net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/tcp_memcontrol.h>
  65 #include <net/busy_poll.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 #include <linux/crypto.h>
  71 #include <linux/scatterlist.h>
  72
  73 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  75                                       struct request_sock *req);
  76
  77 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  78
  79 static const struct inet_connection_sock_af_ops ipv6_mapped;
  80 static const struct inet_connection_sock_af_ops ipv6_specific;
  81 #ifdef CONFIG_TCP_MD5SIG
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  84 #else
  85 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  86                                                    const struct in6_addr *addr)
  87 {
  88         return NULL;
  89 }
  90 #endif
  91
  92 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  93 {
  94         struct dst_entry *dst = skb_dst(skb);
  95
  96         if (dst && dst_hold_safe(dst)) {
  97                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99                 sk->sk_rx_dst = dst;
 100                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 101                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 102         }
 103 }
 104
 105 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 106 {
 107         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 108                                             ipv6_hdr(skb)->saddr.s6_addr32,
 109                                             tcp_hdr(skb)->dest,
 110                                             tcp_hdr(skb)->source);
 111 }
 112
 113 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 114                           int addr_len)
 115 {
 116         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 117         struct inet_sock *inet = inet_sk(sk);
 118         struct inet_connection_sock *icsk = inet_csk(sk);
 119         struct ipv6_pinfo *np = inet6_sk(sk);
 120         struct tcp_sock *tp = tcp_sk(sk);
 121         struct in6_addr *saddr = NULL, *final_p, final;
 122         struct ipv6_txoptions *opt;
 123         struct flowi6 fl6;
 124         struct dst_entry *dst;
 125         int addr_type;
 126         int err;
 127
 128         if (addr_len < SIN6_LEN_RFC2133)
 129                 return -EINVAL;
 130
 131         if (usin->sin6_family != AF_INET6)
 132                 return -EAFNOSUPPORT;
 133
 134         memset(&fl6, 0, sizeof(fl6));
 135
 136         if (np->sndflow) {
 137                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 138                 IP6_ECN_flow_init(fl6.flowlabel);
 139                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 140                         struct ip6_flowlabel *flowlabel;
 141                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 142                         if (!flowlabel)
 143                                 return -EINVAL;
 144                         fl6_sock_release(flowlabel);
 145                 }
 146         }
 147
 148         /*
 149          *      connect() to INADDR_ANY means loopback (BSD'ism).
 150          */
 151
 152         if (ipv6_addr_any(&usin->sin6_addr)) {
 153                 if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
 154                         ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
 155                                                &usin->sin6_addr);
 156                 else
 157                         usin->sin6_addr = in6addr_loopback;
 158         }
 159
 160         addr_type = ipv6_addr_type(&usin->sin6_addr);
 161
 162         if (addr_type & IPV6_ADDR_MULTICAST)
 163                 return -ENETUNREACH;
 164
 165         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 166                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 167                     usin->sin6_scope_id) {
 168                         /* If interface is set while binding, indices
 169                          * must coincide.
 170                          */
 171                         if (sk->sk_bound_dev_if &&
 172                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 173                                 return -EINVAL;
 174
 175                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 176                 }
 177
 178                 /* Connect to link-local address requires an interface */
 179                 if (!sk->sk_bound_dev_if)
 180                         return -EINVAL;
 181         }
 182
 183         if (tp->rx_opt.ts_recent_stamp &&
 184             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 185                 tp->rx_opt.ts_recent = 0;
 186                 tp->rx_opt.ts_recent_stamp = 0;
 187                 tp->write_seq = 0;
 188         }
 189
 190         sk->sk_v6_daddr = usin->sin6_addr;
 191         np->flow_label = fl6.flowlabel;
 192
 193         /*
 194          *      TCP over IPv4
 195          */
 196
 197         if (addr_type & IPV6_ADDR_MAPPED) {
 198                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 199                 struct sockaddr_in sin;
 200
 201                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 202
 203                 if (__ipv6_only_sock(sk))
 204                         return -ENETUNREACH;
 205
 206                 sin.sin_family = AF_INET;
 207                 sin.sin_port = usin->sin6_port;
 208                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 209
 210                 icsk->icsk_af_ops = &ipv6_mapped;
 211                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 212 #ifdef CONFIG_TCP_MD5SIG
 213                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 214 #endif
 215
 216                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 217
 218                 if (err) {
 219                         icsk->icsk_ext_hdr_len = exthdrlen;
 220                         icsk->icsk_af_ops = &ipv6_specific;
 221                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                         tp->af_specific = &tcp_sock_ipv6_specific;
 224 #endif
 225                         goto failure;
 226                 }
 227                 np->saddr = sk->sk_v6_rcv_saddr;
 228
 229                 return err;
 230         }
 231
 232         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 233                 saddr = &sk->sk_v6_rcv_saddr;
 234
 235         fl6.flowi6_proto = IPPROTO_TCP;
 236         fl6.daddr = sk->sk_v6_daddr;
 237         fl6.saddr = saddr ? *saddr : np->saddr;
 238         fl6.flowi6_oif = sk->sk_bound_dev_if;
 239         fl6.flowi6_mark = sk->sk_mark;
 240         fl6.fl6_dport = usin->sin6_port;
 241         fl6.fl6_sport = inet->inet_sport;
 242
 243         opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
 244         final_p = fl6_update_dst(&fl6, opt, &final);
 245
 246         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 247
 248         dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
 249         if (IS_ERR(dst)) {
 250                 err = PTR_ERR(dst);
 251                 goto failure;
 252         }
 253
 254         if (!saddr) {
 255                 saddr = &fl6.saddr;
 256                 sk->sk_v6_rcv_saddr = *saddr;
 257         }
 258
 259         /* set the source address */
 260         np->saddr = *saddr;
 261         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 262
 263         sk->sk_gso_type = SKB_GSO_TCPV6;
 264         ip6_dst_store(sk, dst, NULL, NULL);
 265
 266         if (tcp_death_row.sysctl_tw_recycle &&
 267             !tp->rx_opt.ts_recent_stamp &&
 268             ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
 269                 tcp_fetch_timewait_stamp(sk, dst);
 270
 271         icsk->icsk_ext_hdr_len = 0;
 272         if (opt)
 273                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 274                                          opt->opt_nflen;
 275
 276         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 277
 278         inet->inet_dport = usin->sin6_port;
 279
 280         tcp_set_state(sk, TCP_SYN_SENT);
 281         err = inet6_hash_connect(&tcp_death_row, sk);
 282         if (err)
 283                 goto late_failure;
 284
 285         sk_set_txhash(sk);
 286
 287         if (!tp->write_seq && likely(!tp->repair))
 288                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 289                                                              sk->sk_v6_daddr.s6_addr32,
 290                                                              inet->inet_sport,
 291                                                              inet->inet_dport);
 292
 293         err = tcp_connect(sk);
 294         if (err)
 295                 goto late_failure;
 296
 297         return 0;
 298
 299 late_failure:
 300         tcp_set_state(sk, TCP_CLOSE);
 301         __sk_dst_reset(sk);
 302 failure:
 303         inet->inet_dport = 0;
 304         sk->sk_route_caps = 0;
 305         return err;
 306 }
 307
 308 static void tcp_v6_mtu_reduced(struct sock *sk)
 309 {
 310         struct dst_entry *dst;
 311         u32 mtu;
 312
 313         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 314                 return;
 315
 316         mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
 317
 318         /* Drop requests trying to increase our current mss.
 319          * Check done in __ip6_rt_update_pmtu() is too late.
