.flowi6_proto = IPPROTO_TCP;
1049         fl6.flowi6_oif = inet6_iif(skb);
1050         fl6.fl6_dport = t1->dest;
1051         fl6.fl6_sport = t1->source;
1052         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
1053
1054         /* Pass a socket to ip6_dst_lookup either it is for RST
1055          * Underlying function will use this to retrieve the network
1056          * namespace
1057          */
1058         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
1059         if (!IS_ERR(dst)) {
1060                 skb_dst_set(buff, dst);
1061                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
1062                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
1063                 if (rst)
1064                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
1065                 return;
1066         }
1067
1068         kfree_skb(buff);
1069 }
1070
1071 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
1072 {
1073         const struct tcphdr *th = tcp_hdr(skb);
1074         u32 seq = 0, ack_seq = 0;
1075         struct tcp_md5sig_key *key = NULL;
1076
1077         if (th->rst)
1078                 return;
1079
1080         if (!ipv6_unicast_destination(skb))
1081                 return;
1082
1083 #ifdef CONFIG_TCP_MD5SIG
1084         if (sk)
1085                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1086 #endif
1087
1088         if (th->ack)
1089                 seq = ntohl(th->ack_seq);
1090         else
1091                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
1092                           (th->doff << 2);
1093
1094         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
1095 }
1096
1097 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
1098                             struct tcp_md5sig_key *key, u8 tclass)
1099 {
1100         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
1101 }
1102
1103 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1104 {
1105         struct inet_timewait_sock *tw = inet_twsk(sk);
1106         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1107
1108         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1109                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1110                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
1111                         tw->tw_tclass);
1112
1113         inet_twsk_put(tw);
1114 }
1115
1116 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1117                                   struct request_sock *req)
1118 {
1119         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1120                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
1121 }
1122
1123
1124 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1125 {
1126         struct request_sock *req, **prev;
1127         const struct tcphdr *th = tcp_hdr(skb);
1128         struct sock *nsk;
1129
1130         /* Find possible connection requests. */
1131         req = inet6_csk_search_req(sk, &prev, th->source,
1132                                    &ipv6_hdr(skb)->saddr,
1133                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1134         if (req)
1135                 return tcp_check_req(sk, skb, req, prev);
1136
1137         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1138                         &ipv6_hdr(skb)->saddr, th->source,
1139                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1140
1141         if (nsk) {
1142                 if (nsk->sk_state != TCP_TIME_WAIT) {
1143                         bh_lock_sock(nsk);
1144                         return nsk;
1145                 }
1146                 inet_twsk_put(inet_twsk(nsk));
1147                 return NULL;
1148         }
1149
1150 #ifdef CONFIG_SYN_COOKIES
1151         if (!th->syn)
1152                 sk = cookie_v6_check(sk, skb);
1153 #endif
1154         return sk;
1155 }
1156
1157 /* FIXME: this is substantially similar to the ipv4 code.
1158  * Can some kind of merge be done? -- erics
1159  */
1160 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1161 {
1162         struct tcp_extend_values tmp_ext;
1163         struct tcp_options_received tmp_opt;
1164         const u8 *hash_location;
1165         struct request_sock *req;
1166         struct inet6_request_sock *treq;
1167         struct ipv6_pinfo *np = inet6_sk(sk);
1168         struct tcp_sock *tp = tcp_sk(sk);
1169         __u32 isn = TCP_SKB_CB(skb)->when;
1170         struct dst_entry *dst = NULL;
1171         int want_cookie = 0;
1172
1173         if (skb->protocol == htons(ETH_P_IP))
1174                 return tcp_v4_conn_request(sk, skb);
1175
1176         if (!ipv6_unicast_destination(skb))
1177                 goto drop;
1178
1179         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1180                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
1181                 if (!want_cookie)
1182                         goto drop;
1183         }
1184
1185         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1186                 goto drop;
1187
1188         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1189         if (req == NULL)
1190                 goto drop;
1191
1192 #ifdef CONFIG_TCP_MD5SIG
1193         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1194 #endif
1195
1196         tcp_clear_options(&tmp_opt);
1197         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1198         tmp_opt.user_mss = tp->rx_opt.user_mss;
1199         tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1200
1201         if (tmp_opt.cookie_plus > 0 &&
1202             tmp_opt.saw_tstamp &&
1203             !tp->rx_opt.cookie_out_never &&
1204             (sysctl_tcp_cookie_size > 0 ||
1205              (tp->cookie_values != NULL &&
1206               tp->cookie_values->cookie_desired > 0))) {
1207                 u8 *c;
1208                 u32 *d;
1209                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1210                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1211
1212                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1213                         goto drop_and_free;
1214
1215                 /* Secret recipe starts with IP addresses */
1216                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1217                 *mess++ ^= *d++;
1218                 *mess++ ^= *d++;
1219                 *mess++ ^= *d++;
1220                 *mess++ ^= *d++;
1221                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1222                 *mess++ ^= *d++;
1223                 *mess++ ^= *d++;
1224                 *mess++ ^= *d++;
1225                 *mess++ ^= *d++;
1226
1227                 /* plus variable length Initiator Cookie */
1228                 c = (u8 *)mess;
1229                 while (l-- > 0)
1230                         *c++ ^= *hash_location++;
1231
1232                 want_cookie = 0;        /* not our kind of cookie */
1233                 tmp_ext.cookie_out_never = 0; /* false */
1234                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1235         } else if (!tp->rx_opt.cookie_in_always) {
1236                 /* redundant indications, but ensure initialization. */
1237                 tmp_ext.cookie_out_never = 1; /* true */
