Pileus Git - ~andy/linux/blob - net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65 #include <net/tcp_memcontrol.h>
  66 #include <net/busy_poll.h>
  67
  68 #include <asm/uaccess.h>
  69
  70 #include <linux/proc_fs.h>
  71 #include <linux/seq_file.h>
  72
  73 #include <linux/crypto.h>
  74 #include <linux/scatterlist.h>
  75
  76 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  77 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  78                                       struct request_sock *req);
  79
  80 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  81
  82 static const struct inet_connection_sock_af_ops ipv6_mapped;
  83 static const struct inet_connection_sock_af_ops ipv6_specific;
  84 #ifdef CONFIG_TCP_MD5SIG
  85 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  86 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  87 #else
  88 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  89                                                    const struct in6_addr *addr)
  90 {
  91         return NULL;
  92 }
  93 #endif
  94
  95 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  96 {
  97         struct dst_entry *dst = skb_dst(skb);
  98         const struct rt6_info *rt = (const struct rt6_info *)dst;
  99
 100         dst_hold(dst);
 101         sk->sk_rx_dst = dst;
 102         inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 103         if (rt->rt6i_node)
 104                 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 105 }
 106
 107 static void tcp_v6_hash(struct sock *sk)
 108 {
 109         if (sk->sk_state != TCP_CLOSE) {
 110                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 111                         tcp_prot.hash(sk);
 112                         return;
 113                 }
 114                 local_bh_disable();
 115                 __inet6_hash(sk, NULL);
 116                 local_bh_enable();
 117         }
 118 }
 119
 120 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 121 {
 122         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 123                                             ipv6_hdr(skb)->saddr.s6_addr32,
 124                                             tcp_hdr(skb)->dest,
 125                                             tcp_hdr(skb)->source);
 126 }
 127
 128 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 129                           int addr_len)
 130 {
 131         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 132         struct inet_sock *inet = inet_sk(sk);
 133         struct inet_connection_sock *icsk = inet_csk(sk);
 134         struct ipv6_pinfo *np = inet6_sk(sk);
 135         struct tcp_sock *tp = tcp_sk(sk);
 136         struct in6_addr *saddr = NULL, *final_p, final;
 137         struct rt6_info *rt;
 138         struct flowi6 fl6;
 139         struct dst_entry *dst;
 140         int addr_type;
 141         int err;
 142
 143         if (addr_len < SIN6_LEN_RFC2133)
 144                 return -EINVAL;
 145
 146         if (usin->sin6_family != AF_INET6)
 147                 return -EAFNOSUPPORT;
 148
 149         memset(&fl6, 0, sizeof(fl6));
 150
 151         if (np->sndflow) {
 152                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 153                 IP6_ECN_flow_init(fl6.flowlabel);
 154                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 155                         struct ip6_flowlabel *flowlabel;
 156                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 157                         if (flowlabel == NULL)
 158                                 return -EINVAL;
 159                         usin->sin6_addr = flowlabel->dst;
 160                         fl6_sock_release(flowlabel);
 161                 }
 162         }
 163
 164         /*
 165          *      connect() to INADDR_ANY means loopback (BSD'ism).
 166          */
 167
 168         if(ipv6_addr_any(&usin->sin6_addr))
 169                 usin->sin6_addr.s6_addr[15] = 0x1;
 170
 171         addr_type = ipv6_addr_type(&usin->sin6_addr);
 172
 173         if(addr_type & IPV6_ADDR_MULTICAST)
 174                 return -ENETUNREACH;
 175
 176         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 177                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 178                     usin->sin6_scope_id) {
 179                         /* If interface is set while binding, indices
 180                          * must coincide.
 181                          */
 182                         if (sk->sk_bound_dev_if &&
 183                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 184                                 return -EINVAL;
 185
 186                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 187                 }
 188
 189                 /* Connect to link-local address requires an interface */
 190                 if (!sk->sk_bound_dev_if)
 191                         return -EINVAL;
 192         }
 193
 194         if (tp->rx_opt.ts_recent_stamp &&
 195             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 196                 tp->rx_opt.ts_recent = 0;
 197                 tp->rx_opt.ts_recent_stamp = 0;
 198                 tp->write_seq = 0;
 199         }
 200
 201         np->daddr = usin->sin6_addr;
 202         np->flow_label = fl6.flowlabel;
 203
 204         /*
 205          *      TCP over IPv4
 206          */
 207
 208         if (addr_type == IPV6_ADDR_MAPPED) {
 209                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 210                 struct sockaddr_in sin;
 211
 212                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 213
 214                 if (__ipv6_only_sock(sk))
 215                         return -ENETUNREACH;
 216
 217                 sin.sin_family = AF_INET;
 218                 sin.sin_port = usin->sin6_port;
 219                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 220
 221                 icsk->icsk_af_ops = &ipv6_mapped;
 222                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 223 #ifdef CONFIG_TCP_MD5SIG
 224                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 225 #endif
 226
 227                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 228
 229                 if (err) {
 230                         icsk->icsk_ext_hdr_len = exthdrlen;
 231                         icsk->icsk_af_ops = &ipv6_specific;
 232                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 233 #ifdef CONFIG_TCP_MD5SIG
 234                         tp->af_specific = &tcp_sock_ipv6_specific;
 235 #endif
 236                         goto failure;
 237                 } else {
 238                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 239                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 240                                                &np->rcv_saddr);
 241                 }
 242
 243                 return err;
 244         }
 245
 246         if (!ipv6_addr_any(&np->rcv_saddr))
 247                 saddr = &np->rcv_saddr;
 248
 249         fl6.flowi6_proto = IPPROTO_TCP;
 250         fl6.daddr = np->daddr;
 251         fl6.saddr = saddr ? *saddr : np->saddr;
 252         fl6.flowi6_oif = sk->sk_bound_dev_if;
 253         fl6.flowi6_mark = sk->sk_mark;
 254         fl6.fl6_dport = usin->sin6_port;
 255         fl6.fl6_sport = inet->inet_sport;
 256
 257         final_p = fl6_update_dst(&fl6, np->opt, &final);
 258
 259         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 260
 261         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 262         if (IS_ERR(dst)) {
 263                 err = PTR_ERR(dst);
 264                 goto failure;
 265         }
 266
 267         if (saddr == NULL) {
 268                 saddr = &fl6.saddr;
 269                 np->rcv_saddr = *saddr;
 270         }
 271
 272         /* set the source address */
 273         np->saddr = *saddr;
 274         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 275
 276         sk->sk_gso_type = SKB_GSO_TCPV6;
 277         __ip6_dst_store(sk, dst, NULL, NULL);
 278
 279         rt = (struct rt6_info *) dst;
 280         if (tcp_death_row.sysctl_tw_recycle &&
 281             !tp->rx_opt.ts_recent_stamp &&
 282             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr))
 283                 tcp_fetch_timewait_stamp(sk, dst);
 284
 285         icsk->icsk_ext_hdr_len = 0;
 286         if (np->opt)
 287                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 288                                           np->opt->opt_nflen);
 289
 290         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 291
 292         inet->inet_dport = usin->sin6_port;
 293
 294         tcp_set_state(sk, TCP_SYN_SENT);
 295         err = inet6_hash_connect(&tcp_death_row, sk);
 296         if (err)
 297                 goto late_failure;
 298
 299         if (!tp->write_seq && likely(!tp->repair))
 300                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 301                                                              np->daddr.s6_addr32,
 302                                                              inet->inet_sport,
 303                                                              inet->inet_dport);
 304
 305         err = tcp_connect(sk);
 306         if (err)
 307                 goto late_failure;
 308
 309         return 0;
 310
 311 late_failure:
 312         tcp_set_state(sk, TCP_CLOSE);
 313         __sk_dst_reset(sk);
 314 failure:
 315         inet->inet_dport = 0;
 316         sk->sk_route_caps = 0;
 317         return err;
 318 }