 320          */
 321         if (tcp_mtu_to_mss(sk, mtu) >= tcp_sk(sk)->mss_cache)
 322                 return;
 323
 324         dst = inet6_csk_update_pmtu(sk, mtu);
 325         if (!dst)
 326                 return;
 327
 328         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 329                 tcp_sync_mss(sk, dst_mtu(dst));
 330                 tcp_simple_retransmit(sk);
 331         }
 332 }
 333
 334 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 335                 u8 type, u8 code, int offset, __be32 info)
 336 {
 337         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 338         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 339         struct net *net = dev_net(skb->dev);
 340         struct request_sock *fastopen;
 341         struct ipv6_pinfo *np;
 342         struct tcp_sock *tp;
 343         __u32 seq, snd_una;
 344         struct sock *sk;
 345         bool fatal;
 346         int err;
 347
 348         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 349                                         &hdr->daddr, th->dest,
 350                                         &hdr->saddr, ntohs(th->source),
 351                                         skb->dev->ifindex);
 352
 353         if (!sk) {
 354                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 355                                    ICMP6_MIB_INERRORS);
 356                 return;
 357         }
 358
 359         if (sk->sk_state == TCP_TIME_WAIT) {
 360                 inet_twsk_put(inet_twsk(sk));
 361                 return;
 362         }
 363         seq = ntohl(th->seq);
 364         fatal = icmpv6_err_convert(type, code, &err);
 365         if (sk->sk_state == TCP_NEW_SYN_RECV)
 366                 return tcp_req_err(sk, seq, fatal);
 367
 368         bh_lock_sock(sk);
 369         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 370                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 371
 372         if (sk->sk_state == TCP_CLOSE)
 373                 goto out;
 374
 375         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 376                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 377                 goto out;
 378         }
 379
 380         tp = tcp_sk(sk);
 381         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 382         fastopen = tp->fastopen_rsk;
 383         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 384         if (sk->sk_state != TCP_LISTEN &&
 385             !between(seq, snd_una, tp->snd_nxt)) {
 386                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 387                 goto out;
 388         }
 389
 390         np = inet6_sk(sk);
 391
 392         if (type == NDISC_REDIRECT) {
 393                 if (!sock_owned_by_user(sk)) {
 394                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 395
 396                         if (dst)
 397                                 dst->ops->redirect(dst, sk, skb);
 398                 }
 399                 goto out;
 400         }
 401
 402         if (type == ICMPV6_PKT_TOOBIG) {
 403                 u32 mtu = ntohl(info);
 404
 405                 /* We are not interested in TCP_LISTEN and open_requests
 406                  * (SYN-ACKs send out by Linux are always <576bytes so
 407                  * they should go through unfragmented).
 408                  */
 409                 if (sk->sk_state == TCP_LISTEN)
 410                         goto out;
 411
 412                 if (!ip6_sk_accept_pmtu(sk))
 413                         goto out;
 414
 415                 if (mtu < IPV6_MIN_MTU)
 416                         goto out;
 417
 418                 WRITE_ONCE(tp->mtu_info, mtu);
 419
 420                 if (!sock_owned_by_user(sk))
 421                         tcp_v6_mtu_reduced(sk);
 422                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 423                                            &tp->tsq_flags))
 424                         sock_hold(sk);
 425                 goto out;
 426         }
 427
 428
 429         /* Might be for an request_sock */
 430         switch (sk->sk_state) {
 431         case TCP_SYN_SENT:
 432         case TCP_SYN_RECV:
 433                 /* Only in fast or simultaneous open. If a fast open socket is
 434                  * is already accepted it is treated as a connected one below.
 435                  */
 436                 if (fastopen && !fastopen->sk)
 437                         break;
 438
 439                 if (!sock_owned_by_user(sk)) {
 440                         sk->sk_err = err;
 441                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 442
 443                         tcp_done(sk);
 444                 } else
 445                         sk->sk_err_soft = err;
 446                 goto out;
 447         }
 448
 449         if (!sock_owned_by_user(sk) && np->recverr) {
 450                 sk->sk_err = err;
 451                 sk->sk_error_report(sk);
 452         } else
 453                 sk->sk_err_soft = err;
 454
 455 out:
 456         bh_unlock_sock(sk);
 457         sock_put(sk);
 458 }
 459
 460
 461 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 462                               struct flowi *fl,
 463                               struct request_sock *req,
 464                               struct tcp_fastopen_cookie *foc,
 465                               bool attach_req)
 466 {
 467         struct inet_request_sock *ireq = inet_rsk(req);
 468         struct ipv6_pinfo *np = inet6_sk(sk);
 469         struct flowi6 *fl6 = &fl->u.ip6;
 470         struct sk_buff *skb;
 471         int err = -ENOMEM;
 472
 473         /* First, grab a route. */
 474         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 475                                                IPPROTO_TCP)) == NULL)
 476                 goto done;
 477
 478         skb = tcp_make_synack(sk, dst, req, foc, attach_req);
 479
 480         if (skb) {
 481                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 482                                     &ireq->ir_v6_rmt_addr);
 483
 484                 fl6->daddr = ireq->ir_v6_rmt_addr;
 485                 if (np->repflow && ireq->pktopts)
 486                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 487
 488                 rcu_read_lock();
 489                 err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
 490                                np->tclass);
 491                 rcu_read_unlock();
 492                 err = net_xmit_eval(err);
 493         }
 494
 495 done:
 496         return err;
 497 }
 498
 499
 500 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 501 {
 502         kfree_skb(inet_rsk(req)->pktopts);
 503 }
 504
 505 #ifdef CONFIG_TCP_MD5SIG
 506 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 507                                                    const struct in6_addr *addr)
 508 {
 509         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 510 }
 511
 512 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 513                                                 const struct sock *addr_sk)
 514 {
 515         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 516 }
 517
 518 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 519                                  int optlen)
 520 {
 521         struct tcp_md5sig cmd;
 522         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 523
 524         if (optlen < sizeof(cmd))
 525                 return -EINVAL;
 526
 527         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 528                 return -EFAULT;
 529
 530         if (sin6->sin6_family != AF_INET6)
 531                 return -EINVAL;
 532
 533         if (!cmd.tcpm_keylen) {
 534                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 535                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 536                                               AF_INET);
 537                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 538                                       AF_INET6);
 539         }
 540
 541         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 542                 return -EINVAL;
 543
 544         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 545                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 546                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 547
 548         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 549                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 550 }
 551
 552 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 553                                         const struct in6_addr *daddr,
 554                                         const struct in6_addr *saddr, int nbytes)
 555 {
 556         struct tcp6_pseudohdr *bp;
 557         struct scatterlist sg;
 558
 559         bp = &hp->md5_blk.ip6;
 560         /* 1. TCP pseudo-header (RFC2460) */
 561         bp->saddr = *saddr;
 562         bp->daddr = *daddr;
 563         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 564         bp->len = cpu_to_be32(nbytes);
 565
 566         sg_init_one(&sg, bp, sizeof(*bp));
 567         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 568 }
 569
 570 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 571                                const struct in6_addr *daddr, struct in6_addr *saddr,
 572                                const struct tcphdr *th)
 573 {
 574         struct tcp_md5sig_pool *hp;
 575         struct hash_desc *desc;
 576
 577         hp = tcp_get_md5sig_pool();
 578         if (!hp)
 579                 goto clear_hash_noput;
 580         desc = &hp->md5_desc;
 581
 582         if (crypto_hash_init(desc))
 583                 goto clear_hash;
 584         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 585                 goto clear_hash;
 586         if (tcp_md5_hash_header(hp, th))
 587                 goto clear_hash;
 588         if (tcp_md5_hash_key(hp, key))
 589                 goto clear_hash;
 590         if (crypto_hash_final(desc, md5_hash))
 591                 goto clear_hash;
 592
 593         tcp_put_md5sig_pool();
 594         return 0;
 595
 596 clear_hash:
 597         tcp_put_md5sig_pool();
 598 clear_hash_noput:
 599         memset(md5_hash, 0, 16);
 600         return 1;
 601 }
 602
 603 static int tcp_v6_md5_hash_skb(char *md5_hash,
 604                                const struct tcp_md5sig_key *key,
 605                                const struct sock *sk,
 606                                const struct sk_buff *skb)
