GNU Linux-libre 5.4.257-gnu1
[releases.git] / net / dccp / ipv6.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *      DCCP over IPv6
4  *      Linux INET6 implementation
5  *
6  *      Based on net/dccp6/ipv6.c
7  *
8  *      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
9  */
10
11 #include <linux/module.h>
12 #include <linux/random.h>
13 #include <linux/slab.h>
14 #include <linux/xfrm.h>
15 #include <linux/string.h>
16
17 #include <net/addrconf.h>
18 #include <net/inet_common.h>
19 #include <net/inet_hashtables.h>
20 #include <net/inet_sock.h>
21 #include <net/inet6_connection_sock.h>
22 #include <net/inet6_hashtables.h>
23 #include <net/ip6_route.h>
24 #include <net/ipv6.h>
25 #include <net/protocol.h>
26 #include <net/transp_v6.h>
27 #include <net/ip6_checksum.h>
28 #include <net/xfrm.h>
29 #include <net/secure_seq.h>
30 #include <net/sock.h>
31
32 #include "dccp.h"
33 #include "ipv6.h"
34 #include "feat.h"
35
36 /* The per-net dccp.v6_ctl_sk is used for sending RSTs and ACKs */
37
38 static const struct inet_connection_sock_af_ops dccp_ipv6_mapped;
39 static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops;
40
41 /* add pseudo-header to DCCP checksum stored in skb->csum */
42 static inline __sum16 dccp_v6_csum_finish(struct sk_buff *skb,
43                                       const struct in6_addr *saddr,
44                                       const struct in6_addr *daddr)
45 {
46         return csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_DCCP, skb->csum);
47 }
48
49 static inline void dccp_v6_send_check(struct sock *sk, struct sk_buff *skb)
50 {
51         struct ipv6_pinfo *np = inet6_sk(sk);
52         struct dccp_hdr *dh = dccp_hdr(skb);
53
54         dccp_csum_outgoing(skb);
55         dh->dccph_checksum = dccp_v6_csum_finish(skb, &np->saddr, &sk->sk_v6_daddr);
56 }
57
58 static inline __u64 dccp_v6_init_sequence(struct sk_buff *skb)
59 {
60         return secure_dccpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
61                                              ipv6_hdr(skb)->saddr.s6_addr32,
62                                              dccp_hdr(skb)->dccph_dport,
63                                              dccp_hdr(skb)->dccph_sport     );
64
65 }
66
67 static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
68                         u8 type, u8 code, int offset, __be32 info)
69 {
70         const struct ipv6hdr *hdr;
71         const struct dccp_hdr *dh;
72         struct dccp_sock *dp;
73         struct ipv6_pinfo *np;
74         struct sock *sk;
75         int err;
76         __u64 seq;
77         struct net *net = dev_net(skb->dev);
78
79         /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x,
80          * which is in byte 7 of the dccp header.
81          * Our caller (icmpv6_notify()) already pulled 8 bytes for us.
82          *
83          * Later on, we want to access the sequence number fields, which are
84          * beyond 8 bytes, so we have to pskb_may_pull() ourselves.
85          */
86         dh = (struct dccp_hdr *)(skb->data + offset);
87         if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh)))
88                 return -EINVAL;
89         hdr = (const struct ipv6hdr *)skb->data;
90         dh = (struct dccp_hdr *)(skb->data + offset);
91
92         sk = __inet6_lookup_established(net, &dccp_hashinfo,
93                                         &hdr->daddr, dh->dccph_dport,
94                                         &hdr->saddr, ntohs(dh->dccph_sport),
95                                         inet6_iif(skb), 0);
96
97         if (!sk) {
98                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
99                                   ICMP6_MIB_INERRORS);
100                 return -ENOENT;
101         }
102
103         if (sk->sk_state == DCCP_TIME_WAIT) {
104                 inet_twsk_put(inet_twsk(sk));
105                 return 0;
106         }
107         seq = dccp_hdr_seq(dh);
108         if (sk->sk_state == DCCP_NEW_SYN_RECV) {
109                 dccp_req_err(sk, seq);
110                 return 0;
111         }
112
113         bh_lock_sock(sk);
114         if (sock_owned_by_user(sk))
115                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
116
117         if (sk->sk_state == DCCP_CLOSED)
118                 goto out;
119
120         dp = dccp_sk(sk);
121         if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
122             !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
123                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
124                 goto out;
125         }
126
127         np = inet6_sk(sk);
128
129         if (type == NDISC_REDIRECT) {
130                 if (!sock_owned_by_user(sk)) {
131                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
132
133                         if (dst)
134                                 dst->ops->redirect(dst, sk, skb);
135                 }
136                 goto out;
137         }
138
139         if (type == ICMPV6_PKT_TOOBIG) {
140                 struct dst_entry *dst = NULL;
141
142                 if (!ip6_sk_accept_pmtu(sk))
143                         goto out;
144
145                 if (sock_owned_by_user(sk))
146                         goto out;
147                 if ((1 << sk->sk_state) & (DCCPF_LISTEN | DCCPF_CLOSED))
148                         goto out;
149
150                 dst = inet6_csk_update_pmtu(sk, ntohl(info));
151                 if (!dst)
152                         goto out;
153
154                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst))
155                         dccp_sync_mss(sk, dst_mtu(dst));
156                 goto out;
157         }
158
159         icmpv6_err_convert(type, code, &err);
160
161         /* Might be for an request_sock */
162         switch (sk->sk_state) {
163         case DCCP_REQUESTING:
164         case DCCP_RESPOND:  /* Cannot happen.
