net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/busy_poll.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <crypto/hash.h>
  70 #include <linux/scatterlist.h>
  71
  72 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  73 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  74                                       struct request_sock *req);
  75
  76 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  77
  78 static const struct inet_connection_sock_af_ops ipv6_mapped;
  79 static const struct inet_connection_sock_af_ops ipv6_specific;
  80 #ifdef CONFIG_TCP_MD5SIG
  81 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  83 #else
  84 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  85                                                    const struct in6_addr *addr)
  86 {
  87         return NULL;
  88 }
  89 #endif
  90
  91 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  92 {
  93         struct dst_entry *dst = skb_dst(skb);
  94
  95         if (dst && dst_hold_safe(dst)) {
  96                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  97
  98                 rcu_assign_pointer(sk->sk_rx_dst, dst);
  99                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 100                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 101         }
 102 }
 103
 104 static u32 tcp_v6_init_seq(const struct sk_buff *skb)
 105 {
 106         return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
 107                                 ipv6_hdr(skb)->saddr.s6_addr32,
 108                                 tcp_hdr(skb)->dest,
 109                                 tcp_hdr(skb)->source);
 110 }
 111
 112 static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
 113 {
 114         return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
 115                                    ipv6_hdr(skb)->saddr.s6_addr32);
 116 }
 117
 118 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 119                           int addr_len)
 120 {
 121         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 122         struct inet_sock *inet = inet_sk(sk);
 123         struct inet_connection_sock *icsk = inet_csk(sk);
 124         struct ipv6_pinfo *np = inet6_sk(sk);
 125         struct tcp_sock *tp = tcp_sk(sk);
 126         struct in6_addr *saddr = NULL, *final_p, final;
 127         struct ipv6_txoptions *opt;
 128         struct flowi6 fl6;
 129         struct dst_entry *dst;
 130         int addr_type;
 131         int err;
 132         struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
 133
 134         if (addr_len < SIN6_LEN_RFC2133)
 135                 return -EINVAL;
 136
 137         if (usin->sin6_family != AF_INET6)
 138                 return -EAFNOSUPPORT;
 139
 140         memset(&fl6, 0, sizeof(fl6));
 141
 142         if (np->sndflow) {
 143                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 144                 IP6_ECN_flow_init(fl6.flowlabel);
 145                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 146                         struct ip6_flowlabel *flowlabel;
 147                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 148                         if (!flowlabel)
 149                                 return -EINVAL;
 150                         fl6_sock_release(flowlabel);
 151                 }
 152         }
 153
 154         /*
 155          *      connect() to INADDR_ANY means loopback (BSD'ism).
 156          */
 157
 158         if (ipv6_addr_any(&usin->sin6_addr)) {
 159                 if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
 160                         ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
 161                                                &usin->sin6_addr);
 162                 else
 163                         usin->sin6_addr = in6addr_loopback;
 164         }
 165
 166         addr_type = ipv6_addr_type(&usin->sin6_addr);
 167
 168         if (addr_type & IPV6_ADDR_MULTICAST)
 169                 return -ENETUNREACH;
 170
 171         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 172                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 173                     usin->sin6_scope_id) {
 174                         /* If interface is set while binding, indices
 175                          * must coincide.
 176                          */
 177                         if (sk->sk_bound_dev_if &&
 178                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 179                                 return -EINVAL;
 180
 181                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 182                 }
 183
 184                 /* Connect to link-local address requires an interface */
 185                 if (!sk->sk_bound_dev_if)
 186                         return -EINVAL;
 187         }
 188
 189         if (tp->rx_opt.ts_recent_stamp &&
 190             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 191                 tp->rx_opt.ts_recent = 0;
 192                 tp->rx_opt.ts_recent_stamp = 0;
 193                 tp->write_seq = 0;
 194         }
 195
 196         sk->sk_v6_daddr = usin->sin6_addr;
 197         np->flow_label = fl6.flowlabel;
 198
 199         /*
 200          *      TCP over IPv4
 201          */
 202
 203         if (addr_type & IPV6_ADDR_MAPPED) {
 204                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 205                 struct sockaddr_in sin;
 206
 207                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 208
 209                 if (__ipv6_only_sock(sk))
 210                         return -ENETUNREACH;
 211
 212                 sin.sin_family = AF_INET;
 213                 sin.sin_port = usin->sin6_port;
 214                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 215
 216                 icsk->icsk_af_ops = &ipv6_mapped;
 217                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 218 #ifdef CONFIG_TCP_MD5SIG
 219                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 220 #endif
 221
 222                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 223
 224                 if (err) {
 225                         icsk->icsk_ext_hdr_len = exthdrlen;
 226                         icsk->icsk_af_ops = &ipv6_specific;
 227                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 228 #ifdef CONFIG_TCP_MD5SIG
 229                         tp->af_specific = &tcp_sock_ipv6_specific;
 230 #endif
 231                         goto failure;
 232                 }
 233                 np->saddr = sk->sk_v6_rcv_saddr;
 234
 235                 return err;
 236         }
 237
 238         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 239                 saddr = &sk->sk_v6_rcv_saddr;
 240
 241         fl6.flowi6_proto = IPPROTO_TCP;
 242         fl6.daddr = sk->sk_v6_daddr;
 243         fl6.saddr = saddr ? *saddr : np->saddr;
 244         fl6.flowlabel = ip6_make_flowinfo(np->tclass, np->flow_label);
 245         fl6.flowi6_oif = sk->sk_bound_dev_if;
 246         fl6.flowi6_mark = sk->sk_mark;
 247         fl6.fl6_dport = usin->sin6_port;
 248         fl6.fl6_sport = inet->inet_sport;
 249         fl6.flowi6_uid = sk->sk_uid;
 250
 251         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 252         final_p = fl6_update_dst(&fl6, opt, &final);
 253
 254         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 255
 256         dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
 257         if (IS_ERR(dst)) {
 258                 err = PTR_ERR(dst);
 259                 goto failure;
 260         }
 261
 262         if (!saddr) {
 263                 saddr = &fl6.saddr;
 264                 sk->sk_v6_rcv_saddr = *saddr;
 265         }
 266
 267         /* set the source address */
 268         np->saddr = *saddr;
 269         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 270
 271         sk->sk_gso_type = SKB_GSO_TCPV6;
 272         ip6_dst_store(sk, dst, NULL, NULL);
 273
 274         icsk->icsk_ext_hdr_len = 0;
 275         if (opt)
 276                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 277                                          opt->opt_nflen;
 278
 279         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 280
 281         inet->inet_dport = usin->sin6_port;
 282
 283         tcp_set_state(sk, TCP_SYN_SENT);
 284         err = inet6_hash_connect(tcp_death_row, sk);
 285         if (err)
 286                 goto late_failure;
 287
 288         sk_set_txhash(sk);
 289
 290         if (likely(!tp->repair)) {
 291                 if (!tp->write_seq)
 292                         tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
 293                                                          sk->sk_v6_daddr.s6_addr32,
 294                                                          inet->inet_sport,
 295                                                          inet->inet_dport);
 296                 tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
 297                                                    np->saddr.s6_addr32,
 298                                                    sk->sk_v6_daddr.s6_addr32);
 299         }
 300
 301         if (tcp_fastopen_defer_connect(sk, &err))
 302                 return err;
 303         if (err)
 304                 goto late_failure;
 305
 306         err = tcp_connect(sk);
 307         if (err)
 308                 goto late_failure;
 309
 310         return 0;
 311
 312 late_failure:
 313         tcp_set_state(sk, TCP_CLOSE);
 314         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
 315                 inet_reset_saddr(sk);
 316 failure:
 317         inet->inet_dport = 0;
 318         sk->sk_route_caps = 0;
 319         return err;
 320 }
 321
 322 static void tcp_v6_mtu_reduced(struct sock *sk)
 323 {
 324         struct dst_entry *dst;
 325         u32 mtu;
 326
 327         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 328                 return;
 329
 330         mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
 331
 332         /* Drop requests trying to increase our current mss.