 607 {
 608         const struct in6_addr *saddr, *daddr;
 609         struct tcp_md5sig_pool *hp;
 610         struct hash_desc *desc;
 611         const struct tcphdr *th = tcp_hdr(skb);
 612
 613         if (sk) { /* valid for establish/request sockets */
 614                 saddr = &sk->sk_v6_rcv_saddr;
 615                 daddr = &sk->sk_v6_daddr;
 616         } else {
 617                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 618                 saddr = &ip6h->saddr;
 619                 daddr = &ip6h->daddr;
 620         }
 621
 622         hp = tcp_get_md5sig_pool();
 623         if (!hp)
 624                 goto clear_hash_noput;
 625         desc = &hp->md5_desc;
 626
 627         if (crypto_hash_init(desc))
 628                 goto clear_hash;
 629
 630         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 631                 goto clear_hash;
 632         if (tcp_md5_hash_header(hp, th))
 633                 goto clear_hash;
 634         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 635                 goto clear_hash;
 636         if (tcp_md5_hash_key(hp, key))
 637                 goto clear_hash;
 638         if (crypto_hash_final(desc, md5_hash))
 639                 goto clear_hash;
 640
 641         tcp_put_md5sig_pool();
 642         return 0;
 643
 644 clear_hash:
 645         tcp_put_md5sig_pool();
 646 clear_hash_noput:
 647         memset(md5_hash, 0, 16);
 648         return 1;
 649 }
 650
 651 #endif
 652
 653 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 654                                     const struct sk_buff *skb)
 655 {
 656 #ifdef CONFIG_TCP_MD5SIG
 657         const __u8 *hash_location = NULL;
 658         struct tcp_md5sig_key *hash_expected;
 659         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 660         const struct tcphdr *th = tcp_hdr(skb);
 661         int genhash;
 662         u8 newhash[16];
 663
 664         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 665         hash_location = tcp_parse_md5sig_option(th);
 666
 667         /* We've parsed the options - do we have a hash? */
 668         if (!hash_expected && !hash_location)
 669                 return false;
 670
 671         if (hash_expected && !hash_location) {
 672                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 673                 return true;
 674         }
 675
 676         if (!hash_expected && hash_location) {
 677                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 678                 return true;
 679         }
 680
 681         /* check the signature */
 682         genhash = tcp_v6_md5_hash_skb(newhash,
 683                                       hash_expected,
 684                                       NULL, skb);
 685
 686         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 687                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 688                                      genhash ? "failed" : "mismatch",
 689                                      &ip6h->saddr, ntohs(th->source),
 690                                      &ip6h->daddr, ntohs(th->dest));
 691                 return true;
 692         }
 693 #endif
 694         return false;
 695 }
 696
 697 static void tcp_v6_init_req(struct request_sock *req,
 698                             const struct sock *sk_listener,
 699                             struct sk_buff *skb)
 700 {
 701         struct inet_request_sock *ireq = inet_rsk(req);
 702         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 703
 704         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 705         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 706
 707         /* So that link locals have meaning */
 708         if (!sk_listener->sk_bound_dev_if &&
 709             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 710                 ireq->ir_iif = tcp_v6_iif(skb);
 711
 712         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 713             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 714              np->rxopt.bits.rxinfo ||
 715              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 716              np->rxopt.bits.rxohlim || np->repflow)) {
 717                 atomic_inc(&skb->users);
 718                 ireq->pktopts = skb;
 719         }
 720 }
 721
 722 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 723                                           struct flowi *fl,
 724                                           const struct request_sock *req,
 725                                           bool *strict)
 726 {
 727         if (strict)
 728                 *strict = true;
 729         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 730 }
 731
 732 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 733         .family         =       AF_INET6,
 734         .obj_size       =       sizeof(struct tcp6_request_sock),
 735         .rtx_syn_ack    =       tcp_rtx_synack,
 736         .send_ack       =       tcp_v6_reqsk_send_ack,
 737         .destructor     =       tcp_v6_reqsk_destructor,
 738         .send_reset     =       tcp_v6_send_reset,
 739         .syn_ack_timeout =      tcp_syn_ack_timeout,
 740 };
 741
 742 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 743         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 744                                 sizeof(struct ipv6hdr),
 745 #ifdef CONFIG_TCP_MD5SIG
 746         .req_md5_lookup =       tcp_v6_md5_lookup,
 747         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 748 #endif
 749         .init_req       =       tcp_v6_init_req,
 750 #ifdef CONFIG_SYN_COOKIES
 751         .cookie_init_seq =      cookie_v6_init_sequence,
 752 #endif
 753         .route_req      =       tcp_v6_route_req,
 754         .init_seq       =       tcp_v6_init_sequence,
 755         .send_synack    =       tcp_v6_send_synack,
 756 };
 757
 758 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 759                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 760                                  int oif, struct tcp_md5sig_key *key, int rst,
 761                                  u8 tclass, u32 label)
 762 {
 763         const struct tcphdr *th = tcp_hdr(skb);
 764         struct tcphdr *t1;
 765         struct sk_buff *buff;
 766         struct flowi6 fl6;
 767         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 768         struct sock *ctl_sk = net->ipv6.tcp_sk;
 769         unsigned int tot_len = sizeof(struct tcphdr);
 770         struct dst_entry *dst;
 771         __be32 *topt;
 772
 773         if (tsecr)
 774                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 775 #ifdef CONFIG_TCP_MD5SIG
 776         if (key)
 777                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 778 #endif
 779
 780         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 781                          GFP_ATOMIC);
 782         if (!buff)
 783                 return;
 784
 785         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 786
 787         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 788         skb_reset_transport_header(buff);
 789
 790         /* Swap the send and the receive. */
 791         memset(t1, 0, sizeof(*t1));
 792         t1->dest = th->source;
 793         t1->source = th->dest;
 794         t1->doff = tot_len / 4;
 795         t1->seq = htonl(seq);
 796         t1->ack_seq = htonl(ack);
 797         t1->ack = !rst || !th->ack;
 798         t1->rst = rst;
 799         t1->window = htons(win);
 800
 801         topt = (__be32 *)(t1 + 1);
 802
 803         if (tsecr) {
 804                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 805                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 806                 *topt++ = htonl(tsval);
 807                 *topt++ = htonl(tsecr);
 808         }
 809
 810 #ifdef CONFIG_TCP_MD5SIG
 811         if (key) {
 812                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 813                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 814                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 815                                     &ipv6_hdr(skb)->saddr,
 816                                     &ipv6_hdr(skb)->daddr, t1);
 817         }
 818 #endif
 819
 820         memset(&fl6, 0, sizeof(fl6));
 821         fl6.daddr = ipv6_hdr(skb)->saddr;
 822         fl6.saddr = ipv6_hdr(skb)->daddr;
 823         fl6.flowlabel = label;
 824
 825         buff->ip_summed = CHECKSUM_PARTIAL;
 826         buff->csum = 0;
 827
 828         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 829
 830         fl6.flowi6_proto = IPPROTO_TCP;
 831         if (rt6_need_strict(&fl6.daddr) && !oif)
 832                 fl6.flowi6_oif = tcp_v6_iif(skb);
 833         else {
 834                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 835                         oif = skb->skb_iif;
 836
 837                 fl6.flowi6_oif = oif;
 838         }
 839
 840         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 841         fl6.fl6_dport = t1->dest;
 842         fl6.fl6_sport = t1->source;
 843         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 844
 845         /* Pass a socket to ip6_dst_lookup either it is for RST
 846          * Underlying function will use this to retrieve the network
 847          * namespace
 848          */
 849         dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
 850         if (!IS_ERR(dst)) {
 851                 skb_dst_set(buff, dst);
 852                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 853                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 854                 if (rst)
 855                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 856                 return;
 857         }
 858
 859         kfree_skb(buff);
 860 }
 861
 862 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 863 {
 864         const struct tcphdr *th = tcp_hdr(skb);
 865         u32 seq = 0, ack_seq = 0;
 866         struct tcp_md5sig_key *key = NULL;
 867 #ifdef CONFIG_TCP_MD5SIG
 868         const __u8 *hash_location = NULL;
 869         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 870         unsigned char newhash[16];
 871         int genhash;
 872         struct sock *sk1 = NULL;
 873 #endif
 874         int oif;
 875
 876         if (th->rst)
 877                 return;
 878
 879         /* If sk not NULL, it means we did a successful lookup and incoming
 880          * route had to be correct. prequeue might have dropped our dst.