1238                 tmp_ext.cookie_plus = 0;
1239         } else {
1240                 goto drop_and_free;
1241         }
1242         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1243
1244         if (want_cookie && !tmp_opt.saw_tstamp)
1245                 tcp_clear_options(&tmp_opt);
1246
1247         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1248         tcp_openreq_init(req, &tmp_opt, skb);
1249
1250         treq = inet6_rsk(req);
1251         treq->rmt_addr = ipv6_hdr(skb)->saddr;
1252         treq->loc_addr = ipv6_hdr(skb)->daddr;
1253         if (!want_cookie || tmp_opt.tstamp_ok)
1254                 TCP_ECN_create_request(req, tcp_hdr(skb));
1255
1256         treq->iif = sk->sk_bound_dev_if;
1257
1258         /* So that link locals have meaning */
1259         if (!sk->sk_bound_dev_if &&
1260             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1261                 treq->iif = inet6_iif(skb);
1262
1263         if (!isn) {
1264                 struct inet_peer *peer = NULL;
1265
1266                 if (ipv6_opt_accepted(sk, skb) ||
1267                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1268                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1269                         atomic_inc(&skb->users);
1270                         treq->pktopts = skb;
1271                 }
1272
1273                 if (want_cookie) {
1274                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1275                         req->cookie_ts = tmp_opt.tstamp_ok;
1276                         goto have_isn;
1277                 }
1278
1279                 /* VJ's idea. We save last timestamp seen
1280                  * from the destination in peer table, when entering
1281                  * state TIME-WAIT, and check against it before
1282                  * accepting new connection request.
1283                  *
1284                  * If "isn" is not zero, this request hit alive
1285                  * timewait bucket, so that all the necessary checks
1286                  * are made in the function processing timewait state.
1287                  */
1288                 if (tmp_opt.saw_tstamp &&
1289                     tcp_death_row.sysctl_tw_recycle &&
1290                     (dst = inet6_csk_route_req(sk, req)) != NULL &&
1291                     (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
1292                     ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
1293                                     &treq->rmt_addr)) {
1294                         inet_peer_refcheck(peer);
1295                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1296                             (s32)(peer->tcp_ts - req->ts_recent) >
1297                                                         TCP_PAWS_WINDOW) {
1298                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1299                                 goto drop_and_release;
1300                         }
1301                 }
1302                 /* Kill the following clause, if you dislike this way. */
1303                 else if (!sysctl_tcp_syncookies &&
1304                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1305                           (sysctl_max_syn_backlog >> 2)) &&
1306                          (!peer || !peer->tcp_ts_stamp) &&
1307                          (!dst || !dst_metric(dst, RTAX_RTT))) {
1308                         /* Without syncookies last quarter of
1309                          * backlog is filled with destinations,
1310                          * proven to be alive.
1311                          * It means that we continue to communicate
1312                          * to destinations, already remembered
1313                          * to the moment of synflood.
1314                          */
1315                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1316                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1317                         goto drop_and_release;
1318                 }
1319
1320                 isn = tcp_v6_init_sequence(skb);
1321         }
1322 have_isn:
1323         tcp_rsk(req)->snt_isn = isn;
1324         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1325
1326         security_inet_conn_request(sk, skb, req);
1327
1328         if (tcp_v6_send_synack(sk, req,
1329                                (struct request_values *)&tmp_ext) ||
1330             want_cookie)
1331                 goto drop_and_free;
1332
1333         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1334         return 0;
1335
1336 drop_and_release:
1337         dst_release(dst);
1338 drop_and_free:
1339         reqsk_free(req);
1340 drop:
1341         return 0; /* don't send reset */
1342 }
1343
1344 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1345                                           struct request_sock *req,
1346                                           struct dst_entry *dst)
1347 {
1348         struct inet6_request_sock *treq;
1349         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1350         struct tcp6_sock *newtcp6sk;
1351         struct inet_sock *newinet;
1352         struct tcp_sock *newtp;
1353         struct sock *newsk;
1354         struct ipv6_txoptions *opt;
1355 #ifdef CONFIG_TCP_MD5SIG
1356         struct tcp_md5sig_key *key;
1357 #endif
1358
1359         if (skb->protocol == htons(ETH_P_IP)) {
1360                 /*
1361                  *      v6 mapped
1362                  */
1363
1364                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1365
1366                 if (newsk == NULL)
1367                         return NULL;
1368
1369                 newtcp6sk = (struct tcp6_sock *)newsk;
1370                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1371
1372                 newinet = inet_sk(newsk);
1373                 newnp = inet6_sk(newsk);
1374                 newtp = tcp_sk(newsk);
1375
1376                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1377
1378                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1379
1380                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1381
1382                 newnp->rcv_saddr = newnp->saddr;
1383
1384                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1385                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1386 #ifdef CONFIG_TCP_MD5SIG
1387                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1388 #endif
1389
1390                 newnp->ipv6_ac_list = NULL;
1391                 newnp->ipv6_fl_list = NULL;
1392                 newnp->pktoptions  = NULL;
1393                 newnp->opt         = NULL;
1394                 newnp->mcast_oif   = inet6_iif(skb);
1395                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1396
1397                 /*
1398                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1399                  * here, tcp_create_openreq_child now does this for us, see the comment in
1400                  * that function for the gory details. -acme
1401                  */
1402
1403                 /* It is tricky place. Until this moment IPv4 tcp
1404                    worked with IPv6 icsk.icsk_af_ops.