 333          * Check done in __ip6_rt_update_pmtu() is too late.
 334          */
 335         if (tcp_mtu_to_mss(sk, mtu) >= tcp_sk(sk)->mss_cache)
 336                 return;
 337
 338         dst = inet6_csk_update_pmtu(sk, mtu);
 339         if (!dst)
 340                 return;
 341
 342         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 343                 tcp_sync_mss(sk, dst_mtu(dst));
 344                 tcp_simple_retransmit(sk);
 345         }
 346 }
 347
 348 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 349                 u8 type, u8 code, int offset, __be32 info)
 350 {
 351         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 352         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 353         struct net *net = dev_net(skb->dev);
 354         struct request_sock *fastopen;
 355         struct ipv6_pinfo *np;
 356         struct tcp_sock *tp;
 357         __u32 seq, snd_una;
 358         struct sock *sk;
 359         bool fatal;
 360         int err;
 361
 362         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 363                                         &hdr->daddr, th->dest,
 364                                         &hdr->saddr, ntohs(th->source),
 365                                         skb->dev->ifindex, inet6_sdif(skb));
 366
 367         if (!sk) {
 368                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 369                                   ICMP6_MIB_INERRORS);
 370                 return;
 371         }
 372
 373         if (sk->sk_state == TCP_TIME_WAIT) {
 374                 inet_twsk_put(inet_twsk(sk));
 375                 return;
 376         }
 377         seq = ntohl(th->seq);
 378         fatal = icmpv6_err_convert(type, code, &err);
 379         if (sk->sk_state == TCP_NEW_SYN_RECV)
 380                 return tcp_req_err(sk, seq, fatal);
 381
 382         bh_lock_sock(sk);
 383         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 384                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 385
 386         if (sk->sk_state == TCP_CLOSE)
 387                 goto out;
 388
 389         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 390                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 391                 goto out;
 392         }
 393
 394         tp = tcp_sk(sk);
 395         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 396         fastopen = tp->fastopen_rsk;
 397         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 398         if (sk->sk_state != TCP_LISTEN &&
 399             !between(seq, snd_una, tp->snd_nxt)) {
 400                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 401                 goto out;
 402         }
 403
 404         np = inet6_sk(sk);
 405
 406         if (type == NDISC_REDIRECT) {
 407                 if (!sock_owned_by_user(sk)) {
 408                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 409
 410                         if (dst)
 411                                 dst->ops->redirect(dst, sk, skb);
 412                 }
 413                 goto out;
 414         }
 415
 416         if (type == ICMPV6_PKT_TOOBIG) {
 417                 u32 mtu = ntohl(info);
 418
 419                 /* We are not interested in TCP_LISTEN and open_requests
 420                  * (SYN-ACKs send out by Linux are always <576bytes so
 421                  * they should go through unfragmented).
 422                  */
 423                 if (sk->sk_state == TCP_LISTEN)
 424                         goto out;
 425
 426                 if (!ip6_sk_accept_pmtu(sk))
 427                         goto out;
 428
 429                 if (mtu < IPV6_MIN_MTU)
 430                         goto out;
 431
 432                 WRITE_ONCE(tp->mtu_info, mtu);
 433
 434                 if (!sock_owned_by_user(sk))
 435                         tcp_v6_mtu_reduced(sk);
 436                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 437                                            &sk->sk_tsq_flags))
 438                         sock_hold(sk);
 439                 goto out;
 440         }
 441
 442
 443         /* Might be for an request_sock */
 444         switch (sk->sk_state) {
 445         case TCP_SYN_SENT:
 446         case TCP_SYN_RECV:
 447                 /* Only in fast or simultaneous open. If a fast open socket is
 448                  * is already accepted it is treated as a connected one below.
 449                  */
 450                 if (fastopen && !fastopen->sk)
 451                         break;
 452
 453                 if (!sock_owned_by_user(sk)) {
 454                         sk->sk_err = err;
 455                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 456
 457                         tcp_done(sk);
 458                 } else
 459                         sk->sk_err_soft = err;
 460                 goto out;
 461         }
 462
 463         if (!sock_owned_by_user(sk) && np->recverr) {
 464                 sk->sk_err = err;
 465                 sk->sk_error_report(sk);
 466         } else
 467                 sk->sk_err_soft = err;
 468
 469 out:
 470         bh_unlock_sock(sk);
 471         sock_put(sk);
 472 }
 473
 474
 475 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 476                               struct flowi *fl,
 477                               struct request_sock *req,
 478                               struct tcp_fastopen_cookie *foc,
 479                               enum tcp_synack_type synack_type)
 480 {
 481         struct inet_request_sock *ireq = inet_rsk(req);
 482         struct ipv6_pinfo *np = inet6_sk(sk);
 483         struct ipv6_txoptions *opt;
 484         struct flowi6 *fl6 = &fl->u.ip6;
 485         struct sk_buff *skb;
 486         int err = -ENOMEM;
 487
 488         /* First, grab a route. */
 489         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 490                                                IPPROTO_TCP)) == NULL)
 491                 goto done;
 492
 493         skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 494
 495         if (skb) {
 496                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 497                                     &ireq->ir_v6_rmt_addr);
 498
 499                 fl6->daddr = ireq->ir_v6_rmt_addr;
 500                 if (np->repflow && ireq->pktopts)
 501                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 502
 503                 rcu_read_lock();
 504                 opt = ireq->ipv6_opt;
 505                 if (!opt)
 506                         opt = rcu_dereference(np->opt);
 507                 err = ip6_xmit(sk, skb, fl6, skb->mark ? : sk->sk_mark, opt,
 508                                np->tclass);
 509                 rcu_read_unlock();
 510                 err = net_xmit_eval(err);
 511         }
 512
 513 done:
 514         return err;
 515 }
 516
 517
 518 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 519 {
 520         kfree(inet_rsk(req)->ipv6_opt);
 521         kfree_skb(inet_rsk(req)->pktopts);
 522 }
 523
 524 #ifdef CONFIG_TCP_MD5SIG
 525 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 526                                                    const struct in6_addr *addr)
 527 {
 528         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 529 }
 530
 531 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 532                                                 const struct sock *addr_sk)
 533 {
 534         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 535 }
 536
 537 static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
 538                                  char __user *optval, int optlen)
 539 {
 540         struct tcp_md5sig cmd;
 541         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 542         u8 prefixlen;
 543
 544         if (optlen < sizeof(cmd))
 545                 return -EINVAL;
 546
 547         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 548                 return -EFAULT;
 549
 550         if (sin6->sin6_family != AF_INET6)
 551                 return -EINVAL;
 552
 553         if (optname == TCP_MD5SIG_EXT &&
 554             cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
 555                 prefixlen = cmd.tcpm_prefixlen;
 556                 if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
 557                                         prefixlen > 32))
 558                         return -EINVAL;
 559         } else {
 560                 prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
 561         }
 562
 563         if (!cmd.tcpm_keylen) {
 564                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 565                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 566                                               AF_INET, prefixlen);
 567                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 568                                       AF_INET6, prefixlen);
 569         }
 570
 571         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 572                 return -EINVAL;
 573
 574         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 575                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 576                                       AF_INET, prefixlen, cmd.tcpm_key,
 577                                       cmd.tcpm_keylen, GFP_KERNEL);
 578
 579         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 580                               AF_INET6, prefixlen, cmd.tcpm_key,
 581                               cmd.tcpm_keylen, GFP_KERNEL);
 582 }
 583
 584 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 585                                    const struct in6_addr *daddr,
 586                                    const struct in6_addr *saddr,
 587                                    const struct tcphdr *th, int nbytes)
 588 {
 589         struct tcp6_pseudohdr *bp;
 590         struct scatterlist sg;
 591         struct tcphdr *_th;
 592
 593         bp = hp->scratch;
 594         /* 1. TCP pseudo-header (RFC2460) */
 595         bp->saddr = *saddr;
 596         bp->daddr = *daddr;
 597         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 598         bp->len = cpu_to_be32(nbytes);
 599
 600         _th = (struct tcphdr *)(bp + 1);
 601         memcpy(_th, th, sizeof(*th));
 602         _th->check = 0;
 603
 604         sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 605         ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 606                                 sizeof(*bp) + sizeof(*th));
 607         return crypto_ahash_update(hp->md5_req);
 608 }
 609
 610 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 611                                const struct in6_addr *daddr, struct in6_addr *saddr,
 612                                const struct tcphdr *th)
 613 {
 614         struct tcp_md5sig_pool *hp;
 615         struct ahash_request *req;
 616
 617         hp = tcp_get_md5sig_pool();
 618         if (!hp)
 619                 goto clear_hash_noput;
 620         req = hp->md5_req;
 621
 622         if (crypto_ahash_init(req))
 623                 goto clear_hash;
 624         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 625                 goto clear_hash;
