net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/busy_poll.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <crypto/hash.h>
  70 #include <linux/scatterlist.h>
  71
  72 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  73 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  74                                       struct request_sock *req);
  75
  76 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  77
  78 static const struct inet_connection_sock_af_ops ipv6_mapped;
  79 static const struct inet_connection_sock_af_ops ipv6_specific;
  80 #ifdef CONFIG_TCP_MD5SIG
  81 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  83 #else
  84 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  85                                                    const struct in6_addr *addr)
  86 {
  87         return NULL;
  88 }
  89 #endif
  90
  91 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  92 {
  93         struct dst_entry *dst = skb_dst(skb);
  94
  95         if (dst && dst_hold_safe(dst)) {
  96                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  97
  98                 rcu_assign_pointer(sk->sk_rx_dst, dst);
  99                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 100                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 101         }
 102 }
 103
 104 static u32 tcp_v6_init_seq(const struct sk_buff *skb)
 105 {
 106         return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
 107                                 ipv6_hdr(skb)->saddr.s6_addr32,
 108                                 tcp_hdr(skb)->dest,
 109                                 tcp_hdr(skb)->source);
 110 }
 111
 112 static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
 113 {
 114         return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
 115                                    ipv6_hdr(skb)->saddr.s6_addr32);
 116 }
 117
 118 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 119                           int addr_len)
 120 {
 121         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 122         struct inet_sock *inet = inet_sk(sk);
 123         struct inet_connection_sock *icsk = inet_csk(sk);
 124         struct ipv6_pinfo *np = inet6_sk(sk);
 125         struct tcp_sock *tp = tcp_sk(sk);
 126         struct in6_addr *saddr = NULL, *final_p, final;
 127         struct ipv6_txoptions *opt;
 128         struct flowi6 fl6;
 129         struct dst_entry *dst;
 130         int addr_type;
 131         int err;
 132         struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
 133
 134         if (addr_len < SIN6_LEN_RFC2133)
 135                 return -EINVAL;
 136
 137         if (usin->sin6_family != AF_INET6)
 138                 return -EAFNOSUPPORT;
 139
 140         memset(&fl6, 0, sizeof(fl6));
 141
 142         if (np->sndflow) {
 143                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 144                 IP6_ECN_flow_init(fl6.flowlabel);
 145                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 146                         struct ip6_flowlabel *flowlabel;
 147                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 148                         if (!flowlabel)
 149                                 return -EINVAL;
 150                         fl6_sock_release(flowlabel);
 151                 }
 152         }
 153
 154         /*
 155          *      connect() to INADDR_ANY means loopback (BSD'ism).
 156          */
 157
 158         if (ipv6_addr_any(&usin->sin6_addr)) {
 159                 if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
 160                         ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
 161                                                &usin->sin6_addr);
 162                 else
 163                         usin->sin6_addr = in6addr_loopback;
 164         }
 165
 166         addr_type = ipv6_addr_type(&usin->sin6_addr);
 167
 168         if (addr_type & IPV6_ADDR_MULTICAST)
 169                 return -ENETUNREACH;
 170
 171         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 172                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 173                     usin->sin6_scope_id) {
 174                         /* If interface is set while binding, indices
 175                          * must coincide.
 176                          */
 177                         if (sk->sk_bound_dev_if &&
 178                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 179                                 return -EINVAL;
 180
 181                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 182                 }
 183
 184                 /* Connect to link-local address requires an interface */
 185                 if (!sk->sk_bound_dev_if)
 186                         return -EINVAL;
 187         }
 188
 189         if (tp->rx_opt.ts_recent_stamp &&
 190             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 191                 tp->rx_opt.ts_recent = 0;
 192                 tp->rx_opt.ts_recent_stamp = 0;
 193                 tp->write_seq = 0;
 194         }
 195
 196         sk->sk_v6_daddr = usin->sin6_addr;
 197         np->flow_label = fl6.flowlabel;
 198
 199         /*
 200          *      TCP over IPv4
 201          */
 202
 203         if (addr_type & IPV6_ADDR_MAPPED) {
 204                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 205                 struct sockaddr_in sin;
 206
 207                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 208
 209                 if (__ipv6_only_sock(sk))
 210                         return -ENETUNREACH;
 211
 212                 sin.sin_family = AF_INET;
 213                 sin.sin_port = usin->sin6_port;
 214                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 215
 216                 icsk->icsk_af_ops = &ipv6_mapped;
 217                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 218 #ifdef CONFIG_TCP_MD5SIG
 219                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 220 #endif
 221
 222                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 223
 224                 if (err) {
 225                         icsk->icsk_ext_hdr_len = exthdrlen;
 226                         icsk->icsk_af_ops = &ipv6_specific;
 227                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 228 #ifdef CONFIG_TCP_MD5SIG
 229                         tp->af_specific = &tcp_sock_ipv6_specific;
 230 #endif
 231                         goto failure;
 232                 }
 233                 np->saddr = sk->sk_v6_rcv_saddr;
 234
 235                 return err;
 236         }
 237
 238         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 239                 saddr = &sk->sk_v6_rcv_saddr;
 240
 241         fl6.flowi6_proto = IPPROTO_TCP;
 242         fl6.daddr = sk->sk_v6_daddr;
 243         fl6.saddr = saddr ? *saddr : np->saddr;
 244         fl6.flowi6_oif = sk->sk_bound_dev_if;
 245         fl6.flowi6_mark = sk->sk_mark;
 246         fl6.fl6_dport = usin->sin6_port;
 247         fl6.fl6_sport = inet->inet_sport;
 248         fl6.flowi6_uid = sk->sk_uid;
 249
 250         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 251         final_p = fl6_update_dst(&fl6, opt, &final);
 252
 253         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 254
 255         dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
 256         if (IS_ERR(dst)) {
 257                 err = PTR_ERR(dst);
 258                 goto failure;
 259         }
 260
 261         if (!saddr) {
 262                 saddr = &fl6.saddr;
 263                 sk->sk_v6_rcv_saddr = *saddr;
 264         }
 265
 266         /* set the source address */
 267         np->saddr = *saddr;
 268         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 269
 270         sk->sk_gso_type = SKB_GSO_TCPV6;
 271         ip6_dst_store(sk, dst, NULL, NULL);
 272
 273         icsk->icsk_ext_hdr_len = 0;
 274         if (opt)
 275                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 276                                          opt->opt_nflen;
 277
 278         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 279
 280         inet->inet_dport = usin->sin6_port;
 281
 282         tcp_set_state(sk, TCP_SYN_SENT);
 283         err = inet6_hash_connect(tcp_death_row, sk);
 284         if (err)
 285                 goto late_failure;
 286
 287         sk_set_txhash(sk);
 288
 289         if (likely(!tp->repair)) {
 290                 if (!tp->write_seq)
 291                         tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
 292                                                          sk->sk_v6_daddr.s6_addr32,
 293                                                          inet->inet_sport,
 294                                                          inet->inet_dport);
 295                 tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
 296                                                    np->saddr.s6_addr32,
 297                                                    sk->sk_v6_daddr.s6_addr32);
 298         }
 299
 300         if (tcp_fastopen_defer_connect(sk, &err))
 301                 return err;
 302         if (err)
 303                 goto late_failure;
 304
 305         err = tcp_connect(sk);
 306         if (err)
 307                 goto late_failure;
 308
 309         return 0;
 310
 311 late_failure:
 312         tcp_set_state(sk, TCP_CLOSE);
 313         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
 314                 inet_reset_saddr(sk);
 315 failure:
 316         inet->inet_dport = 0;
 317         sk->sk_route_caps = 0;
 318         return err;
 319 }
 320
 321 static void tcp_v6_mtu_reduced(struct sock *sk)
 322 {
 323         struct dst_entry *dst;
 324         u32 mtu;
 325
 326         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 327                 return;
 328
 329         mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
 330
 331         /* Drop requests trying to increase our current mss.