1405                    Sync it now.
1406                  */
1407                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1408
1409                 return newsk;
1410         }
1411
1412         treq = inet6_rsk(req);
1413         opt = np->opt;
1414
1415         if (sk_acceptq_is_full(sk))
1416                 goto out_overflow;
1417
1418         if (!dst) {
1419                 dst = inet6_csk_route_req(sk, req);
1420                 if (!dst)
1421                         goto out;
1422         }
1423
1424         newsk = tcp_create_openreq_child(sk, req, skb);
1425         if (newsk == NULL)
1426                 goto out_nonewsk;
1427
1428         /*
1429          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1430          * count here, tcp_create_openreq_child now does this for us, see the
1431          * comment in that function for the gory details. -acme
1432          */
1433
1434         newsk->sk_gso_type = SKB_GSO_TCPV6;
1435         __ip6_dst_store(newsk, dst, NULL, NULL);
1436
1437         newtcp6sk = (struct tcp6_sock *)newsk;
1438         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1439
1440         newtp = tcp_sk(newsk);
1441         newinet = inet_sk(newsk);
1442         newnp = inet6_sk(newsk);
1443
1444         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1445
1446         newnp->daddr = treq->rmt_addr;
1447         newnp->saddr = treq->loc_addr;
1448         newnp->rcv_saddr = treq->loc_addr;
1449         newsk->sk_bound_dev_if = treq->iif;
1450
1451         /* Now IPv6 options...
1452
1453            First: no IPv4 options.
1454          */
1455         newinet->inet_opt = NULL;
1456         newnp->ipv6_ac_list = NULL;
1457         newnp->ipv6_fl_list = NULL;
1458
1459         /* Clone RX bits */
1460         newnp->rxopt.all = np->rxopt.all;
1461
1462         /* Clone pktoptions received with SYN */
1463         newnp->pktoptions = NULL;
1464         if (treq->pktopts != NULL) {
1465                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1466                 kfree_skb(treq->pktopts);
1467                 treq->pktopts = NULL;
1468                 if (newnp->pktoptions)
1469                         skb_set_owner_r(newnp->pktoptions, newsk);
1470         }
1471         newnp->opt        = NULL;
1472         newnp->mcast_oif  = inet6_iif(skb);
1473         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1474
1475         /* Clone native IPv6 options from listening socket (if any)
1476
1477            Yes, keeping reference count would be much more clever,
1478            but we make one more one thing there: reattach optmem
1479            to newsk.
1480          */
1481         if (opt) {
1482                 newnp->opt = ipv6_dup_options(newsk, opt);
1483                 if (opt != np->opt)
1484                         sock_kfree_s(sk, opt, opt->tot_len);
1485         }
1486
1487         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1488         if (newnp->opt)
1489                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1490                                                      newnp->opt->opt_flen);
1491
1492         tcp_mtup_init(newsk);
1493         tcp_sync_mss(newsk, dst_mtu(dst));
1494         newtp->advmss = dst_metric_advmss(dst);
1495         tcp_initialize_rcv_mss(newsk);
1496         if (tcp_rsk(req)->snt_synack)
1497                 tcp_valid_rtt_meas(newsk,
1498                     tcp_time_stamp - tcp_rsk(req)->snt_synack);
1499         newtp->total_retrans = req->retrans;
1500
1501         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1502         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1503
1504 #ifdef CONFIG_TCP_MD5SIG
1505         /* Copy over the MD5 key from the original socket */
1506         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1507                 /* We're using one, so create a matching key
1508                  * on the newsk structure. If we fail to get
1509                  * memory, then we end up not copying the key
1510                  * across. Shucks.
1511                  */
1512                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1513                 if (newkey != NULL)
1514                         tcp_v6_md5_do_add(newsk, &newnp->daddr,
1515                                           newkey, key->keylen);
1516         }
1517 #endif
1518
1519         if (__inet_inherit_port(sk, newsk) < 0) {
1520                 sock_put(newsk);
1521                 goto out;
1522         }
1523         __inet6_hash(newsk, NULL);
1524
1525         return newsk;
1526
1527 out_overflow:
1528         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1529 out_nonewsk:
1530         if (opt && opt != np->opt)
1531                 sock_kfree_s(sk, opt, opt->tot_len);
1532         dst_release(dst);
1533 out:
1534         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1535         return NULL;
1536 }
1537
1538 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1539 {
1540         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1541                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1542                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1543                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1544                         return 0;
1545                 }
1546         }
1547
1548         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1549                                               &ipv6_hdr(skb)->saddr,
1550                                               &ipv6_hdr(skb)->daddr, 0));
1551
1552         if (skb->len <= 76) {
1553                 return __skb_checksum_complete(skb);
1554         }
1555         return 0;
1556 }
1557
1558 /* The socket must have it's spinlock held when we get
1559  * here.