 881          */
 882         if (!sk && !ipv6_unicast_destination(skb))
 883                 return;
 884
 885 #ifdef CONFIG_TCP_MD5SIG
 886         hash_location = tcp_parse_md5sig_option(th);
 887         if (!sk && hash_location) {
 888                 /*
 889                  * active side is lost. Try to find listening socket through
 890                  * source port, and then find md5 key through listening socket.
 891                  * we are not loose security here:
 892                  * Incoming packet is checked with md5 hash with finding key,
 893                  * no RST generated if md5 hash doesn't match.
 894                  */
 895                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 896                                            &tcp_hashinfo, &ipv6h->saddr,
 897                                            th->source, &ipv6h->daddr,
 898                                            ntohs(th->source), tcp_v6_iif(skb));
 899                 if (!sk1)
 900                         return;
 901
 902                 rcu_read_lock();
 903                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 904                 if (!key)
 905                         goto release_sk1;
 906
 907                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 908                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 909                         goto release_sk1;
 910         } else {
 911                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 912         }
 913 #endif
 914
 915         if (th->ack)
 916                 seq = ntohl(th->ack_seq);
 917         else
 918                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 919                           (th->doff << 2);
 920
 921         oif = sk ? sk->sk_bound_dev_if : 0;
 922         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 923
 924 #ifdef CONFIG_TCP_MD5SIG
 925 release_sk1:
 926         if (sk1) {
 927                 rcu_read_unlock();
 928                 sock_put(sk1);
 929         }
 930 #endif
 931 }
 932
 933 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 934                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 935                             struct tcp_md5sig_key *key, u8 tclass,
 936                             u32 label)
 937 {
 938         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 939                              tclass, label);
 940 }
 941
 942 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 943 {
 944         struct inet_timewait_sock *tw = inet_twsk(sk);
 945         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 946
 947         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 948                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 949                         tcp_time_stamp + tcptw->tw_ts_offset,
 950                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 951                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 952
 953         inet_twsk_put(tw);
 954 }
 955
 956 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 957                                   struct request_sock *req)
 958 {
 959         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 960          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 961          */
 962         /* RFC 7323 2.3
 963          * The window field (SEG.WND) of every outgoing segment, with the
 964          * exception of <SYN> segments, MUST be right-shifted by
 965          * Rcv.Wind.Shift bits:
 966          */
 967         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 968                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
 969                         tcp_rsk(req)->rcv_nxt,
 970                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
 971                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 972                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
 973                         0, 0);
 974 }
 975
 976
 977 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
 978 {
 979 #ifdef CONFIG_SYN_COOKIES
 980         const struct tcphdr *th = tcp_hdr(skb);
 981
 982         if (!th->syn)
 983                 sk = cookie_v6_check(sk, skb);
 984 #endif
 985         return sk;
 986 }
 987
 988 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 989 {
 990         if (skb->protocol == htons(ETH_P_IP))
 991                 return tcp_v4_conn_request(sk, skb);
 992
 993         if (!ipv6_unicast_destination(skb))
 994                 goto drop;
 995
 996         if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
 997                 IP6_INC_STATS_BH(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
 998                 return 0;
 999         }
1000
1001         return tcp_conn_request(&tcp6_request_sock_ops,
1002                                 &tcp_request_sock_ipv6_ops, sk, skb);
1003
1004 drop:
1005         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1006         return 0; /* don't send reset */
1007 }
1008
1009 static void tcp_v6_restore_cb(struct sk_buff *skb)
1010 {
1011         /* We need to move header back to the beginning if xfrm6_policy_check()
1012          * and tcp_v6_fill_cb() are going to be called again.
1013          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1014          */
1015         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1016                 sizeof(struct inet6_skb_parm));
1017 }
1018
1019 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1020                                          struct request_sock *req,
1021                                          struct dst_entry *dst,
1022                                          struct request_sock *req_unhash,
1023                                          bool *own_req)
1024 {
1025         struct inet_request_sock *ireq;
1026         struct ipv6_pinfo *newnp;
1027         const struct ipv6_pinfo *np = inet6_sk(sk);
1028         struct ipv6_txoptions *opt;
1029         struct tcp6_sock *newtcp6sk;
1030         struct inet_sock *newinet;
1031         struct tcp_sock *newtp;
1032         struct sock *newsk;
1033 #ifdef CONFIG_TCP_MD5SIG
1034         struct tcp_md5sig_key *key;
1035 #endif
1036         struct flowi6 fl6;
1037
1038         if (skb->protocol == htons(ETH_P_IP)) {
1039                 /*
1040                  *      v6 mapped
1041                  */
1042
1043                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1044                                              req_unhash, own_req);
1045
1046                 if (!newsk)
1047                         return NULL;
1048
1049                 newtcp6sk = (struct tcp6_sock *)newsk;
1050                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1051
1052                 newinet = inet_sk(newsk);
1053                 newnp = inet6_sk(newsk);
1054                 newtp = tcp_sk(newsk);
1055
1056                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1057
1058                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1059
1060                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1061                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1062 #ifdef CONFIG_TCP_MD5SIG
1063                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1064 #endif
1065
1066                 newnp->ipv6_mc_list = NULL;
1067                 newnp->ipv6_ac_list = NULL;
1068                 newnp->ipv6_fl_list = NULL;
1069                 newnp->pktoptions  = NULL;
1070                 newnp->opt         = NULL;
1071                 newnp->mcast_oif   = inet_iif(skb);
1072                 newnp->mcast_hops  = ip_hdr(skb)->ttl;
1073                 newnp->rcv_flowinfo = 0;
1074                 if (np->repflow)
1075                         newnp->flow_label = 0;
1076
1077                 /*
1078                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1079                  * here, tcp_create_openreq_child now does this for us, see the comment in
1080                  * that function for the gory details. -acme
1081                  */
1082
1083                 /* It is tricky place. Until this moment IPv4 tcp
1084                    worked with IPv6 icsk.icsk_af_ops.