 332          * Check done in __ip6_rt_update_pmtu() is too late.
 333          */
 334         if (tcp_mtu_to_mss(sk, mtu) >= tcp_sk(sk)->mss_cache)
 335                 return;
 336
 337         dst = inet6_csk_update_pmtu(sk, mtu);
 338         if (!dst)
 339                 return;
 340
 341         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 342                 tcp_sync_mss(sk, dst_mtu(dst));
 343                 tcp_simple_retransmit(sk);
 344         }
 345 }
 346
 347 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 348                 u8 type, u8 code, int offset, __be32 info)
 349 {
 350         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 351         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 352         struct net *net = dev_net(skb->dev);
 353         struct request_sock *fastopen;
 354         struct ipv6_pinfo *np;
 355         struct tcp_sock *tp;
 356         __u32 seq, snd_una;
 357         struct sock *sk;
 358         bool fatal;
 359         int err;
 360
 361         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 362                                         &hdr->daddr, th->dest,
 363                                         &hdr->saddr, ntohs(th->source),
 364                                         skb->dev->ifindex, inet6_sdif(skb));
 365
 366         if (!sk) {
 367                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 368                                   ICMP6_MIB_INERRORS);
 369                 return;
 370         }
 371
 372         if (sk->sk_state == TCP_TIME_WAIT) {
 373                 inet_twsk_put(inet_twsk(sk));
 374                 return;
 375         }
 376         seq = ntohl(th->seq);
 377         fatal = icmpv6_err_convert(type, code, &err);
 378         if (sk->sk_state == TCP_NEW_SYN_RECV)
 379                 return tcp_req_err(sk, seq, fatal);
 380
 381         bh_lock_sock(sk);
 382         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 383                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 384
 385         if (sk->sk_state == TCP_CLOSE)
 386                 goto out;
 387
 388         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 389                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 390                 goto out;
 391         }
 392
 393         tp = tcp_sk(sk);
 394         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 395         fastopen = tp->fastopen_rsk;
 396         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 397         if (sk->sk_state != TCP_LISTEN &&
 398             !between(seq, snd_una, tp->snd_nxt)) {
 399                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 400                 goto out;
 401         }
 402
 403         np = inet6_sk(sk);
 404
 405         if (type == NDISC_REDIRECT) {
 406                 if (!sock_owned_by_user(sk)) {
 407                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 408
 409                         if (dst)
 410                                 dst->ops->redirect(dst, sk, skb);
 411                 }
 412                 goto out;
 413         }
 414
 415         if (type == ICMPV6_PKT_TOOBIG) {
 416                 u32 mtu = ntohl(info);
 417
 418                 /* We are not interested in TCP_LISTEN and open_requests
 419                  * (SYN-ACKs send out by Linux are always <576bytes so
 420                  * they should go through unfragmented).
 421                  */
 422                 if (sk->sk_state == TCP_LISTEN)
 423                         goto out;
 424
 425                 if (!ip6_sk_accept_pmtu(sk))
 426                         goto out;
 427
 428                 if (mtu < IPV6_MIN_MTU)
 429                         goto out;
 430
 431                 WRITE_ONCE(tp->mtu_info, mtu);
 432
 433                 if (!sock_owned_by_user(sk))
 434                         tcp_v6_mtu_reduced(sk);
 435                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 436                                            &sk->sk_tsq_flags))
 437                         sock_hold(sk);
 438                 goto out;
 439         }
 440
 441
 442         /* Might be for an request_sock */
 443         switch (sk->sk_state) {
 444         case TCP_SYN_SENT:
 445         case TCP_SYN_RECV:
 446                 /* Only in fast or simultaneous open. If a fast open socket is
 447                  * is already accepted it is treated as a connected one below.
 448                  */
 449                 if (fastopen && !fastopen->sk)
 450                         break;
 451
 452                 if (!sock_owned_by_user(sk)) {
 453                         sk->sk_err = err;
 454                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 455
 456                         tcp_done(sk);
 457                 } else
 458                         sk->sk_err_soft = err;
 459                 goto out;
 460         }
 461
 462         if (!sock_owned_by_user(sk) && np->recverr) {
 463                 sk->sk_err = err;
 464                 sk->sk_error_report(sk);
 465         } else
 466                 sk->sk_err_soft = err;
 467
 468 out:
 469         bh_unlock_sock(sk);
 470         sock_put(sk);
 471 }
 472
 473
 474 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 475                               struct flowi *fl,
 476                               struct request_sock *req,
 477                               struct tcp_fastopen_cookie *foc,
 478                               enum tcp_synack_type synack_type)
 479 {
 480         struct inet_request_sock *ireq = inet_rsk(req);
 481         struct ipv6_pinfo *np = inet6_sk(sk);
 482         struct ipv6_txoptions *opt;
 483         struct flowi6 *fl6 = &fl->u.ip6;
 484         struct sk_buff *skb;
 485         int err = -ENOMEM;
 486
 487         /* First, grab a route. */
 488         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 489                                                IPPROTO_TCP)) == NULL)
 490                 goto done;
 491
 492         skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 493
 494         if (skb) {
 495                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 496                                     &ireq->ir_v6_rmt_addr);
 497
 498                 fl6->daddr = ireq->ir_v6_rmt_addr;
 499                 if (np->repflow && ireq->pktopts)
 500                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 501
 502                 rcu_read_lock();
 503                 opt = ireq->ipv6_opt;
 504                 if (!opt)
 505                         opt = rcu_dereference(np->opt);
 506                 err = ip6_xmit(sk, skb, fl6, skb->mark ? : sk->sk_mark, opt,
 507                                np->tclass);
 508                 rcu_read_unlock();
 509                 err = net_xmit_eval(err);
 510         }
 511
 512 done:
 513         return err;
 514 }
 515
 516
 517 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 518 {
 519         kfree(inet_rsk(req)->ipv6_opt);
 520         kfree_skb(inet_rsk(req)->pktopts);
 521 }
 522
 523 #ifdef CONFIG_TCP_MD5SIG
 524 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 525                                                    const struct in6_addr *addr)
 526 {
 527         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 528 }
 529
 530 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 531                                                 const struct sock *addr_sk)
 532 {
 533         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 534 }
 535
 536 static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
 537                                  char __user *optval, int optlen)
 538 {
 539         struct tcp_md5sig cmd;
 540         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 541         u8 prefixlen;
 542
 543         if (optlen < sizeof(cmd))
 544                 return -EINVAL;
 545
 546         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 547                 return -EFAULT;
 548
 549         if (sin6->sin6_family != AF_INET6)
 550                 return -EINVAL;
 551
 552         if (optname == TCP_MD5SIG_EXT &&
 553             cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
 554                 prefixlen = cmd.tcpm_prefixlen;
 555                 if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
 556                                         prefixlen > 32))
 557                         return -EINVAL;
 558         } else {
 559                 prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
 560         }
 561
 562         if (!cmd.tcpm_keylen) {
 563                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 564                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 565                                               AF_INET, prefixlen);
 566                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 567                                       AF_INET6, prefixlen);
 568         }
 569
 570         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 571                 return -EINVAL;
 572
 573         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 574                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 575                                       AF_INET, prefixlen, cmd.tcpm_key,
 576                                       cmd.tcpm_keylen, GFP_KERNEL);
 577
 578         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 579                               AF_INET6, prefixlen, cmd.tcpm_key,
 580                               cmd.tcpm_keylen, GFP_KERNEL);
 581 }
 582
 583 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 584                                    const struct in6_addr *daddr,
 585                                    const struct in6_addr *saddr,
 586                                    const struct tcphdr *th, int nbytes)
 587 {
 588         struct tcp6_pseudohdr *bp;
 589         struct scatterlist sg;
 590         struct tcphdr *_th;
 591
 592         bp = hp->scratch;
 593         /* 1. TCP pseudo-header (RFC2460) */
 594         bp->saddr = *saddr;
 595         bp->daddr = *daddr;
 596         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 597         bp->len = cpu_to_be32(nbytes);
 598
 599         _th = (struct tcphdr *)(bp + 1);
 600         memcpy(_th, th, sizeof(*th));
 601         _th->check = 0;
 602
 603         sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 604         ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 605                                 sizeof(*bp) + sizeof(*th));
 606         return crypto_ahash_update(hp->md5_req);
 607 }
 608
 609 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 610                                const struct in6_addr *daddr, struct in6_addr *saddr,
 611                                const struct tcphdr *th)
 612 {
 613         struct tcp_md5sig_pool *hp;
 614         struct ahash_request *req;
 615
 616         hp = tcp_get_md5sig_pool();
 617         if (!hp)
 618                 goto clear_hash_noput;
 619         req = hp->md5_req;
 620
 621         if (crypto_ahash_init(req))
 622                 goto clear_hash;
 623         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 624                 goto clear_hash;