1560  *
1561  * We have a potential double-lock case here, so even when
1562  * doing backlog processing we use the BH locking scheme.
1563  * This is because we cannot sleep with the original spinlock
1564  * held.
1565  */
1566 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1567 {
1568         struct ipv6_pinfo *np = inet6_sk(sk);
1569         struct tcp_sock *tp;
1570         struct sk_buff *opt_skb = NULL;
1571
1572         /* Imagine: socket is IPv6. IPv4 packet arrives,
1573            goes to IPv4 receive handler and backlogged.
1574            From backlog it always goes here. Kerboom...
1575            Fortunately, tcp_rcv_established and rcv_established
1576            handle them correctly, but it is not case with
1577            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1578          */
1579
1580         if (skb->protocol == htons(ETH_P_IP))
1581                 return tcp_v4_do_rcv(sk, skb);
1582
1583 #ifdef CONFIG_TCP_MD5SIG
1584         if (tcp_v6_inbound_md5_hash (sk, skb))
1585                 goto discard;
1586 #endif
1587
1588         if (sk_filter(sk, skb))
1589                 goto discard;
1590
1591         /*
1592          *      socket locking is here for SMP purposes as backlog rcv
1593          *      is currently called with bh processing disabled.
1594          */
1595
1596         /* Do Stevens' IPV6_PKTOPTIONS.
1597
1598            Yes, guys, it is the only place in our code, where we
1599            may make it not affecting IPv4.
1600            The rest of code is protocol independent,
1601            and I do not like idea to uglify IPv4.
1602
1603            Actually, all the idea behind IPV6_PKTOPTIONS
1604            looks not very well thought. For now we latch
1605            options, received in the last packet, enqueued
1606            by tcp. Feel free to propose better solution.
1607                                                --ANK (980728)
1608          */
1609         if (np->rxopt.all)
1610                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1611
1612         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1613                 sock_rps_save_rxhash(sk, skb);
1614                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1615                         goto reset;
1616                 if (opt_skb)
1617                         goto ipv6_pktoptions;
1618                 return 0;
1619         }
1620
1621         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1622                 goto csum_err;
1623
1624         if (sk->sk_state == TCP_LISTEN) {
1625                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1626                 if (!nsk)
1627                         goto discard;
1628
1629                 /*
1630                  * Queue it on the new socket if the new socket is active,
1631                  * otherwise we just shortcircuit this and continue with
1632                  * the new socket..
1633                  */
1634                 if(nsk != sk) {
1635                         sock_rps_save_rxhash(nsk, skb);
1636                         if (tcp_child_process(sk, nsk, skb))
1637                                 goto reset;
1638                         if (opt_skb)
1639                                 __kfree_skb(opt_skb);
1640                         return 0;
1641                 }
1642         } else
1643                 sock_rps_save_rxhash(sk, skb);
1644
1645         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1646                 goto reset;
1647         if (opt_skb)
1648                 goto ipv6_pktoptions;
1649         return 0;
1650
1651 reset:
1652         tcp_v6_send_reset(sk, skb);
1653 discard:
1654         if (opt_skb)
1655                 __kfree_skb(opt_skb);
1656         kfree_skb(skb);
1657         return 0;
1658 csum_err:
1659         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1660         goto discard;
1661
1662
1663 ipv6_pktoptions:
1664         /* Do you ask, what is it?
1665
1666            1. skb was enqueued by tcp.
1667            2. skb is added to tail of read queue, rather than out of order.
1668            3. socket is not in passive state.
1669            4. Finally, it really contains options, which user wants to receive.
1670          */
1671         tp = tcp_sk(sk);
1672         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1673             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1674                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1675                         np->mcast_oif = inet6_iif(opt_skb);
1676                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1677                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1678                 if (ipv6_opt_accepted(sk, opt_skb)) {
1679                         skb_set_owner_r(opt_skb, sk);
1680                         opt_skb = xchg(&np->pktoptions, opt_skb);
1681                 } else {
1682                         __kfree_skb(opt_skb);
1683                         opt_skb = xchg(&np->pktoptions, NULL);
1684                 }
1685         }
1686
1687         kfree_skb(opt_skb);
1688         return 0;
1689 }
1690
1691 static int tcp_v6_rcv(struct sk_buff *skb)
1692 {
1693         const struct tcphdr *th;
1694         const struct ipv6hdr *hdr;
1695         struct sock *sk;
1696         int ret;
1697         struct net *net = dev_net(skb->dev);
1698
1699         if (skb->pkt_type != PACKET_HOST)
1700                 goto discard_it;
1701
1702         /*
1703          *      Count it even if it's bad.
