net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65 #include <net/tcp_memcontrol.h>
  66 #include <net/busy_poll.h>
  67
  68 #include <linux/proc_fs.h>
  69 #include <linux/seq_file.h>
  70
  71 #include <linux/crypto.h>
  72 #include <linux/scatterlist.h>
  73
  74 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80 static const struct inet_connection_sock_af_ops ipv6_mapped;
  81 static const struct inet_connection_sock_af_ops ipv6_specific;
  82 #ifdef CONFIG_TCP_MD5SIG
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  85 #else
  86 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  87                                                    const struct in6_addr *addr)
  88 {
  89         return NULL;
  90 }
  91 #endif
  92
  93 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  94 {
  95         struct dst_entry *dst = skb_dst(skb);
  96         const struct rt6_info *rt = (const struct rt6_info *)dst;
  97
  98         dst_hold(dst);
  99         sk->sk_rx_dst = dst;
 100         inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 101         if (rt->rt6i_node)
 102                 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 103 }
 104
 105 static void tcp_v6_hash(struct sock *sk)
 106 {
 107         if (sk->sk_state != TCP_CLOSE) {
 108                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 109                         tcp_prot.hash(sk);
 110                         return;
 111                 }
 112                 local_bh_disable();
 113                 __inet6_hash(sk, NULL);
 114                 local_bh_enable();
 115         }
 116 }
 117
 118 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 119 {
 120         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 121                                             ipv6_hdr(skb)->saddr.s6_addr32,
 122                                             tcp_hdr(skb)->dest,
 123                                             tcp_hdr(skb)->source);
 124 }
 125
 126 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 127                           int addr_len)
 128 {
 129         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 130         struct inet_sock *inet = inet_sk(sk);
 131         struct inet_connection_sock *icsk = inet_csk(sk);
 132         struct ipv6_pinfo *np = inet6_sk(sk);
 133         struct tcp_sock *tp = tcp_sk(sk);
 134         struct in6_addr *saddr = NULL, *final_p, final;
 135         struct rt6_info *rt;
 136         struct flowi6 fl6;
 137         struct dst_entry *dst;
 138         int addr_type;
 139         int err;
 140
 141         if (addr_len < SIN6_LEN_RFC2133)
 142                 return -EINVAL;
 143
 144         if (usin->sin6_family != AF_INET6)
 145                 return -EAFNOSUPPORT;
 146
 147         memset(&fl6, 0, sizeof(fl6));
 148
 149         if (np->sndflow) {
 150                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 151                 IP6_ECN_flow_init(fl6.flowlabel);
 152                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 153                         struct ip6_flowlabel *flowlabel;
 154                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 155                         if (flowlabel == NULL)
 156                                 return -EINVAL;
 157                         fl6_sock_release(flowlabel);
 158                 }
 159         }
 160
 161         /*
 162          *      connect() to INADDR_ANY means loopback (BSD'ism).
 163          */
 164
 165         if (ipv6_addr_any(&usin->sin6_addr))
 166                 usin->sin6_addr.s6_addr[15] = 0x1;
 167
 168         addr_type = ipv6_addr_type(&usin->sin6_addr);
 169
 170         if (addr_type & IPV6_ADDR_MULTICAST)
 171                 return -ENETUNREACH;
 172
 173         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 174                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 175                     usin->sin6_scope_id) {
 176                         /* If interface is set while binding, indices
 177                          * must coincide.
 178                          */
 179                         if (sk->sk_bound_dev_if &&
 180                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 181                                 return -EINVAL;
 182
 183                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 184                 }
 185
 186                 /* Connect to link-local address requires an interface */
 187                 if (!sk->sk_bound_dev_if)
 188                         return -EINVAL;
 189         }
 190
 191         if (tp->rx_opt.ts_recent_stamp &&
 192             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 193                 tp->rx_opt.ts_recent = 0;
 194                 tp->rx_opt.ts_recent_stamp = 0;
 195                 tp->write_seq = 0;
 196         }
 197
 198         sk->sk_v6_daddr = usin->sin6_addr;
 199         np->flow_label = fl6.flowlabel;
 200
 201         /*
 202          *      TCP over IPv4
 203          */
 204
 205         if (addr_type == IPV6_ADDR_MAPPED) {
 206                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 207                 struct sockaddr_in sin;
 208
 209                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 210
 211                 if (__ipv6_only_sock(sk))
 212                         return -ENETUNREACH;
 213
 214                 sin.sin_family = AF_INET;
 215                 sin.sin_port = usin->sin6_port;
 216                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 217
 218                 icsk->icsk_af_ops = &ipv6_mapped;
 219                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 220 #ifdef CONFIG_TCP_MD5SIG
 221                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 222 #endif
 223
 224                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 225
 226                 if (err) {
 227                         icsk->icsk_ext_hdr_len = exthdrlen;
 228                         icsk->icsk_af_ops = &ipv6_specific;
 229                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 230 #ifdef CONFIG_TCP_MD5SIG
 231                         tp->af_specific = &tcp_sock_ipv6_specific;
 232 #endif
 233                         goto failure;
 234                 } else {
 235                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 236                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 237                                                &sk->sk_v6_rcv_saddr);
 238                 }
 239
 240                 return err;
 241         }
 242
 243         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 244                 saddr = &sk->sk_v6_rcv_saddr;
 245
 246         fl6.flowi6_proto = IPPROTO_TCP;
 247         fl6.daddr = sk->sk_v6_daddr;
 248         fl6.saddr = saddr ? *saddr : np->saddr;
 249         fl6.flowi6_oif = sk->sk_bound_dev_if;