 319
 320 static void tcp_v6_mtu_reduced(struct sock *sk)
 321 {
 322         struct dst_entry *dst;
 323
 324         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 325                 return;
 326
 327         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 328         if (!dst)
 329                 return;
 330
 331         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 332                 tcp_sync_mss(sk, dst_mtu(dst));
 333                 tcp_simple_retransmit(sk);
 334         }
 335 }
 336
 337 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 338                 u8 type, u8 code, int offset, __be32 info)
 339 {
 340         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 341         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 342         struct ipv6_pinfo *np;
 343         struct sock *sk;
 344         int err;
 345         struct tcp_sock *tp;
 346         __u32 seq;
 347         struct net *net = dev_net(skb->dev);
 348
 349         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 350                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 351
 352         if (sk == NULL) {
 353                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 354                                    ICMP6_MIB_INERRORS);
 355                 return;
 356         }
 357
 358         if (sk->sk_state == TCP_TIME_WAIT) {
 359                 inet_twsk_put(inet_twsk(sk));
 360                 return;
 361         }
 362
 363         bh_lock_sock(sk);
 364         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 365                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 366
 367         if (sk->sk_state == TCP_CLOSE)
 368                 goto out;
 369
 370         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 371                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 372                 goto out;
 373         }
 374
 375         tp = tcp_sk(sk);
 376         seq = ntohl(th->seq);
 377         if (sk->sk_state != TCP_LISTEN &&
 378             !between(seq, tp->snd_una, tp->snd_nxt)) {
 379                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 380                 goto out;
 381         }
 382
 383         np = inet6_sk(sk);
 384
 385         if (type == NDISC_REDIRECT) {
 386                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 387
 388                 if (dst)
 389                         dst->ops->redirect(dst, sk, skb);
 390                 goto out;
 391         }
 392
 393         if (type == ICMPV6_PKT_TOOBIG) {
 394                 /* We are not interested in TCP_LISTEN and open_requests
 395                  * (SYN-ACKs send out by Linux are always <576bytes so
 396                  * they should go through unfragmented).
 397                  */
 398                 if (sk->sk_state == TCP_LISTEN)
 399                         goto out;
 400
 401                 tp->mtu_info = ntohl(info);
 402                 if (!sock_owned_by_user(sk))
 403                         tcp_v6_mtu_reduced(sk);
 404                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 405                                            &tp->tsq_flags))
 406                         sock_hold(sk);
 407                 goto out;
 408         }
 409
 410         icmpv6_err_convert(type, code, &err);
 411
 412         /* Might be for an request_sock */
 413         switch (sk->sk_state) {
 414                 struct request_sock *req, **prev;
 415         case TCP_LISTEN:
 416                 if (sock_owned_by_user(sk))
 417                         goto out;
 418
 419                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 420                                            &hdr->saddr, inet6_iif(skb));
 421                 if (!req)
 422                         goto out;
 423
 424                 /* ICMPs are not backlogged, hence we cannot get
 425                  * an established socket here.
 426                  */
 427                 WARN_ON(req->sk != NULL);
 428
 429                 if (seq != tcp_rsk(req)->snt_isn) {
 430                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 431                         goto out;
 432                 }
 433
 434                 inet_csk_reqsk_queue_drop(sk, req, prev);
 435                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 436                 goto out;
 437
 438         case TCP_SYN_SENT:
 439         case TCP_SYN_RECV:  /* Cannot happen.
 440                                It can, it SYNs are crossed. --ANK */
 441                 if (!sock_owned_by_user(sk)) {
 442                         sk->sk_err = err;
 443                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 444
 445                         tcp_done(sk);
 446                 } else
 447                         sk->sk_err_soft = err;
 448                 goto out;
 449         }
 450
 451         if (!sock_owned_by_user(sk) && np->recverr) {
 452                 sk->sk_err = err;
 453                 sk->sk_error_report(sk);
 454         } else
 455                 sk->sk_err_soft = err;
 456
 457 out:
 458         bh_unlock_sock(sk);
 459         sock_put(sk);
 460 }
 461
 462
 463 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 464                               struct flowi6 *fl6,
 465                               struct request_sock *req,
 466                               u16 queue_mapping)
 467 {
 468         struct inet6_request_sock *treq = inet6_rsk(req);
 469         struct ipv6_pinfo *np = inet6_sk(sk);
 470         struct sk_buff * skb;
 471         int err = -ENOMEM;
 472
 473         /* First, grab a route. */
 474         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 475                 goto done;
 476
 477         skb = tcp_make_synack(sk, dst, req, NULL);
 478
 479         if (skb) {
 480                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 481
 482                 fl6->daddr = treq->rmt_addr;
 483                 skb_set_queue_mapping(skb, queue_mapping);
 484                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 485                 err = net_xmit_eval(err);
 486         }
 487
 488 done:
 489         return err;
 490 }
 491
 492 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
 493 {
 494         struct flowi6 fl6;
 495         int res;
 496
 497         res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
 498         if (!res)
 499                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 500         return res;
 501 }
 502
 503 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 504 {
 505         kfree_skb(inet6_rsk(req)->pktopts);
 506 }
 507
 508 #ifdef CONFIG_TCP_MD5SIG
 509 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 510                                                    const struct in6_addr *addr)
 511 {
 512         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 513 }
 514
 515 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 516                                                 struct sock *addr_sk)
 517 {
 518         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 519 }
 520
 521 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 522                                                       struct request_sock *req)
 523 {
 524         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 525 }
 526
 527 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 528                                   int optlen)
 529 {
 530         struct tcp_md5sig cmd;
 531         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 532
 533         if (optlen < sizeof(cmd))
 534                 return -EINVAL;
 535
 536         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 537                 return -EFAULT;
 538
 539         if (sin6->sin6_family != AF_INET6)
 540                 return -EINVAL;
 541
 542         if (!cmd.tcpm_keylen) {
 543                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 544                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 545                                               AF_INET);
 546                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 547                                       AF_INET6);
 548         }
 549
 550         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 551                 return -EINVAL;
 552
 553         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 554                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 555                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 556
 557         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 558                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 559 }
 560
 561 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 562                                         const struct in6_addr *daddr,
 563                                         const struct in6_addr *saddr, int nbytes)
 564 {
 565         struct tcp6_pseudohdr *bp;
 566         struct scatterlist sg;
 567
 568         bp = &hp->md5_blk.ip6;
 569         /* 1. TCP pseudo-header (RFC2460) */
 570         bp->saddr = *saddr;
 571         bp->daddr = *daddr;
 572         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 573         bp->len = cpu_to_be32(nbytes);
 574
 575         sg_init_one(&sg, bp, sizeof(*bp));
 576         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 577 }
 578
 579 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 580                                const struct in6_addr *daddr, struct in6_addr *saddr,
 581                                const struct tcphdr *th)