1704          */
1705         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1706
1707         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1708                 goto discard_it;
1709
1710         th = tcp_hdr(skb);
1711
1712         if (th->doff < sizeof(struct tcphdr)/4)
1713                 goto bad_packet;
1714         if (!pskb_may_pull(skb, th->doff*4))
1715                 goto discard_it;
1716
1717         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1718                 goto bad_packet;
1719
1720         th = tcp_hdr(skb);
1721         hdr = ipv6_hdr(skb);
1722         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1723         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1724                                     skb->len - th->doff*4);
1725         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1726         TCP_SKB_CB(skb)->when = 0;
1727         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1728         TCP_SKB_CB(skb)->sacked = 0;
1729
1730         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1731         if (!sk)
1732                 goto no_tcp_socket;
1733
1734 process:
1735         if (sk->sk_state == TCP_TIME_WAIT)
1736                 goto do_time_wait;
1737
1738         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1739                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1740                 goto discard_and_relse;
1741         }
1742
1743         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1744                 goto discard_and_relse;
1745
1746         if (sk_filter(sk, skb))
1747                 goto discard_and_relse;
1748
1749         skb->dev = NULL;
1750
1751         bh_lock_sock_nested(sk);
1752         ret = 0;
1753         if (!sock_owned_by_user(sk)) {
1754 #ifdef CONFIG_NET_DMA
1755                 struct tcp_sock *tp = tcp_sk(sk);
1756                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1757                         tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
1758                 if (tp->ucopy.dma_chan)
1759                         ret = tcp_v6_do_rcv(sk, skb);
1760                 else
1761 #endif
1762                 {
1763                         if (!tcp_prequeue(sk, skb))
1764                                 ret = tcp_v6_do_rcv(sk, skb);
1765                 }
1766         } else if (unlikely(sk_add_backlog(sk, skb))) {
1767                 bh_unlock_sock(sk);
1768                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1769                 goto discard_and_relse;
1770         }
1771         bh_unlock_sock(sk);
1772
1773         sock_put(sk);
1774         return ret ? -1 : 0;
1775
1776 no_tcp_socket:
1777         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1778                 goto discard_it;
1779
1780         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1781 bad_packet:
1782                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1783         } else {
1784                 tcp_v6_send_reset(NULL, skb);
1785         }
1786
1787 discard_it:
1788
1789         /*
1790          *      Discard frame
1791          */
1792
1793         kfree_skb(skb);
1794         return 0;
1795
1796 discard_and_relse:
1797         sock_put(sk);
1798         goto discard_it;
1799
1800 do_time_wait:
1801         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1802                 inet_twsk_put(inet_twsk(sk));
1803                 goto discard_it;
1804         }
1805
1806         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1807                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1808                 inet_twsk_put(inet_twsk(sk));
1809                 goto discard_it;
1810         }
1811
1812         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1813         case TCP_TW_SYN:
1814         {
1815                 struct sock *sk2;
1816
1817                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1818                                             &ipv6_hdr(skb)->daddr,
1819                                             ntohs(th->dest), inet6_iif(skb));
1820                 if (sk2 != NULL) {
1821                         struct inet_timewait_sock *tw = inet_twsk(sk);
1822                         inet_twsk_deschedule(tw, &tcp_death_row);
1823                         inet_twsk_put(tw);
1824                         sk = sk2;
1825                         goto process;
1826                 }
1827                 /* Fall through to ACK */
1828         }
1829         case TCP_TW_ACK:
1830                 tcp_v6_timewait_ack(sk, skb);
1831                 break;
1832         case TCP_TW_RST:
1833                 goto no_tcp_socket;
1834         case TCP_TW_SUCCESS:;
1835         }
1836         goto discard_it;
1837 }
1838
1839 static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
1840 {
1841         struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
1842         struct ipv6_pinfo *np = inet6_sk(sk);
1843         struct inet_peer *peer;
1844
1845         if (!rt ||
1846             !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
1847                 peer = inet_getpeer_v6(&np->daddr, 1);
1848                 *release_it = true;
1849         } else {
1850                 if (!rt->rt6i_peer)
1851                         rt6_bind_peer(rt, 1);
1852                 peer = rt->rt6i_peer;
1853                 *release_it = false;
1854         }
1855
1856         return peer;
1857 }
1858
1859 static void *tcp_v6_tw_get_peer(struct sock *sk)
1860 {
1861         const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
1862         const struct inet_timewait_sock *tw = inet_twsk(sk);
1863
1864         if (tw->tw_family == AF_INET)
1865                 return tcp_v4_tw_get_peer(sk);
1866
1867         return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
1868 }
1869