 250         fl6.flowi6_mark = sk->sk_mark;
 251         fl6.fl6_dport = usin->sin6_port;
 252         fl6.fl6_sport = inet->inet_sport;
 253
 254         final_p = fl6_update_dst(&fl6, np->opt, &final);
 255
 256         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 257
 258         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 259         if (IS_ERR(dst)) {
 260                 err = PTR_ERR(dst);
 261                 goto failure;
 262         }
 263
 264         if (saddr == NULL) {
 265                 saddr = &fl6.saddr;
 266                 sk->sk_v6_rcv_saddr = *saddr;
 267         }
 268
 269         /* set the source address */
 270         np->saddr = *saddr;
 271         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 272
 273         sk->sk_gso_type = SKB_GSO_TCPV6;
 274         __ip6_dst_store(sk, dst, NULL, NULL);
 275
 276         rt = (struct rt6_info *) dst;
 277         if (tcp_death_row.sysctl_tw_recycle &&
 278             !tp->rx_opt.ts_recent_stamp &&
 279             ipv6_addr_equal(&rt->rt6i_dst.addr, &sk->sk_v6_daddr))
 280                 tcp_fetch_timewait_stamp(sk, dst);
 281
 282         icsk->icsk_ext_hdr_len = 0;
 283         if (np->opt)
 284                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 285                                           np->opt->opt_nflen);
 286
 287         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 288
 289         inet->inet_dport = usin->sin6_port;
 290
 291         tcp_set_state(sk, TCP_SYN_SENT);
 292         err = inet6_hash_connect(&tcp_death_row, sk);
 293         if (err)
 294                 goto late_failure;
 295
 296         if (!tp->write_seq && likely(!tp->repair))
 297                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 298                                                              sk->sk_v6_daddr.s6_addr32,
 299                                                              inet->inet_sport,
 300                                                              inet->inet_dport);
 301
 302         err = tcp_connect(sk);
 303         if (err)
 304                 goto late_failure;
 305
 306         return 0;
 307
 308 late_failure:
 309         tcp_set_state(sk, TCP_CLOSE);
 310         __sk_dst_reset(sk);
 311 failure:
 312         inet->inet_dport = 0;
 313         sk->sk_route_caps = 0;
 314         return err;
 315 }
 316
 317 static void tcp_v6_mtu_reduced(struct sock *sk)
 318 {
 319         struct dst_entry *dst;
 320
 321         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 322                 return;
 323
 324         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 325         if (!dst)
 326                 return;
 327
 328         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 329                 tcp_sync_mss(sk, dst_mtu(dst));
 330                 tcp_simple_retransmit(sk);
 331         }
 332 }
 333
 334 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 335                 u8 type, u8 code, int offset, __be32 info)
 336 {
 337         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 338         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 339         struct ipv6_pinfo *np;
 340         struct sock *sk;
 341         int err;
 342         struct tcp_sock *tp;
 343         __u32 seq;
 344         struct net *net = dev_net(skb->dev);
 345
 346         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 347                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 348
 349         if (sk == NULL) {
 350                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 351                                    ICMP6_MIB_INERRORS);
 352                 return;
 353         }
 354
 355         if (sk->sk_state == TCP_TIME_WAIT) {
 356                 inet_twsk_put(inet_twsk(sk));
 357                 return;
 358         }
 359
 360         bh_lock_sock(sk);
 361         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 362                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 363
 364         if (sk->sk_state == TCP_CLOSE)
 365                 goto out;
 366
 367         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 368                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 369                 goto out;
 370         }
 371
 372         tp = tcp_sk(sk);
 373         seq = ntohl(th->seq);
 374         if (sk->sk_state != TCP_LISTEN &&
 375             !between(seq, tp->snd_una, tp->snd_nxt)) {
 376                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 377                 goto out;
 378         }
 379
 380         np = inet6_sk(sk);
 381
 382         if (type == NDISC_REDIRECT) {
 383                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 384
 385                 if (dst)
 386                         dst->ops->redirect(dst, sk, skb);
 387                 goto out;
 388         }
 389
 390         if (type == ICMPV6_PKT_TOOBIG) {
 391                 /* We are not interested in TCP_LISTEN and open_requests
 392                  * (SYN-ACKs send out by Linux are always <576bytes so
 393                  * they should go through unfragmented).
 394                  */
 395                 if (sk->sk_state == TCP_LISTEN)
 396                         goto out;
 397
 398                 if (!ip6_sk_accept_pmtu(sk))
 399                         goto out;
 400
 401                 tp->mtu_info = ntohl(info);
 402                 if (!sock_owned_by_user(sk))
 403                         tcp_v6_mtu_reduced(sk);
 404                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 405                                            &tp->tsq_flags))
 406                         sock_hold(sk);
 407                 goto out;
 408         }
 409
 410         icmpv6_err_convert(type, code, &err);
 411
 412         /* Might be for an request_sock */
 413         switch (sk->sk_state) {
 414                 struct request_sock *req, **prev;
 415         case TCP_LISTEN:
 416                 if (sock_owned_by_user(sk))
 417                         goto out;
 418
 419                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 420                                            &hdr->saddr, inet6_iif(skb));
 421                 if (!req)
 422                         goto out;
 423
 424                 /* ICMPs are not backlogged, hence we cannot get
 425                  * an established socket here.
 426                  */
 427                 WARN_ON(req->sk != NULL);
 428
 429                 if (seq != tcp_rsk(req)->snt_isn) {
 430                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 431                         goto out;
 432                 }
 433
 434                 inet_csk_reqsk_queue_drop(sk, req, prev);
 435                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 436                 goto out;
 437
 438         case TCP_SYN_SENT:
 439         case TCP_SYN_RECV:  /* Cannot happen.