 626         if (tcp_md5_hash_key(hp, key))
 627                 goto clear_hash;
 628         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 629         if (crypto_ahash_final(req))
 630                 goto clear_hash;
 631
 632         tcp_put_md5sig_pool();
 633         return 0;
 634
 635 clear_hash:
 636         tcp_put_md5sig_pool();
 637 clear_hash_noput:
 638         memset(md5_hash, 0, 16);
 639         return 1;
 640 }
 641
 642 static int tcp_v6_md5_hash_skb(char *md5_hash,
 643                                const struct tcp_md5sig_key *key,
 644                                const struct sock *sk,
 645                                const struct sk_buff *skb)
 646 {
 647         const struct in6_addr *saddr, *daddr;
 648         struct tcp_md5sig_pool *hp;
 649         struct ahash_request *req;
 650         const struct tcphdr *th = tcp_hdr(skb);
 651
 652         if (sk) { /* valid for establish/request sockets */
 653                 saddr = &sk->sk_v6_rcv_saddr;
 654                 daddr = &sk->sk_v6_daddr;
 655         } else {
 656                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 657                 saddr = &ip6h->saddr;
 658                 daddr = &ip6h->daddr;
 659         }
 660
 661         hp = tcp_get_md5sig_pool();
 662         if (!hp)
 663                 goto clear_hash_noput;
 664         req = hp->md5_req;
 665
 666         if (crypto_ahash_init(req))
 667                 goto clear_hash;
 668
 669         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 670                 goto clear_hash;
 671         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 672                 goto clear_hash;
 673         if (tcp_md5_hash_key(hp, key))
 674                 goto clear_hash;
 675         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 676         if (crypto_ahash_final(req))
 677                 goto clear_hash;
 678
 679         tcp_put_md5sig_pool();
 680         return 0;
 681
 682 clear_hash:
 683         tcp_put_md5sig_pool();
 684 clear_hash_noput:
 685         memset(md5_hash, 0, 16);
 686         return 1;
 687 }
 688
 689 #endif
 690
 691 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 692                                     const struct sk_buff *skb)
 693 {
 694 #ifdef CONFIG_TCP_MD5SIG
 695         const __u8 *hash_location = NULL;
 696         struct tcp_md5sig_key *hash_expected;
 697         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 698         const struct tcphdr *th = tcp_hdr(skb);
 699         int genhash;
 700         u8 newhash[16];
 701
 702         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 703         hash_location = tcp_parse_md5sig_option(th);
 704
 705         /* We've parsed the options - do we have a hash? */
 706         if (!hash_expected && !hash_location)
 707                 return false;
 708
 709         if (hash_expected && !hash_location) {
 710                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 711                 return true;
 712         }
 713
 714         if (!hash_expected && hash_location) {
 715                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 716                 return true;
 717         }
 718
 719         /* check the signature */
 720         genhash = tcp_v6_md5_hash_skb(newhash,
 721                                       hash_expected,
 722                                       NULL, skb);
 723
 724         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 725                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 726                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 727                                      genhash ? "failed" : "mismatch",
 728                                      &ip6h->saddr, ntohs(th->source),
 729                                      &ip6h->daddr, ntohs(th->dest));
 730                 return true;
 731         }
 732 #endif
 733         return false;
 734 }
 735
 736 static void tcp_v6_init_req(struct request_sock *req,
 737                             const struct sock *sk_listener,
 738                             struct sk_buff *skb)
 739 {
 740         struct inet_request_sock *ireq = inet_rsk(req);
 741         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 742
 743         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 744         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 745
 746         /* So that link locals have meaning */
 747         if (!sk_listener->sk_bound_dev_if &&
 748             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 749                 ireq->ir_iif = tcp_v6_iif(skb);
 750
 751         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 752             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 753              np->rxopt.bits.rxinfo ||
 754              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 755              np->rxopt.bits.rxohlim || np->repflow)) {
 756                 refcount_inc(&skb->users);
 757                 ireq->pktopts = skb;
 758         }
 759 }
 760
 761 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 762                                           struct flowi *fl,
 763                                           const struct request_sock *req)
 764 {
 765         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 766 }
 767
 768 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 769         .family         =       AF_INET6,
 770         .obj_size       =       sizeof(struct tcp6_request_sock),
 771         .rtx_syn_ack    =       tcp_rtx_synack,
 772         .send_ack       =       tcp_v6_reqsk_send_ack,
 773         .destructor     =       tcp_v6_reqsk_destructor,
 774         .send_reset     =       tcp_v6_send_reset,
 775         .syn_ack_timeout =      tcp_syn_ack_timeout,
 776 };
 777
 778 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 779         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 780                                 sizeof(struct ipv6hdr),
 781 #ifdef CONFIG_TCP_MD5SIG
 782         .req_md5_lookup =       tcp_v6_md5_lookup,
 783         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 784 #endif
 785         .init_req       =       tcp_v6_init_req,
 786 #ifdef CONFIG_SYN_COOKIES
 787         .cookie_init_seq =      cookie_v6_init_sequence,
 788 #endif
 789         .route_req      =       tcp_v6_route_req,
 790         .init_seq       =       tcp_v6_init_seq,
 791         .init_ts_off    =       tcp_v6_init_ts_off,
 792         .send_synack    =       tcp_v6_send_synack,
 793 };
 794
 795 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 796                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 797                                  int oif, struct tcp_md5sig_key *key, int rst,
 798                                  u8 tclass, __be32 label)
 799 {
 800         const struct tcphdr *th = tcp_hdr(skb);
 801         struct tcphdr *t1;
 802         struct sk_buff *buff;
 803         struct flowi6 fl6;
 804         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 805         struct sock *ctl_sk = net->ipv6.tcp_sk;
 806         unsigned int tot_len = sizeof(struct tcphdr);
 807         struct dst_entry *dst;
 808         __be32 *topt;
 809
 810         if (tsecr)
 811                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 812 #ifdef CONFIG_TCP_MD5SIG
 813         if (key)
 814                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 815 #endif
 816
 817         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 818                          GFP_ATOMIC);
 819         if (!buff)
 820                 return;
 821
 822         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 823
 824         t1 = skb_push(buff, tot_len);
 825         skb_reset_transport_header(buff);
 826
 827         /* Swap the send and the receive. */
 828         memset(t1, 0, sizeof(*t1));
 829         t1->dest = th->source;
 830         t1->source = th->dest;
 831         t1->doff = tot_len / 4;
 832         t1->seq = htonl(seq);
 833         t1->ack_seq = htonl(ack);
 834         t1->ack = !rst || !th->ack;
 835         t1->rst = rst;
 836         t1->window = htons(win);
 837
 838         topt = (__be32 *)(t1 + 1);
 839
 840         if (tsecr) {
 841                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 842                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 843                 *topt++ = htonl(tsval);
 844                 *topt++ = htonl(tsecr);
 845         }
 846
 847 #ifdef CONFIG_TCP_MD5SIG
 848         if (key) {
 849                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 850                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 851                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 852                                     &ipv6_hdr(skb)->saddr,
 853                                     &ipv6_hdr(skb)->daddr, t1);
 854         }
 855 #endif
 856
 857         memset(&fl6, 0, sizeof(fl6));
 858         fl6.daddr = ipv6_hdr(skb)->saddr;
 859         fl6.saddr = ipv6_hdr(skb)->daddr;
 860         fl6.flowlabel = label;
 861
 862         buff->ip_summed = CHECKSUM_PARTIAL;
 863         buff->csum = 0;
 864
 865         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 866
 867         fl6.flowi6_proto = IPPROTO_TCP;
 868         if (rt6_need_strict(&fl6.daddr) && !oif)
 869                 fl6.flowi6_oif = tcp_v6_iif(skb);
 870         else {
 871                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 872                         oif = skb->skb_iif;
 873
 874                 fl6.flowi6_oif = oif;
 875         }
 876
 877         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 878         fl6.fl6_dport = t1->dest;
 879         fl6.fl6_sport = t1->source;
 880         fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 881         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 882
 883         /* Pass a socket to ip6_dst_lookup either it is for RST
 884          * Underlying function will use this to retrieve the network
 885          * namespace
 886          */
 887         dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
 888         if (!IS_ERR(dst)) {
 889                 skb_dst_set(buff, dst);
 890                 ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
 891                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 892                 if (rst)
 893                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 894                 return;
 895         }
 896
 897         kfree_skb(buff);
 898 }
 899
 900 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 901 {
 902         const struct tcphdr *th = tcp_hdr(skb);
 903         u32 seq = 0, ack_seq = 0;
 904         struct tcp_md5sig_key *key = NULL;
 905 #ifdef CONFIG_TCP_MD5SIG
 906         const __u8 *hash_location = NULL;
 907         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 908         unsigned char newhash[16];
 909         int genhash;
 910         struct sock *sk1 = NULL;
 911 #endif
 912         int oif;
 913
 914         if (th->rst)
 915                 return;
 916
 917         /* If sk not NULL, it means we did a successful lookup and incoming
 918          * route had to be correct. prequeue might have dropped our dst.