165                                It can, it SYNs are crossed. --ANK */
166                 if (!sock_owned_by_user(sk)) {
167                         __DCCP_INC_STATS(DCCP_MIB_ATTEMPTFAILS);
168                         sk->sk_err = err;
169                         /*
170                          * Wake people up to see the error
171                          * (see connect in sock.c)
172                          */
173                         sk->sk_error_report(sk);
174                         dccp_done(sk);
175                 } else
176                         sk->sk_err_soft = err;
177                 goto out;
178         }
179
180         if (!sock_owned_by_user(sk) && np->recverr) {
181                 sk->sk_err = err;
182                 sk->sk_error_report(sk);
183         } else
184                 sk->sk_err_soft = err;
185
186 out:
187         bh_unlock_sock(sk);
188         sock_put(sk);
189         return 0;
190 }
191
192
193 static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req)
194 {
195         struct inet_request_sock *ireq = inet_rsk(req);
196         struct ipv6_pinfo *np = inet6_sk(sk);
197         struct sk_buff *skb;
198         struct in6_addr *final_p, final;
199         struct flowi6 fl6;
200         int err = -1;
201         struct dst_entry *dst;
202
203         memset(&fl6, 0, sizeof(fl6));
204         fl6.flowi6_proto = IPPROTO_DCCP;
205         fl6.daddr = ireq->ir_v6_rmt_addr;
206         fl6.saddr = ireq->ir_v6_loc_addr;
207         fl6.flowlabel = 0;
208         fl6.flowi6_oif = ireq->ir_iif;
209         fl6.fl6_dport = ireq->ir_rmt_port;
210         fl6.fl6_sport = htons(ireq->ir_num);
211         security_req_classify_flow(req, flowi6_to_flowi(&fl6));
212
213
214         rcu_read_lock();
215         final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
216         rcu_read_unlock();
217
218         dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
219         if (IS_ERR(dst)) {
220                 err = PTR_ERR(dst);
221                 dst = NULL;
222                 goto done;
223         }
224
225         skb = dccp_make_response(sk, dst, req);
226         if (skb != NULL) {
227                 struct dccp_hdr *dh = dccp_hdr(skb);
228                 struct ipv6_txoptions *opt;
229
230                 dh->dccph_checksum = dccp_v6_csum_finish(skb,
231                                                          &ireq->ir_v6_loc_addr,
232                                                          &ireq->ir_v6_rmt_addr);
233                 fl6.daddr = ireq->ir_v6_rmt_addr;
234                 rcu_read_lock();
235                 opt = ireq->ipv6_opt;
236                 if (!opt)
237                         opt = rcu_dereference(np->opt);
238                 err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, opt, np->tclass,
239                                sk->sk_priority);
240                 rcu_read_unlock();
241                 err = net_xmit_eval(err);
242         }
243
244 done:
245         dst_release(dst);
246         return err;
247 }
248
249 static void dccp_v6_reqsk_destructor(struct request_sock *req)
250 {
251         dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
252         kfree(inet_rsk(req)->ipv6_opt);
253         kfree_skb(inet_rsk(req)->pktopts);
254 }
255
256 static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
257 {
258         const struct ipv6hdr *rxip6h;
259         struct sk_buff *skb;
260         struct flowi6 fl6;
261         struct net *net = dev_net(skb_dst(rxskb)->dev);
262         struct sock *ctl_sk = net->dccp.v6_ctl_sk;
263         struct dst_entry *dst;
264
265         if (dccp_hdr(rxskb)->dccph_type == DCCP_PKT_RESET)
266                 return;
267
268         if (!ipv6_unicast_destination(rxskb))
269                 return;
270
271         skb = dccp_ctl_make_reset(ctl_sk, rxskb);
272         if (skb == NULL)
273                 return;
274
275         rxip6h = ipv6_hdr(rxskb);
276         dccp_hdr(skb)->dccph_checksum = dccp_v6_csum_finish(skb, &rxip6h->saddr,
277                                                             &rxip6h->daddr);
278
279         memset(&fl6, 0, sizeof(fl6));
280         fl6.daddr = rxip6h->saddr;
281         fl6.saddr = rxip6h->daddr;
282
283         fl6.flowi6_proto = IPPROTO_DCCP;
284         fl6.flowi6_oif = inet6_iif(rxskb);
285         fl6.fl6_dport = dccp_hdr(skb)->dccph_dport;
286         fl6.fl6_sport = dccp_hdr(skb)->dccph_sport;
287         security_skb_classify_flow(rxskb, flowi6_to_flowi(&fl6));
288
289         /* sk = NULL, but it is safe for now. RST socket required. */
290         dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
291         if (!IS_ERR(dst)) {
292                 skb_dst_set(skb, dst);
293                 ip6_xmit(ctl_sk, skb, &fl6, 0, NULL, 0, 0);
294                 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
295                 DCCP_INC_STATS(DCCP_MIB_OUTRSTS);
296                 return;
297         }
298
299         kfree_skb(skb);
300 }
301
302 static struct request_sock_ops dccp6_request_sock_ops = {
303         .family         = AF_INET6,
304         .obj_size       = sizeof(struct dccp6_request_sock),
305         .rtx_syn_ack    = dccp_v6_send_response,
306         .send_ack       = dccp_reqsk_send_ack,
307         .destructor     = dccp_v6_reqsk_destructor,
308         .send_reset     = dccp_v6_ctl_send_reset,
309         .syn_ack_timeout = dccp_syn_ack_timeout,
310 };
311
312 static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
313 {
314         struct request_sock *req;
315         struct dccp_request_sock *dreq;
316         struct inet_request_sock *ireq;
317         struct ipv6_pinfo *np = inet6_sk(sk);
318         const __be32 service = dccp_hdr_request(skb)->dccph_req_service;
319         struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
320
321         if (skb->protocol == htons(ETH_P_IP))
322                 return dccp_v4_conn_request(sk, skb);
323
324         if (!ipv6_unicast_destination(skb))
325                 return 0;       /* discard, don't send a reset here */
326
327         if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
328                 __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
329                 return 0;
330         }
331
332         if (dccp_bad_service_code(sk, service)) {
333                 dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
334                 goto drop;
335         }
336         /*
337          * There are no SYN attacks on IPv6, yet...