 625         if (tcp_md5_hash_key(hp, key))
 626                 goto clear_hash;
 627         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 628         if (crypto_ahash_final(req))
 629                 goto clear_hash;
 630
 631         tcp_put_md5sig_pool();
 632         return 0;
 633
 634 clear_hash:
 635         tcp_put_md5sig_pool();
 636 clear_hash_noput:
 637         memset(md5_hash, 0, 16);
 638         return 1;
 639 }
 640
 641 static int tcp_v6_md5_hash_skb(char *md5_hash,
 642                                const struct tcp_md5sig_key *key,
 643                                const struct sock *sk,
 644                                const struct sk_buff *skb)
 645 {
 646         const struct in6_addr *saddr, *daddr;
 647         struct tcp_md5sig_pool *hp;
 648         struct ahash_request *req;
 649         const struct tcphdr *th = tcp_hdr(skb);
 650
 651         if (sk) { /* valid for establish/request sockets */
 652                 saddr = &sk->sk_v6_rcv_saddr;
 653                 daddr = &sk->sk_v6_daddr;
 654         } else {
 655                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 656                 saddr = &ip6h->saddr;
 657                 daddr = &ip6h->daddr;
 658         }
 659
 660         hp = tcp_get_md5sig_pool();
 661         if (!hp)
 662                 goto clear_hash_noput;
 663         req = hp->md5_req;
 664
 665         if (crypto_ahash_init(req))
 666                 goto clear_hash;
 667
 668         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 669                 goto clear_hash;
 670         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 671                 goto clear_hash;
 672         if (tcp_md5_hash_key(hp, key))
 673                 goto clear_hash;
 674         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 675         if (crypto_ahash_final(req))
 676                 goto clear_hash;
 677
 678         tcp_put_md5sig_pool();
 679         return 0;
 680
 681 clear_hash:
 682         tcp_put_md5sig_pool();
 683 clear_hash_noput:
 684         memset(md5_hash, 0, 16);
 685         return 1;
 686 }
 687
 688 #endif
 689
 690 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 691                                     const struct sk_buff *skb)
 692 {
 693 #ifdef CONFIG_TCP_MD5SIG
 694         const __u8 *hash_location = NULL;
 695         struct tcp_md5sig_key *hash_expected;
 696         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 697         const struct tcphdr *th = tcp_hdr(skb);
 698         int genhash;
 699         u8 newhash[16];
 700
 701         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 702         hash_location = tcp_parse_md5sig_option(th);
 703
 704         /* We've parsed the options - do we have a hash? */
 705         if (!hash_expected && !hash_location)
 706                 return false;
 707
 708         if (hash_expected && !hash_location) {
 709                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 710                 return true;
 711         }
 712
 713         if (!hash_expected && hash_location) {
 714                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 715                 return true;
 716         }
 717
 718         /* check the signature */
 719         genhash = tcp_v6_md5_hash_skb(newhash,
 720                                       hash_expected,
 721                                       NULL, skb);
 722
 723         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 724                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 725                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 726                                      genhash ? "failed" : "mismatch",
 727                                      &ip6h->saddr, ntohs(th->source),
 728                                      &ip6h->daddr, ntohs(th->dest));
 729                 return true;
 730         }
 731 #endif
 732         return false;
 733 }
 734
 735 static void tcp_v6_init_req(struct request_sock *req,
 736                             const struct sock *sk_listener,
 737                             struct sk_buff *skb)
 738 {
 739         struct inet_request_sock *ireq = inet_rsk(req);
 740         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 741
 742         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 743         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 744
 745         /* So that link locals have meaning */
 746         if (!sk_listener->sk_bound_dev_if &&
 747             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 748                 ireq->ir_iif = tcp_v6_iif(skb);
 749
 750         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 751             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 752              np->rxopt.bits.rxinfo ||
 753              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 754              np->rxopt.bits.rxohlim || np->repflow)) {
 755                 refcount_inc(&skb->users);
 756                 ireq->pktopts = skb;
 757         }
 758 }
 759
 760 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 761                                           struct flowi *fl,
 762                                           const struct request_sock *req)
 763 {
 764         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 765 }
 766
 767 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 768         .family         =       AF_INET6,
 769         .obj_size       =       sizeof(struct tcp6_request_sock),
 770         .rtx_syn_ack    =       tcp_rtx_synack,
 771         .send_ack       =       tcp_v6_reqsk_send_ack,
 772         .destructor     =       tcp_v6_reqsk_destructor,
 773         .send_reset     =       tcp_v6_send_reset,
 774         .syn_ack_timeout =      tcp_syn_ack_timeout,
 775 };
 776
 777 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 778         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 779                                 sizeof(struct ipv6hdr),
 780 #ifdef CONFIG_TCP_MD5SIG
 781         .req_md5_lookup =       tcp_v6_md5_lookup,
 782         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 783 #endif
 784         .init_req       =       tcp_v6_init_req,
 785 #ifdef CONFIG_SYN_COOKIES
 786         .cookie_init_seq =      cookie_v6_init_sequence,
 787 #endif
 788         .route_req      =       tcp_v6_route_req,
 789         .init_seq       =       tcp_v6_init_seq,
 790         .init_ts_off    =       tcp_v6_init_ts_off,
 791         .send_synack    =       tcp_v6_send_synack,
 792 };
 793
 794 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 795                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 796                                  int oif, struct tcp_md5sig_key *key, int rst,
 797                                  u8 tclass, __be32 label)
 798 {
 799         const struct tcphdr *th = tcp_hdr(skb);
 800         struct tcphdr *t1;
 801         struct sk_buff *buff;
 802         struct flowi6 fl6;
 803         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 804         struct sock *ctl_sk = net->ipv6.tcp_sk;
 805         unsigned int tot_len = sizeof(struct tcphdr);
 806         struct dst_entry *dst;
 807         __be32 *topt;
 808
 809         if (tsecr)
 810                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 811 #ifdef CONFIG_TCP_MD5SIG
 812         if (key)
 813                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 814 #endif
 815
 816         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 817                          GFP_ATOMIC);
 818         if (!buff)
 819                 return;
 820
 821         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 822
 823         t1 = skb_push(buff, tot_len);
 824         skb_reset_transport_header(buff);
 825
 826         /* Swap the send and the receive. */
 827         memset(t1, 0, sizeof(*t1));
 828         t1->dest = th->source;
 829         t1->source = th->dest;
 830         t1->doff = tot_len / 4;
 831         t1->seq = htonl(seq);
 832         t1->ack_seq = htonl(ack);
 833         t1->ack = !rst || !th->ack;
 834         t1->rst = rst;
 835         t1->window = htons(win);
 836
 837         topt = (__be32 *)(t1 + 1);
 838
 839         if (tsecr) {
 840                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 841                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 842                 *topt++ = htonl(tsval);
 843                 *topt++ = htonl(tsecr);
 844         }
 845
 846 #ifdef CONFIG_TCP_MD5SIG
 847         if (key) {
 848                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 849                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 850                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 851                                     &ipv6_hdr(skb)->saddr,
 852                                     &ipv6_hdr(skb)->daddr, t1);
 853         }
 854 #endif
 855
 856         memset(&fl6, 0, sizeof(fl6));
 857         fl6.daddr = ipv6_hdr(skb)->saddr;
 858         fl6.saddr = ipv6_hdr(skb)->daddr;
 859         fl6.flowlabel = label;
 860
 861         buff->ip_summed = CHECKSUM_PARTIAL;
 862         buff->csum = 0;
 863
 864         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 865
 866         fl6.flowi6_proto = IPPROTO_TCP;
 867         if (rt6_need_strict(&fl6.daddr) && !oif)
 868                 fl6.flowi6_oif = tcp_v6_iif(skb);
 869         else {
 870                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 871                         oif = skb->skb_iif;
 872
 873                 fl6.flowi6_oif = oif;
 874         }
 875
 876         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 877         fl6.fl6_dport = t1->dest;
 878         fl6.fl6_sport = t1->source;
 879         fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 880         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 881
 882         /* Pass a socket to ip6_dst_lookup either it is for RST
 883          * Underlying function will use this to retrieve the network
 884          * namespace
 885          */
 886         dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
 887         if (!IS_ERR(dst)) {
 888                 skb_dst_set(buff, dst);
 889                 ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
 890                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 891                 if (rst)
 892                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 893                 return;
 894         }
 895
 896         kfree_skb(buff);
 897 }
 898
 899 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 900 {
 901         const struct tcphdr *th = tcp_hdr(skb);
 902         u32 seq = 0, ack_seq = 0;
 903         struct tcp_md5sig_key *key = NULL;
 904 #ifdef CONFIG_TCP_MD5SIG
 905         const __u8 *hash_location = NULL;
 906         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 907         unsigned char newhash[16];
 908         int genhash;
 909         struct sock *sk1 = NULL;
 910 #endif
 911         int oif;
 912
 913         if (th->rst)
 914                 return;
 915
 916         /* If sk not NULL, it means we did a successful lookup and incoming
 917          * route had to be correct. prequeue might have dropped our dst.