1085                    Sync it now.
1086                  */
1087                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1088
1089                 return newsk;
1090         }
1091
1092         ireq = inet_rsk(req);
1093
1094         if (sk_acceptq_is_full(sk))
1095                 goto out_overflow;
1096
1097         if (!dst) {
1098                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1099                 if (!dst)
1100                         goto out;
1101         }
1102
1103         newsk = tcp_create_openreq_child(sk, req, skb);
1104         if (!newsk)
1105                 goto out_nonewsk;
1106
1107         /*
1108          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1109          * count here, tcp_create_openreq_child now does this for us, see the
1110          * comment in that function for the gory details. -acme
1111          */
1112
1113         newsk->sk_gso_type = SKB_GSO_TCPV6;
1114         ip6_dst_store(newsk, dst, NULL, NULL);
1115         inet6_sk_rx_dst_set(newsk, skb);
1116
1117         newtcp6sk = (struct tcp6_sock *)newsk;
1118         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1119
1120         newtp = tcp_sk(newsk);
1121         newinet = inet_sk(newsk);
1122         newnp = inet6_sk(newsk);
1123
1124         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1125
1126         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1127         newnp->saddr = ireq->ir_v6_loc_addr;
1128         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1129         newsk->sk_bound_dev_if = ireq->ir_iif;
1130
1131         /* Now IPv6 options...
1132
1133            First: no IPv4 options.
1134          */
1135         newinet->inet_opt = NULL;
1136         newnp->ipv6_mc_list = NULL;
1137         newnp->ipv6_ac_list = NULL;
1138         newnp->ipv6_fl_list = NULL;
1139
1140         /* Clone RX bits */
1141         newnp->rxopt.all = np->rxopt.all;
1142
1143         newnp->pktoptions = NULL;
1144         newnp->opt        = NULL;
1145         newnp->mcast_oif  = tcp_v6_iif(skb);
1146         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1147         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1148         if (np->repflow)
1149                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1150
1151         /* Clone native IPv6 options from listening socket (if any)
1152
1153            Yes, keeping reference count would be much more clever,
1154            but we make one more one thing there: reattach optmem
1155            to newsk.
1156          */
1157         opt = rcu_dereference(np->opt);
1158         if (opt) {
1159                 opt = ipv6_dup_options(newsk, opt);
1160                 RCU_INIT_POINTER(newnp->opt, opt);
1161         }
1162         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1163         if (opt)
1164                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1165                                                     opt->opt_flen;
1166
1167         tcp_ca_openreq_child(newsk, dst);
1168
1169         tcp_sync_mss(newsk, dst_mtu(dst));
1170         newtp->advmss = dst_metric_advmss(dst);
1171         if (tcp_sk(sk)->rx_opt.user_mss &&
1172             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1173                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1174
1175         tcp_initialize_rcv_mss(newsk);
1176
1177         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1178         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1179
1180 #ifdef CONFIG_TCP_MD5SIG
1181         /* Copy over the MD5 key from the original socket */
1182         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1183         if (key) {
1184                 /* We're using one, so create a matching key
1185                  * on the newsk structure. If we fail to get
1186                  * memory, then we end up not copying the key
1187                  * across. Shucks.
1188                  */
1189                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1190                                AF_INET6, key->key, key->keylen,
1191                                sk_gfp_atomic(sk, GFP_ATOMIC));
1192         }
1193 #endif
1194
1195         if (__inet_inherit_port(sk, newsk) < 0) {
1196                 inet_csk_prepare_forced_close(newsk);
1197                 tcp_done(newsk);
1198                 goto out;
1199         }
1200         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1201         if (*own_req) {
1202                 tcp_move_syn(newtp, req);
1203
1204                 /* Clone pktoptions received with SYN, if we own the req */
1205                 if (ireq->pktopts) {
1206                         newnp->pktoptions = skb_clone(ireq->pktopts,
1207                                                       sk_gfp_atomic(sk, GFP_ATOMIC));
1208                         consume_skb(ireq->pktopts);
1209                         ireq->pktopts = NULL;
1210                         if (newnp->pktoptions) {
1211                                 tcp_v6_restore_cb(newnp->pktoptions);
1212                                 skb_set_owner_r(newnp->pktoptions, newsk);
1213                         }
1214                 }
1215         }
1216
1217         return newsk;
1218
1219 out_overflow:
1220         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1221 out_nonewsk:
1222         dst_release(dst);
1223 out:
1224         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1225         return NULL;
1226 }
1227
1228 /* The socket must have it's spinlock held when we get
1229  * here, unless it is a TCP_LISTEN socket.
1230  *
1231  * We have a potential double-lock case here, so even when
1232  * doing backlog processing we use the BH locking scheme.
1233  * This is because we cannot sleep with the original spinlock
1234  * held.
1235  */
1236 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1237 {
1238         struct ipv6_pinfo *np = inet6_sk(sk);
1239         struct tcp_sock *tp;
1240         struct sk_buff *opt_skb = NULL;
1241
1242         /* Imagine: socket is IPv6. IPv4 packet arrives,
1243            goes to IPv4 receive handler and backlogged.
1244            From backlog it always goes here. Kerboom...
1245            Fortunately, tcp_rcv_established and rcv_established
1246            handle them correctly, but it is not case with
1247            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1248          */
1249
1250         if (skb->protocol == htons(ETH_P_IP))
1251                 return tcp_v4_do_rcv(sk, skb);
1252
1253         if (tcp_filter(sk, skb))
1254                 goto discard;
1255
1256         /*
1257          *      socket locking is here for SMP purposes as backlog rcv
1258          *      is currently called with bh processing disabled.
1259          */
1260
1261         /* Do Stevens' IPV6_PKTOPTIONS.
1262
1263            Yes, guys, it is the only place in our code, where we
1264            may make it not affecting IPv4.
1265            The rest of code is protocol independent,
1266            and I do not like idea to uglify IPv4.
1267
1268            Actually, all the idea behind IPV6_PKTOPTIONS
1269            looks not very well thought. For now we latch
1270            options, received in the last packet, enqueued
1271            by tcp. Feel free to propose better solution.
1272                                                --ANK (980728)
1273          */
1274         if (np->rxopt.all)
1275                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1276
1277         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1278                 struct dst_entry *dst = sk->sk_rx_dst;
1279
1280                 sock_rps_save_rxhash(sk, skb);
1281                 sk_mark_napi_id(sk, skb);
1282                 if (dst) {
1283                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1284                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1285                                 dst_release(dst);
1286                                 sk->sk_rx_dst = NULL;
1287                         }
1288                 }
1289
1290                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1291                 if (opt_skb)
1292                         goto ipv6_pktoptions;
1293                 return 0;
1294         }
1295
1296         if (tcp_checksum_complete(skb))
1297                 goto csum_err;
1298
1299         if (sk->sk_state == TCP_LISTEN) {
1300                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1301
1302                 if (!nsk)
1303                         goto discard;
1304
1305                 if (nsk != sk) {
1306                         sock_rps_save_rxhash(nsk, skb);
1307                         sk_mark_napi_id(nsk, skb);
1308                         if (tcp_child_process(sk, nsk, skb))
1309                                 goto reset;
1310                         if (opt_skb)
1311                                 __kfree_skb(opt_skb);
1312                         return 0;
1313                 }
1314         } else
1315                 sock_rps_save_rxhash(sk, skb);
1316
1317         if (tcp_rcv_state_process(sk, skb))
1318                 goto reset;
1319         if (opt_skb)
1320                 goto ipv6_pktoptions;
1321         return 0;
1322
1323 reset:
1324         tcp_v6_send_reset(sk, skb);
1325 discard:
1326         if (opt_skb)
1327                 __kfree_skb(opt_skb);
1328         kfree_skb(skb);
1329         return 0;
1330 csum_err:
1331         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1332         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1333         goto discard;
1334
1335
1336 ipv6_pktoptions:
1337         /* Do you ask, what is it?