338          */
339         dcb->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
340         if (inet_csk_reqsk_queue_is_full(sk))
341                 goto drop;
342
343         if (sk_acceptq_is_full(sk))
344                 goto drop;
345
346         req = inet_reqsk_alloc(&dccp6_request_sock_ops, sk, true);
347         if (req == NULL)
348                 goto drop;
349
350         if (dccp_reqsk_init(req, dccp_sk(sk), skb))
351                 goto drop_and_free;
352
353         dreq = dccp_rsk(req);
354         if (dccp_parse_options(sk, dreq, skb))
355                 goto drop_and_free;
356
357         if (security_inet_conn_request(sk, skb, req))
358                 goto drop_and_free;
359
360         ireq = inet_rsk(req);
361         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
362         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
363         ireq->ireq_family = AF_INET6;
364         ireq->ir_mark = inet_request_mark(sk, skb);
365
366         if (ipv6_opt_accepted(sk, skb, IP6CB(skb)) ||
367             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
368             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
369                 refcount_inc(&skb->users);
370                 ireq->pktopts = skb;
371         }
372         ireq->ir_iif = sk->sk_bound_dev_if;
373
374         /* So that link locals have meaning */
375         if (!sk->sk_bound_dev_if &&
376             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
377                 ireq->ir_iif = inet6_iif(skb);
378
379         /*
380          * Step 3: Process LISTEN state
381          *
382          *   Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
383          *
384          * Setting S.SWL/S.SWH to is deferred to dccp_create_openreq_child().
385          */
386         dreq->dreq_isr     = dcb->dccpd_seq;
387         dreq->dreq_gsr     = dreq->dreq_isr;
388         dreq->dreq_iss     = dccp_v6_init_sequence(skb);
389         dreq->dreq_gss     = dreq->dreq_iss;
390         dreq->dreq_service = service;
391
392         if (dccp_v6_send_response(sk, req))
393                 goto drop_and_free;
394
395         inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
396         reqsk_put(req);
397         return 0;
398
399 drop_and_free:
400         reqsk_free(req);
401 drop:
402         __DCCP_INC_STATS(DCCP_MIB_ATTEMPTFAILS);
403         return -1;
404 }
405
406 static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
407                                               struct sk_buff *skb,
408                                               struct request_sock *req,
409                                               struct dst_entry *dst,
410                                               struct request_sock *req_unhash,
411                                               bool *own_req)
412 {
413         struct inet_request_sock *ireq = inet_rsk(req);
414         struct ipv6_pinfo *newnp;
415         const struct ipv6_pinfo *np = inet6_sk(sk);
416         struct ipv6_txoptions *opt;
417         struct inet_sock *newinet;
418         struct dccp6_sock *newdp6;
419         struct sock *newsk;
420
421         if (skb->protocol == htons(ETH_P_IP)) {
422                 /*
423                  *      v6 mapped
424                  */
425                 newsk = dccp_v4_request_recv_sock(sk, skb, req, dst,
426                                                   req_unhash, own_req);
427                 if (newsk == NULL)
428                         return NULL;
429
430                 newdp6 = (struct dccp6_sock *)newsk;
431                 newinet = inet_sk(newsk);
432                 newinet->pinet6 = &newdp6->inet6;
433                 newnp = inet6_sk(newsk);
434
435                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
436
437                 newnp->saddr = newsk->sk_v6_rcv_saddr;
438
439                 inet_csk(newsk)->icsk_af_ops = &dccp_ipv6_mapped;
440                 newsk->sk_backlog_rcv = dccp_v4_do_rcv;
441                 newnp->pktoptions  = NULL;
442                 newnp->opt         = NULL;
443                 newnp->ipv6_mc_list = NULL;
444                 newnp->ipv6_ac_list = NULL;
445                 newnp->ipv6_fl_list = NULL;
446                 newnp->mcast_oif   = inet_iif(skb);
447                 newnp->mcast_hops  = ip_hdr(skb)->ttl;
448
449                 /*
450                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
451                  * here, dccp_create_openreq_child now does this for us, see the comment in
452                  * that function for the gory details. -acme
453                  */
454
455                 /* It is tricky place. Until this moment IPv4 tcp
456                    worked with IPv6 icsk.icsk_af_ops.