 582 {
 583         struct tcp_md5sig_pool *hp;
 584         struct hash_desc *desc;
 585
 586         hp = tcp_get_md5sig_pool();
 587         if (!hp)
 588                 goto clear_hash_noput;
 589         desc = &hp->md5_desc;
 590
 591         if (crypto_hash_init(desc))
 592                 goto clear_hash;
 593         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 594                 goto clear_hash;
 595         if (tcp_md5_hash_header(hp, th))
 596                 goto clear_hash;
 597         if (tcp_md5_hash_key(hp, key))
 598                 goto clear_hash;
 599         if (crypto_hash_final(desc, md5_hash))
 600                 goto clear_hash;
 601
 602         tcp_put_md5sig_pool();
 603         return 0;
 604
 605 clear_hash:
 606         tcp_put_md5sig_pool();
 607 clear_hash_noput:
 608         memset(md5_hash, 0, 16);
 609         return 1;
 610 }
 611
 612 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 613                                const struct sock *sk,
 614                                const struct request_sock *req,
 615                                const struct sk_buff *skb)
 616 {
 617         const struct in6_addr *saddr, *daddr;
 618         struct tcp_md5sig_pool *hp;
 619         struct hash_desc *desc;
 620         const struct tcphdr *th = tcp_hdr(skb);
 621
 622         if (sk) {
 623                 saddr = &inet6_sk(sk)->saddr;
 624                 daddr = &inet6_sk(sk)->daddr;
 625         } else if (req) {
 626                 saddr = &inet6_rsk(req)->loc_addr;
 627                 daddr = &inet6_rsk(req)->rmt_addr;
 628         } else {
 629                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 630                 saddr = &ip6h->saddr;
 631                 daddr = &ip6h->daddr;
 632         }
 633
 634         hp = tcp_get_md5sig_pool();
 635         if (!hp)
 636                 goto clear_hash_noput;
 637         desc = &hp->md5_desc;
 638
 639         if (crypto_hash_init(desc))
 640                 goto clear_hash;
 641
 642         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 643                 goto clear_hash;
 644         if (tcp_md5_hash_header(hp, th))
 645                 goto clear_hash;
 646         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 647                 goto clear_hash;
 648         if (tcp_md5_hash_key(hp, key))
 649                 goto clear_hash;
 650         if (crypto_hash_final(desc, md5_hash))
 651                 goto clear_hash;
 652
 653         tcp_put_md5sig_pool();
 654         return 0;
 655
 656 clear_hash:
 657         tcp_put_md5sig_pool();
 658 clear_hash_noput:
 659         memset(md5_hash, 0, 16);
 660         return 1;
 661 }
 662
 663 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 664 {
 665         const __u8 *hash_location = NULL;
 666         struct tcp_md5sig_key *hash_expected;
 667         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 668         const struct tcphdr *th = tcp_hdr(skb);
 669         int genhash;
 670         u8 newhash[16];
 671
 672         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 673         hash_location = tcp_parse_md5sig_option(th);
 674
 675         /* We've parsed the options - do we have a hash? */
 676         if (!hash_expected && !hash_location)
 677                 return 0;
 678
 679         if (hash_expected && !hash_location) {
 680                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 681                 return 1;
 682         }
 683
 684         if (!hash_expected && hash_location) {
 685                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 686                 return 1;
 687         }
 688
 689         /* check the signature */
 690         genhash = tcp_v6_md5_hash_skb(newhash,
 691                                       hash_expected,
 692                                       NULL, NULL, skb);
 693
 694         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 695                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 696                                      genhash ? "failed" : "mismatch",
 697                                      &ip6h->saddr, ntohs(th->source),
 698                                      &ip6h->daddr, ntohs(th->dest));
 699                 return 1;
 700         }
 701         return 0;
 702 }
 703 #endif
 704
 705 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 706         .family         =       AF_INET6,
 707         .obj_size       =       sizeof(struct tcp6_request_sock),
 708         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 709         .send_ack       =       tcp_v6_reqsk_send_ack,
 710         .destructor     =       tcp_v6_reqsk_destructor,
 711         .send_reset     =       tcp_v6_send_reset,
 712         .syn_ack_timeout =      tcp_syn_ack_timeout,
 713 };
 714
 715 #ifdef CONFIG_TCP_MD5SIG
 716 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 717         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 718         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 719 };
 720 #endif
 721
 722 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 723                                  u32 tsval, u32 tsecr,
 724                                  struct tcp_md5sig_key *key, int rst, u8 tclass)
 725 {
 726         const struct tcphdr *th = tcp_hdr(skb);
 727         struct tcphdr *t1;
 728         struct sk_buff *buff;
 729         struct flowi6 fl6;
 730         struct net *net = dev_net(skb_dst(skb)->dev);
 731         struct sock *ctl_sk = net->ipv6.tcp_sk;
 732         unsigned int tot_len = sizeof(struct tcphdr);
 733         struct dst_entry *dst;
 734         __be32 *topt;
 735
 736         if (tsecr)
 737                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 738 #ifdef CONFIG_TCP_MD5SIG
 739         if (key)
 740                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 741 #endif
 742
 743         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 744                          GFP_ATOMIC);
 745         if (buff == NULL)
 746                 return;
 747
 748         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 749
 750         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 751         skb_reset_transport_header(buff);
 752
 753         /* Swap the send and the receive. */
 754         memset(t1, 0, sizeof(*t1));
 755         t1->dest = th->source;
 756         t1->source = th->dest;
 757         t1->doff = tot_len / 4;
 758         t1->seq = htonl(seq);
 759         t1->ack_seq = htonl(ack);
 760         t1->ack = !rst || !th->ack;
 761         t1->rst = rst;
 762         t1->window = htons(win);
 763
 764         topt = (__be32 *)(t1 + 1);
 765
 766         if (tsecr) {
 767                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 768                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 769                 *topt++ = htonl(tsval);
 770                 *topt++ = htonl(tsecr);
 771         }
 772
 773 #ifdef CONFIG_TCP_MD5SIG
 774         if (key) {
 775                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 776                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 777                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 778                                     &ipv6_hdr(skb)->saddr,
 779                                     &ipv6_hdr(skb)->daddr, t1);
 780         }
 781 #endif
 782
 783         memset(&fl6, 0, sizeof(fl6));
 784         fl6.daddr = ipv6_hdr(skb)->saddr;
 785         fl6.saddr = ipv6_hdr(skb)->daddr;
 786
 787         buff->ip_summed = CHECKSUM_PARTIAL;
 788         buff->csum = 0;
 789
 790         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 791
 792         fl6.flowi6_proto = IPPROTO_TCP;
 793         if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
 794                 fl6.flowi6_oif = inet6_iif(skb);
 795         fl6.fl6_dport = t1->dest;
 796         fl6.fl6_sport = t1->source;
 797         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 798
 799         /* Pass a socket to ip6_dst_lookup either it is for RST
 800          * Underlying function will use this to retrieve the network
 801          * namespace
 802          */
 803         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
 804         if (!IS_ERR(dst)) {
 805                 skb_dst_set(buff, dst);
 806                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 807                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 808                 if (rst)
 809                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 810                 return;
 811         }
 812
 813         kfree_skb(buff);
 814 }
 815
 816 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 817 {
 818         const struct tcphdr *th = tcp_hdr(skb);
 819         u32 seq = 0, ack_seq = 0;
 820         struct tcp_md5sig_key *key = NULL;
 821 #ifdef CONFIG_TCP_MD5SIG
 822         const __u8 *hash_location = NULL;
 823         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 824         unsigned char newhash[16];
 825         int genhash;
 826         struct sock *sk1 = NULL;
 827 #endif
 828
 829         if (th->rst)
 830                 return;
 831
 832         if (!ipv6_unicast_destination(skb))
 833                 return;
 834
 835 #ifdef CONFIG_TCP_MD5SIG
 836         hash_location = tcp_parse_md5sig_option(th);
 837         if (!sk && hash_location) {
 838                 /*
 839                  * active side is lost. Try to find listening socket through
 840                  * source port, and then find md5 key through listening socket.