 440                                It can, it SYNs are crossed. --ANK */
 441                 if (!sock_owned_by_user(sk)) {
 442                         sk->sk_err = err;
 443                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 444
 445                         tcp_done(sk);
 446                 } else
 447                         sk->sk_err_soft = err;
 448                 goto out;
 449         }
 450
 451         if (!sock_owned_by_user(sk) && np->recverr) {
 452                 sk->sk_err = err;
 453                 sk->sk_error_report(sk);
 454         } else
 455                 sk->sk_err_soft = err;
 456
 457 out:
 458         bh_unlock_sock(sk);
 459         sock_put(sk);
 460 }
 461
 462
 463 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 464                               struct flowi6 *fl6,
 465                               struct request_sock *req,
 466                               u16 queue_mapping)
 467 {
 468         struct inet_request_sock *ireq = inet_rsk(req);
 469         struct ipv6_pinfo *np = inet6_sk(sk);
 470         struct sk_buff *skb;
 471         int err = -ENOMEM;
 472
 473         /* First, grab a route. */
 474         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 475                 goto done;
 476
 477         skb = tcp_make_synack(sk, dst, req, NULL);
 478
 479         if (skb) {
 480                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 481                                     &ireq->ir_v6_rmt_addr);
 482
 483                 fl6->daddr = ireq->ir_v6_rmt_addr;
 484                 if (np->repflow && (ireq->pktopts != NULL))
 485                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 486
 487                 skb_set_queue_mapping(skb, queue_mapping);
 488                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 489                 err = net_xmit_eval(err);
 490         }
 491
 492 done:
 493         return err;
 494 }
 495
 496 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
 497 {
 498         struct flowi6 fl6;
 499         int res;
 500
 501         res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
 502         if (!res) {
 503                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 504                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
 505         }
 506         return res;
 507 }
 508
 509 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 510 {
 511         kfree_skb(inet_rsk(req)->pktopts);
 512 }
 513
 514 #ifdef CONFIG_TCP_MD5SIG
 515 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 516                                                    const struct in6_addr *addr)
 517 {
 518         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 519 }
 520
 521 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 522                                                 struct sock *addr_sk)
 523 {
 524         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 525 }
 526
 527 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 528                                                       struct request_sock *req)
 529 {
 530         return tcp_v6_md5_do_lookup(sk, &inet_rsk(req)->ir_v6_rmt_addr);
 531 }
 532
 533 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 534                                  int optlen)
 535 {
 536         struct tcp_md5sig cmd;
 537         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 538
 539         if (optlen < sizeof(cmd))
 540                 return -EINVAL;
 541
 542         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 543                 return -EFAULT;
 544
 545         if (sin6->sin6_family != AF_INET6)
 546                 return -EINVAL;
 547
 548         if (!cmd.tcpm_keylen) {
 549                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 550                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 551                                               AF_INET);
 552                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 553                                       AF_INET6);
 554         }
 555
 556         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 557                 return -EINVAL;
 558
 559         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 560                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 561                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 562
 563         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 564                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 565 }
 566
 567 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 568                                         const struct in6_addr *daddr,
 569                                         const struct in6_addr *saddr, int nbytes)
 570 {
 571         struct tcp6_pseudohdr *bp;
 572         struct scatterlist sg;
 573
 574         bp = &hp->md5_blk.ip6;
 575         /* 1. TCP pseudo-header (RFC2460) */
 576         bp->saddr = *saddr;
 577         bp->daddr = *daddr;
 578         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 579         bp->len = cpu_to_be32(nbytes);
 580
 581         sg_init_one(&sg, bp, sizeof(*bp));
 582         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 583 }
 584
 585 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 586                                const struct in6_addr *daddr, struct in6_addr *saddr,
 587                                const struct tcphdr *th)
 588 {
 589         struct tcp_md5sig_pool *hp;
 590         struct hash_desc *desc;
 591
 592         hp = tcp_get_md5sig_pool();
 593         if (!hp)
 594                 goto clear_hash_noput;
 595         desc = &hp->md5_desc;
 596
 597         if (crypto_hash_init(desc))
 598                 goto clear_hash;
 599         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 600                 goto clear_hash;
 601         if (tcp_md5_hash_header(hp, th))
 602                 goto clear_hash;
 603         if (tcp_md5_hash_key(hp, key))
 604                 goto clear_hash;
 605         if (crypto_hash_final(desc, md5_hash))
 606                 goto clear_hash;
 607
 608         tcp_put_md5sig_pool();
 609         return 0;
 610
 611 clear_hash:
 612         tcp_put_md5sig_pool();
 613 clear_hash_noput:
 614         memset(md5_hash, 0, 16);
 615         return 1;
 616 }
 617
 618 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 619                                const struct sock *sk,
 620                                const struct request_sock *req,
 621                                const struct sk_buff *skb)
 622 {
 623         const struct in6_addr *saddr, *daddr;
 624         struct tcp_md5sig_pool *hp;
 625         struct hash_desc *desc;
 626         const struct tcphdr *th = tcp_hdr(skb);
 627
 628         if (sk) {
 629                 saddr = &inet6_sk(sk)->saddr;
 630                 daddr = &sk->sk_v6_daddr;
 631         } else if (req) {
 632                 saddr = &inet_rsk(req)->ir_v6_loc_addr;
 633                 daddr = &inet_rsk(req)->ir_v6_rmt_addr;
 634         } else {
 635                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 636                 saddr = &ip6h->saddr;
 637                 daddr = &ip6h->daddr;
 638         }
 639
 640         hp = tcp_get_md5sig_pool();
 641         if (!hp)
 642                 goto clear_hash_noput;
 643         desc = &hp->md5_desc;
 644
 645         if (crypto_hash_init(desc))
 646                 goto clear_hash;
 647
 648         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 649                 goto clear_hash;
 650         if (tcp_md5_hash_header(hp, th))
 651                 goto clear_hash;
 652         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 653                 goto clear_hash;
 654         if (tcp_md5_hash_key(hp, key))
 655                 goto clear_hash;
 656         if (crypto_hash_final(desc, md5_hash))
 657                 goto clear_hash;
 658
 659         tcp_put_md5sig_pool();
 660         return 0;
 661
 662 clear_hash:
 663         tcp_put_md5sig_pool();
 664 clear_hash_noput:
 665         memset(md5_hash, 0, 16);
 666         return 1;
 667 }
 668
 669 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 670 {
 671         const __u8 *hash_location = NULL;
 672         struct tcp_md5sig_key *hash_expected;
 673         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 674         const struct tcphdr *th = tcp_hdr(skb);
 675         int genhash;
 676         u8 newhash[16];
 677
 678         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 679         hash_location = tcp_parse_md5sig_option(th);
 680
 681         /* We've parsed the options - do we have a hash? */
 682         if (!hash_expected && !hash_location)
 683                 return 0;
 684
 685         if (hash_expected && !hash_location) {
 686                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 687                 return 1;
 688         }
 689
 690         if (!hash_expected && hash_location) {
 691                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 692                 return 1;
 693         }
 694
 695         /* check the signature */
 696         genhash = tcp_v6_md5_hash_skb(newhash,
 697                                       hash_expected,
 698                                       NULL, NULL, skb);
 699
 700         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 701                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 702                                      genhash ? "failed" : "mismatch",
 703                                      &ip6h->saddr, ntohs(th->source),
 704                                      &ip6h->daddr, ntohs(th->dest));
 705                 return 1;
 706         }
 707         return 0;