 919          */
 920         if (!sk && !ipv6_unicast_destination(skb))
 921                 return;
 922
 923 #ifdef CONFIG_TCP_MD5SIG
 924         rcu_read_lock();
 925         hash_location = tcp_parse_md5sig_option(th);
 926         if (sk && sk_fullsock(sk)) {
 927                 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 928         } else if (hash_location) {
 929                 /*
 930                  * active side is lost. Try to find listening socket through
 931                  * source port, and then find md5 key through listening socket.
 932                  * we are not loose security here:
 933                  * Incoming packet is checked with md5 hash with finding key,
 934                  * no RST generated if md5 hash doesn't match.
 935                  */
 936                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 937                                            &tcp_hashinfo, NULL, 0,
 938                                            &ipv6h->saddr,
 939                                            th->source, &ipv6h->daddr,
 940                                            ntohs(th->source),
 941                                            tcp_v6_iif_l3_slave(skb),
 942                                            tcp_v6_sdif(skb));
 943                 if (!sk1)
 944                         goto out;
 945
 946                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 947                 if (!key)
 948                         goto out;
 949
 950                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 951                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 952                         goto out;
 953         }
 954 #endif
 955
 956         if (th->ack)
 957                 seq = ntohl(th->ack_seq);
 958         else
 959                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 960                           (th->doff << 2);
 961
 962         oif = sk ? sk->sk_bound_dev_if : 0;
 963         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 964
 965 #ifdef CONFIG_TCP_MD5SIG
 966 out:
 967         rcu_read_unlock();
 968 #endif
 969 }
 970
 971 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 972                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 973                             struct tcp_md5sig_key *key, u8 tclass,
 974                             __be32 label)
 975 {
 976         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 977                              tclass, label);
 978 }
 979
 980 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 981 {
 982         struct inet_timewait_sock *tw = inet_twsk(sk);
 983         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 984
 985         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 986                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 987                         tcp_time_stamp_raw() + tcptw->tw_ts_offset,
 988                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 989                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 990
 991         inet_twsk_put(tw);
 992 }
 993
 994 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 995                                   struct request_sock *req)
 996 {
 997         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 998          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 999          */
1000         /* RFC 7323 2.3
1001          * The window field (SEG.WND) of every outgoing segment, with the
1002          * exception of <SYN> segments, MUST be right-shifted by
1003          * Rcv.Wind.Shift bits:
1004          */
1005         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
1006                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
1007                         tcp_rsk(req)->rcv_nxt,
1008                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1009                         tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1010                         req->ts_recent, sk->sk_bound_dev_if,
1011                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
1012                         0, 0);
1013 }
1014
1015
1016 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
1017 {
1018 #ifdef CONFIG_SYN_COOKIES
1019         const struct tcphdr *th = tcp_hdr(skb);
1020
1021         if (!th->syn)
1022                 sk = cookie_v6_check(sk, skb);
1023 #endif
1024         return sk;
1025 }
1026
1027 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1028 {
1029         if (skb->protocol == htons(ETH_P_IP))
1030                 return tcp_v4_conn_request(sk, skb);
1031
1032         if (!ipv6_unicast_destination(skb))
1033                 goto drop;
1034
1035         if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
1036                 __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
1037                 return 0;
1038         }
1039
1040         return tcp_conn_request(&tcp6_request_sock_ops,
1041                                 &tcp_request_sock_ipv6_ops, sk, skb);
1042
1043 drop:
1044         tcp_listendrop(sk);
1045         return 0; /* don't send reset */
1046 }
1047
1048 static void tcp_v6_restore_cb(struct sk_buff *skb)
1049 {
1050         /* We need to move header back to the beginning if xfrm6_policy_check()
1051          * and tcp_v6_fill_cb() are going to be called again.
1052          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1053          */
1054         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1055                 sizeof(struct inet6_skb_parm));
1056 }
1057
1058 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1059                                          struct request_sock *req,
1060                                          struct dst_entry *dst,
1061                                          struct request_sock *req_unhash,
1062                                          bool *own_req)
1063 {
1064         struct inet_request_sock *ireq;
1065         struct ipv6_pinfo *newnp;
1066         const struct ipv6_pinfo *np = inet6_sk(sk);
1067         struct ipv6_txoptions *opt;
1068         struct tcp6_sock *newtcp6sk;
1069         struct inet_sock *newinet;
1070         bool found_dup_sk = false;
1071         struct tcp_sock *newtp;
1072         struct sock *newsk;
1073 #ifdef CONFIG_TCP_MD5SIG
1074         struct tcp_md5sig_key *key;
1075 #endif
1076         struct flowi6 fl6;
1077
1078         if (skb->protocol == htons(ETH_P_IP)) {
1079                 /*
1080                  *      v6 mapped
1081                  */
1082
1083                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1084                                              req_unhash, own_req);
1085
1086                 if (!newsk)
1087                         return NULL;
1088
1089                 newtcp6sk = (struct tcp6_sock *)newsk;
1090                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1091
1092                 newinet = inet_sk(newsk);
1093                 newnp = inet6_sk(newsk);
1094                 newtp = tcp_sk(newsk);
1095
1096                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1097
1098                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1099
1100                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1101                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1102 #ifdef CONFIG_TCP_MD5SIG
1103                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1104 #endif
1105
1106                 newnp->ipv6_mc_list = NULL;
1107                 newnp->ipv6_ac_list = NULL;
1108                 newnp->ipv6_fl_list = NULL;
1109                 newnp->pktoptions  = NULL;
1110                 newnp->opt         = NULL;
1111                 newnp->mcast_oif   = inet_iif(skb);
1112                 newnp->mcast_hops  = ip_hdr(skb)->ttl;
1113                 newnp->rcv_flowinfo = 0;
1114                 if (np->repflow)
1115                         newnp->flow_label = 0;
1116
1117                 /*
1118                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1119                  * here, tcp_create_openreq_child now does this for us, see the comment in
1120                  * that function for the gory details. -acme
1121                  */
1122
1123                 /* It is tricky place. Until this moment IPv4 tcp
1124                    worked with IPv6 icsk.icsk_af_ops.