 841                  * we are not loose security here:
 842                  * Incoming packet is checked with md5 hash with finding key,
 843                  * no RST generated if md5 hash doesn't match.
 844                  */
 845                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 846                                            &tcp_hashinfo, &ipv6h->saddr,
 847                                            th->source, &ipv6h->daddr,
 848                                            ntohs(th->source), inet6_iif(skb));
 849                 if (!sk1)
 850                         return;
 851
 852                 rcu_read_lock();
 853                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 854                 if (!key)
 855                         goto release_sk1;
 856
 857                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 858                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 859                         goto release_sk1;
 860         } else {
 861                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 862         }
 863 #endif
 864
 865         if (th->ack)
 866                 seq = ntohl(th->ack_seq);
 867         else
 868                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 869                           (th->doff << 2);
 870
 871         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0);
 872
 873 #ifdef CONFIG_TCP_MD5SIG
 874 release_sk1:
 875         if (sk1) {
 876                 rcu_read_unlock();
 877                 sock_put(sk1);
 878         }
 879 #endif
 880 }
 881
 882 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 883                             u32 win, u32 tsval, u32 tsecr,
 884                             struct tcp_md5sig_key *key, u8 tclass)
 885 {
 886         tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass);
 887 }
 888
 889 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 890 {
 891         struct inet_timewait_sock *tw = inet_twsk(sk);
 892         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 893
 894         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 895                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 896                         tcp_time_stamp + tcptw->tw_ts_offset,
 897                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
 898                         tw->tw_tclass);
 899
 900         inet_twsk_put(tw);
 901 }
 902
 903 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 904                                   struct request_sock *req)
 905 {
 906         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
 907                         req->rcv_wnd, tcp_time_stamp, req->ts_recent,
 908                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 909 }
 910
 911
 912 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 913 {
 914         struct request_sock *req, **prev;
 915         const struct tcphdr *th = tcp_hdr(skb);
 916         struct sock *nsk;
 917
 918         /* Find possible connection requests. */
 919         req = inet6_csk_search_req(sk, &prev, th->source,
 920                                    &ipv6_hdr(skb)->saddr,
 921                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 922         if (req)
 923                 return tcp_check_req(sk, skb, req, prev, false);
 924
 925         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 926                         &ipv6_hdr(skb)->saddr, th->source,
 927                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 928
 929         if (nsk) {
 930                 if (nsk->sk_state != TCP_TIME_WAIT) {
 931                         bh_lock_sock(nsk);
 932                         return nsk;
 933                 }
 934                 inet_twsk_put(inet_twsk(nsk));
 935                 return NULL;
 936         }
 937
 938 #ifdef CONFIG_SYN_COOKIES
 939         if (!th->syn)
 940                 sk = cookie_v6_check(sk, skb);
 941 #endif
 942         return sk;
 943 }
 944
 945 /* FIXME: this is substantially similar to the ipv4 code.
 946  * Can some kind of merge be done? -- erics
 947  */
 948 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 949 {
 950         struct tcp_options_received tmp_opt;
 951         struct request_sock *req;
 952         struct inet6_request_sock *treq;
 953         struct ipv6_pinfo *np = inet6_sk(sk);
 954         struct tcp_sock *tp = tcp_sk(sk);
 955         __u32 isn = TCP_SKB_CB(skb)->when;
 956         struct dst_entry *dst = NULL;
 957         struct flowi6 fl6;
 958         bool want_cookie = false;
 959
 960         if (skb->protocol == htons(ETH_P_IP))
 961                 return tcp_v4_conn_request(sk, skb);
 962
 963         if (!ipv6_unicast_destination(skb))
 964                 goto drop;
 965
 966         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
 967                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
 968                 if (!want_cookie)
 969                         goto drop;
 970         }
 971
 972         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
 973                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 974                 goto drop;
 975         }
 976
 977         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 978         if (req == NULL)
 979                 goto drop;
 980
 981 #ifdef CONFIG_TCP_MD5SIG
 982         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
 983 #endif
 984
 985         tcp_clear_options(&tmp_opt);
 986         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 987         tmp_opt.user_mss = tp->rx_opt.user_mss;
 988         tcp_parse_options(skb, &tmp_opt, 0, NULL);
 989
 990         if (want_cookie && !tmp_opt.saw_tstamp)
 991                 tcp_clear_options(&tmp_opt);
 992
 993         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
 994         tcp_openreq_init(req, &tmp_opt, skb);
 995
 996         treq = inet6_rsk(req);
 997         treq->rmt_addr = ipv6_hdr(skb)->saddr;
 998         treq->loc_addr = ipv6_hdr(skb)->daddr;
 999         if (!want_cookie || tmp_opt.tstamp_ok)
1000                 TCP_ECN_create_request(req, skb, sock_net(sk));
1001
1002         treq->iif = sk->sk_bound_dev_if;
1003
1004         /* So that link locals have meaning */
1005         if (!sk->sk_bound_dev_if &&
1006             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1007                 treq->iif = inet6_iif(skb);
1008
1009         if (!isn) {
1010                 if (ipv6_opt_accepted(sk, skb) ||
1011                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1012                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1013                         atomic_inc(&skb->users);
1014                         treq->pktopts = skb;
1015                 }
1016
1017                 if (want_cookie) {
1018                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1019                         req->cookie_ts = tmp_opt.tstamp_ok;
1020                         goto have_isn;
1021                 }
1022
1023                 /* VJ's idea. We save last timestamp seen
1024                  * from the destination in peer table, when entering
1025                  * state TIME-WAIT, and check against it before
1026                  * accepting new connection request.
1027                  *
1028                  * If "isn" is not zero, this request hit alive
1029                  * timewait bucket, so that all the necessary checks
1030                  * are made in the function processing timewait state.
1031                  */
1032                 if (tmp_opt.saw_tstamp &&
1033                     tcp_death_row.sysctl_tw_recycle &&
1034                     (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1035                         if (!tcp_peer_is_proven(req, dst, true)) {
1036                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1037                                 goto drop_and_release;
1038                         }
1039                 }
1040                 /* Kill the following clause, if you dislike this way. */
1041                 else if (!sysctl_tcp_syncookies &&
1042                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1043                           (sysctl_max_syn_backlog >> 2)) &&
1044                          !tcp_peer_is_proven(req, dst, false)) {
1045                         /* Without syncookies last quarter of
1046                          * backlog is filled with destinations,
1047                          * proven to be alive.
1048                          * It means that we continue to communicate
1049                          * to destinations, already remembered
1050                          * to the moment of synflood.