457                    Sync it now.
458                  */
459                 dccp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
460
461                 return newsk;
462         }
463
464
465         if (sk_acceptq_is_full(sk))
466                 goto out_overflow;
467
468         if (!dst) {
469                 struct flowi6 fl6;
470
471                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_DCCP);
472                 if (!dst)
473                         goto out;
474         }
475
476         newsk = dccp_create_openreq_child(sk, req, skb);
477         if (newsk == NULL)
478                 goto out_nonewsk;
479
480         /*
481          * No need to charge this sock to the relevant IPv6 refcnt debug socks
482          * count here, dccp_create_openreq_child now does this for us, see the
483          * comment in that function for the gory details. -acme
484          */
485
486         ip6_dst_store(newsk, dst, NULL, NULL);
487         newsk->sk_route_caps = dst->dev->features & ~(NETIF_F_IP_CSUM |
488                                                       NETIF_F_TSO);
489         newdp6 = (struct dccp6_sock *)newsk;
490         newinet = inet_sk(newsk);
491         newinet->pinet6 = &newdp6->inet6;
492         newnp = inet6_sk(newsk);
493
494         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
495
496         newsk->sk_v6_daddr      = ireq->ir_v6_rmt_addr;
497         newnp->saddr            = ireq->ir_v6_loc_addr;
498         newsk->sk_v6_rcv_saddr  = ireq->ir_v6_loc_addr;
499         newsk->sk_bound_dev_if  = ireq->ir_iif;
500
501         /* Now IPv6 options...
502
503            First: no IPv4 options.
504          */
505         newinet->inet_opt = NULL;
506
507         /* Clone RX bits */
508         newnp->rxopt.all = np->rxopt.all;
509
510         newnp->ipv6_mc_list = NULL;
511         newnp->ipv6_ac_list = NULL;
512         newnp->ipv6_fl_list = NULL;
513         newnp->pktoptions = NULL;
514         newnp->opt        = NULL;
515         newnp->mcast_oif  = inet6_iif(skb);
516         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
517
518         /*
519          * Clone native IPv6 options from listening socket (if any)
520          *
521          * Yes, keeping reference count would be much more clever, but we make
522          * one more one thing there: reattach optmem to newsk.
523          */
524         opt = ireq->ipv6_opt;
525         if (!opt)
526                 opt = rcu_dereference(np->opt);
527         if (opt) {
528                 opt = ipv6_dup_options(newsk, opt);
529                 RCU_INIT_POINTER(newnp->opt, opt);
530         }
531         inet_csk(newsk)->icsk_ext_hdr_len = 0;
532         if (opt)
533                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
534                                                     opt->opt_flen;
535
536         dccp_sync_mss(newsk, dst_mtu(dst));
537
538         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
539         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
540
541         if (__inet_inherit_port(sk, newsk) < 0) {
542                 inet_csk_prepare_forced_close(newsk);
543                 dccp_done(newsk);
544                 goto out;
545         }
546         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash), NULL);
547         /* Clone pktoptions received with SYN, if we own the req */
548         if (*own_req && ireq->pktopts) {
549                 newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk);
550                 consume_skb(ireq->pktopts);
551                 ireq->pktopts = NULL;
552         }
553
554         return newsk;
555
556 out_overflow:
557         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
558 out_nonewsk:
559         dst_release(dst);
560 out:
561         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENDROPS);
562         return NULL;
563 }
564
565 /* The socket must have it's spinlock held when we get
566  * here.
567  *
568  * We have a potential double-lock case here, so even when
569  * doing backlog processing we use the BH locking scheme.
570  * This is because we cannot sleep with the original spinlock
571  * held.
572  */
573 static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
574 {
575         struct ipv6_pinfo *np = inet6_sk(sk);
576         struct sk_buff *opt_skb = NULL;
577
578         /* Imagine: socket is IPv6. IPv4 packet arrives,
579            goes to IPv4 receive handler and backlogged.
580            From backlog it always goes here. Kerboom...
581            Fortunately, dccp_rcv_established and rcv_established
582            handle them correctly, but it is not case with
583            dccp_v6_hnd_req and dccp_v6_ctl_send_reset().   --ANK
584          */
585
586         if (skb->protocol == htons(ETH_P_IP))
587                 return dccp_v4_do_rcv(sk, skb);
588
589         if (sk_filter(sk, skb))
590                 goto discard;
591
592         /*
593          * socket locking is here for SMP purposes as backlog rcv is currently
594          * called with bh processing disabled.
595          */
596
597         /* Do Stevens' IPV6_PKTOPTIONS.
598
599            Yes, guys, it is the only place in our code, where we
600            may make it not affecting IPv4.
601            The rest of code is protocol independent,
602            and I do not like idea to uglify IPv4.
603
604            Actually, all the idea behind IPV6_PKTOPTIONS
605            looks not very well thought. For now we latch
606            options, received in the last packet, enqueued
607            by tcp. Feel free to propose better solution.