 708 }
 709 #endif
 710
 711 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 712         .family         =       AF_INET6,
 713         .obj_size       =       sizeof(struct tcp6_request_sock),
 714         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 715         .send_ack       =       tcp_v6_reqsk_send_ack,
 716         .destructor     =       tcp_v6_reqsk_destructor,
 717         .send_reset     =       tcp_v6_send_reset,
 718         .syn_ack_timeout =      tcp_syn_ack_timeout,
 719 };
 720
 721 #ifdef CONFIG_TCP_MD5SIG
 722 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 723         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 724         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 725 };
 726 #endif
 727
 728 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 729                                  u32 tsval, u32 tsecr, int oif,
 730                                  struct tcp_md5sig_key *key, int rst, u8 tclass,
 731                                  u32 label)
 732 {
 733         const struct tcphdr *th = tcp_hdr(skb);
 734         struct tcphdr *t1;
 735         struct sk_buff *buff;
 736         struct flowi6 fl6;
 737         struct net *net = dev_net(skb_dst(skb)->dev);
 738         struct sock *ctl_sk = net->ipv6.tcp_sk;
 739         unsigned int tot_len = sizeof(struct tcphdr);
 740         struct dst_entry *dst;
 741         __be32 *topt;
 742
 743         if (tsecr)
 744                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 745 #ifdef CONFIG_TCP_MD5SIG
 746         if (key)
 747                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 748 #endif
 749
 750         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 751                          GFP_ATOMIC);
 752         if (buff == NULL)
 753                 return;
 754
 755         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 756
 757         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 758         skb_reset_transport_header(buff);
 759
 760         /* Swap the send and the receive. */
 761         memset(t1, 0, sizeof(*t1));
 762         t1->dest = th->source;
 763         t1->source = th->dest;
 764         t1->doff = tot_len / 4;
 765         t1->seq = htonl(seq);
 766         t1->ack_seq = htonl(ack);
 767         t1->ack = !rst || !th->ack;
 768         t1->rst = rst;
 769         t1->window = htons(win);
 770
 771         topt = (__be32 *)(t1 + 1);
 772
 773         if (tsecr) {
 774                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 775                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 776                 *topt++ = htonl(tsval);
 777                 *topt++ = htonl(tsecr);
 778         }
 779
 780 #ifdef CONFIG_TCP_MD5SIG
 781         if (key) {
 782                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 783                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 784                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 785                                     &ipv6_hdr(skb)->saddr,
 786                                     &ipv6_hdr(skb)->daddr, t1);
 787         }
 788 #endif
 789
 790         memset(&fl6, 0, sizeof(fl6));
 791         fl6.daddr = ipv6_hdr(skb)->saddr;
 792         fl6.saddr = ipv6_hdr(skb)->daddr;
 793         fl6.flowlabel = label;
 794
 795         buff->ip_summed = CHECKSUM_PARTIAL;
 796         buff->csum = 0;
 797
 798         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 799
 800         fl6.flowi6_proto = IPPROTO_TCP;
 801         if (rt6_need_strict(&fl6.daddr) && !oif)
 802                 fl6.flowi6_oif = inet6_iif(skb);
 803         else
 804                 fl6.flowi6_oif = oif;
 805         fl6.fl6_dport = t1->dest;
 806         fl6.fl6_sport = t1->source;
 807         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 808
 809         /* Pass a socket to ip6_dst_lookup either it is for RST
 810          * Underlying function will use this to retrieve the network
 811          * namespace
 812          */
 813         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 814         if (!IS_ERR(dst)) {
 815                 skb_dst_set(buff, dst);
 816                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 817                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 818                 if (rst)
 819                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 820                 return;
 821         }
 822
 823         kfree_skb(buff);
 824 }
 825
 826 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 827 {
 828         const struct tcphdr *th = tcp_hdr(skb);
 829         u32 seq = 0, ack_seq = 0;
 830         struct tcp_md5sig_key *key = NULL;
 831 #ifdef CONFIG_TCP_MD5SIG
 832         const __u8 *hash_location = NULL;
 833         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 834         unsigned char newhash[16];
 835         int genhash;
 836         struct sock *sk1 = NULL;
 837 #endif
 838         int oif;
 839
 840         if (th->rst)
 841                 return;
 842
 843         if (!ipv6_unicast_destination(skb))
 844                 return;
 845
 846 #ifdef CONFIG_TCP_MD5SIG
 847         hash_location = tcp_parse_md5sig_option(th);
 848         if (!sk && hash_location) {
 849                 /*
 850                  * active side is lost. Try to find listening socket through
 851                  * source port, and then find md5 key through listening socket.
 852                  * we are not loose security here:
 853                  * Incoming packet is checked with md5 hash with finding key,
 854                  * no RST generated if md5 hash doesn't match.
 855                  */
 856                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 857                                            &tcp_hashinfo, &ipv6h->saddr,
 858                                            th->source, &ipv6h->daddr,
 859                                            ntohs(th->source), inet6_iif(skb));
 860                 if (!sk1)
 861                         return;
 862
 863                 rcu_read_lock();
 864                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 865                 if (!key)
 866                         goto release_sk1;
 867
 868                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 869                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 870                         goto release_sk1;
 871         } else {
 872                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 873         }
 874 #endif
 875
 876         if (th->ack)
 877                 seq = ntohl(th->ack_seq);
 878         else
 879                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 880                           (th->doff << 2);
 881
 882         oif = sk ? sk->sk_bound_dev_if : 0;
 883         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 884
 885 #ifdef CONFIG_TCP_MD5SIG
 886 release_sk1:
 887         if (sk1) {
 888                 rcu_read_unlock();
 889                 sock_put(sk1);
 890         }
 891 #endif
 892 }
 893
 894 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 895                             u32 win, u32 tsval, u32 tsecr, int oif,
 896                             struct tcp_md5sig_key *key, u8 tclass,
 897                             u32 label)
 898 {
 899         tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, oif, key, 0, tclass,
 900                              label);
 901 }
 902
 903 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 904 {
 905         struct inet_timewait_sock *tw = inet_twsk(sk);
 906         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 907
 908         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 909                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 910                         tcp_time_stamp + tcptw->tw_ts_offset,
 911                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 912                         tw->tw_tclass, (tw->tw_flowlabel << 12));
 913
 914         inet_twsk_put(tw);
 915 }
 916
 917 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 918                                   struct request_sock *req)
 919 {
 920         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
 921                         req->rcv_wnd, tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 922                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 923                         0, 0);
 924 }
 925
 926
 927 static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
 928 {
 929         struct request_sock *req, **prev;
 930         const struct tcphdr *th = tcp_hdr(skb);
 931         struct sock *nsk;
 932
 933         /* Find possible connection requests. */
 934         req = inet6_csk_search_req(sk, &prev, th->source,
 935                                    &ipv6_hdr(skb)->saddr,
 936                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 937         if (req)
 938                 return tcp_check_req(sk, skb, req, prev, false);
 939
 940         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 941                         &ipv6_hdr(skb)->saddr, th->source,
 942                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 943
 944         if (nsk) {
 945                 if (nsk->sk_state != TCP_TIME_WAIT) {
 946                         bh_lock_sock(nsk);
 947                         return nsk;
 948                 }
 949                 inet_twsk_put(inet_twsk(nsk));
 950                 return NULL;
 951         }
 952
 953 #ifdef CONFIG_SYN_COOKIES
 954         if (!th->syn)
 955                 sk = cookie_v6_check(sk, skb);
 956 #endif
 957         return sk;
 958 }
 959
 960 /* FIXME: this is substantially similar to the ipv4 code.