1051                          */
1052                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1053                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1054                         goto drop_and_release;
1055                 }
1056
1057                 isn = tcp_v6_init_sequence(skb);
1058         }
1059 have_isn:
1060         tcp_rsk(req)->snt_isn = isn;
1061
1062         if (security_inet_conn_request(sk, skb, req))
1063                 goto drop_and_release;
1064
1065         if (tcp_v6_send_synack(sk, dst, &fl6, req,
1066                                skb_get_queue_mapping(skb)) ||
1067             want_cookie)
1068                 goto drop_and_free;
1069
1070         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1071         tcp_rsk(req)->listener = NULL;
1072         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1073         return 0;
1074
1075 drop_and_release:
1076         dst_release(dst);
1077 drop_and_free:
1078         reqsk_free(req);
1079 drop:
1080         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1081         return 0; /* don't send reset */
1082 }
1083
1084 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1085                                           struct request_sock *req,
1086                                           struct dst_entry *dst)
1087 {
1088         struct inet6_request_sock *treq;
1089         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1090         struct tcp6_sock *newtcp6sk;
1091         struct inet_sock *newinet;
1092         struct tcp_sock *newtp;
1093         struct sock *newsk;
1094 #ifdef CONFIG_TCP_MD5SIG
1095         struct tcp_md5sig_key *key;
1096 #endif
1097         struct flowi6 fl6;
1098
1099         if (skb->protocol == htons(ETH_P_IP)) {
1100                 /*
1101                  *      v6 mapped
1102                  */
1103
1104                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1105
1106                 if (newsk == NULL)
1107                         return NULL;
1108
1109                 newtcp6sk = (struct tcp6_sock *)newsk;
1110                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1111
1112                 newinet = inet_sk(newsk);
1113                 newnp = inet6_sk(newsk);
1114                 newtp = tcp_sk(newsk);
1115
1116                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1117
1118                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1119
1120                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1121
1122                 newnp->rcv_saddr = newnp->saddr;
1123
1124                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1125                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1126 #ifdef CONFIG_TCP_MD5SIG
1127                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1128 #endif
1129
1130                 newnp->ipv6_ac_list = NULL;
1131                 newnp->ipv6_fl_list = NULL;
1132                 newnp->pktoptions  = NULL;
1133                 newnp->opt         = NULL;
1134                 newnp->mcast_oif   = inet6_iif(skb);
1135                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1136                 newnp->rcv_tclass  = ipv6_get_dsfield(ipv6_hdr(skb));
1137
1138                 /*
1139                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1140                  * here, tcp_create_openreq_child now does this for us, see the comment in
1141                  * that function for the gory details. -acme
1142                  */
1143
1144                 /* It is tricky place. Until this moment IPv4 tcp
1145                    worked with IPv6 icsk.icsk_af_ops.
1146                    Sync it now.
1147                  */
1148                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1149
1150                 return newsk;
1151         }
1152
1153         treq = inet6_rsk(req);
1154
1155         if (sk_acceptq_is_full(sk))
1156                 goto out_overflow;
1157
1158         if (!dst) {
1159                 dst = inet6_csk_route_req(sk, &fl6, req);
1160                 if (!dst)
1161                         goto out;
1162         }
1163
1164         newsk = tcp_create_openreq_child(sk, req, skb);
1165         if (newsk == NULL)
1166                 goto out_nonewsk;
1167
1168         /*
1169          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1170          * count here, tcp_create_openreq_child now does this for us, see the
1171          * comment in that function for the gory details. -acme
1172          */
1173
1174         newsk->sk_gso_type = SKB_GSO_TCPV6;
1175         __ip6_dst_store(newsk, dst, NULL, NULL);
1176         inet6_sk_rx_dst_set(newsk, skb);
1177
1178         newtcp6sk = (struct tcp6_sock *)newsk;
1179         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1180
1181         newtp = tcp_sk(newsk);
1182         newinet = inet_sk(newsk);
1183         newnp = inet6_sk(newsk);
1184
1185         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1186
1187         newnp->daddr = treq->rmt_addr;
1188         newnp->saddr = treq->loc_addr;
1189         newnp->rcv_saddr = treq->loc_addr;
1190         newsk->sk_bound_dev_if = treq->iif;
1191
1192         /* Now IPv6 options...
1193
1194            First: no IPv4 options.
1195          */
1196         newinet->inet_opt = NULL;
1197         newnp->ipv6_ac_list = NULL;
1198         newnp->ipv6_fl_list = NULL;
1199
1200         /* Clone RX bits */
1201         newnp->rxopt.all = np->rxopt.all;
1202
1203         /* Clone pktoptions received with SYN */
1204         newnp->pktoptions = NULL;
1205         if (treq->pktopts != NULL) {
1206                 newnp->pktoptions = skb_clone(treq->pktopts,
1207                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1208                 consume_skb(treq->pktopts);
1209                 treq->pktopts = NULL;
1210                 if (newnp->pktoptions)
1211                         skb_set_owner_r(newnp->pktoptions, newsk);
1212         }
1213         newnp->opt        = NULL;
1214         newnp->mcast_oif  = inet6_iif(skb);
1215         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1216         newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1217
1218         /* Clone native IPv6 options from listening socket (if any)
1219
1220            Yes, keeping reference count would be much more clever,
1221            but we make one more one thing there: reattach optmem
1222            to newsk.
1223          */
1224         if (np->opt)
1225                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1226
1227         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1228         if (newnp->opt)
1229                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1230                                                      newnp->opt->opt_flen);
1231
1232         tcp_mtup_init(newsk);
1233         tcp_sync_mss(newsk, dst_mtu(dst));
1234         newtp->advmss = dst_metric_advmss(dst);
1235         if (tcp_sk(sk)->rx_opt.user_mss &&
1236             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1237                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1238
1239         tcp_initialize_rcv_mss(newsk);
1240         tcp_synack_rtt_meas(newsk, req);
1241         newtp->total_retrans = req->num_retrans;
1242
1243         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1244         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1245
1246 #ifdef CONFIG_TCP_MD5SIG
1247         /* Copy over the MD5 key from the original socket */
1248         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1249                 /* We're using one, so create a matching key
1250                  * on the newsk structure. If we fail to get
1251                  * memory, then we end up not copying the key
1252                  * across. Shucks.
1253                  */
1254                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1255                                AF_INET6, key->key, key->keylen,
1256                                sk_gfp_atomic(sk, GFP_ATOMIC));
1257         }
1258 #endif
1259
1260         if (__inet_inherit_port(sk, newsk) < 0) {
1261                 inet_csk_prepare_forced_close(newsk);
1262                 tcp_done(newsk);
1263                 goto out;
1264         }
1265         __inet6_hash(newsk, NULL);
1266
1267         return newsk;
1268
1269 out_overflow:
1270         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1271 out_nonewsk:
1272         dst_release(dst);
1273 out:
1274         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1275         return NULL;
1276 }
1277
1278 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1279 {
1280         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1281                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1282                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1283                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1284                         return 0;
1285                 }
1286         }
1287
1288         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1289                                               &ipv6_hdr(skb)->saddr,
1290                                               &ipv6_hdr(skb)->daddr, 0));
1291
1292         if (skb->len <= 76) {
1293                 return __skb_checksum_complete(skb);
1294         }
1295         return 0;
1296 }
1297
1298 /* The socket must have it's spinlock held when we get
1299  * here.
1300  *
1301  * We have a potential double-lock case here, so even when
1302  * doing backlog processing we use the BH locking scheme.
1303  * This is because we cannot sleep with the original spinlock
1304  * held.
1305  */
1306 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1307 {
1308         struct ipv6_pinfo *np = inet6_sk(sk);
1309         struct tcp_sock *tp;
1310         struct sk_buff *opt_skb = NULL;
1311
1312         /* Imagine: socket is IPv6. IPv4 packet arrives,
1313            goes to IPv4 receive handler and backlogged.
1314            From backlog it always goes here. Kerboom...
1315            Fortunately, tcp_rcv_established and rcv_established
1316            handle them correctly, but it is not case with
1317            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1318          */
1319
1320         if (skb->protocol == htons(ETH_P_IP))
1321                 return tcp_v4_do_rcv(sk, skb);
1322
1323 #ifdef CONFIG_TCP_MD5SIG
1324         if (tcp_v6_inbound_md5_hash (sk, skb))
1325                 goto discard;
1326 #endif
1327
1328         if (sk_filter(sk, skb))
1329                 goto discard;
1330
1331         /*
1332          *      socket locking is here for SMP purposes as backlog rcv
1333          *      is currently called with bh processing disabled.
1334          */
1335
1336         /* Do Stevens' IPV6_PKTOPTIONS.