608                                                --ANK (980728)
609          */
610         if (np->rxopt.all)
611                 opt_skb = skb_clone_and_charge_r(skb, sk);
612
613         if (sk->sk_state == DCCP_OPEN) { /* Fast path */
614                 if (dccp_rcv_established(sk, skb, dccp_hdr(skb), skb->len))
615                         goto reset;
616                 if (opt_skb)
617                         goto ipv6_pktoptions;
618                 return 0;
619         }
620
621         /*
622          *  Step 3: Process LISTEN state
623          *     If S.state == LISTEN,
624          *       If P.type == Request or P contains a valid Init Cookie option,
625          *            (* Must scan the packet's options to check for Init
626          *               Cookies.  Only Init Cookies are processed here,
627          *               however; other options are processed in Step 8.  This
628          *               scan need only be performed if the endpoint uses Init
629          *               Cookies *)
630          *            (* Generate a new socket and switch to that socket *)
631          *            Set S := new socket for this port pair
632          *            S.state = RESPOND
633          *            Choose S.ISS (initial seqno) or set from Init Cookies
634          *            Initialize S.GAR := S.ISS
635          *            Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookies
636          *            Continue with S.state == RESPOND
637          *            (* A Response packet will be generated in Step 11 *)
638          *       Otherwise,
639          *            Generate Reset(No Connection) unless P.type == Reset
640          *            Drop packet and return
641          *
642          * NOTE: the check for the packet types is done in
643          *       dccp_rcv_state_process
644          */
645
646         if (dccp_rcv_state_process(sk, skb, dccp_hdr(skb), skb->len))
647                 goto reset;
648         if (opt_skb)
649                 goto ipv6_pktoptions;
650         return 0;
651
652 reset:
653         dccp_v6_ctl_send_reset(sk, skb);
654 discard:
655         if (opt_skb != NULL)
656                 __kfree_skb(opt_skb);
657         kfree_skb(skb);
658         return 0;
659
660 /* Handling IPV6_PKTOPTIONS skb the similar
661  * way it's done for net/ipv6/tcp_ipv6.c
662  */
663 ipv6_pktoptions:
664         if (!((1 << sk->sk_state) & (DCCPF_CLOSED | DCCPF_LISTEN))) {
665                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
666                         np->mcast_oif = inet6_iif(opt_skb);
667                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
668                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
669                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
670                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
671                 if (np->repflow)
672                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
673                 if (ipv6_opt_accepted(sk, opt_skb,
674                                       &DCCP_SKB_CB(opt_skb)->header.h6)) {
675                         memmove(IP6CB(opt_skb),
676                                 &DCCP_SKB_CB(opt_skb)->header.h6,
677                                 sizeof(struct inet6_skb_parm));
678                         opt_skb = xchg(&np->pktoptions, opt_skb);
679                 } else {
680                         __kfree_skb(opt_skb);
681                         opt_skb = xchg(&np->pktoptions, NULL);
682                 }
683         }
684
685         kfree_skb(opt_skb);
686         return 0;
687 }
688
689 static int dccp_v6_rcv(struct sk_buff *skb)
690 {
691         const struct dccp_hdr *dh;
692         bool refcounted;
693         struct sock *sk;
694         int min_cov;
695
696         /* Step 1: Check header basics */
697
698         if (dccp_invalid_packet(skb))
699                 goto discard_it;
700
701         /* Step 1: If header checksum is incorrect, drop packet and return. */
702         if (dccp_v6_csum_finish(skb, &ipv6_hdr(skb)->saddr,
703                                      &ipv6_hdr(skb)->daddr)) {
704                 DCCP_WARN("dropped packet with invalid checksum\n");
705                 goto discard_it;
706         }
707
708         dh = dccp_hdr(skb);
709
710         DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(dh);
711         DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
712
713         if (dccp_packet_without_ack(skb))
714                 DCCP_SKB_CB(skb)->dccpd_ack_seq = DCCP_PKT_WITHOUT_ACK_SEQ;
715         else
716                 DCCP_SKB_CB(skb)->dccpd_ack_seq = dccp_hdr_ack_seq(skb);
717
718 lookup:
719         sk = __inet6_lookup_skb(&dccp_hashinfo, skb, __dccp_hdr_len(dh),
720                                 dh->dccph_sport, dh->dccph_dport,
721                                 inet6_iif(skb), 0, &refcounted);
722         if (!sk) {
723                 dccp_pr_debug("failed to look up flow ID in table and "
724                               "get corresponding socket\n");
725                 goto no_dccp_socket;
726         }
727
728         /*
729          * Step 2:
730          *      ... or S.state == TIMEWAIT,
731          *              Generate Reset(No Connection) unless P.type == Reset
732          *              Drop packet and return
733          */
734         if (sk->sk_state == DCCP_TIME_WAIT) {
735                 dccp_pr_debug("sk->sk_state == DCCP_TIME_WAIT: do_time_wait\n");
736                 inet_twsk_put(inet_twsk(sk));
737                 goto no_dccp_socket;
738         }
739
740         if (sk->sk_state == DCCP_NEW_SYN_RECV) {
741                 struct request_sock *req = inet_reqsk(sk);
742                 struct sock *nsk;
743
744                 sk = req->rsk_listener;
745                 if (unlikely(sk->sk_state != DCCP_LISTEN)) {
746                         inet_csk_reqsk_queue_drop_and_put(sk, req);
747                         goto lookup;
748                 }
749                 sock_hold(sk);
750                 refcounted = true;
751                 nsk = dccp_check_req(sk, skb, req);
752                 if (!nsk) {
753                         reqsk_put(req);
754                         goto discard_and_relse;
755                 }
756                 if (nsk == sk) {
757                         reqsk_put(req);
758                 } else if (dccp_child_process(sk, nsk, skb)) {
759                         dccp_v6_ctl_send_reset(sk, skb);
760                         goto discard_and_relse;
761                 } else {
762                         sock_put(sk);
763                         return 0;
764                 }
765         }
766         /*
767          * RFC 4340, sec. 9.2.1: Minimum Checksum Coverage
768          *      o if MinCsCov = 0, only packets with CsCov = 0 are accepted
769          *      o if MinCsCov > 0, also accept packets with CsCov >= MinCsCov
770          */
771         min_cov = dccp_sk(sk)->dccps_pcrlen;
772         if (dh->dccph_cscov  &&  (min_cov == 0 || dh->dccph_cscov < min_cov))  {
773                 dccp_pr_debug("Packet CsCov %d does not satisfy MinCsCov %d\n",
774                               dh->dccph_cscov, min_cov);
775                 /* FIXME: send Data Dropped option (see also dccp_v4_rcv) */
776                 goto discard_and_relse;
777         }
778
779         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
780                 goto discard_and_relse;
781
782         return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4,
783                                 refcounted) ? -1 : 0;
784
785 no_dccp_socket:
786         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
787                 goto discard_it;
788         /*
789          * Step 2:
790          *      If no socket ...