1338
1339            1. skb was enqueued by tcp.
1340            2. skb is added to tail of read queue, rather than out of order.
1341            3. socket is not in passive state.
1342            4. Finally, it really contains options, which user wants to receive.
1343          */
1344         tp = tcp_sk(sk);
1345         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1346             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1347                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1348                         np->mcast_oif = tcp_v6_iif(opt_skb);
1349                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1350                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1351                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1352                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1353                 if (np->repflow)
1354                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1355                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1356                         skb_set_owner_r(opt_skb, sk);
1357                         tcp_v6_restore_cb(opt_skb);
1358                         opt_skb = xchg(&np->pktoptions, opt_skb);
1359                 } else {
1360                         __kfree_skb(opt_skb);
1361                         opt_skb = xchg(&np->pktoptions, NULL);
1362                 }
1363         }
1364
1365         kfree_skb(opt_skb);
1366         return 0;
1367 }
1368
1369 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1370                            const struct tcphdr *th)
1371 {
1372         /* This is tricky: we move IP6CB at its correct location into
1373          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1374          * _decode_session6() uses IP6CB().
1375          * barrier() makes sure compiler won't play aliasing games.
1376          */
1377         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1378                 sizeof(struct inet6_skb_parm));
1379         barrier();
1380
1381         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1382         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1383                                     skb->len - th->doff*4);
1384         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1385         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1386         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1387         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1388         TCP_SKB_CB(skb)->sacked = 0;
1389 }
1390
1391 static int tcp_v6_rcv(struct sk_buff *skb)
1392 {
1393         const struct tcphdr *th;
1394         const struct ipv6hdr *hdr;
1395         struct sock *sk;
1396         int ret;
1397         struct net *net = dev_net(skb->dev);
1398
1399         if (skb->pkt_type != PACKET_HOST)
1400                 goto discard_it;
1401
1402         /*
1403          *      Count it even if it's bad.
1404          */
1405         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1406
1407         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1408                 goto discard_it;
1409
1410         th = tcp_hdr(skb);
1411
1412         if (th->doff < sizeof(struct tcphdr)/4)
1413                 goto bad_packet;
1414         if (!pskb_may_pull(skb, th->doff*4))
1415                 goto discard_it;
1416
1417         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1418                 goto csum_error;
1419
1420         th = tcp_hdr(skb);
1421         hdr = ipv6_hdr(skb);
1422
1423 lookup:
1424         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1425                                 inet6_iif(skb));
1426         if (!sk)
1427                 goto no_tcp_socket;
1428
1429 process:
1430         if (sk->sk_state == TCP_TIME_WAIT)
1431                 goto do_time_wait;
1432
1433         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1434                 struct request_sock *req = inet_reqsk(sk);
1435                 struct sock *nsk;
1436
1437                 sk = req->rsk_listener;
1438                 tcp_v6_fill_cb(skb, hdr, th);
1439                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1440                         reqsk_put(req);
1441                         goto discard_it;
1442                 }
1443                 if (tcp_checksum_complete(skb)) {
1444                         reqsk_put(req);
1445                         goto csum_error;
1446                 }
1447                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1448                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1449                         goto lookup;
1450                 }
1451                 sock_hold(sk);
1452                 nsk = tcp_check_req(sk, skb, req, false);
1453                 if (!nsk) {
1454                         reqsk_put(req);
1455                         goto discard_and_relse;
1456                 }
1457                 if (nsk == sk) {
1458                         reqsk_put(req);
1459                         tcp_v6_restore_cb(skb);
1460                 } else if (tcp_child_process(sk, nsk, skb)) {
1461                         tcp_v6_send_reset(nsk, skb);
1462                         goto discard_and_relse;
1463                 } else {
1464                         sock_put(sk);
1465                         return 0;
1466                 }
1467         }
1468         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1469                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1470                 goto discard_and_relse;
1471         }
1472
1473         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1474                 goto discard_and_relse;
1475
1476         tcp_v6_fill_cb(skb, hdr, th);
1477
1478         if (tcp_v6_inbound_md5_hash(sk, skb))
1479                 goto discard_and_relse;
1480
1481         if (tcp_filter(sk, skb))
1482                 goto discard_and_relse;
1483         th = (const struct tcphdr *)skb->data;
1484         hdr = ipv6_hdr(skb);
1485
1486         skb->dev = NULL;
1487
1488         if (sk->sk_state == TCP_LISTEN) {
1489                 ret = tcp_v6_do_rcv(sk, skb);
1490                 goto put_and_return;
1491         }
1492
1493         sk_incoming_cpu_update(sk);
1494
1495         bh_lock_sock_nested(sk);
1496         tcp_sk(sk)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
1497         ret = 0;
1498         if (!sock_owned_by_user(sk)) {
1499                 if (!tcp_prequeue(sk, skb))
1500                         ret = tcp_v6_do_rcv(sk, skb);
1501         } else if (unlikely(sk_add_backlog(sk, skb,
1502                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1503                 bh_unlock_sock(sk);
1504                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1505                 goto discard_and_relse;
1506         }
1507         bh_unlock_sock(sk);
1508
1509 put_and_return:
1510         sock_put(sk);
1511         return ret ? -1 : 0;
1512
1513 no_tcp_socket:
1514         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1515                 goto discard_it;
1516
1517         tcp_v6_fill_cb(skb, hdr, th);
1518
1519         if (tcp_checksum_complete(skb)) {
1520 csum_error:
1521                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1522 bad_packet:
1523                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1524         } else {
1525                 tcp_v6_send_reset(NULL, skb);
1526         }
1527
1528 discard_it:
1529         kfree_skb(skb);
1530         return 0;
1531
1532 discard_and_relse:
1533         sk_drops_add(sk, skb);
1534         sock_put(sk);
1535         goto discard_it;
1536
1537 do_time_wait:
1538         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1539                 inet_twsk_put(inet_twsk(sk));
1540                 goto discard_it;
1541         }
1542
1543         tcp_v6_fill_cb(skb, hdr, th);
1544
1545         if (tcp_checksum_complete(skb)) {
1546                 inet_twsk_put(inet_twsk(sk));
1547                 goto csum_error;
1548         }
1549
1550         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1551         case TCP_TW_SYN:
1552         {
1553                 struct sock *sk2;
1554
1555                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1556                                             &ipv6_hdr(skb)->saddr, th->source,
1557                                             &ipv6_hdr(skb)->daddr,
1558                                             ntohs(th->dest), tcp_v6_iif(skb));
1559                 if (sk2) {
1560                         struct inet_timewait_sock *tw = inet_twsk(sk);
1561                         inet_twsk_deschedule_put(tw);
1562                         sk = sk2;
1563                         tcp_v6_restore_cb(skb);
1564                         goto process;
1565                 }
1566                 /* Fall through to ACK */
1567         }
1568         case TCP_TW_ACK:
1569                 tcp_v6_timewait_ack(sk, skb);
1570                 break;
1571         case TCP_TW_RST:
1572                 tcp_v6_restore_cb(skb);
1573                 goto no_tcp_socket;
1574         case TCP_TW_SUCCESS:
1575                 ;
1576         }
1577         goto discard_it;
1578 }
1579
1580 static void tcp_v6_early_demux(struct sk_buff *skb)
1581 {
1582         const struct ipv6hdr *hdr;
1583         const struct tcphdr *th;
1584         struct sock *sk;
1585