1337
1338            Yes, guys, it is the only place in our code, where we
1339            may make it not affecting IPv4.
1340            The rest of code is protocol independent,
1341            and I do not like idea to uglify IPv4.
1342
1343            Actually, all the idea behind IPV6_PKTOPTIONS
1344            looks not very well thought. For now we latch
1345            options, received in the last packet, enqueued
1346            by tcp. Feel free to propose better solution.
1347                                                --ANK (980728)
1348          */
1349         if (np->rxopt.all)
1350                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1351
1352         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1353                 struct dst_entry *dst = sk->sk_rx_dst;
1354
1355                 sock_rps_save_rxhash(sk, skb);
1356                 if (dst) {
1357                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1358                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1359                                 dst_release(dst);
1360                                 sk->sk_rx_dst = NULL;
1361                         }
1362                 }
1363
1364                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1365                         goto reset;
1366                 if (opt_skb)
1367                         goto ipv6_pktoptions;
1368                 return 0;
1369         }
1370
1371         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1372                 goto csum_err;
1373
1374         if (sk->sk_state == TCP_LISTEN) {
1375                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1376                 if (!nsk)
1377                         goto discard;
1378
1379                 /*
1380                  * Queue it on the new socket if the new socket is active,
1381                  * otherwise we just shortcircuit this and continue with
1382                  * the new socket..
1383                  */
1384                 if(nsk != sk) {
1385                         sock_rps_save_rxhash(nsk, skb);
1386                         if (tcp_child_process(sk, nsk, skb))
1387                                 goto reset;
1388                         if (opt_skb)
1389                                 __kfree_skb(opt_skb);
1390                         return 0;
1391                 }
1392         } else
1393                 sock_rps_save_rxhash(sk, skb);
1394
1395         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1396                 goto reset;
1397         if (opt_skb)
1398                 goto ipv6_pktoptions;
1399         return 0;
1400
1401 reset:
1402         tcp_v6_send_reset(sk, skb);
1403 discard:
1404         if (opt_skb)
1405                 __kfree_skb(opt_skb);
1406         kfree_skb(skb);
1407         return 0;
1408 csum_err:
1409         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1410         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1411         goto discard;
1412
1413
1414 ipv6_pktoptions:
1415         /* Do you ask, what is it?
1416
1417            1. skb was enqueued by tcp.
1418            2. skb is added to tail of read queue, rather than out of order.
1419            3. socket is not in passive state.
1420            4. Finally, it really contains options, which user wants to receive.
1421          */
1422         tp = tcp_sk(sk);
1423         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1424             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1425                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1426                         np->mcast_oif = inet6_iif(opt_skb);
1427                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1428                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1429                 if (np->rxopt.bits.rxtclass)
1430                         np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1431                 if (ipv6_opt_accepted(sk, opt_skb)) {
1432                         skb_set_owner_r(opt_skb, sk);
1433                         opt_skb = xchg(&np->pktoptions, opt_skb);
1434                 } else {
1435                         __kfree_skb(opt_skb);
1436                         opt_skb = xchg(&np->pktoptions, NULL);
1437                 }
1438         }
1439
1440         kfree_skb(opt_skb);
1441         return 0;
1442 }
1443
1444 static int tcp_v6_rcv(struct sk_buff *skb)
1445 {
1446         const struct tcphdr *th;
1447         const struct ipv6hdr *hdr;
1448         struct sock *sk;
1449         int ret;
1450         struct net *net = dev_net(skb->dev);
1451
1452         if (skb->pkt_type != PACKET_HOST)
1453                 goto discard_it;
1454
1455         /*
1456          *      Count it even if it's bad.
1457          */
1458         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1459
1460         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1461                 goto discard_it;
1462
1463         th = tcp_hdr(skb);
1464
1465         if (th->doff < sizeof(struct tcphdr)/4)
1466                 goto bad_packet;
1467         if (!pskb_may_pull(skb, th->doff*4))
1468                 goto discard_it;
1469
1470         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1471                 goto csum_error;
1472
1473         th = tcp_hdr(skb);
1474         hdr = ipv6_hdr(skb);
1475         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1476         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1477                                     skb->len - th->doff*4);
1478         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1479         TCP_SKB_CB(skb)->when = 0;
1480         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1481         TCP_SKB_CB(skb)->sacked = 0;
1482
1483         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1484         if (!sk)
1485                 goto no_tcp_socket;
1486
1487 process:
1488         if (sk->sk_state == TCP_TIME_WAIT)
1489                 goto do_time_wait;
1490
1491         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1492                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1493                 goto discard_and_relse;
1494         }
1495
1496         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1497                 goto discard_and_relse;
1498
1499         if (sk_filter(sk, skb))
1500                 goto discard_and_relse;
1501
1502         sk_mark_napi_id(sk, skb);
1503         skb->dev = NULL;
1504
1505         bh_lock_sock_nested(sk);
1506         ret = 0;
1507         if (!sock_owned_by_user(sk)) {
1508 #ifdef CONFIG_NET_DMA
1509                 struct tcp_sock *tp = tcp_sk(sk);
1510                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1511                         tp->ucopy.dma_chan = net_dma_find_channel();
1512                 if (tp->ucopy.dma_chan)
1513                         ret = tcp_v6_do_rcv(sk, skb);
1514                 else
1515 #endif
1516                 {
1517                         if (!tcp_prequeue(sk, skb))
1518                                 ret = tcp_v6_do_rcv(sk, skb);
1519                 }
1520         } else if (unlikely(sk_add_backlog(sk, skb,
1521                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1522                 bh_unlock_sock(sk);
1523                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1524                 goto discard_and_relse;
1525         }
1526         bh_unlock_sock(sk);
1527
1528         sock_put(sk);
1529         return ret ? -1 : 0;
1530
1531 no_tcp_socket:
1532         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1533                 goto discard_it;
1534
1535         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1536 csum_error:
1537                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1538 bad_packet:
1539                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1540         } else {
1541                 tcp_v6_send_reset(NULL, skb);
1542         }
1543
1544 discard_it:
1545         kfree_skb(skb);
1546         return 0;
1547
1548 discard_and_relse:
1549         sock_put(sk);
1550         goto discard_it;
1551
1552 do_time_wait:
1553         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1554                 inet_twsk_put(inet_twsk(sk));
1555                 goto discard_it;
1556         }
1557
1558         if (skb->len < (th->doff<<2)) {
1559                 inet_twsk_put(inet_twsk(sk));
1560                 goto bad_packet;
1561         }
1562         if (tcp_checksum_complete(skb)) {
1563                 inet_twsk_put(inet_twsk(sk));
1564                 goto csum_error;
1565         }
1566
1567         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1568         case TCP_TW_SYN:
1569         {
1570                 struct sock *sk2;
1571
1572                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1573                                             &ipv6_hdr(skb)->saddr, th->source,