1125                    Sync it now.
1126                  */
1127                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1128
1129                 return newsk;
1130         }
1131
1132         ireq = inet_rsk(req);
1133
1134         if (sk_acceptq_is_full(sk))
1135                 goto out_overflow;
1136
1137         if (!dst) {
1138                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1139                 if (!dst)
1140                         goto out;
1141         }
1142
1143         newsk = tcp_create_openreq_child(sk, req, skb);
1144         if (!newsk)
1145                 goto out_nonewsk;
1146
1147         /*
1148          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1149          * count here, tcp_create_openreq_child now does this for us, see the
1150          * comment in that function for the gory details. -acme
1151          */
1152
1153         newsk->sk_gso_type = SKB_GSO_TCPV6;
1154         ip6_dst_store(newsk, dst, NULL, NULL);
1155         inet6_sk_rx_dst_set(newsk, skb);
1156
1157         newtcp6sk = (struct tcp6_sock *)newsk;
1158         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1159
1160         newtp = tcp_sk(newsk);
1161         newinet = inet_sk(newsk);
1162         newnp = inet6_sk(newsk);
1163
1164         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1165
1166         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1167         newnp->saddr = ireq->ir_v6_loc_addr;
1168         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1169         newsk->sk_bound_dev_if = ireq->ir_iif;
1170
1171         /* Now IPv6 options...
1172
1173            First: no IPv4 options.
1174          */
1175         newinet->inet_opt = NULL;
1176         newnp->ipv6_mc_list = NULL;
1177         newnp->ipv6_ac_list = NULL;
1178         newnp->ipv6_fl_list = NULL;
1179
1180         /* Clone RX bits */
1181         newnp->rxopt.all = np->rxopt.all;
1182
1183         newnp->pktoptions = NULL;
1184         newnp->opt        = NULL;
1185         newnp->mcast_oif  = tcp_v6_iif(skb);
1186         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1187         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1188         if (np->repflow)
1189                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1190
1191         /* Clone native IPv6 options from listening socket (if any)
1192
1193            Yes, keeping reference count would be much more clever,
1194            but we make one more one thing there: reattach optmem
1195            to newsk.
1196          */
1197         opt = ireq->ipv6_opt;
1198         if (!opt)
1199                 opt = rcu_dereference(np->opt);
1200         if (opt) {
1201                 opt = ipv6_dup_options(newsk, opt);
1202                 RCU_INIT_POINTER(newnp->opt, opt);
1203         }
1204         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1205         if (opt)
1206                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1207                                                     opt->opt_flen;
1208
1209         tcp_ca_openreq_child(newsk, dst);
1210
1211         tcp_sync_mss(newsk, dst_mtu(dst));
1212         newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
1213
1214         tcp_initialize_rcv_mss(newsk);
1215
1216         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1217         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1218
1219 #ifdef CONFIG_TCP_MD5SIG
1220         /* Copy over the MD5 key from the original socket */
1221         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1222         if (key) {
1223                 /* We're using one, so create a matching key
1224                  * on the newsk structure. If we fail to get
1225                  * memory, then we end up not copying the key
1226                  * across. Shucks.
1227                  */
1228                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1229                                AF_INET6, 128, key->key, key->keylen,
1230                                sk_gfp_mask(sk, GFP_ATOMIC));
1231         }
1232 #endif
1233
1234         if (__inet_inherit_port(sk, newsk) < 0) {
1235                 inet_csk_prepare_forced_close(newsk);
1236                 tcp_done(newsk);
1237                 goto out;
1238         }
1239         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash),
1240                                        &found_dup_sk);
1241         if (*own_req) {
1242                 tcp_move_syn(newtp, req);
1243
1244                 /* Clone pktoptions received with SYN, if we own the req */
1245                 if (ireq->pktopts) {
1246                         newnp->pktoptions = skb_clone_and_charge_r(ireq->pktopts, newsk);
1247                         consume_skb(ireq->pktopts);
1248                         ireq->pktopts = NULL;
1249                         if (newnp->pktoptions)
1250                                 tcp_v6_restore_cb(newnp->pktoptions);
1251                 }
1252         } else {
1253                 if (!req_unhash && found_dup_sk) {
1254                         /* This code path should only be executed in the
1255                          * syncookie case only
1256                          */
1257                         bh_unlock_sock(newsk);
1258                         sock_put(newsk);
1259                         newsk = NULL;
1260                 }
1261         }
1262
1263         return newsk;
1264
1265 out_overflow:
1266         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1267 out_nonewsk:
1268         dst_release(dst);
1269 out:
1270         tcp_listendrop(sk);
1271         return NULL;
1272 }
1273
1274 /* The socket must have it's spinlock held when we get
1275  * here, unless it is a TCP_LISTEN socket.
1276  *
1277  * We have a potential double-lock case here, so even when
1278  * doing backlog processing we use the BH locking scheme.
1279  * This is because we cannot sleep with the original spinlock
1280  * held.
1281  */
1282 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1283 {
1284         struct ipv6_pinfo *np = inet6_sk(sk);
1285         struct tcp_sock *tp;
1286         struct sk_buff *opt_skb = NULL;
1287
1288         /* Imagine: socket is IPv6. IPv4 packet arrives,
1289            goes to IPv4 receive handler and backlogged.
1290            From backlog it always goes here. Kerboom...
1291            Fortunately, tcp_rcv_established and rcv_established
1292            handle them correctly, but it is not case with
1293            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1294          */
1295
1296         if (skb->protocol == htons(ETH_P_IP))
1297                 return tcp_v4_do_rcv(sk, skb);
1298
1299         /*
1300          *      socket locking is here for SMP purposes as backlog rcv
1301          *      is currently called with bh processing disabled.
1302          */
1303
1304         /* Do Stevens' IPV6_PKTOPTIONS.
1305
1306            Yes, guys, it is the only place in our code, where we
1307            may make it not affecting IPv4.
1308            The rest of code is protocol independent,
1309            and I do not like idea to uglify IPv4.
1310
1311            Actually, all the idea behind IPV6_PKTOPTIONS
1312            looks not very well thought. For now we latch
1313            options, received in the last packet, enqueued
1314            by tcp. Feel free to propose better solution.
1315                                                --ANK (980728)
1316          */
1317         if (np->rxopt.all)
1318                 opt_skb = skb_clone_and_charge_r(skb, sk);
1319
1320         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1321                 struct dst_entry *dst;
1322
1323                 dst = rcu_dereference_protected(sk->sk_rx_dst,
1324                                                 lockdep_sock_is_held(sk));
1325
1326                 sock_rps_save_rxhash(sk, skb);
1327                 sk_mark_napi_id(sk, skb);
1328                 if (dst) {
1329                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1330                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1331                                 RCU_INIT_POINTER(sk->sk_rx_dst, NULL);
1332                                 dst_release(dst);
1333                         }
1334                 }
1335
1336                 tcp_rcv_established(sk, skb, tcp_hdr(skb));
1337                 if (opt_skb)
1338                         goto ipv6_pktoptions;
1339                 return 0;
1340         }
1341
1342         if (tcp_checksum_complete(skb))
1343                 goto csum_err;
1344
1345         if (sk->sk_state == TCP_LISTEN) {
1346                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1347
1348                 if (!nsk)
1349                         goto discard;
1350
1351                 if (nsk != sk) {
1352                         if (tcp_child_process(sk, nsk, skb))
1353                                 goto reset;
1354                         if (opt_skb)
1355                                 __kfree_skb(opt_skb);
1356                         return 0;
1357                 }
1358         } else
1359                 sock_rps_save_rxhash(sk, skb);
1360
1361         if (tcp_rcv_state_process(sk, skb))
1362                 goto reset;
1363         if (opt_skb)
1364                 goto ipv6_pktoptions;
1365         return 0;
1366
1367 reset:
1368         tcp_v6_send_reset(sk, skb);
1369 discard:
1370         if (opt_skb)
1371                 __kfree_skb(opt_skb);
1372         kfree_skb(skb);
1373         return 0;
1374 csum_err:
1375         TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1376         TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1377         goto discard;
1378
1379
1380 ipv6_pktoptions:
1381         /* Do you ask, what is it?