 961  * Can some kind of merge be done? -- erics
 962  */
 963 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 964 {
 965         struct tcp_options_received tmp_opt;
 966         struct request_sock *req;
 967         struct inet_request_sock *ireq;
 968         struct ipv6_pinfo *np = inet6_sk(sk);
 969         struct tcp_sock *tp = tcp_sk(sk);
 970         __u32 isn = TCP_SKB_CB(skb)->when;
 971         struct dst_entry *dst = NULL;
 972         struct flowi6 fl6;
 973         bool want_cookie = false;
 974
 975         if (skb->protocol == htons(ETH_P_IP))
 976                 return tcp_v4_conn_request(sk, skb);
 977
 978         if (!ipv6_unicast_destination(skb))
 979                 goto drop;
 980
 981         if ((sysctl_tcp_syncookies == 2 ||
 982              inet_csk_reqsk_queue_is_full(sk)) && !isn) {
 983                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
 984                 if (!want_cookie)
 985                         goto drop;
 986         }
 987
 988         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
 989                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 990                 goto drop;
 991         }
 992
 993         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 994         if (req == NULL)
 995                 goto drop;
 996
 997 #ifdef CONFIG_TCP_MD5SIG
 998         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
 999 #endif
1000
1001         tcp_clear_options(&tmp_opt);
1002         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1003         tmp_opt.user_mss = tp->rx_opt.user_mss;
1004         tcp_parse_options(skb, &tmp_opt, 0, NULL);
1005
1006         if (want_cookie && !tmp_opt.saw_tstamp)
1007                 tcp_clear_options(&tmp_opt);
1008
1009         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1010         tcp_openreq_init(req, &tmp_opt, skb);
1011
1012         ireq = inet_rsk(req);
1013         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
1014         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
1015         if (!want_cookie || tmp_opt.tstamp_ok)
1016                 TCP_ECN_create_request(req, skb, sock_net(sk));
1017
1018         ireq->ir_iif = sk->sk_bound_dev_if;
1019
1020         /* So that link locals have meaning */
1021         if (!sk->sk_bound_dev_if &&
1022             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
1023                 ireq->ir_iif = inet6_iif(skb);
1024
1025         if (!isn) {
1026                 if (ipv6_opt_accepted(sk, skb) ||
1027                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1028                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim ||
1029                     np->repflow) {
1030                         atomic_inc(&skb->users);
1031                         ireq->pktopts = skb;
1032                 }
1033
1034                 if (want_cookie) {
1035                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1036                         req->cookie_ts = tmp_opt.tstamp_ok;
1037                         goto have_isn;
1038                 }
1039
1040                 /* VJ's idea. We save last timestamp seen
1041                  * from the destination in peer table, when entering
1042                  * state TIME-WAIT, and check against it before
1043                  * accepting new connection request.
1044                  *
1045                  * If "isn" is not zero, this request hit alive
1046                  * timewait bucket, so that all the necessary checks
1047                  * are made in the function processing timewait state.
1048                  */
1049                 if (tmp_opt.saw_tstamp &&
1050                     tcp_death_row.sysctl_tw_recycle &&
1051                     (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1052                         if (!tcp_peer_is_proven(req, dst, true)) {
1053                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1054                                 goto drop_and_release;
1055                         }
1056                 }
1057                 /* Kill the following clause, if you dislike this way. */
1058                 else if (!sysctl_tcp_syncookies &&
1059                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1060                           (sysctl_max_syn_backlog >> 2)) &&
1061                          !tcp_peer_is_proven(req, dst, false)) {
1062                         /* Without syncookies last quarter of
1063                          * backlog is filled with destinations,
1064                          * proven to be alive.
1065                          * It means that we continue to communicate
1066                          * to destinations, already remembered
1067                          * to the moment of synflood.
1068                          */
1069                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1070                                        &ireq->ir_v6_rmt_addr, ntohs(tcp_hdr(skb)->source));
1071                         goto drop_and_release;
1072                 }
1073
1074                 isn = tcp_v6_init_sequence(skb);
1075         }
1076 have_isn:
1077         tcp_rsk(req)->snt_isn = isn;
1078
1079         if (security_inet_conn_request(sk, skb, req))
1080                 goto drop_and_release;
1081
1082         if (tcp_v6_send_synack(sk, dst, &fl6, req,
1083                                skb_get_queue_mapping(skb)) ||
1084             want_cookie)
1085                 goto drop_and_free;
1086
1087         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1088         tcp_rsk(req)->listener = NULL;
1089         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1090         return 0;
1091
1092 drop_and_release:
1093         dst_release(dst);
1094 drop_and_free:
1095         reqsk_free(req);
1096 drop:
1097         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1098         return 0; /* don't send reset */
1099 }
1100
1101 static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1102                                          struct request_sock *req,
1103                                          struct dst_entry *dst)
1104 {
1105         struct inet_request_sock *ireq;
1106         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1107         struct tcp6_sock *newtcp6sk;
1108         struct inet_sock *newinet;
1109         struct tcp_sock *newtp;
1110         struct sock *newsk;
1111 #ifdef CONFIG_TCP_MD5SIG
1112         struct tcp_md5sig_key *key;
1113 #endif
1114         struct flowi6 fl6;
1115
1116         if (skb->protocol == htons(ETH_P_IP)) {
1117                 /*
1118                  *      v6 mapped
1119                  */
1120
1121                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1122
1123                 if (newsk == NULL)
1124                         return NULL;
1125
1126                 newtcp6sk = (struct tcp6_sock *)newsk;
1127                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1128
1129                 newinet = inet_sk(newsk);
1130                 newnp = inet6_sk(newsk);
1131                 newtp = tcp_sk(newsk);
1132
1133                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1134
1135                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newsk->sk_v6_daddr);
1136
1137                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1138
1139                 newsk->sk_v6_rcv_saddr = newnp->saddr;
1140
1141                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1142                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1143 #ifdef CONFIG_TCP_MD5SIG
1144                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1145 #endif
1146
1147                 newnp->ipv6_ac_list = NULL;
1148                 newnp->ipv6_fl_list = NULL;
1149                 newnp->pktoptions  = NULL;
1150                 newnp->opt         = NULL;
1151                 newnp->mcast_oif   = inet6_iif(skb);
1152                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1153                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1154                 if (np->repflow)
1155                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1156
1157                 /*
1158                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1159                  * here, tcp_create_openreq_child now does this for us, see the comment in
1160                  * that function for the gory details. -acme
1161                  */
1162
1163                 /* It is tricky place. Until this moment IPv4 tcp
1164                    worked with IPv6 icsk.icsk_af_ops.