 918          */
 919         if (!sk && !ipv6_unicast_destination(skb))
 920                 return;
 921
 922 #ifdef CONFIG_TCP_MD5SIG
 923         rcu_read_lock();
 924         hash_location = tcp_parse_md5sig_option(th);
 925         if (sk && sk_fullsock(sk)) {
 926                 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 927         } else if (hash_location) {
 928                 /*
 929                  * active side is lost. Try to find listening socket through
 930                  * source port, and then find md5 key through listening socket.
 931                  * we are not loose security here:
 932                  * Incoming packet is checked with md5 hash with finding key,
 933                  * no RST generated if md5 hash doesn't match.
 934                  */
 935                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 936                                            &tcp_hashinfo, NULL, 0,
 937                                            &ipv6h->saddr,
 938                                            th->source, &ipv6h->daddr,
 939                                            ntohs(th->source),
 940                                            tcp_v6_iif_l3_slave(skb),
 941                                            tcp_v6_sdif(skb));
 942                 if (!sk1)
 943                         goto out;
 944
 945                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 946                 if (!key)
 947                         goto out;
 948
 949                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 950                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 951                         goto out;
 952         }
 953 #endif
 954
 955         if (th->ack)
 956                 seq = ntohl(th->ack_seq);
 957         else
 958                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 959                           (th->doff << 2);
 960
 961         oif = sk ? sk->sk_bound_dev_if : 0;
 962         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 963
 964 #ifdef CONFIG_TCP_MD5SIG
 965 out:
 966         rcu_read_unlock();
 967 #endif
 968 }
 969
 970 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 971                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 972                             struct tcp_md5sig_key *key, u8 tclass,
 973                             __be32 label)
 974 {
 975         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 976                              tclass, label);
 977 }
 978
 979 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 980 {
 981         struct inet_timewait_sock *tw = inet_twsk(sk);
 982         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 983
 984         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 985                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 986                         tcp_time_stamp_raw() + tcptw->tw_ts_offset,
 987                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 988                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 989
 990         inet_twsk_put(tw);
 991 }
 992
 993 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 994                                   struct request_sock *req)
 995 {
 996         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 997          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 998          */
 999         /* RFC 7323 2.3
1000          * The window field (SEG.WND) of every outgoing segment, with the
1001          * exception of <SYN> segments, MUST be right-shifted by
1002          * Rcv.Wind.Shift bits:
1003          */
1004         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
1005                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
1006                         tcp_rsk(req)->rcv_nxt,
1007                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1008                         tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1009                         req->ts_recent, sk->sk_bound_dev_if,
1010                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
1011                         0, 0);
1012 }
1013
1014
1015 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
1016 {
1017 #ifdef CONFIG_SYN_COOKIES
1018         const struct tcphdr *th = tcp_hdr(skb);
1019
1020         if (!th->syn)
1021                 sk = cookie_v6_check(sk, skb);
1022 #endif
1023         return sk;
1024 }
1025
1026 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1027 {
1028         if (skb->protocol == htons(ETH_P_IP))
1029                 return tcp_v4_conn_request(sk, skb);
1030
1031         if (!ipv6_unicast_destination(skb))
1032                 goto drop;
1033
1034         if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
1035                 __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
1036                 return 0;
1037         }
1038
1039         return tcp_conn_request(&tcp6_request_sock_ops,
1040                                 &tcp_request_sock_ipv6_ops, sk, skb);
1041
1042 drop:
1043         tcp_listendrop(sk);
1044         return 0; /* don't send reset */
1045 }
1046
1047 static void tcp_v6_restore_cb(struct sk_buff *skb)
1048 {
1049         /* We need to move header back to the beginning if xfrm6_policy_check()
1050          * and tcp_v6_fill_cb() are going to be called again.
1051          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1052          */
1053         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1054                 sizeof(struct inet6_skb_parm));
1055 }
1056
1057 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1058                                          struct request_sock *req,
1059                                          struct dst_entry *dst,
1060                                          struct request_sock *req_unhash,
1061                                          bool *own_req)
1062 {
1063         struct inet_request_sock *ireq;
1064         struct ipv6_pinfo *newnp;
1065         const struct ipv6_pinfo *np = inet6_sk(sk);
1066         struct ipv6_txoptions *opt;
1067         struct tcp6_sock *newtcp6sk;
1068         struct inet_sock *newinet;
1069         bool found_dup_sk = false;
1070         struct tcp_sock *newtp;
1071         struct sock *newsk;
1072 #ifdef CONFIG_TCP_MD5SIG
1073         struct tcp_md5sig_key *key;
1074 #endif
1075         struct flowi6 fl6;
1076
1077         if (skb->protocol == htons(ETH_P_IP)) {
1078                 /*
1079                  *      v6 mapped
1080                  */
1081
1082                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1083                                              req_unhash, own_req);
1084
1085                 if (!newsk)
1086                         return NULL;
1087
1088                 newtcp6sk = (struct tcp6_sock *)newsk;
1089                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1090
1091                 newinet = inet_sk(newsk);
1092                 newnp = inet6_sk(newsk);
1093                 newtp = tcp_sk(newsk);
1094
1095                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1096
1097                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1098
1099                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1100                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1101 #ifdef CONFIG_TCP_MD5SIG
1102                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1103 #endif
1104
1105                 newnp->ipv6_mc_list = NULL;
1106                 newnp->ipv6_ac_list = NULL;
1107                 newnp->ipv6_fl_list = NULL;
1108                 newnp->pktoptions  = NULL;
1109                 newnp->opt         = NULL;
1110                 newnp->mcast_oif   = inet_iif(skb);
1111                 newnp->mcast_hops  = ip_hdr(skb)->ttl;
1112                 newnp->rcv_flowinfo = 0;
1113                 if (np->repflow)
1114                         newnp->flow_label = 0;
1115
1116                 /*
1117                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1118                  * here, tcp_create_openreq_child now does this for us, see the comment in
1119                  * that function for the gory details. -acme
1120                  */
1121
1122                 /* It is tricky place. Until this moment IPv4 tcp
1123                    worked with IPv6 icsk.icsk_af_ops.