1574                                             &ipv6_hdr(skb)->daddr,
1575                                             ntohs(th->dest), inet6_iif(skb));
1576                 if (sk2 != NULL) {
1577                         struct inet_timewait_sock *tw = inet_twsk(sk);
1578                         inet_twsk_deschedule(tw, &tcp_death_row);
1579                         inet_twsk_put(tw);
1580                         sk = sk2;
1581                         goto process;
1582                 }
1583                 /* Fall through to ACK */
1584         }
1585         case TCP_TW_ACK:
1586                 tcp_v6_timewait_ack(sk, skb);
1587                 break;
1588         case TCP_TW_RST:
1589                 goto no_tcp_socket;
1590         case TCP_TW_SUCCESS:;
1591         }
1592         goto discard_it;
1593 }
1594
1595 static void tcp_v6_early_demux(struct sk_buff *skb)
1596 {
1597         const struct ipv6hdr *hdr;
1598         const struct tcphdr *th;
1599         struct sock *sk;
1600
1601         if (skb->pkt_type != PACKET_HOST)
1602                 return;
1603
1604         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1605                 return;
1606
1607         hdr = ipv6_hdr(skb);
1608         th = tcp_hdr(skb);
1609
1610         if (th->doff < sizeof(struct tcphdr) / 4)
1611                 return;
1612
1613         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1614                                         &hdr->saddr, th->source,
1615                                         &hdr->daddr, ntohs(th->dest),
1616                                         inet6_iif(skb));
1617         if (sk) {
1618                 skb->sk = sk;
1619                 skb->destructor = sock_edemux;
1620                 if (sk->sk_state != TCP_TIME_WAIT) {
1621                         struct dst_entry *dst = sk->sk_rx_dst;
1622
1623                         if (dst)
1624                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1625                         if (dst &&
1626                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1627                                 skb_dst_set_noref(skb, dst);
1628                 }
1629         }
1630 }
1631
1632 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1633         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1634         .twsk_unique    = tcp_twsk_unique,
1635         .twsk_destructor= tcp_twsk_destructor,
1636 };
1637
1638 static const struct inet_connection_sock_af_ops ipv6_specific = {
1639         .queue_xmit        = inet6_csk_xmit,
1640         .send_check        = tcp_v6_send_check,
1641         .rebuild_header    = inet6_sk_rebuild_header,
1642         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1643         .conn_request      = tcp_v6_conn_request,
1644         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1645         .net_header_len    = sizeof(struct ipv6hdr),
1646         .net_frag_header_len = sizeof(struct frag_hdr),
1647         .setsockopt        = ipv6_setsockopt,
1648         .getsockopt        = ipv6_getsockopt,
1649         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1650         .sockaddr_len      = sizeof(struct sockaddr_in6),
1651         .bind_conflict     = inet6_csk_bind_conflict,
1652 #ifdef CONFIG_COMPAT
1653         .compat_setsockopt = compat_ipv6_setsockopt,
1654         .compat_getsockopt = compat_ipv6_getsockopt,
1655 #endif
1656 };
1657
1658 #ifdef CONFIG_TCP_MD5SIG
1659 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1660         .md5_lookup     =       tcp_v6_md5_lookup,
1661         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1662         .md5_parse      =       tcp_v6_parse_md5_keys,
1663 };
1664 #endif
1665
1666 /*
1667  *      TCP over IPv4 via INET6 API
1668  */
1669
1670 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1671         .queue_xmit        = ip_queue_xmit,
1672         .send_check        = tcp_v4_send_check,
1673         .rebuild_header    = inet_sk_rebuild_header,
1674         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1675         .conn_request      = tcp_v6_conn_request,
1676         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1677         .net_header_len    = sizeof(struct iphdr),
1678         .setsockopt        = ipv6_setsockopt,
1679         .getsockopt        = ipv6_getsockopt,
1680         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1681         .sockaddr_len      = sizeof(struct sockaddr_in6),
1682         .bind_conflict     = inet6_csk_bind_conflict,
1683 #ifdef CONFIG_COMPAT
1684         .compat_setsockopt = compat_ipv6_setsockopt,
1685         .compat_getsockopt = compat_ipv6_getsockopt,
1686 #endif
1687 };
1688
1689 #ifdef CONFIG_TCP_MD5SIG
1690 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1691         .md5_lookup     =       tcp_v4_md5_lookup,
1692         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1693         .md5_parse      =       tcp_v6_parse_md5_keys,
1694 };
1695 #endif
1696
1697 /* NOTE: A lot of things set to zero explicitly by call to
1698  *       sk_alloc() so need not be done here.
1699  */
1700 static int tcp_v6_init_sock(struct sock *sk)
1701 {
1702         struct inet_connection_sock *icsk = inet_csk(sk);
1703
1704         tcp_init_sock(sk);
1705
1706         icsk->icsk_af_ops = &ipv6_specific;
1707
1708 #ifdef CONFIG_TCP_MD5SIG
1709         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1710 #endif
1711
1712         return 0;
1713 }
1714
1715 static void tcp_v6_destroy_sock(struct sock *sk)
1716 {
1717         tcp_v4_destroy_sock(sk);
1718         inet6_destroy_sock(sk);
1719 }
1720
1721 #ifdef CONFIG_PROC_FS
1722 /* Proc filesystem TCPv6 sock list dumping. */
1723 static void get_openreq6(struct seq_file *seq,
1724                          const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1725 {
1726         int ttd = req->expires - jiffies;
1727         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1728         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1729
1730         if (ttd < 0)
1731                 ttd = 0;
1732
1733         seq_printf(seq,
1734                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1735                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1736                    i,
1737                    src->s6_addr32[0], src->s6_addr32[1],
1738                    src->s6_addr32[2], src->s6_addr32[3],
1739                    ntohs(inet_rsk(req)->loc_port),
1740                    dest->s6_addr32[0], dest->s6_addr32[1],
1741                    dest->s6_addr32[2], dest->s6_addr32[3],
1742                    ntohs(inet_rsk(req)->rmt_port),
1743                    TCP_SYN_RECV,
1744                    0,0, /* could print option size, but that is af dependent. */
1745                    1,   /* timers active (only the expire timer) */
1746                    jiffies_to_clock_t(ttd),
1747                    req->num_timeout,
1748                    from_kuid_munged(seq_user_ns(seq), uid),
1749                    0,  /* non standard timer */
1750                    0, /* open_requests have no inode */
1751                    0, req);
1752 }
1753
1754 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1755 {
1756         const struct in6_addr *dest, *src;
1757         __u16 destp, srcp;
1758         int timer_active;
1759         unsigned long timer_expires;
1760         const struct inet_sock *inet = inet_sk(sp);
1761         const struct tcp_sock *tp = tcp_sk(sp);
1762         const struct inet_connection_sock *icsk = inet_csk(sp);
1763         const struct ipv6_pinfo *np = inet6_sk(sp);
1764
1765         dest  = &np->daddr;
1766         src   = &np->rcv_saddr;
1767         destp = ntohs(inet->inet_dport);
1768         srcp  = ntohs(inet->inet_sport);
1769
1770         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1771                 timer_active    = 1;
1772                 timer_expires   = icsk->icsk_timeout;
1773         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1774                 timer_active    = 4;
1775                 timer_expires   = icsk->icsk_timeout;
1776         } else if (timer_pending(&sp->sk_timer)) {
1777                 timer_active    = 2;
1778                 timer_expires   = sp->sk_timer.expires;
1779         } else {
1780                 timer_active    = 0;
1781                 timer_expires = jiffies;
1782         }
1783
1784         seq_printf(seq,
1785                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1786                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
1787                    i,
1788                    src->s6_addr32[0], src->s6_addr32[1],
1789                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1790                    dest->s6_addr32[0], dest->s6_addr32[1],
1791                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1792                    sp->sk_state,
1793                    tp->write_seq-tp->snd_una,