1165                    Sync it now.
1166                  */
1167                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1168
1169                 return newsk;
1170         }
1171
1172         ireq = inet_rsk(req);
1173
1174         if (sk_acceptq_is_full(sk))
1175                 goto out_overflow;
1176
1177         if (!dst) {
1178                 dst = inet6_csk_route_req(sk, &fl6, req);
1179                 if (!dst)
1180                         goto out;
1181         }
1182
1183         newsk = tcp_create_openreq_child(sk, req, skb);
1184         if (newsk == NULL)
1185                 goto out_nonewsk;
1186
1187         /*
1188          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1189          * count here, tcp_create_openreq_child now does this for us, see the
1190          * comment in that function for the gory details. -acme
1191          */
1192
1193         newsk->sk_gso_type = SKB_GSO_TCPV6;
1194         __ip6_dst_store(newsk, dst, NULL, NULL);
1195         inet6_sk_rx_dst_set(newsk, skb);
1196
1197         newtcp6sk = (struct tcp6_sock *)newsk;
1198         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1199
1200         newtp = tcp_sk(newsk);
1201         newinet = inet_sk(newsk);
1202         newnp = inet6_sk(newsk);
1203
1204         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1205
1206         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1207         newnp->saddr = ireq->ir_v6_loc_addr;
1208         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1209         newsk->sk_bound_dev_if = ireq->ir_iif;
1210
1211         /* Now IPv6 options...
1212
1213            First: no IPv4 options.
1214          */
1215         newinet->inet_opt = NULL;
1216         newnp->ipv6_ac_list = NULL;
1217         newnp->ipv6_fl_list = NULL;
1218
1219         /* Clone RX bits */
1220         newnp->rxopt.all = np->rxopt.all;
1221
1222         /* Clone pktoptions received with SYN */
1223         newnp->pktoptions = NULL;
1224         if (ireq->pktopts != NULL) {
1225                 newnp->pktoptions = skb_clone(ireq->pktopts,
1226                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1227                 consume_skb(ireq->pktopts);
1228                 ireq->pktopts = NULL;
1229                 if (newnp->pktoptions)
1230                         skb_set_owner_r(newnp->pktoptions, newsk);
1231         }
1232         newnp->opt        = NULL;
1233         newnp->mcast_oif  = inet6_iif(skb);
1234         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1235         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1236         if (np->repflow)
1237                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1238
1239         /* Clone native IPv6 options from listening socket (if any)
1240
1241            Yes, keeping reference count would be much more clever,
1242            but we make one more one thing there: reattach optmem
1243            to newsk.
1244          */
1245         if (np->opt)
1246                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1247
1248         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1249         if (newnp->opt)
1250                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1251                                                      newnp->opt->opt_flen);
1252
1253         tcp_sync_mss(newsk, dst_mtu(dst));
1254         newtp->advmss = dst_metric_advmss(dst);
1255         if (tcp_sk(sk)->rx_opt.user_mss &&
1256             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1257                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1258
1259         tcp_initialize_rcv_mss(newsk);
1260
1261         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1262         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1263
1264 #ifdef CONFIG_TCP_MD5SIG
1265         /* Copy over the MD5 key from the original socket */
1266         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1267         if (key != NULL) {
1268                 /* We're using one, so create a matching key
1269                  * on the newsk structure. If we fail to get
1270                  * memory, then we end up not copying the key
1271                  * across. Shucks.
1272                  */
1273                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1274                                AF_INET6, key->key, key->keylen,
1275                                sk_gfp_atomic(sk, GFP_ATOMIC));
1276         }
1277 #endif
1278
1279         if (__inet_inherit_port(sk, newsk) < 0) {
1280                 inet_csk_prepare_forced_close(newsk);
1281                 tcp_done(newsk);
1282                 goto out;
1283         }
1284         __inet6_hash(newsk, NULL);
1285
1286         return newsk;
1287
1288 out_overflow:
1289         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1290 out_nonewsk:
1291         dst_release(dst);
1292 out:
1293         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1294         return NULL;
1295 }
1296
1297 /* The socket must have it's spinlock held when we get
1298  * here.
1299  *
1300  * We have a potential double-lock case here, so even when
1301  * doing backlog processing we use the BH locking scheme.
1302  * This is because we cannot sleep with the original spinlock
1303  * held.
1304  */
1305 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1306 {
1307         struct ipv6_pinfo *np = inet6_sk(sk);
1308         struct tcp_sock *tp;
1309         struct sk_buff *opt_skb = NULL;
1310
1311         /* Imagine: socket is IPv6. IPv4 packet arrives,
1312            goes to IPv4 receive handler and backlogged.
1313            From backlog it always goes here. Kerboom...
1314            Fortunately, tcp_rcv_established and rcv_established
1315            handle them correctly, but it is not case with
1316            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1317          */
1318
1319         if (skb->protocol == htons(ETH_P_IP))
1320                 return tcp_v4_do_rcv(sk, skb);
1321
1322 #ifdef CONFIG_TCP_MD5SIG
1323         if (tcp_v6_inbound_md5_hash(sk, skb))
1324                 goto discard;
1325 #endif
1326
1327         if (sk_filter(sk, skb))
1328                 goto discard;
1329
1330         /*
1331          *      socket locking is here for SMP purposes as backlog rcv
1332          *      is currently called with bh processing disabled.