1124                    Sync it now.
1125                  */
1126                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1127
1128                 return newsk;
1129         }
1130
1131         ireq = inet_rsk(req);
1132
1133         if (sk_acceptq_is_full(sk))
1134                 goto out_overflow;
1135
1136         if (!dst) {
1137                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1138                 if (!dst)
1139                         goto out;
1140         }
1141
1142         newsk = tcp_create_openreq_child(sk, req, skb);
1143         if (!newsk)
1144                 goto out_nonewsk;
1145
1146         /*
1147          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1148          * count here, tcp_create_openreq_child now does this for us, see the
1149          * comment in that function for the gory details. -acme
1150          */
1151
1152         newsk->sk_gso_type = SKB_GSO_TCPV6;
1153         ip6_dst_store(newsk, dst, NULL, NULL);
1154         inet6_sk_rx_dst_set(newsk, skb);
1155
1156         newtcp6sk = (struct tcp6_sock *)newsk;
1157         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1158
1159         newtp = tcp_sk(newsk);
1160         newinet = inet_sk(newsk);
1161         newnp = inet6_sk(newsk);
1162
1163         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1164
1165         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1166         newnp->saddr = ireq->ir_v6_loc_addr;
1167         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1168         newsk->sk_bound_dev_if = ireq->ir_iif;
1169
1170         /* Now IPv6 options...
1171
1172            First: no IPv4 options.
1173          */
1174         newinet->inet_opt = NULL;
1175         newnp->ipv6_mc_list = NULL;
1176         newnp->ipv6_ac_list = NULL;
1177         newnp->ipv6_fl_list = NULL;
1178
1179         /* Clone RX bits */
1180         newnp->rxopt.all = np->rxopt.all;
1181
1182         newnp->pktoptions = NULL;
1183         newnp->opt        = NULL;
1184         newnp->mcast_oif  = tcp_v6_iif(skb);
1185         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1186         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1187         if (np->repflow)
1188                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1189
1190         /* Clone native IPv6 options from listening socket (if any)
1191
1192            Yes, keeping reference count would be much more clever,
1193            but we make one more one thing there: reattach optmem
1194            to newsk.
1195          */
1196         opt = ireq->ipv6_opt;
1197         if (!opt)
1198                 opt = rcu_dereference(np->opt);
1199         if (opt) {
1200                 opt = ipv6_dup_options(newsk, opt);
1201                 RCU_INIT_POINTER(newnp->opt, opt);
1202         }
1203         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1204         if (opt)
1205                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1206                                                     opt->opt_flen;
1207
1208         tcp_ca_openreq_child(newsk, dst);
1209
1210         tcp_sync_mss(newsk, dst_mtu(dst));
1211         newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
1212
1213         tcp_initialize_rcv_mss(newsk);
1214
1215         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1216         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1217
1218 #ifdef CONFIG_TCP_MD5SIG
1219         /* Copy over the MD5 key from the original socket */
1220         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1221         if (key) {
1222                 /* We're using one, so create a matching key
1223                  * on the newsk structure. If we fail to get
1224                  * memory, then we end up not copying the key
1225                  * across. Shucks.
1226                  */
1227                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1228                                AF_INET6, 128, key->key, key->keylen,
1229                                sk_gfp_mask(sk, GFP_ATOMIC));
1230         }
1231 #endif
1232
1233         if (__inet_inherit_port(sk, newsk) < 0) {
1234                 inet_csk_prepare_forced_close(newsk);
1235                 tcp_done(newsk);
1236                 goto out;
1237         }
1238         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash),
1239                                        &found_dup_sk);
1240         if (*own_req) {
1241                 tcp_move_syn(newtp, req);
1242
1243                 /* Clone pktoptions received with SYN, if we own the req */
1244                 if (ireq->pktopts) {
1245                         newnp->pktoptions = skb_clone(ireq->pktopts,
1246                                                       sk_gfp_mask(sk, GFP_ATOMIC));
1247                         consume_skb(ireq->pktopts);
1248                         ireq->pktopts = NULL;
1249                         if (newnp->pktoptions) {
1250                                 tcp_v6_restore_cb(newnp->pktoptions);
1251                                 skb_set_owner_r(newnp->pktoptions, newsk);
1252                         }
1253                 }
1254         } else {
1255                 if (!req_unhash && found_dup_sk) {
1256                         /* This code path should only be executed in the
1257                          * syncookie case only
1258                          */
1259                         bh_unlock_sock(newsk);
1260                         sock_put(newsk);
1261                         newsk = NULL;
1262                 }
1263         }
1264
1265         return newsk;
1266
1267 out_overflow:
1268         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1269 out_nonewsk:
1270         dst_release(dst);
1271 out:
1272         tcp_listendrop(sk);
1273         return NULL;
1274 }
1275
1276 /* The socket must have it's spinlock held when we get
1277  * here, unless it is a TCP_LISTEN socket.
1278  *
1279  * We have a potential double-lock case here, so even when
1280  * doing backlog processing we use the BH locking scheme.
1281  * This is because we cannot sleep with the original spinlock
1282  * held.
1283  */
1284 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1285 {
1286         struct ipv6_pinfo *np = inet6_sk(sk);
1287         struct tcp_sock *tp;
1288         struct sk_buff *opt_skb = NULL;
1289
1290         /* Imagine: socket is IPv6. IPv4 packet arrives,
1291            goes to IPv4 receive handler and backlogged.
1292            From backlog it always goes here. Kerboom...
1293            Fortunately, tcp_rcv_established and rcv_established
1294            handle them correctly, but it is not case with
1295            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1296          */
1297
1298         if (skb->protocol == htons(ETH_P_IP))
1299                 return tcp_v4_do_rcv(sk, skb);
1300
1301         /*
1302          *      socket locking is here for SMP purposes as backlog rcv
1303          *      is currently called with bh processing disabled.
1304          */
1305
1306         /* Do Stevens' IPV6_PKTOPTIONS.
1307
1308            Yes, guys, it is the only place in our code, where we
1309            may make it not affecting IPv4.
1310            The rest of code is protocol independent,
1311            and I do not like idea to uglify IPv4.
1312
1313            Actually, all the idea behind IPV6_PKTOPTIONS
1314            looks not very well thought. For now we latch
1315            options, received in the last packet, enqueued
1316            by tcp. Feel free to propose better solution.
1317                                                --ANK (980728)
1318          */
1319         if (np->rxopt.all)
1320                 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1321
1322         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1323                 struct dst_entry *dst;
1324
1325                 dst = rcu_dereference_protected(sk->sk_rx_dst,
1326                                                 lockdep_sock_is_held(sk));
1327
1328                 sock_rps_save_rxhash(sk, skb);
1329                 sk_mark_napi_id(sk, skb);
1330                 if (dst) {
1331                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1332                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1333                                 RCU_INIT_POINTER(sk->sk_rx_dst, NULL);
1334                                 dst_release(dst);
1335                         }
1336                 }
1337
1338                 tcp_rcv_established(sk, skb, tcp_hdr(skb));
1339                 if (opt_skb)
1340                         goto ipv6_pktoptions;
1341                 return 0;
1342         }
1343
1344         if (tcp_checksum_complete(skb))
1345                 goto csum_err;
1346
1347         if (sk->sk_state == TCP_LISTEN) {
1348                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1349
1350                 if (!nsk)
1351                         goto discard;
1352
1353                 if (nsk != sk) {
1354                         if (tcp_child_process(sk, nsk, skb))
1355                                 goto reset;
1356                         if (opt_skb)
1357                                 __kfree_skb(opt_skb);
1358                         return 0;
1359                 }
1360         } else
1361                 sock_rps_save_rxhash(sk, skb);
1362
1363         if (tcp_rcv_state_process(sk, skb))
1364                 goto reset;
1365         if (opt_skb)
1366                 goto ipv6_pktoptions;
1367         return 0;
1368
1369 reset:
1370         tcp_v6_send_reset(sk, skb);
1371 discard:
1372         if (opt_skb)
1373                 __kfree_skb(opt_skb);
1374         kfree_skb(skb);
1375         return 0;
1376 csum_err:
1377         TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1378         TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1379         goto discard;
1380
1381
1382 ipv6_pktoptions:
1383         /* Do you ask, what is it?