791          *              Generate Reset(No Connection) unless P.type == Reset
792          *              Drop packet and return
793          */
794         if (dh->dccph_type != DCCP_PKT_RESET) {
795                 DCCP_SKB_CB(skb)->dccpd_reset_code =
796                                         DCCP_RESET_CODE_NO_CONNECTION;
797                 dccp_v6_ctl_send_reset(sk, skb);
798         }
799
800 discard_it:
801         kfree_skb(skb);
802         return 0;
803
804 discard_and_relse:
805         if (refcounted)
806                 sock_put(sk);
807         goto discard_it;
808 }
809
810 static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
811                            int addr_len)
812 {
813         struct sockaddr_in6 *usin = (struct sockaddr_in6 *)uaddr;
814         struct inet_connection_sock *icsk = inet_csk(sk);
815         struct inet_sock *inet = inet_sk(sk);
816         struct ipv6_pinfo *np = inet6_sk(sk);
817         struct dccp_sock *dp = dccp_sk(sk);
818         struct in6_addr *saddr = NULL, *final_p, final;
819         struct ipv6_txoptions *opt;
820         struct flowi6 fl6;
821         struct dst_entry *dst;
822         int addr_type;
823         int err;
824
825         dp->dccps_role = DCCP_ROLE_CLIENT;
826
827         if (addr_len < SIN6_LEN_RFC2133)
828                 return -EINVAL;
829
830         if (usin->sin6_family != AF_INET6)
831                 return -EAFNOSUPPORT;
832
833         memset(&fl6, 0, sizeof(fl6));
834
835         if (np->sndflow) {
836                 fl6.flowlabel = usin->sin6_flowinfo & IPV6_FLOWINFO_MASK;
837                 IP6_ECN_flow_init(fl6.flowlabel);
838                 if (fl6.flowlabel & IPV6_FLOWLABEL_MASK) {
839                         struct ip6_flowlabel *flowlabel;
840                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
841                         if (IS_ERR(flowlabel))
842                                 return -EINVAL;
843                         fl6_sock_release(flowlabel);
844                 }
845         }
846         /*
847          * connect() to INADDR_ANY means loopback (BSD'ism).
848          */
849         if (ipv6_addr_any(&usin->sin6_addr))
850                 usin->sin6_addr.s6_addr[15] = 1;
851
852         addr_type = ipv6_addr_type(&usin->sin6_addr);
853
854         if (addr_type & IPV6_ADDR_MULTICAST)
855                 return -ENETUNREACH;
856
857         if (addr_type & IPV6_ADDR_LINKLOCAL) {
858                 if (addr_len >= sizeof(struct sockaddr_in6) &&
859                     usin->sin6_scope_id) {
860                         /* If interface is set while binding, indices
861                          * must coincide.
862                          */
863                         if (sk->sk_bound_dev_if &&
864                             sk->sk_bound_dev_if != usin->sin6_scope_id)
865                                 return -EINVAL;
866
867                         sk->sk_bound_dev_if = usin->sin6_scope_id;
868                 }
869
870                 /* Connect to link-local address requires an interface */
871                 if (!sk->sk_bound_dev_if)
872                         return -EINVAL;
873         }
874
875         sk->sk_v6_daddr = usin->sin6_addr;
876         np->flow_label = fl6.flowlabel;
877
878         /*
879          * DCCP over IPv4
880          */
881         if (addr_type == IPV6_ADDR_MAPPED) {
882                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
883                 struct sockaddr_in sin;
884
885                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
886
887                 if (__ipv6_only_sock(sk))
888                         return -ENETUNREACH;
889
890                 sin.sin_family = AF_INET;
891                 sin.sin_port = usin->sin6_port;
892                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
893
894                 icsk->icsk_af_ops = &dccp_ipv6_mapped;
895                 sk->sk_backlog_rcv = dccp_v4_do_rcv;
896
897                 err = dccp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
898                 if (err) {
899                         icsk->icsk_ext_hdr_len = exthdrlen;
900                         icsk->icsk_af_ops = &dccp_ipv6_af_ops;
901                         sk->sk_backlog_rcv = dccp_v6_do_rcv;