1794                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1795                    timer_active,
1796                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1797                    icsk->icsk_retransmits,
1798                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1799                    icsk->icsk_probes_out,
1800                    sock_i_ino(sp),
1801                    atomic_read(&sp->sk_refcnt), sp,
1802                    jiffies_to_clock_t(icsk->icsk_rto),
1803                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1804                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1805                    tp->snd_cwnd,
1806                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1807                    );
1808 }
1809
1810 static void get_timewait6_sock(struct seq_file *seq,
1811                                struct inet_timewait_sock *tw, int i)
1812 {
1813         const struct in6_addr *dest, *src;
1814         __u16 destp, srcp;
1815         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1816         long delta = tw->tw_ttd - jiffies;
1817
1818         dest = &tw6->tw_v6_daddr;
1819         src  = &tw6->tw_v6_rcv_saddr;
1820         destp = ntohs(tw->tw_dport);
1821         srcp  = ntohs(tw->tw_sport);
1822
1823         seq_printf(seq,
1824                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1825                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1826                    i,
1827                    src->s6_addr32[0], src->s6_addr32[1],
1828                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1829                    dest->s6_addr32[0], dest->s6_addr32[1],
1830                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1831                    tw->tw_substate, 0, 0,
1832                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1833                    atomic_read(&tw->tw_refcnt), tw);
1834 }
1835
1836 static int tcp6_seq_show(struct seq_file *seq, void *v)
1837 {
1838         struct tcp_iter_state *st;
1839
1840         if (v == SEQ_START_TOKEN) {
1841                 seq_puts(seq,
1842                          "  sl  "
1843                          "local_address                         "
1844                          "remote_address                        "
1845                          "st tx_queue rx_queue tr tm->when retrnsmt"
1846                          "   uid  timeout inode\n");
1847                 goto out;
1848         }
1849         st = seq->private;
1850
1851         switch (st->state) {
1852         case TCP_SEQ_STATE_LISTENING:
1853         case TCP_SEQ_STATE_ESTABLISHED:
1854                 get_tcp6_sock(seq, v, st->num);
1855                 break;
1856         case TCP_SEQ_STATE_OPENREQ:
1857                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1858                 break;
1859         case TCP_SEQ_STATE_TIME_WAIT:
1860                 get_timewait6_sock(seq, v, st->num);
1861                 break;
1862         }
1863 out:
1864         return 0;
1865 }
1866
1867 static const struct file_operations tcp6_afinfo_seq_fops = {
1868         .owner   = THIS_MODULE,
1869         .open    = tcp_seq_open,
1870         .read    = seq_read,
1871         .llseek  = seq_lseek,
1872         .release = seq_release_net
1873 };
1874
1875 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1876         .name           = "tcp6",
1877         .family         = AF_INET6,
1878         .seq_fops       = &tcp6_afinfo_seq_fops,
1879         .seq_ops        = {
1880                 .show           = tcp6_seq_show,
1881         },
1882 };
1883
1884 int __net_init tcp6_proc_init(struct net *net)
1885 {
1886         return tcp_proc_register(net, &tcp6_seq_afinfo);
1887 }
1888
1889 void tcp6_proc_exit(struct net *net)
1890 {
1891         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1892 }
1893 #endif
1894
1895 static void tcp_v6_clear_sk(struct sock *sk, int size)
1896 {
1897         struct inet_sock *inet = inet_sk(sk);
1898
1899         /* we do not want to clear pinet6 field, because of RCU lookups */
1900         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1901
1902         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1903         memset(&inet->pinet6 + 1, 0, size);
1904 }
1905
1906 struct proto tcpv6_prot = {
1907         .name                   = "TCPv6",
1908         .owner                  = THIS_MODULE,
1909         .close                  = tcp_close,
1910         .connect                = tcp_v6_connect,
1911         .disconnect             = tcp_disconnect,
1912         .accept                 = inet_csk_accept,
1913         .ioctl                  = tcp_ioctl,
1914         .init                   = tcp_v6_init_sock,
1915         .destroy                = tcp_v6_destroy_sock,
1916         .shutdown               = tcp_shutdown,
1917         .setsockopt             = tcp_setsockopt,
1918         .getsockopt             = tcp_getsockopt,
1919         .recvmsg                = tcp_recvmsg,
1920         .sendmsg                = tcp_sendmsg,
1921         .sendpage               = tcp_sendpage,
1922         .backlog_rcv            = tcp_v6_do_rcv,
1923         .release_cb             = tcp_release_cb,
1924         .mtu_reduced            = tcp_v6_mtu_reduced,
1925         .hash                   = tcp_v6_hash,
1926         .unhash                 = inet_unhash,
1927         .get_port               = inet_csk_get_port,
1928         .enter_memory_pressure  = tcp_enter_memory_pressure,
1929         .sockets_allocated      = &tcp_sockets_allocated,
1930         .memory_allocated       = &tcp_memory_allocated,
1931         .memory_pressure        = &tcp_memory_pressure,
1932         .orphan_count           = &tcp_orphan_count,
1933         .sysctl_wmem            = sysctl_tcp_wmem,
1934         .sysctl_rmem            = sysctl_tcp_rmem,
1935         .max_header             = MAX_TCP_HEADER,
1936         .obj_size               = sizeof(struct tcp6_sock),
1937         .slab_flags             = SLAB_DESTROY_BY_RCU,
1938         .twsk_prot              = &tcp6_timewait_sock_ops,
1939         .rsk_prot               = &tcp6_request_sock_ops,
1940         .h.hashinfo             = &tcp_hashinfo,
1941         .no_autobind            = true,
1942 #ifdef CONFIG_COMPAT
1943         .compat_setsockopt      = compat_tcp_setsockopt,
1944         .compat_getsockopt      = compat_tcp_getsockopt,
1945 #endif
1946 #ifdef CONFIG_MEMCG_KMEM
1947         .proto_cgroup           = tcp_proto_cgroup,
1948 #endif
1949         .clear_sk               = tcp_v6_clear_sk,
1950 };
1951
1952 static const struct inet6_protocol tcpv6_protocol = {
1953         .early_demux    =       tcp_v6_early_demux,
1954         .handler        =       tcp_v6_rcv,
1955         .err_handler    =       tcp_v6_err,
1956         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1957 };
1958
1959 static struct inet_protosw tcpv6_protosw = {
1960         .type           =       SOCK_STREAM,
1961         .protocol       =       IPPROTO_TCP,
1962         .prot           =       &tcpv6_prot,
1963         .ops            =       &inet6_stream_ops,
1964         .no_check       =       0,
1965         .flags          =       INET_PROTOSW_PERMANENT |
1966                                 INET_PROTOSW_ICSK,
1967 };
1968
1969 static int __net_init tcpv6_net_init(struct net *net)
1970 {
1971         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1972                                     SOCK_RAW, IPPROTO_TCP, net);
1973 }
1974
1975 static void __net_exit tcpv6_net_exit(struct net *net)
1976 {
1977         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1978 }
1979
1980 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1981 {
1982         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1983 }
1984
1985 static struct pernet_operations tcpv6_net_ops = {
1986         .init       = tcpv6_net_init,
1987         .exit       = tcpv6_net_exit,
1988         .exit_batch = tcpv6_net_exit_batch,
1989 };
1990
1991 int __init tcpv6_init(void)
1992 {
1993         int ret;
1994
1995         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1996         if (ret)
1997                 goto out;
1998
1999         /* register inet6 protocol */
2000         ret = inet6_register_protosw(&tcpv6_protosw);
2001         if (ret)
2002                 goto out_tcpv6_protocol;
2003
2004         ret = register_pernet_subsys(&tcpv6_net_ops);
2005         if (ret)
2006                 goto out_tcpv6_protosw;
2007 out:
2008         return ret;
2009
2010 out_tcpv6_protosw:
2011         inet6_unregister_protosw(&tcpv6_protosw);
2012 out_tcpv6_protocol:
2013         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2014         goto out;
2015 }
2016
2017 void tcpv6_exit(void)
2018 {
2019         unregister_pernet_subsys(&tcpv6_net_ops);
2020         inet6_unregister_protosw(&tcpv6_protosw);
2021         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2022 }