1384
1385            1. skb was enqueued by tcp.
1386            2. skb is added to tail of read queue, rather than out of order.
1387            3. socket is not in passive state.
1388            4. Finally, it really contains options, which user wants to receive.
1389          */
1390         tp = tcp_sk(sk);
1391         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1392             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1393                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1394                         np->mcast_oif = tcp_v6_iif(opt_skb);
1395                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1396                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1397                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1398                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1399                 if (np->repflow)
1400                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1401                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1402                         skb_set_owner_r(opt_skb, sk);
1403                         tcp_v6_restore_cb(opt_skb);
1404                         opt_skb = xchg(&np->pktoptions, opt_skb);
1405                 } else {
1406                         __kfree_skb(opt_skb);
1407                         opt_skb = xchg(&np->pktoptions, NULL);
1408                 }
1409         }
1410
1411         kfree_skb(opt_skb);
1412         return 0;
1413 }
1414
1415 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1416                            const struct tcphdr *th)
1417 {
1418         /* This is tricky: we move IP6CB at its correct location into
1419          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1420          * _decode_session6() uses IP6CB().
1421          * barrier() makes sure compiler won't play aliasing games.
1422          */
1423         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1424                 sizeof(struct inet6_skb_parm));
1425         barrier();
1426
1427         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1428         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1429                                     skb->len - th->doff*4);
1430         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1431         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1432         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1433         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1434         TCP_SKB_CB(skb)->sacked = 0;
1435         TCP_SKB_CB(skb)->has_rxtstamp =
1436                         skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
1437 }
1438
1439 static int tcp_v6_rcv(struct sk_buff *skb)
1440 {
1441         int sdif = inet6_sdif(skb);
1442         const struct tcphdr *th;
1443         const struct ipv6hdr *hdr;
1444         bool refcounted;
1445         struct sock *sk;
1446         int ret;
1447         struct net *net = dev_net(skb->dev);
1448
1449         if (skb->pkt_type != PACKET_HOST)
1450                 goto discard_it;
1451
1452         /*
1453          *      Count it even if it's bad.
1454          */
1455         __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1456
1457         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1458                 goto discard_it;
1459
1460         th = (const struct tcphdr *)skb->data;
1461
1462         if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1463                 goto bad_packet;
1464         if (!pskb_may_pull(skb, th->doff*4))
1465                 goto discard_it;
1466
1467         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1468                 goto csum_error;
1469
1470         th = (const struct tcphdr *)skb->data;
1471         hdr = ipv6_hdr(skb);
1472
1473 lookup:
1474         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1475                                 th->source, th->dest, inet6_iif(skb), sdif,
1476                                 &refcounted);
1477         if (!sk)
1478                 goto no_tcp_socket;
1479
1480 process:
1481         if (sk->sk_state == TCP_TIME_WAIT)
1482                 goto do_time_wait;
1483
1484         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1485                 struct request_sock *req = inet_reqsk(sk);
1486                 struct sock *nsk;
1487
1488                 sk = req->rsk_listener;
1489                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1490                         sk_drops_add(sk, skb);
1491                         reqsk_put(req);
1492                         goto discard_it;
1493                 }
1494                 if (tcp_checksum_complete(skb)) {
1495                         reqsk_put(req);
1496                         goto csum_error;
1497                 }
1498                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1499                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1500                         goto lookup;
1501                 }
1502                 sock_hold(sk);
1503                 refcounted = true;
1504                 nsk = NULL;
1505                 if (!tcp_filter(sk, skb)) {
1506                         th = (const struct tcphdr *)skb->data;
1507                         hdr = ipv6_hdr(skb);
1508                         tcp_v6_fill_cb(skb, hdr, th);
1509                         nsk = tcp_check_req(sk, skb, req, false);
1510                 }
1511                 if (!nsk) {
1512                         reqsk_put(req);
1513                         goto discard_and_relse;
1514                 }
1515                 if (nsk == sk) {
1516                         reqsk_put(req);
1517                         tcp_v6_restore_cb(skb);
1518                 } else if (tcp_child_process(sk, nsk, skb)) {
1519                         tcp_v6_send_reset(nsk, skb);
1520                         goto discard_and_relse;
1521                 } else {
1522                         sock_put(sk);
1523                         return 0;
1524                 }
1525         }
1526         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1527                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1528                 goto discard_and_relse;
1529         }
1530
1531         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1532                 goto discard_and_relse;
1533
1534         if (tcp_v6_inbound_md5_hash(sk, skb))
1535                 goto discard_and_relse;
1536
1537         if (tcp_filter(sk, skb))
1538                 goto discard_and_relse;
1539         th = (const struct tcphdr *)skb->data;
1540         hdr = ipv6_hdr(skb);
1541         tcp_v6_fill_cb(skb, hdr, th);
1542
1543         skb->dev = NULL;
1544
1545         if (sk->sk_state == TCP_LISTEN) {
1546                 ret = tcp_v6_do_rcv(sk, skb);
1547                 goto put_and_return;
1548         }
1549
1550         sk_incoming_cpu_update(sk);
1551
1552         bh_lock_sock_nested(sk);
1553         tcp_segs_in(tcp_sk(sk), skb);
1554         ret = 0;
1555         if (!sock_owned_by_user(sk)) {
1556                 ret = tcp_v6_do_rcv(sk, skb);
1557         } else if (tcp_add_backlog(sk, skb)) {
1558                 goto discard_and_relse;
1559         }
1560         bh_unlock_sock(sk);
1561
1562 put_and_return:
1563         if (refcounted)
1564                 sock_put(sk);
1565         return ret ? -1 : 0;
1566
1567 no_tcp_socket:
1568         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1569                 goto discard_it;
1570
1571         tcp_v6_fill_cb(skb, hdr, th);
1572
1573         if (tcp_checksum_complete(skb)) {
1574 csum_error:
1575                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1576 bad_packet:
1577                 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1578         } else {
1579                 tcp_v6_send_reset(NULL, skb);
1580         }
1581
1582 discard_it:
1583         kfree_skb(skb);
1584         return 0;
1585
1586 discard_and_relse:
1587         sk_drops_add(sk, skb);
1588         if (refcounted)
1589                 sock_put(sk);
1590         goto discard_it;
1591
1592 do_time_wait:
1593         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1594                 inet_twsk_put(inet_twsk(sk));
1595                 goto discard_it;
1596         }
1597
1598         tcp_v6_fill_cb(skb, hdr, th);
1599
1600         if (tcp_checksum_complete(skb)) {
1601                 inet_twsk_put(inet_twsk(sk));
1602                 goto csum_error;
1603         }
1604
1605         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1606         case TCP_TW_SYN:
1607         {
1608                 struct sock *sk2;
1609
1610                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1611                                             skb, __tcp_hdrlen(th),
1612                                             &ipv6_hdr(skb)->saddr, th->source,
1613                                             &ipv6_hdr(skb)->daddr,
1614                                             ntohs(th->dest),
1615                                             tcp_v6_iif_l3_slave(skb),