902                         goto failure;
903                 }
904                 np->saddr = sk->sk_v6_rcv_saddr;
905                 return err;
906         }
907
908         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
909                 saddr = &sk->sk_v6_rcv_saddr;
910
911         fl6.flowi6_proto = IPPROTO_DCCP;
912         fl6.daddr = sk->sk_v6_daddr;
913         fl6.saddr = saddr ? *saddr : np->saddr;
914         fl6.flowi6_oif = sk->sk_bound_dev_if;
915         fl6.fl6_dport = usin->sin6_port;
916         fl6.fl6_sport = inet->inet_sport;
917         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
918
919         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
920         final_p = fl6_update_dst(&fl6, opt, &final);
921
922         dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
923         if (IS_ERR(dst)) {
924                 err = PTR_ERR(dst);
925                 goto failure;
926         }
927
928         if (saddr == NULL) {
929                 saddr = &fl6.saddr;
930                 sk->sk_v6_rcv_saddr = *saddr;
931         }
932
933         /* set the source address */
934         np->saddr = *saddr;
935         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
936
937         ip6_dst_store(sk, dst, NULL, NULL);
938
939         icsk->icsk_ext_hdr_len = 0;
940         if (opt)
941                 icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
942
943         inet->inet_dport = usin->sin6_port;
944
945         dccp_set_state(sk, DCCP_REQUESTING);
946         err = inet6_hash_connect(&dccp_death_row, sk);
947         if (err)
948                 goto late_failure;
949
950         dp->dccps_iss = secure_dccpv6_sequence_number(np->saddr.s6_addr32,
951                                                       sk->sk_v6_daddr.s6_addr32,
952                                                       inet->inet_sport,
953                                                       inet->inet_dport);
954         err = dccp_connect(sk);
955         if (err)
956                 goto late_failure;
957
958         return 0;
959
960 late_failure:
961         dccp_set_state(sk, DCCP_CLOSED);
962         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
963                 inet_reset_saddr(sk);
964         __sk_dst_reset(sk);
965 failure:
966         inet->inet_dport = 0;
967         sk->sk_route_caps = 0;
968         return err;
969 }
970
971 static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops = {
972         .queue_xmit        = inet6_csk_xmit,
973         .send_check        = dccp_v6_send_check,
974         .rebuild_header    = inet6_sk_rebuild_header,
975         .conn_request      = dccp_v6_conn_request,
976         .syn_recv_sock     = dccp_v6_request_recv_sock,
977         .net_header_len    = sizeof(struct ipv6hdr),
978         .setsockopt        = ipv6_setsockopt,
979         .getsockopt        = ipv6_getsockopt,
980         .addr2sockaddr     = inet6_csk_addr2sockaddr,
981         .sockaddr_len      = sizeof(struct sockaddr_in6),
982 #ifdef CONFIG_COMPAT
983         .compat_setsockopt = compat_ipv6_setsockopt,
984         .compat_getsockopt = compat_ipv6_getsockopt,
985 #endif
986 };
987
988 /*
989  *      DCCP over IPv4 via INET6 API
990  */
991 static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
992         .queue_xmit        = ip_queue_xmit,
993         .send_check        = dccp_v4_send_check,
994         .rebuild_header    = inet_sk_rebuild_header,
995         .conn_request      = dccp_v6_conn_request,
996         .syn_recv_sock     = dccp_v6_request_recv_sock,
997         .net_header_len    = sizeof(struct iphdr),
998         .setsockopt        = ipv6_setsockopt,
999         .getsockopt        = ipv6_getsockopt,
1000         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1001         .sockaddr_len      = sizeof(struct sockaddr_in6),
1002 #ifdef CONFIG_COMPAT
1003         .compat_setsockopt = compat_ipv6_setsockopt,
1004         .compat_getsockopt = compat_ipv6_getsockopt,
1005 #endif
1006 };
1007
1008 static void dccp_v6_sk_destruct(struct sock *sk)
1009 {
1010         dccp_destruct_common(sk);
1011         inet6_sock_destruct(sk);
1012 }
1013
1014 /* NOTE: A lot of things set to zero explicitly by call to
1015  *       sk_alloc() so need not be done here.