1382
1383            1. skb was enqueued by tcp.
1384            2. skb is added to tail of read queue, rather than out of order.
1385            3. socket is not in passive state.
1386            4. Finally, it really contains options, which user wants to receive.
1387          */
1388         tp = tcp_sk(sk);
1389         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1390             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1391                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1392                         np->mcast_oif = tcp_v6_iif(opt_skb);
1393                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1394                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1395                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1396                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1397                 if (np->repflow)
1398                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1399                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1400                         tcp_v6_restore_cb(opt_skb);
1401                         opt_skb = xchg(&np->pktoptions, opt_skb);
1402                 } else {
1403                         __kfree_skb(opt_skb);
1404                         opt_skb = xchg(&np->pktoptions, NULL);
1405                 }
1406         }
1407
1408         kfree_skb(opt_skb);
1409         return 0;
1410 }
1411
1412 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1413                            const struct tcphdr *th)
1414 {
1415         /* This is tricky: we move IP6CB at its correct location into
1416          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1417          * _decode_session6() uses IP6CB().
1418          * barrier() makes sure compiler won't play aliasing games.
1419          */
1420         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1421                 sizeof(struct inet6_skb_parm));
1422         barrier();
1423
1424         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1425         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1426                                     skb->len - th->doff*4);
1427         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1428         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1429         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1430         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1431         TCP_SKB_CB(skb)->sacked = 0;
1432         TCP_SKB_CB(skb)->has_rxtstamp =
1433                         skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
1434 }
1435
1436 static int tcp_v6_rcv(struct sk_buff *skb)
1437 {
1438         int sdif = inet6_sdif(skb);
1439         const struct tcphdr *th;
1440         const struct ipv6hdr *hdr;
1441         bool refcounted;
1442         struct sock *sk;
1443         int ret;
1444         struct net *net = dev_net(skb->dev);
1445
1446         if (skb->pkt_type != PACKET_HOST)
1447                 goto discard_it;
1448
1449         /*
1450          *      Count it even if it's bad.
1451          */
1452         __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1453
1454         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1455                 goto discard_it;
1456
1457         th = (const struct tcphdr *)skb->data;
1458
1459         if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1460                 goto bad_packet;
1461         if (!pskb_may_pull(skb, th->doff*4))
1462                 goto discard_it;
1463
1464         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1465                 goto csum_error;
1466
1467         th = (const struct tcphdr *)skb->data;
1468         hdr = ipv6_hdr(skb);
1469
1470 lookup:
1471         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1472                                 th->source, th->dest, inet6_iif(skb), sdif,
1473                                 &refcounted);
1474         if (!sk)
1475                 goto no_tcp_socket;
1476
1477 process:
1478         if (sk->sk_state == TCP_TIME_WAIT)
1479                 goto do_time_wait;
1480
1481         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1482                 struct request_sock *req = inet_reqsk(sk);
1483                 struct sock *nsk;
1484
1485                 sk = req->rsk_listener;
1486                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1487                         sk_drops_add(sk, skb);
1488                         reqsk_put(req);
1489                         goto discard_it;
1490                 }
1491                 if (tcp_checksum_complete(skb)) {
1492                         reqsk_put(req);
1493                         goto csum_error;
1494                 }
1495                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1496                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1497                         goto lookup;
1498                 }
1499                 sock_hold(sk);
1500                 refcounted = true;
1501                 nsk = NULL;
1502                 if (!tcp_filter(sk, skb)) {
1503                         th = (const struct tcphdr *)skb->data;
1504                         hdr = ipv6_hdr(skb);
1505                         tcp_v6_fill_cb(skb, hdr, th);
1506                         nsk = tcp_check_req(sk, skb, req, false);
1507                 }
1508                 if (!nsk) {
1509                         reqsk_put(req);
1510                         goto discard_and_relse;
1511                 }
1512                 if (nsk == sk) {
1513                         reqsk_put(req);
1514                         tcp_v6_restore_cb(skb);
1515                 } else if (tcp_child_process(sk, nsk, skb)) {
1516                         tcp_v6_send_reset(nsk, skb);
1517                         goto discard_and_relse;
1518                 } else {
1519                         sock_put(sk);
1520                         return 0;
1521                 }
1522         }
1523         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1524                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1525                 goto discard_and_relse;
1526         }
1527
1528         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1529                 goto discard_and_relse;
1530
1531         if (tcp_v6_inbound_md5_hash(sk, skb))
1532                 goto discard_and_relse;
1533
1534         if (tcp_filter(sk, skb))
1535                 goto discard_and_relse;
1536         th = (const struct tcphdr *)skb->data;
1537         hdr = ipv6_hdr(skb);
1538         tcp_v6_fill_cb(skb, hdr, th);
1539
1540         skb->dev = NULL;
1541
1542         if (sk->sk_state == TCP_LISTEN) {
1543                 ret = tcp_v6_do_rcv(sk, skb);
1544                 goto put_and_return;
1545         }
1546
1547         sk_incoming_cpu_update(sk);
1548
1549         bh_lock_sock_nested(sk);
1550         tcp_segs_in(tcp_sk(sk), skb);
1551         ret = 0;
1552         if (!sock_owned_by_user(sk)) {
1553                 ret = tcp_v6_do_rcv(sk, skb);
1554         } else if (tcp_add_backlog(sk, skb)) {
1555                 goto discard_and_relse;
1556         }
1557         bh_unlock_sock(sk);
1558
1559 put_and_return:
1560         if (refcounted)
1561                 sock_put(sk);
1562         return ret ? -1 : 0;
1563
1564 no_tcp_socket:
1565         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1566                 goto discard_it;
1567
1568         tcp_v6_fill_cb(skb, hdr, th);
1569
1570         if (tcp_checksum_complete(skb)) {
1571 csum_error:
1572                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1573 bad_packet:
1574                 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1575         } else {
1576                 tcp_v6_send_reset(NULL, skb);
1577         }
1578
1579 discard_it:
1580         kfree_skb(skb);
1581         return 0;
1582
1583 discard_and_relse:
1584         sk_drops_add(sk, skb);
1585         if (refcounted)
1586                 sock_put(sk);
1587         goto discard_it;
1588
1589 do_time_wait:
1590         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1591                 inet_twsk_put(inet_twsk(sk));
1592                 goto discard_it;
1593         }
1594
1595         tcp_v6_fill_cb(skb, hdr, th);
1596
1597         if (tcp_checksum_complete(skb)) {
1598                 inet_twsk_put(inet_twsk(sk));
1599                 goto csum_error;
1600         }
1601
1602         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1603         case TCP_TW_SYN:
1604         {
1605                 struct sock *sk2;
1606
1607                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1608                                             skb, __tcp_hdrlen(th),
1609                                             &ipv6_hdr(skb)->saddr, th->source,
1610                                             &ipv6_hdr(skb)->daddr,
1611                                             ntohs(th->dest),