1333          */
1334
1335         /* Do Stevens' IPV6_PKTOPTIONS.
1336
1337            Yes, guys, it is the only place in our code, where we
1338            may make it not affecting IPv4.
1339            The rest of code is protocol independent,
1340            and I do not like idea to uglify IPv4.
1341
1342            Actually, all the idea behind IPV6_PKTOPTIONS
1343            looks not very well thought. For now we latch
1344            options, received in the last packet, enqueued
1345            by tcp. Feel free to propose better solution.
1346                                                --ANK (980728)
1347          */
1348         if (np->rxopt.all)
1349                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1350
1351         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1352                 struct dst_entry *dst = sk->sk_rx_dst;
1353
1354                 sock_rps_save_rxhash(sk, skb);
1355                 if (dst) {
1356                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1357                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1358                                 dst_release(dst);
1359                                 sk->sk_rx_dst = NULL;
1360                         }
1361                 }
1362
1363                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1364                 if (opt_skb)
1365                         goto ipv6_pktoptions;
1366                 return 0;
1367         }
1368
1369         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1370                 goto csum_err;
1371
1372         if (sk->sk_state == TCP_LISTEN) {
1373                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1374                 if (!nsk)
1375                         goto discard;
1376
1377                 /*
1378                  * Queue it on the new socket if the new socket is active,
1379                  * otherwise we just shortcircuit this and continue with
1380                  * the new socket..
1381                  */
1382                 if (nsk != sk) {
1383                         sock_rps_save_rxhash(nsk, skb);
1384                         if (tcp_child_process(sk, nsk, skb))
1385                                 goto reset;
1386                         if (opt_skb)
1387                                 __kfree_skb(opt_skb);
1388                         return 0;
1389                 }
1390         } else
1391                 sock_rps_save_rxhash(sk, skb);
1392
1393         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1394                 goto reset;
1395         if (opt_skb)
1396                 goto ipv6_pktoptions;
1397         return 0;
1398
1399 reset:
1400         tcp_v6_send_reset(sk, skb);
1401 discard:
1402         if (opt_skb)
1403                 __kfree_skb(opt_skb);
1404         kfree_skb(skb);
1405         return 0;
1406 csum_err:
1407         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1408         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1409         goto discard;
1410
1411
1412 ipv6_pktoptions:
1413         /* Do you ask, what is it?
1414
1415            1. skb was enqueued by tcp.
1416            2. skb is added to tail of read queue, rather than out of order.
1417            3. socket is not in passive state.
1418            4. Finally, it really contains options, which user wants to receive.
1419          */
1420         tp = tcp_sk(sk);
1421         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1422             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1423                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1424                         np->mcast_oif = inet6_iif(opt_skb);
1425                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1426                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1427                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1428                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1429                 if (np->repflow)
1430                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1431                 if (ipv6_opt_accepted(sk, opt_skb)) {
1432                         skb_set_owner_r(opt_skb, sk);
1433                         opt_skb = xchg(&np->pktoptions, opt_skb);
1434                 } else {
1435                         __kfree_skb(opt_skb);
1436                         opt_skb = xchg(&np->pktoptions, NULL);
1437                 }
1438         }
1439
1440         kfree_skb(opt_skb);
1441         return 0;
1442 }
1443
1444 static int tcp_v6_rcv(struct sk_buff *skb)
1445 {
1446         const struct tcphdr *th;
1447         const struct ipv6hdr *hdr;
1448         struct sock *sk;
1449         int ret;
1450         struct net *net = dev_net(skb->dev);
1451
1452         if (skb->pkt_type != PACKET_HOST)
1453                 goto discard_it;
1454
1455         /*
1456          *      Count it even if it's bad.
1457          */
1458         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1459
1460         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1461                 goto discard_it;
1462
1463         th = tcp_hdr(skb);
1464
1465         if (th->doff < sizeof(struct tcphdr)/4)
1466                 goto bad_packet;
1467         if (!pskb_may_pull(skb, th->doff*4))
1468                 goto discard_it;
1469
1470         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1471                 goto csum_error;
1472
1473         th = tcp_hdr(skb);
1474         hdr = ipv6_hdr(skb);
1475         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1476         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1477                                     skb->len - th->doff*4);
1478         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1479         TCP_SKB_CB(skb)->when = 0;
1480         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1481         TCP_SKB_CB(skb)->sacked = 0;
1482
1483         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1484         if (!sk)
1485                 goto no_tcp_socket;
1486
1487 process:
1488         if (sk->sk_state == TCP_TIME_WAIT)
1489                 goto do_time_wait;
1490
1491         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1492                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1493                 goto discard_and_relse;
1494         }
1495
1496         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1497                 goto discard_and_relse;
1498
1499         if (sk_filter(sk, skb))
1500                 goto discard_and_relse;
1501
1502         sk_mark_napi_id(sk, skb);
1503         skb->dev = NULL;
1504
1505         bh_lock_sock_nested(sk);
1506         ret = 0;
1507         if (!sock_owned_by_user(sk)) {
1508 #ifdef CONFIG_NET_DMA
1509                 struct tcp_sock *tp = tcp_sk(sk);
1510                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1511                         tp->ucopy.dma_chan = net_dma_find_channel();
1512                 if (tp->ucopy.dma_chan)
1513                         ret = tcp_v6_do_rcv(sk, skb);
1514                 else
1515 #endif
1516                 {
1517                         if (!tcp_prequeue(sk, skb))
1518                                 ret = tcp_v6_do_rcv(sk, skb);
1519                 }
1520         } else if (unlikely(sk_add_backlog(sk, skb,
1521                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1522                 bh_unlock_sock(sk);
1523                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1524                 goto discard_and_relse;
1525         }
1526         bh_unlock_sock(sk);