1016  */
1017 static int dccp_v6_init_sock(struct sock *sk)
1018 {
1019         static __u8 dccp_v6_ctl_sock_initialized;
1020         int err = dccp_init_sock(sk, dccp_v6_ctl_sock_initialized);
1021
1022         if (err == 0) {
1023                 if (unlikely(!dccp_v6_ctl_sock_initialized))
1024                         dccp_v6_ctl_sock_initialized = 1;
1025                 inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops;
1026                 sk->sk_destruct = dccp_v6_sk_destruct;
1027         }
1028
1029         return err;
1030 }
1031
1032 static struct timewait_sock_ops dccp6_timewait_sock_ops = {
1033         .twsk_obj_size  = sizeof(struct dccp6_timewait_sock),
1034 };
1035
1036 static struct proto dccp_v6_prot = {
1037         .name              = "DCCPv6",
1038         .owner             = THIS_MODULE,
1039         .close             = dccp_close,
1040         .connect           = dccp_v6_connect,
1041         .disconnect        = dccp_disconnect,
1042         .ioctl             = dccp_ioctl,
1043         .init              = dccp_v6_init_sock,
1044         .setsockopt        = dccp_setsockopt,
1045         .getsockopt        = dccp_getsockopt,
1046         .sendmsg           = dccp_sendmsg,
1047         .recvmsg           = dccp_recvmsg,
1048         .backlog_rcv       = dccp_v6_do_rcv,
1049         .hash              = inet6_hash,
1050         .unhash            = inet_unhash,
1051         .accept            = inet_csk_accept,
1052         .get_port          = inet_csk_get_port,
1053         .shutdown          = dccp_shutdown,
1054         .destroy           = dccp_destroy_sock,
1055         .orphan_count      = &dccp_orphan_count,
1056         .max_header        = MAX_DCCP_HEADER,
1057         .obj_size          = sizeof(struct dccp6_sock),
1058         .slab_flags        = SLAB_TYPESAFE_BY_RCU,
1059         .rsk_prot          = &dccp6_request_sock_ops,
1060         .twsk_prot         = &dccp6_timewait_sock_ops,
1061         .h.hashinfo        = &dccp_hashinfo,
1062 #ifdef CONFIG_COMPAT
1063         .compat_setsockopt = compat_dccp_setsockopt,
1064         .compat_getsockopt = compat_dccp_getsockopt,
1065 #endif
1066 };
1067
1068 static const struct inet6_protocol dccp_v6_protocol = {
1069         .handler        = dccp_v6_rcv,
1070         .err_handler    = dccp_v6_err,
1071         .flags          = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
1072 };
1073
1074 static const struct proto_ops inet6_dccp_ops = {
1075         .family            = PF_INET6,
1076         .owner             = THIS_MODULE,
1077         .release           = inet6_release,
1078         .bind              = inet6_bind,
1079         .connect           = inet_stream_connect,
1080         .socketpair        = sock_no_socketpair,
1081         .accept            = inet_accept,
1082         .getname           = inet6_getname,
1083         .poll              = dccp_poll,
1084         .ioctl             = inet6_ioctl,
1085         .gettstamp         = sock_gettstamp,
1086         .listen            = inet_dccp_listen,
1087         .shutdown          = inet_shutdown,
1088         .setsockopt        = sock_common_setsockopt,
1089         .getsockopt        = sock_common_getsockopt,
1090         .sendmsg           = inet_sendmsg,
1091         .recvmsg           = sock_common_recvmsg,
1092         .mmap              = sock_no_mmap,
1093         .sendpage          = sock_no_sendpage,
1094 #ifdef CONFIG_COMPAT
1095         .compat_setsockopt = compat_sock_common_setsockopt,
1096         .compat_getsockopt = compat_sock_common_getsockopt,
1097 #endif
1098 };
1099
1100 static struct inet_protosw dccp_v6_protosw = {
1101         .type           = SOCK_DCCP,
1102         .protocol       = IPPROTO_DCCP,
1103         .prot           = &dccp_v6_prot,
1104         .ops            = &inet6_dccp_ops,
1105         .flags          = INET_PROTOSW_ICSK,
1106 };
1107
1108 static int __net_init dccp_v6_init_net(struct net *net)
1109 {
1110         if (dccp_hashinfo.bhash == NULL)
1111                 return -ESOCKTNOSUPPORT;
1112
1113         return inet_ctl_sock_create(&net->dccp.v6_ctl_sk, PF_INET6,
1114                                     SOCK_DCCP, IPPROTO_DCCP, net);
1115 }
1116
1117 static void __net_exit dccp_v6_exit_net(struct net *net)
1118 {
1119         inet_ctl_sock_destroy(net->dccp.v6_ctl_sk);
1120 }
1121
1122 static void __net_exit dccp_v6_exit_batch(struct list_head *net_exit_list)
1123 {
1124         inet_twsk_purge(&dccp_hashinfo, AF_INET6);
1125 }
1126
1127 static struct pernet_operations dccp_v6_ops = {
1128         .init   = dccp_v6_init_net,
1129         .exit   = dccp_v6_exit_net,
1130         .exit_batch = dccp_v6_exit_batch,
1131 };
1132
1133 static int __init dccp_v6_init(void)
1134 {
1135         int err = proto_register(&dccp_v6_prot, 1);
1136
1137         if (err)
1138                 goto out;
1139
1140         inet6_register_protosw(&dccp_v6_protosw);
1141
1142         err = register_pernet_subsys(&dccp_v6_ops);
1143         if (err)
1144                 goto out_destroy_ctl_sock;
1145
1146         err = inet6_add_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1147         if (err)
1148                 goto out_unregister_proto;
1149
1150 out:
1151         return err;
1152 out_unregister_proto:
1153         unregister_pernet_subsys(&dccp_v6_ops);
1154 out_destroy_ctl_sock:
1155         inet6_unregister_protosw(&dccp_v6_protosw);
1156         proto_unregister(&dccp_v6_prot);
1157         goto out;
1158 }
1159
1160 static void __exit dccp_v6_exit(void)
1161 {
1162         inet6_del_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1163         unregister_pernet_subsys(&dccp_v6_ops);
1164         inet6_unregister_protosw(&dccp_v6_protosw);
1165         proto_unregister(&dccp_v6_prot);
1166 }
1167
1168 module_init(dccp_v6_init);
1169 module_exit(dccp_v6_exit);
1170
1171 /*
1172  * __stringify doesn't likes enums, so use SOCK_DCCP (6) and IPPROTO_DCCP (33)
1173  * values directly, Also cover the case where the protocol is not specified,
1174  * i.e. net-pf-PF_INET6-proto-0-type-SOCK_DCCP
1175  */
1176 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 33, 6);
1177 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 0, 6);
1178 MODULE_LICENSE("GPL");
1179 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
1180 MODULE_DESCRIPTION("DCCPv6 - Datagram Congestion Controlled Protocol");