1616                                             sdif);
1617                 if (sk2) {
1618                         struct inet_timewait_sock *tw = inet_twsk(sk);
1619                         inet_twsk_deschedule_put(tw);
1620                         sk = sk2;
1621                         tcp_v6_restore_cb(skb);
1622                         refcounted = false;
1623                         goto process;
1624                 }
1625                 /* Fall through to ACK */
1626         }
1627         case TCP_TW_ACK:
1628                 tcp_v6_timewait_ack(sk, skb);
1629                 break;
1630         case TCP_TW_RST:
1631                 tcp_v6_send_reset(sk, skb);
1632                 inet_twsk_deschedule_put(inet_twsk(sk));
1633                 goto discard_it;
1634         case TCP_TW_SUCCESS:
1635                 ;
1636         }
1637         goto discard_it;
1638 }
1639
1640 void tcp_v6_early_demux(struct sk_buff *skb)
1641 {
1642         const struct ipv6hdr *hdr;
1643         const struct tcphdr *th;
1644         struct sock *sk;
1645
1646         if (skb->pkt_type != PACKET_HOST)
1647                 return;
1648
1649         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1650                 return;
1651
1652         hdr = ipv6_hdr(skb);
1653         th = tcp_hdr(skb);
1654
1655         if (th->doff < sizeof(struct tcphdr) / 4)
1656                 return;
1657
1658         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1659         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1660                                         &hdr->saddr, th->source,
1661                                         &hdr->daddr, ntohs(th->dest),
1662                                         inet6_iif(skb), inet6_sdif(skb));
1663         if (sk) {
1664                 skb->sk = sk;
1665                 skb->destructor = sock_edemux;
1666                 if (sk_fullsock(sk)) {
1667                         struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst);
1668
1669                         if (dst)
1670                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1671                         if (dst &&
1672                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1673                                 skb_dst_set_noref(skb, dst);
1674                 }
1675         }
1676 }
1677
1678 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1679         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1680         .twsk_unique    = tcp_twsk_unique,
1681         .twsk_destructor = tcp_twsk_destructor,
1682 };
1683
1684 static const struct inet_connection_sock_af_ops ipv6_specific = {
1685         .queue_xmit        = inet6_csk_xmit,
1686         .send_check        = tcp_v6_send_check,
1687         .rebuild_header    = inet6_sk_rebuild_header,
1688         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1689         .conn_request      = tcp_v6_conn_request,
1690         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1691         .net_header_len    = sizeof(struct ipv6hdr),
1692         .net_frag_header_len = sizeof(struct frag_hdr),
1693         .setsockopt        = ipv6_setsockopt,
1694         .getsockopt        = ipv6_getsockopt,
1695         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1696         .sockaddr_len      = sizeof(struct sockaddr_in6),
1697 #ifdef CONFIG_COMPAT
1698         .compat_setsockopt = compat_ipv6_setsockopt,
1699         .compat_getsockopt = compat_ipv6_getsockopt,
1700 #endif
1701         .mtu_reduced       = tcp_v6_mtu_reduced,
1702 };
1703
1704 #ifdef CONFIG_TCP_MD5SIG
1705 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1706         .md5_lookup     =       tcp_v6_md5_lookup,
1707         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1708         .md5_parse      =       tcp_v6_parse_md5_keys,
1709 };
1710 #endif
1711
1712 /*
1713  *      TCP over IPv4 via INET6 API
1714  */
1715 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1716         .queue_xmit        = ip_queue_xmit,
1717         .send_check        = tcp_v4_send_check,
1718         .rebuild_header    = inet_sk_rebuild_header,
1719         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1720         .conn_request      = tcp_v6_conn_request,
1721         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1722         .net_header_len    = sizeof(struct iphdr),
1723         .setsockopt        = ipv6_setsockopt,
1724         .getsockopt        = ipv6_getsockopt,
1725         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1726         .sockaddr_len      = sizeof(struct sockaddr_in6),
1727 #ifdef CONFIG_COMPAT
1728         .compat_setsockopt = compat_ipv6_setsockopt,
1729         .compat_getsockopt = compat_ipv6_getsockopt,
1730 #endif
1731         .mtu_reduced       = tcp_v4_mtu_reduced,
1732 };
1733
1734 #ifdef CONFIG_TCP_MD5SIG
1735 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1736         .md5_lookup     =       tcp_v4_md5_lookup,
1737         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1738         .md5_parse      =       tcp_v6_parse_md5_keys,
1739 };
1740 #endif
1741
1742 /* NOTE: A lot of things set to zero explicitly by call to
1743  *       sk_alloc() so need not be done here.
1744  */
1745 static int tcp_v6_init_sock(struct sock *sk)
1746 {
1747         struct inet_connection_sock *icsk = inet_csk(sk);
1748
1749         tcp_init_sock(sk);
1750
1751         icsk->icsk_af_ops = &ipv6_specific;
1752
1753 #ifdef CONFIG_TCP_MD5SIG
1754         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1755 #endif
1756
1757         return 0;
1758 }
1759
1760 static void tcp_v6_destroy_sock(struct sock *sk)
1761 {
1762         tcp_v4_destroy_sock(sk);
1763         inet6_destroy_sock(sk);
1764 }
1765
1766 #ifdef CONFIG_PROC_FS
1767 /* Proc filesystem TCPv6 sock list dumping. */
1768 static void get_openreq6(struct seq_file *seq,
1769                          const struct request_sock *req, int i)
1770 {
1771         long ttd = req->rsk_timer.expires - jiffies;
1772         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1773         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1774
1775         if (ttd < 0)
1776                 ttd = 0;
1777
1778         seq_printf(seq,
1779                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1780                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1781                    i,
1782                    src->s6_addr32[0], src->s6_addr32[1],
1783                    src->s6_addr32[2], src->s6_addr32[3],
1784                    inet_rsk(req)->ir_num,
1785                    dest->s6_addr32[0], dest->s6_addr32[1],
1786                    dest->s6_addr32[2], dest->s6_addr32[3],
1787                    ntohs(inet_rsk(req)->ir_rmt_port),
1788                    TCP_SYN_RECV,
1789                    0, 0, /* could print option size, but that is af dependent. */
1790                    1,   /* timers active (only the expire timer) */
1791                    jiffies_to_clock_t(ttd),
1792                    req->num_timeout,
1793                    from_kuid_munged(seq_user_ns(seq),
1794                                     sock_i_uid(req->rsk_listener)),
1795                    0,  /* non standard timer */
1796                    0, /* open_requests have no inode */
1797                    0, req);
1798 }
1799
1800 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1801 {
1802         const struct in6_addr *dest, *src;
1803         __u16 destp, srcp;
1804         int timer_active;
1805         unsigned long timer_expires;
1806         const struct inet_sock *inet = inet_sk(sp);
1807         const struct tcp_sock *tp = tcp_sk(sp);
1808         const struct inet_connection_sock *icsk = inet_csk(sp);
1809         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1810         int rx_queue;
1811         int state;
1812
1813         dest  = &sp->sk_v6_daddr;
1814         src   = &sp->sk_v6_rcv_saddr;
1815         destp = ntohs(inet->inet_dport);
1816         srcp  = ntohs(inet->inet_sport);
1817
1818         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1819             icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1820             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1821                 timer_active    = 1;
1822                 timer_expires   = icsk->icsk_timeout;
1823         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1824                 timer_active    = 4;
1825                 timer_expires   = icsk->icsk_timeout;
1826         } else if (timer_pending(&sp->sk_timer)) {
1827                 timer_active    = 2;
1828                 timer_expires   = sp->sk_timer.expires;
1829         } else {
1830                 timer_active    = 0;
1831                 timer_expires = jiffies;
1832         }
1833
1834         state = sk_state_load(sp);
1835         if (state == TCP_LISTEN)
1836                 rx_queue = sp->sk_ack_backlog;
1837         else
1838                 /* Because we don't lock the socket,
1839                  * we might find a transient negative value.