1586         if (skb->pkt_type != PACKET_HOST)
1587                 return;
1588
1589         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1590                 return;
1591
1592         hdr = ipv6_hdr(skb);
1593         th = tcp_hdr(skb);
1594
1595         if (th->doff < sizeof(struct tcphdr) / 4)
1596                 return;
1597
1598         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1599         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1600                                         &hdr->saddr, th->source,
1601                                         &hdr->daddr, ntohs(th->dest),
1602                                         inet6_iif(skb));
1603         if (sk) {
1604                 skb->sk = sk;
1605                 skb->destructor = sock_edemux;
1606                 if (sk_fullsock(sk)) {
1607                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1608
1609                         if (dst)
1610                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1611                         if (dst &&
1612                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1613                                 skb_dst_set_noref(skb, dst);
1614                 }
1615         }
1616 }
1617
1618 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1619         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1620         .twsk_unique    = tcp_twsk_unique,
1621         .twsk_destructor = tcp_twsk_destructor,
1622 };
1623
1624 static const struct inet_connection_sock_af_ops ipv6_specific = {
1625         .queue_xmit        = inet6_csk_xmit,
1626         .send_check        = tcp_v6_send_check,
1627         .rebuild_header    = inet6_sk_rebuild_header,
1628         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1629         .conn_request      = tcp_v6_conn_request,
1630         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1631         .net_header_len    = sizeof(struct ipv6hdr),
1632         .net_frag_header_len = sizeof(struct frag_hdr),
1633         .setsockopt        = ipv6_setsockopt,
1634         .getsockopt        = ipv6_getsockopt,
1635         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1636         .sockaddr_len      = sizeof(struct sockaddr_in6),
1637         .bind_conflict     = inet6_csk_bind_conflict,
1638 #ifdef CONFIG_COMPAT
1639         .compat_setsockopt = compat_ipv6_setsockopt,
1640         .compat_getsockopt = compat_ipv6_getsockopt,
1641 #endif
1642         .mtu_reduced       = tcp_v6_mtu_reduced,
1643 };
1644
1645 #ifdef CONFIG_TCP_MD5SIG
1646 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1647         .md5_lookup     =       tcp_v6_md5_lookup,
1648         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1649         .md5_parse      =       tcp_v6_parse_md5_keys,
1650 };
1651 #endif
1652
1653 /*
1654  *      TCP over IPv4 via INET6 API
1655  */
1656 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1657         .queue_xmit        = ip_queue_xmit,
1658         .send_check        = tcp_v4_send_check,
1659         .rebuild_header    = inet_sk_rebuild_header,
1660         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1661         .conn_request      = tcp_v6_conn_request,
1662         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1663         .net_header_len    = sizeof(struct iphdr),
1664         .setsockopt        = ipv6_setsockopt,
1665         .getsockopt        = ipv6_getsockopt,
1666         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1667         .sockaddr_len      = sizeof(struct sockaddr_in6),
1668         .bind_conflict     = inet6_csk_bind_conflict,
1669 #ifdef CONFIG_COMPAT
1670         .compat_setsockopt = compat_ipv6_setsockopt,
1671         .compat_getsockopt = compat_ipv6_getsockopt,
1672 #endif
1673         .mtu_reduced       = tcp_v4_mtu_reduced,
1674 };
1675
1676 #ifdef CONFIG_TCP_MD5SIG
1677 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1678         .md5_lookup     =       tcp_v4_md5_lookup,
1679         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1680         .md5_parse      =       tcp_v6_parse_md5_keys,
1681 };
1682 #endif
1683
1684 /* NOTE: A lot of things set to zero explicitly by call to
1685  *       sk_alloc() so need not be done here.
1686  */
1687 static int tcp_v6_init_sock(struct sock *sk)
1688 {
1689         struct inet_connection_sock *icsk = inet_csk(sk);
1690
1691         tcp_init_sock(sk);
1692
1693         icsk->icsk_af_ops = &ipv6_specific;
1694
1695 #ifdef CONFIG_TCP_MD5SIG
1696         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1697 #endif
1698
1699         return 0;
1700 }
1701
1702 static void tcp_v6_destroy_sock(struct sock *sk)
1703 {
1704         tcp_v4_destroy_sock(sk);
1705         inet6_destroy_sock(sk);
1706 }
1707
1708 #ifdef CONFIG_PROC_FS
1709 /* Proc filesystem TCPv6 sock list dumping. */
1710 static void get_openreq6(struct seq_file *seq,
1711                          const struct request_sock *req, int i)
1712 {
1713         long ttd = req->rsk_timer.expires - jiffies;
1714         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1715         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1716
1717         if (ttd < 0)
1718                 ttd = 0;
1719
1720         seq_printf(seq,
1721                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1722                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1723                    i,
1724                    src->s6_addr32[0], src->s6_addr32[1],
1725                    src->s6_addr32[2], src->s6_addr32[3],
1726                    inet_rsk(req)->ir_num,
1727                    dest->s6_addr32[0], dest->s6_addr32[1],
1728                    dest->s6_addr32[2], dest->s6_addr32[3],
1729                    ntohs(inet_rsk(req)->ir_rmt_port),
1730                    TCP_SYN_RECV,
1731                    0, 0, /* could print option size, but that is af dependent. */
1732                    1,   /* timers active (only the expire timer) */
1733                    jiffies_to_clock_t(ttd),
1734                    req->num_timeout,
1735                    from_kuid_munged(seq_user_ns(seq),
1736                                     sock_i_uid(req->rsk_listener)),
1737                    0,  /* non standard timer */
1738                    0, /* open_requests have no inode */
1739                    0, req);
1740 }
1741
1742 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1743 {
1744         const struct in6_addr *dest, *src;
1745         __u16 destp, srcp;
1746         int timer_active;
1747         unsigned long timer_expires;
1748         const struct inet_sock *inet = inet_sk(sp);
1749         const struct tcp_sock *tp = tcp_sk(sp);
1750         const struct inet_connection_sock *icsk = inet_csk(sp);
1751         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1752         int rx_queue;
1753         int state;
1754
1755         dest  = &sp->sk_v6_daddr;
1756         src   = &sp->sk_v6_rcv_saddr;
1757         destp = ntohs(inet->inet_dport);
1758         srcp  = ntohs(inet->inet_sport);
1759
1760         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1761             icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
1762             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1763                 timer_active    = 1;
1764                 timer_expires   = icsk->icsk_timeout;
1765         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1766                 timer_active    = 4;
1767                 timer_expires   = icsk->icsk_timeout;
1768         } else if (timer_pending(&sp->sk_timer)) {
1769                 timer_active    = 2;
1770                 timer_expires   = sp->sk_timer.expires;
1771         } else {
1772                 timer_active    = 0;
1773                 timer_expires = jiffies;
1774         }
1775
1776         state = sk_state_load(sp);
1777         if (state == TCP_LISTEN)
1778                 rx_queue = sp->sk_ack_backlog;
1779         else
1780                 /* Because we don't lock the socket,
1781                  * we might find a transient negative value.
1782                  */
1783                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1784
1785         seq_printf(seq,
1786                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1787                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1788                    i,
1789                    src->s6_addr32[0], src->s6_addr32[1],
1790                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1791                    dest->s6_addr32[0], dest->s6_addr32[1],
1792                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1793                    state,
1794                    tp->write_seq - tp->snd_una,
1795                    rx_queue,
1796                    timer_active,
1797                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1798                    icsk->icsk_retransmits,
1799                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1800                    icsk->icsk_probes_out,
1801                    sock_i_ino(sp),
1802                    atomic_read(&sp->sk_refcnt), sp,
1803                    jiffies_to_clock_t(icsk->icsk_rto),
1804                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1805                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1806                    tp->snd_cwnd,
1807                    state == TCP_LISTEN ?