1612                                             tcp_v6_iif_l3_slave(skb),
1613                                             sdif);
1614                 if (sk2) {
1615                         struct inet_timewait_sock *tw = inet_twsk(sk);
1616                         inet_twsk_deschedule_put(tw);
1617                         sk = sk2;
1618                         tcp_v6_restore_cb(skb);
1619                         refcounted = false;
1620                         goto process;
1621                 }
1622                 /* Fall through to ACK */
1623         }
1624         case TCP_TW_ACK:
1625                 tcp_v6_timewait_ack(sk, skb);
1626                 break;
1627         case TCP_TW_RST:
1628                 tcp_v6_send_reset(sk, skb);
1629                 inet_twsk_deschedule_put(inet_twsk(sk));
1630                 goto discard_it;
1631         case TCP_TW_SUCCESS:
1632                 ;
1633         }
1634         goto discard_it;
1635 }
1636
1637 void tcp_v6_early_demux(struct sk_buff *skb)
1638 {
1639         const struct ipv6hdr *hdr;
1640         const struct tcphdr *th;
1641         struct sock *sk;
1642
1643         if (skb->pkt_type != PACKET_HOST)
1644                 return;
1645
1646         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1647                 return;
1648
1649         hdr = ipv6_hdr(skb);
1650         th = tcp_hdr(skb);
1651
1652         if (th->doff < sizeof(struct tcphdr) / 4)
1653                 return;
1654
1655         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1656         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1657                                         &hdr->saddr, th->source,
1658                                         &hdr->daddr, ntohs(th->dest),
1659                                         inet6_iif(skb), inet6_sdif(skb));
1660         if (sk) {
1661                 skb->sk = sk;
1662                 skb->destructor = sock_edemux;
1663                 if (sk_fullsock(sk)) {
1664                         struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst);
1665
1666                         if (dst)
1667                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1668                         if (dst &&
1669                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1670                                 skb_dst_set_noref(skb, dst);
1671                 }
1672         }
1673 }
1674
1675 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1676         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1677         .twsk_unique    = tcp_twsk_unique,
1678         .twsk_destructor = tcp_twsk_destructor,
1679 };
1680
1681 static const struct inet_connection_sock_af_ops ipv6_specific = {
1682         .queue_xmit        = inet6_csk_xmit,
1683         .send_check        = tcp_v6_send_check,
1684         .rebuild_header    = inet6_sk_rebuild_header,
1685         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1686         .conn_request      = tcp_v6_conn_request,
1687         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1688         .net_header_len    = sizeof(struct ipv6hdr),
1689         .net_frag_header_len = sizeof(struct frag_hdr),
1690         .setsockopt        = ipv6_setsockopt,
1691         .getsockopt        = ipv6_getsockopt,
1692         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1693         .sockaddr_len      = sizeof(struct sockaddr_in6),
1694 #ifdef CONFIG_COMPAT
1695         .compat_setsockopt = compat_ipv6_setsockopt,
1696         .compat_getsockopt = compat_ipv6_getsockopt,
1697 #endif
1698         .mtu_reduced       = tcp_v6_mtu_reduced,
1699 };
1700
1701 #ifdef CONFIG_TCP_MD5SIG
1702 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1703         .md5_lookup     =       tcp_v6_md5_lookup,
1704         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1705         .md5_parse      =       tcp_v6_parse_md5_keys,
1706 };
1707 #endif
1708
1709 /*
1710  *      TCP over IPv4 via INET6 API
1711  */
1712 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1713         .queue_xmit        = ip_queue_xmit,
1714         .send_check        = tcp_v4_send_check,
1715         .rebuild_header    = inet_sk_rebuild_header,
1716         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1717         .conn_request      = tcp_v6_conn_request,
1718         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1719         .net_header_len    = sizeof(struct iphdr),
1720         .setsockopt        = ipv6_setsockopt,
1721         .getsockopt        = ipv6_getsockopt,
1722         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1723         .sockaddr_len      = sizeof(struct sockaddr_in6),
1724 #ifdef CONFIG_COMPAT
1725         .compat_setsockopt = compat_ipv6_setsockopt,
1726         .compat_getsockopt = compat_ipv6_getsockopt,
1727 #endif
1728         .mtu_reduced       = tcp_v4_mtu_reduced,
1729 };
1730
1731 #ifdef CONFIG_TCP_MD5SIG
1732 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1733         .md5_lookup     =       tcp_v4_md5_lookup,
1734         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1735         .md5_parse      =       tcp_v6_parse_md5_keys,
1736 };
1737 #endif
1738
1739 /* NOTE: A lot of things set to zero explicitly by call to
1740  *       sk_alloc() so need not be done here.
1741  */
1742 static int tcp_v6_init_sock(struct sock *sk)
1743 {
1744         struct inet_connection_sock *icsk = inet_csk(sk);
1745
1746         tcp_init_sock(sk);
1747
1748         icsk->icsk_af_ops = &ipv6_specific;
1749
1750 #ifdef CONFIG_TCP_MD5SIG
1751         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1752 #endif
1753
1754         return 0;
1755 }
1756
1757 #ifdef CONFIG_PROC_FS
1758 /* Proc filesystem TCPv6 sock list dumping. */
1759 static void get_openreq6(struct seq_file *seq,
1760                          const struct request_sock *req, int i)
1761 {
1762         long ttd = req->rsk_timer.expires - jiffies;
1763         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1764         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1765
1766         if (ttd < 0)
1767                 ttd = 0;
1768
1769         seq_printf(seq,
1770                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1771                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1772                    i,
1773                    src->s6_addr32[0], src->s6_addr32[1],
1774                    src->s6_addr32[2], src->s6_addr32[3],
1775                    inet_rsk(req)->ir_num,
1776                    dest->s6_addr32[0], dest->s6_addr32[1],
1777                    dest->s6_addr32[2], dest->s6_addr32[3],
1778                    ntohs(inet_rsk(req)->ir_rmt_port),
1779                    TCP_SYN_RECV,
1780                    0, 0, /* could print option size, but that is af dependent. */
1781                    1,   /* timers active (only the expire timer) */
1782                    jiffies_to_clock_t(ttd),
1783                    req->num_timeout,
1784                    from_kuid_munged(seq_user_ns(seq),
1785                                     sock_i_uid(req->rsk_listener)),
1786                    0,  /* non standard timer */
1787                    0, /* open_requests have no inode */
1788                    0, req);
1789 }
1790
1791 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1792 {
1793         const struct in6_addr *dest, *src;
1794         __u16 destp, srcp;
1795         int timer_active;
1796         unsigned long timer_expires;
1797         const struct inet_sock *inet = inet_sk(sp);
1798         const struct tcp_sock *tp = tcp_sk(sp);
1799         const struct inet_connection_sock *icsk = inet_csk(sp);
1800         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1801         int rx_queue;
1802         int state;
1803
1804         dest  = &sp->sk_v6_daddr;
1805         src   = &sp->sk_v6_rcv_saddr;
1806         destp = ntohs(inet->inet_dport);
1807         srcp  = ntohs(inet->inet_sport);
1808
1809         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1810             icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1811             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1812                 timer_active    = 1;
1813                 timer_expires   = icsk->icsk_timeout;
1814         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1815                 timer_active    = 4;
1816                 timer_expires   = icsk->icsk_timeout;
1817         } else if (timer_pending(&sp->sk_timer)) {
1818                 timer_active    = 2;
1819                 timer_expires   = sp->sk_timer.expires;
1820         } else {
1821                 timer_active    = 0;
1822                 timer_expires = jiffies;
1823         }
1824
1825         state = sk_state_load(sp);
1826         if (state == TCP_LISTEN)
1827                 rx_queue = sp->sk_ack_backlog;
1828         else
1829                 /* Because we don't lock the socket,
1830                  * we might find a transient negative value.