1840                  */
1841                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1842
1843         seq_printf(seq,
1844                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1845                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1846                    i,
1847                    src->s6_addr32[0], src->s6_addr32[1],
1848                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1849                    dest->s6_addr32[0], dest->s6_addr32[1],
1850                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1851                    state,
1852                    tp->write_seq - tp->snd_una,
1853                    rx_queue,
1854                    timer_active,
1855                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1856                    icsk->icsk_retransmits,
1857                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1858                    icsk->icsk_probes_out,
1859                    sock_i_ino(sp),
1860                    refcount_read(&sp->sk_refcnt), sp,
1861                    jiffies_to_clock_t(icsk->icsk_rto),
1862                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1863                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1864                    tp->snd_cwnd,
1865                    state == TCP_LISTEN ?
1866                         fastopenq->max_qlen :
1867                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1868                    );
1869 }
1870
1871 static void get_timewait6_sock(struct seq_file *seq,
1872                                struct inet_timewait_sock *tw, int i)
1873 {
1874         long delta = tw->tw_timer.expires - jiffies;
1875         const struct in6_addr *dest, *src;
1876         __u16 destp, srcp;
1877
1878         dest = &tw->tw_v6_daddr;
1879         src  = &tw->tw_v6_rcv_saddr;
1880         destp = ntohs(tw->tw_dport);
1881         srcp  = ntohs(tw->tw_sport);
1882
1883         seq_printf(seq,
1884                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1885                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1886                    i,
1887                    src->s6_addr32[0], src->s6_addr32[1],
1888                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1889                    dest->s6_addr32[0], dest->s6_addr32[1],
1890                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1891                    tw->tw_substate, 0, 0,
1892                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1893                    refcount_read(&tw->tw_refcnt), tw);
1894 }
1895
1896 static int tcp6_seq_show(struct seq_file *seq, void *v)
1897 {
1898         struct tcp_iter_state *st;
1899         struct sock *sk = v;
1900
1901         if (v == SEQ_START_TOKEN) {
1902                 seq_puts(seq,
1903                          "  sl  "
1904                          "local_address                         "
1905                          "remote_address                        "
1906                          "st tx_queue rx_queue tr tm->when retrnsmt"
1907                          "   uid  timeout inode\n");
1908                 goto out;
1909         }
1910         st = seq->private;
1911
1912         if (sk->sk_state == TCP_TIME_WAIT)
1913                 get_timewait6_sock(seq, v, st->num);
1914         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1915                 get_openreq6(seq, v, st->num);
1916         else
1917                 get_tcp6_sock(seq, v, st->num);
1918 out:
1919         return 0;
1920 }
1921
1922 static const struct file_operations tcp6_afinfo_seq_fops = {
1923         .owner   = THIS_MODULE,
1924         .open    = tcp_seq_open,
1925         .read    = seq_read,
1926         .llseek  = seq_lseek,
1927         .release = seq_release_net
1928 };
1929
1930 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1931         .name           = "tcp6",
1932         .family         = AF_INET6,
1933         .seq_fops       = &tcp6_afinfo_seq_fops,
1934         .seq_ops        = {
1935                 .show           = tcp6_seq_show,
1936         },
1937 };
1938
1939 int __net_init tcp6_proc_init(struct net *net)
1940 {
1941         return tcp_proc_register(net, &tcp6_seq_afinfo);
1942 }
1943
1944 void tcp6_proc_exit(struct net *net)
1945 {
1946         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1947 }
1948 #endif
1949
1950 struct proto tcpv6_prot = {
1951         .name                   = "TCPv6",
1952         .owner                  = THIS_MODULE,
1953         .close                  = tcp_close,
1954         .connect                = tcp_v6_connect,
1955         .disconnect             = tcp_disconnect,
1956         .accept                 = inet_csk_accept,
1957         .ioctl                  = tcp_ioctl,
1958         .init                   = tcp_v6_init_sock,
1959         .destroy                = tcp_v6_destroy_sock,
1960         .shutdown               = tcp_shutdown,
1961         .setsockopt             = tcp_setsockopt,
1962         .getsockopt             = tcp_getsockopt,
1963         .keepalive              = tcp_set_keepalive,
1964         .recvmsg                = tcp_recvmsg,
1965         .sendmsg                = tcp_sendmsg,
1966         .sendpage               = tcp_sendpage,
1967         .backlog_rcv            = tcp_v6_do_rcv,
1968         .release_cb             = tcp_release_cb,
1969         .hash                   = inet6_hash,
1970         .unhash                 = inet_unhash,
1971         .get_port               = inet_csk_get_port,
1972         .enter_memory_pressure  = tcp_enter_memory_pressure,
1973         .leave_memory_pressure  = tcp_leave_memory_pressure,
1974         .stream_memory_free     = tcp_stream_memory_free,
1975         .sockets_allocated      = &tcp_sockets_allocated,
1976         .memory_allocated       = &tcp_memory_allocated,
1977         .memory_pressure        = &tcp_memory_pressure,
1978         .orphan_count           = &tcp_orphan_count,
1979         .sysctl_mem             = sysctl_tcp_mem,
1980         .sysctl_wmem            = sysctl_tcp_wmem,
1981         .sysctl_rmem            = sysctl_tcp_rmem,
1982         .max_header             = MAX_TCP_HEADER,
1983         .obj_size               = sizeof(struct tcp6_sock),
1984         .slab_flags             = SLAB_TYPESAFE_BY_RCU,
1985         .twsk_prot              = &tcp6_timewait_sock_ops,
1986         .rsk_prot               = &tcp6_request_sock_ops,
1987         .h.hashinfo             = &tcp_hashinfo,
1988         .no_autobind            = true,
1989 #ifdef CONFIG_COMPAT
1990         .compat_setsockopt      = compat_tcp_setsockopt,
1991         .compat_getsockopt      = compat_tcp_getsockopt,
1992 #endif
1993         .diag_destroy           = tcp_abort,
1994 };
1995
1996 static const struct inet6_protocol tcpv6_protocol = {
1997         .handler        =       tcp_v6_rcv,
1998         .err_handler    =       tcp_v6_err,
1999         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2000 };
2001
2002 static struct inet_protosw tcpv6_protosw = {
2003         .type           =       SOCK_STREAM,
2004         .protocol       =       IPPROTO_TCP,
2005         .prot           =       &tcpv6_prot,
2006         .ops            =       &inet6_stream_ops,
2007         .flags          =       INET_PROTOSW_PERMANENT |
2008                                 INET_PROTOSW_ICSK,
2009 };
2010
2011 static int __net_init tcpv6_net_init(struct net *net)
2012 {
2013         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2014                                     SOCK_RAW, IPPROTO_TCP, net);
2015 }
2016
2017 static void __net_exit tcpv6_net_exit(struct net *net)
2018 {
2019         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2020 }
2021
2022 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2023 {
2024         inet_twsk_purge(&tcp_hashinfo, AF_INET6);
2025 }
2026
2027 static struct pernet_operations tcpv6_net_ops = {
2028         .init       = tcpv6_net_init,
2029         .exit       = tcpv6_net_exit,
2030         .exit_batch = tcpv6_net_exit_batch,
2031 };
2032
2033 int __init tcpv6_init(void)
2034 {
2035         int ret;
2036
2037         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2038         if (ret)
2039                 goto out;
2040
2041         /* register inet6 protocol */
2042         ret = inet6_register_protosw(&tcpv6_protosw);
2043         if (ret)
2044                 goto out_tcpv6_protocol;
2045
2046         ret = register_pernet_subsys(&tcpv6_net_ops);
2047         if (ret)
2048                 goto out_tcpv6_protosw;
2049 out:
2050         return ret;
2051
2052 out_tcpv6_protosw:
2053         inet6_unregister_protosw(&tcpv6_protosw);
2054 out_tcpv6_protocol:
2055         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2056         goto out;
2057 }
2058
2059 void tcpv6_exit(void)
2060 {
2061         unregister_pernet_subsys(&tcpv6_net_ops);
2062         inet6_unregister_protosw(&tcpv6_protosw);
2063         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2064 }