1870 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1871         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1872         .twsk_unique    = tcp_twsk_unique,
1873         .twsk_destructor= tcp_twsk_destructor,
1874         .twsk_getpeer   = tcp_v6_tw_get_peer,
1875 };
1876
1877 static const struct inet_connection_sock_af_ops ipv6_specific = {
1878         .queue_xmit        = inet6_csk_xmit,
1879         .send_check        = tcp_v6_send_check,
1880         .rebuild_header    = inet6_sk_rebuild_header,
1881         .conn_request      = tcp_v6_conn_request,
1882         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1883         .get_peer          = tcp_v6_get_peer,
1884         .net_header_len    = sizeof(struct ipv6hdr),
1885         .setsockopt        = ipv6_setsockopt,
1886         .getsockopt        = ipv6_getsockopt,
1887         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1888         .sockaddr_len      = sizeof(struct sockaddr_in6),
1889         .bind_conflict     = inet6_csk_bind_conflict,
1890 #ifdef CONFIG_COMPAT
1891         .compat_setsockopt = compat_ipv6_setsockopt,
1892         .compat_getsockopt = compat_ipv6_getsockopt,
1893 #endif
1894 };
1895
1896 #ifdef CONFIG_TCP_MD5SIG
1897 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1898         .md5_lookup     =       tcp_v6_md5_lookup,
1899         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1900         .md5_add        =       tcp_v6_md5_add_func,
1901         .md5_parse      =       tcp_v6_parse_md5_keys,
1902 };
1903 #endif
1904
1905 /*
1906  *      TCP over IPv4 via INET6 API
1907  */
1908
1909 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1910         .queue_xmit        = ip_queue_xmit,
1911         .send_check        = tcp_v4_send_check,
1912         .rebuild_header    = inet_sk_rebuild_header,
1913         .conn_request      = tcp_v6_conn_request,
1914         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1915         .get_peer          = tcp_v4_get_peer,
1916         .net_header_len    = sizeof(struct iphdr),
1917         .setsockopt        = ipv6_setsockopt,
1918         .getsockopt        = ipv6_getsockopt,
1919         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1920         .sockaddr_len      = sizeof(struct sockaddr_in6),
1921         .bind_conflict     = inet6_csk_bind_conflict,
1922 #ifdef CONFIG_COMPAT
1923         .compat_setsockopt = compat_ipv6_setsockopt,
1924         .compat_getsockopt = compat_ipv6_getsockopt,
1925 #endif
1926 };
1927
1928 #ifdef CONFIG_TCP_MD5SIG
1929 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1930         .md5_lookup     =       tcp_v4_md5_lookup,
1931         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1932         .md5_add        =       tcp_v6_md5_add_func,
1933         .md5_parse      =       tcp_v6_parse_md5_keys,
1934 };
1935 #endif
1936
1937 /* NOTE: A lot of things set to zero explicitly by call to
1938  *       sk_alloc() so need not be done here.
1939  */
1940 static int tcp_v6_init_sock(struct sock *sk)
1941 {
1942         struct inet_connection_sock *icsk = inet_csk(sk);
1943         struct tcp_sock *tp = tcp_sk(sk);
1944
1945         skb_queue_head_init(&tp->out_of_order_queue);
1946         tcp_init_xmit_timers(sk);
1947         tcp_prequeue_init(tp);
1948
1949         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1950         tp->mdev = TCP_TIMEOUT_INIT;
1951
1952         /* So many TCP implementations out there (incorrectly) count the
1953          * initial SYN frame in their delayed-ACK and congestion control
1954          * algorithms that we must have the following bandaid to talk
1955          * efficiently to them.  -DaveM
1956          */
1957         tp->snd_cwnd = 2;
1958
1959         /* See draft-stevens-tcpca-spec-01 for discussion of the
1960          * initialization of these values.
1961          */
1962         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
1963         tp->snd_cwnd_clamp = ~0;
1964         tp->mss_cache = TCP_MSS_DEFAULT;
1965
1966         tp->reordering = sysctl_tcp_reordering;
1967
1968         sk->sk_state = TCP_CLOSE;
1969
1970         icsk->icsk_af_ops = &ipv6_specific;
1971         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1972         icsk->icsk_sync_mss = tcp_sync_mss;
1973         sk->sk_write_space = sk_stream_write_space;
1974         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1975
1976 #ifdef CONFIG_TCP_MD5SIG
1977         tp->af_specific = &tcp_sock_ipv6_specific;
1978 #endif
1979
1980         /* TCP Cookie Transactions */
1981         if (sysctl_tcp_cookie_size > 0) {
1982                 /* Default, cookies without s_data_payload. */
1983                 tp->cookie_values =
1984                         kzalloc(sizeof(*tp->cookie_values),
1985                                 sk->sk_allocation);
1986                 if (tp->cookie_values != NULL)
1987                         kref_init(&tp->cookie_values->kref);
1988         }
1989         /* Presumed zeroed, in order of appearance:
1990          *      cookie_in_always, cookie_out_never,
1991          *      s_data_constant, s_data_in, s_data_out
1992          */
1993         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1994         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1995
1996         local_bh_disable();
1997         percpu_counter_inc(&tcp_sockets_allocated);
1998         local_bh_enable();
1999
2000         return 0;
2001 }
2002
2003 static void tcp_v6_destroy_sock(struct sock *sk)
2004 {
2005 #ifdef CONFIG_TCP_MD5SIG
2006         /* Clean up the MD5 key list */
2007         if (tcp_sk(sk)->md5sig_info)
2008                 tcp_v6_clear_md5_list(sk);
2009 #endif
2010         tcp_v4_destroy_sock(sk);
2011         inet6_destroy_sock(sk);
2012 }
2013
2014 #ifdef CONFIG_PROC_FS
2015 /* Proc filesystem TCPv6 sock list dumping. */
2016 static void get_openreq6(struct seq_file *seq,