1831                  */
1832                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1833
1834         seq_printf(seq,
1835                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1836                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1837                    i,
1838                    src->s6_addr32[0], src->s6_addr32[1],
1839                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1840                    dest->s6_addr32[0], dest->s6_addr32[1],
1841                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1842                    state,
1843                    tp->write_seq - tp->snd_una,
1844                    rx_queue,
1845                    timer_active,
1846                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1847                    icsk->icsk_retransmits,
1848                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1849                    icsk->icsk_probes_out,
1850                    sock_i_ino(sp),
1851                    refcount_read(&sp->sk_refcnt), sp,
1852                    jiffies_to_clock_t(icsk->icsk_rto),
1853                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1854                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1855                    tp->snd_cwnd,
1856                    state == TCP_LISTEN ?
1857                         fastopenq->max_qlen :
1858                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1859                    );
1860 }
1861
1862 static void get_timewait6_sock(struct seq_file *seq,
1863                                struct inet_timewait_sock *tw, int i)
1864 {
1865         long delta = tw->tw_timer.expires - jiffies;
1866         const struct in6_addr *dest, *src;
1867         __u16 destp, srcp;
1868
1869         dest = &tw->tw_v6_daddr;
1870         src  = &tw->tw_v6_rcv_saddr;
1871         destp = ntohs(tw->tw_dport);
1872         srcp  = ntohs(tw->tw_sport);
1873
1874         seq_printf(seq,
1875                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1876                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1877                    i,
1878                    src->s6_addr32[0], src->s6_addr32[1],
1879                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1880                    dest->s6_addr32[0], dest->s6_addr32[1],
1881                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1882                    tw->tw_substate, 0, 0,
1883                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1884                    refcount_read(&tw->tw_refcnt), tw);
1885 }
1886
1887 static int tcp6_seq_show(struct seq_file *seq, void *v)
1888 {
1889         struct tcp_iter_state *st;
1890         struct sock *sk = v;
1891
1892         if (v == SEQ_START_TOKEN) {
1893                 seq_puts(seq,
1894                          "  sl  "
1895                          "local_address                         "
1896                          "remote_address                        "
1897                          "st tx_queue rx_queue tr tm->when retrnsmt"
1898                          "   uid  timeout inode\n");
1899                 goto out;
1900         }
1901         st = seq->private;
1902
1903         if (sk->sk_state == TCP_TIME_WAIT)
1904                 get_timewait6_sock(seq, v, st->num);
1905         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1906                 get_openreq6(seq, v, st->num);
1907         else
1908                 get_tcp6_sock(seq, v, st->num);
1909 out:
1910         return 0;
1911 }
1912
1913 static const struct file_operations tcp6_afinfo_seq_fops = {
1914         .owner   = THIS_MODULE,
1915         .open    = tcp_seq_open,
1916         .read    = seq_read,
1917         .llseek  = seq_lseek,
1918         .release = seq_release_net
1919 };
1920
1921 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1922         .name           = "tcp6",
1923         .family         = AF_INET6,
1924         .seq_fops       = &tcp6_afinfo_seq_fops,
1925         .seq_ops        = {
1926                 .show           = tcp6_seq_show,
1927         },
1928 };
1929
1930 int __net_init tcp6_proc_init(struct net *net)
1931 {
1932         return tcp_proc_register(net, &tcp6_seq_afinfo);
1933 }
1934
1935 void tcp6_proc_exit(struct net *net)
1936 {
1937         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1938 }
1939 #endif
1940
1941 struct proto tcpv6_prot = {
1942         .name                   = "TCPv6",
1943         .owner                  = THIS_MODULE,
1944         .close                  = tcp_close,
1945         .connect                = tcp_v6_connect,
1946         .disconnect             = tcp_disconnect,
1947         .accept                 = inet_csk_accept,
1948         .ioctl                  = tcp_ioctl,
1949         .init                   = tcp_v6_init_sock,
1950         .destroy                = tcp_v4_destroy_sock,
1951         .shutdown               = tcp_shutdown,
1952         .setsockopt             = tcp_setsockopt,
1953         .getsockopt             = tcp_getsockopt,
1954         .keepalive              = tcp_set_keepalive,
1955         .recvmsg                = tcp_recvmsg,
1956         .sendmsg                = tcp_sendmsg,
1957         .sendpage               = tcp_sendpage,
1958         .backlog_rcv            = tcp_v6_do_rcv,
1959         .release_cb             = tcp_release_cb,
1960         .hash                   = inet6_hash,
1961         .unhash                 = inet_unhash,
1962         .get_port               = inet_csk_get_port,
1963         .enter_memory_pressure  = tcp_enter_memory_pressure,
1964         .leave_memory_pressure  = tcp_leave_memory_pressure,
1965         .stream_memory_free     = tcp_stream_memory_free,
1966         .sockets_allocated      = &tcp_sockets_allocated,
1967         .memory_allocated       = &tcp_memory_allocated,
1968         .memory_pressure        = &tcp_memory_pressure,
1969         .orphan_count           = &tcp_orphan_count,
1970         .sysctl_mem             = sysctl_tcp_mem,
1971         .sysctl_wmem            = sysctl_tcp_wmem,
1972         .sysctl_rmem            = sysctl_tcp_rmem,
1973         .max_header             = MAX_TCP_HEADER,
1974         .obj_size               = sizeof(struct tcp6_sock),
1975         .slab_flags             = SLAB_TYPESAFE_BY_RCU,
1976         .twsk_prot              = &tcp6_timewait_sock_ops,
1977         .rsk_prot               = &tcp6_request_sock_ops,
1978         .h.hashinfo             = &tcp_hashinfo,
1979         .no_autobind            = true,
1980 #ifdef CONFIG_COMPAT
1981         .compat_setsockopt      = compat_tcp_setsockopt,
1982         .compat_getsockopt      = compat_tcp_getsockopt,
1983 #endif
1984         .diag_destroy           = tcp_abort,
1985 };
1986
1987 static const struct inet6_protocol tcpv6_protocol = {
1988         .handler        =       tcp_v6_rcv,
1989         .err_handler    =       tcp_v6_err,
1990         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1991 };
1992
1993 static struct inet_protosw tcpv6_protosw = {
1994         .type           =       SOCK_STREAM,
1995         .protocol       =       IPPROTO_TCP,
1996         .prot           =       &tcpv6_prot,
1997         .ops            =       &inet6_stream_ops,
1998         .flags          =       INET_PROTOSW_PERMANENT |
1999                                 INET_PROTOSW_ICSK,
2000 };
2001
2002 static int __net_init tcpv6_net_init(struct net *net)
2003 {
2004         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2005                                     SOCK_RAW, IPPROTO_TCP, net);
2006 }
2007
2008 static void __net_exit tcpv6_net_exit(struct net *net)
2009 {
2010         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2011 }
2012
2013 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2014 {
2015         inet_twsk_purge(&tcp_hashinfo, AF_INET6);
2016 }
2017
2018 static struct pernet_operations tcpv6_net_ops = {
2019         .init       = tcpv6_net_init,
2020         .exit       = tcpv6_net_exit,
2021         .exit_batch = tcpv6_net_exit_batch,
2022 };
2023
2024 int __init tcpv6_init(void)
2025 {
2026         int ret;
2027
2028         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2029         if (ret)
2030                 goto out;
2031
2032         /* register inet6 protocol */
2033         ret = inet6_register_protosw(&tcpv6_protosw);
2034         if (ret)
2035                 goto out_tcpv6_protocol;
2036
2037         ret = register_pernet_subsys(&tcpv6_net_ops);
2038         if (ret)
2039                 goto out_tcpv6_protosw;
2040 out:
2041         return ret;
2042
2043 out_tcpv6_protosw:
2044         inet6_unregister_protosw(&tcpv6_protosw);
2045 out_tcpv6_protocol:
2046         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2047         goto out;
2048 }
2049
2050 void tcpv6_exit(void)
2051 {
2052         unregister_pernet_subsys(&tcpv6_net_ops);
2053         inet6_unregister_protosw(&tcpv6_protosw);
2054         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2055 }