1808                         fastopenq->max_qlen :
1809                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1810                    );
1811 }
1812
1813 static void get_timewait6_sock(struct seq_file *seq,
1814                                struct inet_timewait_sock *tw, int i)
1815 {
1816         long delta = tw->tw_timer.expires - jiffies;
1817         const struct in6_addr *dest, *src;
1818         __u16 destp, srcp;
1819
1820         dest = &tw->tw_v6_daddr;
1821         src  = &tw->tw_v6_rcv_saddr;
1822         destp = ntohs(tw->tw_dport);
1823         srcp  = ntohs(tw->tw_sport);
1824
1825         seq_printf(seq,
1826                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1827                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1828                    i,
1829                    src->s6_addr32[0], src->s6_addr32[1],
1830                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1831                    dest->s6_addr32[0], dest->s6_addr32[1],
1832                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1833                    tw->tw_substate, 0, 0,
1834                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1835                    atomic_read(&tw->tw_refcnt), tw);
1836 }
1837
1838 static int tcp6_seq_show(struct seq_file *seq, void *v)
1839 {
1840         struct tcp_iter_state *st;
1841         struct sock *sk = v;
1842
1843         if (v == SEQ_START_TOKEN) {
1844                 seq_puts(seq,
1845                          "  sl  "
1846                          "local_address                         "
1847                          "remote_address                        "
1848                          "st tx_queue rx_queue tr tm->when retrnsmt"
1849                          "   uid  timeout inode\n");
1850                 goto out;
1851         }
1852         st = seq->private;
1853
1854         if (sk->sk_state == TCP_TIME_WAIT)
1855                 get_timewait6_sock(seq, v, st->num);
1856         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1857                 get_openreq6(seq, v, st->num);
1858         else
1859                 get_tcp6_sock(seq, v, st->num);
1860 out:
1861         return 0;
1862 }
1863
1864 static const struct file_operations tcp6_afinfo_seq_fops = {
1865         .owner   = THIS_MODULE,
1866         .open    = tcp_seq_open,
1867         .read    = seq_read,
1868         .llseek  = seq_lseek,
1869         .release = seq_release_net
1870 };
1871
1872 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1873         .name           = "tcp6",
1874         .family         = AF_INET6,
1875         .seq_fops       = &tcp6_afinfo_seq_fops,
1876         .seq_ops        = {
1877                 .show           = tcp6_seq_show,
1878         },
1879 };
1880
1881 int __net_init tcp6_proc_init(struct net *net)
1882 {
1883         return tcp_proc_register(net, &tcp6_seq_afinfo);
1884 }
1885
1886 void tcp6_proc_exit(struct net *net)
1887 {
1888         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1889 }
1890 #endif
1891
1892 static void tcp_v6_clear_sk(struct sock *sk, int size)
1893 {
1894         struct inet_sock *inet = inet_sk(sk);
1895
1896         /* we do not want to clear pinet6 field, because of RCU lookups */
1897         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1898
1899         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1900         memset(&inet->pinet6 + 1, 0, size);
1901 }
1902
1903 struct proto tcpv6_prot = {
1904         .name                   = "TCPv6",
1905         .owner                  = THIS_MODULE,
1906         .close                  = tcp_close,
1907         .connect                = tcp_v6_connect,
1908         .disconnect             = tcp_disconnect,
1909         .accept                 = inet_csk_accept,
1910         .ioctl                  = tcp_ioctl,
1911         .init                   = tcp_v6_init_sock,
1912         .destroy                = tcp_v6_destroy_sock,
1913         .shutdown               = tcp_shutdown,
1914         .setsockopt             = tcp_setsockopt,
1915         .getsockopt             = tcp_getsockopt,
1916         .recvmsg                = tcp_recvmsg,
1917         .sendmsg                = tcp_sendmsg,
1918         .sendpage               = tcp_sendpage,
1919         .backlog_rcv            = tcp_v6_do_rcv,
1920         .release_cb             = tcp_release_cb,
1921         .hash                   = inet_hash,
1922         .unhash                 = inet_unhash,
1923         .get_port               = inet_csk_get_port,
1924         .enter_memory_pressure  = tcp_enter_memory_pressure,
1925         .stream_memory_free     = tcp_stream_memory_free,
1926         .sockets_allocated      = &tcp_sockets_allocated,
1927         .memory_allocated       = &tcp_memory_allocated,
1928         .memory_pressure        = &tcp_memory_pressure,
1929         .orphan_count           = &tcp_orphan_count,
1930         .sysctl_mem             = sysctl_tcp_mem,
1931         .sysctl_wmem            = sysctl_tcp_wmem,
1932         .sysctl_rmem            = sysctl_tcp_rmem,
1933         .max_header             = MAX_TCP_HEADER,
1934         .obj_size               = sizeof(struct tcp6_sock),
1935         .slab_flags             = SLAB_DESTROY_BY_RCU,
1936         .twsk_prot              = &tcp6_timewait_sock_ops,
1937         .rsk_prot               = &tcp6_request_sock_ops,
1938         .h.hashinfo             = &tcp_hashinfo,
1939         .no_autobind            = true,
1940 #ifdef CONFIG_COMPAT
1941         .compat_setsockopt      = compat_tcp_setsockopt,
1942         .compat_getsockopt      = compat_tcp_getsockopt,
1943 #endif
1944 #ifdef CONFIG_MEMCG_KMEM
1945         .proto_cgroup           = tcp_proto_cgroup,
1946 #endif
1947         .clear_sk               = tcp_v6_clear_sk,
1948 };
1949
1950 static const struct inet6_protocol tcpv6_protocol = {
1951         .early_demux    =       tcp_v6_early_demux,
1952         .handler        =       tcp_v6_rcv,
1953         .err_handler    =       tcp_v6_err,
1954         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1955 };
1956
1957 static struct inet_protosw tcpv6_protosw = {
1958         .type           =       SOCK_STREAM,
1959         .protocol       =       IPPROTO_TCP,
1960         .prot           =       &tcpv6_prot,
1961         .ops            =       &inet6_stream_ops,
1962         .flags          =       INET_PROTOSW_PERMANENT |
1963                                 INET_PROTOSW_ICSK,
1964 };
1965
1966 static int __net_init tcpv6_net_init(struct net *net)
1967 {
1968         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1969                                     SOCK_RAW, IPPROTO_TCP, net);
1970 }
1971
1972 static void __net_exit tcpv6_net_exit(struct net *net)
1973 {
1974         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1975 }
1976
1977 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1978 {
1979         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1980 }
1981
1982 static struct pernet_operations tcpv6_net_ops = {
1983         .init       = tcpv6_net_init,
1984         .exit       = tcpv6_net_exit,
1985         .exit_batch = tcpv6_net_exit_batch,
1986 };
1987
1988 int __init tcpv6_init(void)
1989 {
1990         int ret;
1991
1992         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1993         if (ret)
1994                 goto out;
1995
1996         /* register inet6 protocol */
1997         ret = inet6_register_protosw(&tcpv6_protosw);
1998         if (ret)
1999                 goto out_tcpv6_protocol;
2000
2001         ret = register_pernet_subsys(&tcpv6_net_ops);
2002         if (ret)
2003                 goto out_tcpv6_protosw;
2004 out:
2005         return ret;
2006
2007 out_tcpv6_protosw:
2008         inet6_unregister_protosw(&tcpv6_protosw);
2009 out_tcpv6_protocol:
2010         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2011         goto out;
2012 }
2013
2014 void tcpv6_exit(void)
2015 {
2016         unregister_pernet_subsys(&tcpv6_net_ops);
2017         inet6_unregister_protosw(&tcpv6_protosw);
2018         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2019 }