2017                          const struct sock *sk, struct request_sock *req, int i, int uid)
2018 {
2019         int ttd = req->expires - jiffies;
2020         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
2021         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
2022
2023         if (ttd < 0)
2024                 ttd = 0;
2025
2026         seq_printf(seq,
2027                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2028                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2029                    i,
2030                    src->s6_addr32[0], src->s6_addr32[1],
2031                    src->s6_addr32[2], src->s6_addr32[3],
2032                    ntohs(inet_rsk(req)->loc_port),
2033                    dest->s6_addr32[0], dest->s6_addr32[1],
2034                    dest->s6_addr32[2], dest->s6_addr32[3],
2035                    ntohs(inet_rsk(req)->rmt_port),
2036                    TCP_SYN_RECV,
2037                    0,0, /* could print option size, but that is af dependent. */
2038                    1,   /* timers active (only the expire timer) */
2039                    jiffies_to_clock_t(ttd),
2040                    req->retrans,
2041                    uid,
2042                    0,  /* non standard timer */
2043                    0, /* open_requests have no inode */
2044                    0, req);
2045 }
2046
2047 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
2048 {
2049         const struct in6_addr *dest, *src;
2050         __u16 destp, srcp;
2051         int timer_active;
2052         unsigned long timer_expires;
2053         const struct inet_sock *inet = inet_sk(sp);
2054         const struct tcp_sock *tp = tcp_sk(sp);
2055         const struct inet_connection_sock *icsk = inet_csk(sp);
2056         const struct ipv6_pinfo *np = inet6_sk(sp);
2057
2058         dest  = &np->daddr;
2059         src   = &np->rcv_saddr;
2060         destp = ntohs(inet->inet_dport);
2061         srcp  = ntohs(inet->inet_sport);
2062
2063         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2064                 timer_active    = 1;
2065                 timer_expires   = icsk->icsk_timeout;
2066         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2067                 timer_active    = 4;
2068                 timer_expires   = icsk->icsk_timeout;
2069         } else if (timer_pending(&sp->sk_timer)) {
2070                 timer_active    = 2;
2071                 timer_expires   = sp->sk_timer.expires;
2072         } else {
2073                 timer_active    = 0;
2074                 timer_expires = jiffies;
2075         }
2076
2077         seq_printf(seq,
2078                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2079                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
2080                    i,
2081                    src->s6_addr32[0], src->s6_addr32[1],
2082                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2083                    dest->s6_addr32[0], dest->s6_addr32[1],
2084                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2085                    sp->sk_state,
2086                    tp->write_seq-tp->snd_una,
2087                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2088                    timer_active,
2089                    jiffies_to_clock_t(timer_expires - jiffies),
2090                    icsk->icsk_retransmits,
2091                    sock_i_uid(sp),
2092                    icsk->icsk_probes_out,
2093                    sock_i_ino(sp),
2094                    atomic_read(&sp->sk_refcnt), sp,
2095                    jiffies_to_clock_t(icsk->icsk_rto),
2096                    jiffies_to_clock_t(icsk->icsk_ack.ato),
2097                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2098                    tp->snd_cwnd,
2099                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
2100                    );
2101 }
2102
2103 static void get_timewait6_sock(struct seq_file *seq,
2104                                struct inet_timewait_sock *tw, int i)
2105 {
2106         const struct in6_addr *dest, *src;
2107         __u16 destp, srcp;
2108         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2109         int ttd = tw->tw_ttd - jiffies;
2110
2111         if (ttd < 0)
2112                 ttd = 0;
2113
2114         dest = &tw6->tw_v6_daddr;
2115         src  = &tw6->tw_v6_rcv_saddr;
2116         destp = ntohs(tw->tw_dport);
2117         srcp  = ntohs(tw->tw_sport);
2118
2119         seq_printf(seq,
2120                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2121                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2122                    i,
2123                    src->s6_addr32[0], src->s6_addr32[1],
2124                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2125                    dest->s6_addr32[0], dest->s6_addr32[1],
2126                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2127                    tw->tw_substate, 0, 0,
2128                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2129                    atomic_read(&tw->tw_refcnt), tw);
2130 }
2131
2132 static int tcp6_seq_show(struct seq_file *seq, void *v)
2133 {
2134         struct tcp_iter_state *st;
2135
2136         if (v == SEQ_START_TOKEN) {
2137                 seq_puts(seq,
2138                          "  sl  "
2139                          "local_address                         "
2140                          "remote_address                        "
2141                          "st tx_queue rx_queue tr tm->when retrnsmt"
2142                          "   uid  timeout inode\n");
2143                 goto out;
2144         }
2145         st = seq->private;
2146
2147         switch (st->state) {
2148         case TCP_SEQ_STATE_LISTENING:
2149         case TCP_SEQ_STATE_ESTABLISHED:
2150                 get_tcp6_sock(seq, v, st->num);
2151                 break;
2152         case TCP_SEQ_STATE_OPENREQ:
2153                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2154                 break;
2155         case TCP_SEQ_STATE_TIME_WAIT:
2156                 get_timewait6_sock(seq, v, st->num);
2157                 break;
2158         }
2159 out:
2160         return 0;
2161 }
2162
2163 static const struct file_operations tcp6_afinfo_seq_fops = {
2164         .owner   = THIS_MODULE,
2165         .open    = tcp_seq_open,
2166         .read    = seq_read,
2167         .llseek  = seq_lseek,
2168         .release = seq_release_net
2169 };
2170
2171 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2172         .name           = "tcp6",
2173         .family         = AF_INET6,
2174         .seq_fops       = &tcp6_afinfo_seq_fops,
2175         .seq_ops        = {
2176                 .show           = tcp6_seq_show,
2177         },
2178 };
2179
2180 int __net_init tcp6_proc_init(struct net *net)
2181 {
2182         return tcp_proc_register(net, &tcp6_seq_afinfo);
2183 }
2184
2185 void tcp6_proc_exit(struct net *net)
2186 {
2187         tcp_proc_unregister(net, &tcp6_seq_afinfo);
2188 }
2189 #endif
2190
2191 struct proto tcpv6_prot = {
2192         .name                   = "TCPv6",
2193         .owner                  = THIS_MODULE,
2194         .close                  = tcp_close,
2195         .connect                = tcp_v6_connect,
2196         .disconnect             = tcp_disconnect,
2197         .accept                 = inet_csk_accept,
2198         .ioctl                  = tcp_ioctl,
2199         .init                   = tcp_v6_init_sock,
2200         .destroy                = tcp_v6_destroy_sock,
2201         .shutdown               = tcp_shutdown,
2202         .setsockopt             = tcp_setsockopt,
2203         .getsockopt             = tcp_getsockopt,
2204         .recvmsg                = tcp_recvmsg,
2205         .sendmsg                = tcp_sendmsg,
2206         .sendpage               = tcp_sendpage,
2207         .backlog_rcv            = tcp_v6_do_rcv,
2208         .hash                   = tcp_v6_hash,
2209         .unhash                 = inet_unhash,
2210         .get_port               = inet_csk_get_port,
2211         .enter_memory_pressure  = tcp_enter_memory_pressure,
2212         .sockets_allocated      = &tcp_sockets_allocated,
2213         .memory_allocated       = &tcp_memory_allocated,
2214         .memory_pressure        = &tcp_memory_pressure,
2215         .orphan_count           = &tcp_orphan_count,
2216         .sysctl_mem             = sysctl_tcp_mem,
2217         .sysctl_wmem            = sysctl_tcp_wmem,
2218         .sysctl_rmem            = sysctl_tcp_rmem,
2219         .max_header             = MAX_TCP_HEADER,
2220         .obj_size               = sizeof(struct tcp6_sock),
2221         .slab_flags             = SLAB_DESTROY_BY_RCU,
2222         .twsk_prot              = &tcp6_timewait_sock_ops,
2223         .rsk_prot               = &tcp6_request_sock_ops,
2224         .h.hashinfo             = &tcp_hashinfo,
2225         .no_autobind            = true,
2226 #ifdef CONFIG_COMPAT
2227         .compat_setsockopt      = compat_tcp_setsockopt,
2228         .compat_getsockopt      = compat_tcp_getsockopt,
2229 #endif
2230 };
2231
2232 static const struct inet6_protocol tcpv6_protocol = {
2233         .handler        =       tcp_v6_rcv,
2234         .err_handler    =       tcp_v6_err,
2235         .gso_send_check =       tcp_v6_gso_send_check,
2236         .gso_segment    =       tcp_tso_segment,
2237         .gro_receive    =       tcp6_gro_receive,
2238         .gro_complete   =       tcp6_gro_complete,
2239         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2240 };
2241
2242 static struct inet_protosw tcpv6_protosw = {
2243         .type           =       SOCK_STREAM,
2244         .protocol       =       IPPROTO_TCP,
2245         .prot           =       &tcpv6_prot,
2246         .ops            =       &inet6_stream_ops,
2247         .no_check       =       0,
2248         .flags          =       INET_PROTOSW_PERMANENT |
2249                                 INET_PROTOSW_ICSK,
2250 };
2251
2252 static int __net_init tcpv6_net_init(struct net *net)
2253 {
2254         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2255                                     SOCK_RAW, IPPROTO_TCP, net);
2256 }
2257
2258 static void __net_exit tcpv6_net_exit(struct net *net)
2259 {
2260         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2261 }
2262
2263 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2264 {
2265         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2266 }
2267
2268 static struct pernet_operations tcpv6_net_ops = {
2269         .init       = tcpv6_net_init,
2270         .exit       = tcpv6_net_exit,
2271         .exit_batch = tcpv6_net_exit_batch,
2272 };
2273
2274 int __init tcpv6_init(void)
2275 {
2276         int ret;
2277
2278         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2279         if (ret)
2280                 goto out;
2281
2282         /* register inet6 protocol */
2283         ret = inet6_register_protosw(&tcpv6_protosw);
2284         if (ret)
2285                 goto out_tcpv6_protocol;
2286
2287         ret = register_pernet_subsys(&tcpv6_net_ops);
2288         if (ret)
2289                 goto out_tcpv6_protosw;
2290 out:
2291         return ret;
2292
2293 out_tcpv6_protocol:
2294         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2295 out_tcpv6_protosw:
2296         inet6_unregister_protosw(&tcpv6_protosw);
2297         goto out;
2298 }
2299
2300 void tcpv6_exit(void)
2301 {
2302         unregister_pernet_subsys(&tcpv6_net_ops);
2303         inet6_unregister_protosw(&tcpv6_protosw);
2304         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2305 }