1527
1528         sock_put(sk);
1529         return ret ? -1 : 0;
1530
1531 no_tcp_socket:
1532         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1533                 goto discard_it;
1534
1535         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1536 csum_error:
1537                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1538 bad_packet:
1539                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1540         } else {
1541                 tcp_v6_send_reset(NULL, skb);
1542         }
1543
1544 discard_it:
1545         kfree_skb(skb);
1546         return 0;
1547
1548 discard_and_relse:
1549         sock_put(sk);
1550         goto discard_it;
1551
1552 do_time_wait:
1553         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1554                 inet_twsk_put(inet_twsk(sk));
1555                 goto discard_it;
1556         }
1557
1558         if (skb->len < (th->doff<<2)) {
1559                 inet_twsk_put(inet_twsk(sk));
1560                 goto bad_packet;
1561         }
1562         if (tcp_checksum_complete(skb)) {
1563                 inet_twsk_put(inet_twsk(sk));
1564                 goto csum_error;
1565         }
1566
1567         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1568         case TCP_TW_SYN:
1569         {
1570                 struct sock *sk2;
1571
1572                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1573                                             &ipv6_hdr(skb)->saddr, th->source,
1574                                             &ipv6_hdr(skb)->daddr,
1575                                             ntohs(th->dest), inet6_iif(skb));
1576                 if (sk2 != NULL) {
1577                         struct inet_timewait_sock *tw = inet_twsk(sk);
1578                         inet_twsk_deschedule(tw, &tcp_death_row);
1579                         inet_twsk_put(tw);
1580                         sk = sk2;
1581                         goto process;
1582                 }
1583                 /* Fall through to ACK */
1584         }
1585         case TCP_TW_ACK:
1586                 tcp_v6_timewait_ack(sk, skb);
1587                 break;
1588         case TCP_TW_RST:
1589                 goto no_tcp_socket;
1590         case TCP_TW_SUCCESS:
1591                 ;
1592         }
1593         goto discard_it;
1594 }
1595
1596 static void tcp_v6_early_demux(struct sk_buff *skb)
1597 {
1598         const struct ipv6hdr *hdr;
1599         const struct tcphdr *th;
1600         struct sock *sk;
1601
1602         if (skb->pkt_type != PACKET_HOST)
1603                 return;
1604
1605         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1606                 return;
1607
1608         hdr = ipv6_hdr(skb);
1609         th = tcp_hdr(skb);
1610
1611         if (th->doff < sizeof(struct tcphdr) / 4)
1612                 return;
1613
1614         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1615                                         &hdr->saddr, th->source,
1616                                         &hdr->daddr, ntohs(th->dest),
1617                                         inet6_iif(skb));
1618         if (sk) {
1619                 skb->sk = sk;
1620                 skb->destructor = sock_edemux;
1621                 if (sk->sk_state != TCP_TIME_WAIT) {
1622                         struct dst_entry *dst = sk->sk_rx_dst;
1623
1624                         if (dst)
1625                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1626                         if (dst &&
1627                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1628                                 skb_dst_set_noref(skb, dst);
1629                 }
1630         }
1631 }
1632
1633 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1634         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1635         .twsk_unique    = tcp_twsk_unique,
1636         .twsk_destructor = tcp_twsk_destructor,
1637 };
1638
1639 static const struct inet_connection_sock_af_ops ipv6_specific = {
1640         .queue_xmit        = inet6_csk_xmit,
1641         .send_check        = tcp_v6_send_check,
1642         .rebuild_header    = inet6_sk_rebuild_header,
1643         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1644         .conn_request      = tcp_v6_conn_request,
1645         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1646         .net_header_len    = sizeof(struct ipv6hdr),
1647         .net_frag_header_len = sizeof(struct frag_hdr),
1648         .setsockopt        = ipv6_setsockopt,
1649         .getsockopt        = ipv6_getsockopt,
1650         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1651         .sockaddr_len      = sizeof(struct sockaddr_in6),
1652         .bind_conflict     = inet6_csk_bind_conflict,
1653 #ifdef CONFIG_COMPAT
1654         .compat_setsockopt = compat_ipv6_setsockopt,
1655         .compat_getsockopt = compat_ipv6_getsockopt,
1656 #endif
1657 };
1658
1659 #ifdef CONFIG_TCP_MD5SIG
1660 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1661         .md5_lookup     =       tcp_v6_md5_lookup,
1662         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1663         .md5_parse      =       tcp_v6_parse_md5_keys,
1664 };
1665 #endif
1666
1667 /*
1668  *      TCP over IPv4 via INET6 API
1669  */
1670 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1671         .queue_xmit        = ip_queue_xmit,
1672         .send_check        = tcp_v4_send_check,
1673         .rebuild_header    = inet_sk_rebuild_header,
1674         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1675         .conn_request      = tcp_v6_conn_request,
1676         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1677         .net_header_len    = sizeof(struct iphdr),
1678         .setsockopt        = ipv6_setsockopt,
1679         .getsockopt        = ipv6_getsockopt,
1680         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1681         .sockaddr_len      = sizeof(struct sockaddr_in6),
1682         .bind_conflict     = inet6_csk_bind_conflict,
1683 #ifdef CONFIG_COMPAT
1684         .compat_setsockopt = compat_ipv6_setsockopt,
1685         .compat_getsockopt = compat_ipv6_getsockopt,
1686 #endif
1687 };
1688
1689 #ifdef CONFIG_TCP_MD5SIG
1690 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1691         .md5_lookup     =       tcp_v4_md5_lookup,
1692         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1693         .md5_parse      =       tcp_v6_parse_md5_keys,
1694 };
1695 #endif
1696
1697 /* NOTE: A lot of things set to zero explicitly by call to
1698  *       sk_alloc() so need not be done here.
1699  */
1700 static int tcp_v6_init_sock(struct sock *sk)
1701 {
1702         struct inet_connection_sock *icsk = inet_csk(sk);
1703
1704         tcp_init_sock(sk);
1705
1706         icsk->icsk_af_ops = &ipv6_specific;
1707
1708 #ifdef CONFIG_TCP_MD5SIG
1709         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1710 #endif
1711
1712         return 0;
1713 }
1714
1715 static void tcp_v6_destroy_sock(struct sock *sk)
1716 {
1717         tcp_v4_destroy_sock(sk);
1718         inet6_destroy_sock(sk);
1719 }
1720
1721 #ifdef CONFIG_PROC_FS
1722 /* Proc filesystem TCPv6 sock list dumping. */
1723 static void get_openreq6(struct seq_file *seq,
1724                          const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1725 {
1726         int ttd = req->expires - jiffies;
1727         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1728         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1729
1730         if (ttd < 0)
1731                 ttd = 0;
1732
1733         seq_printf(seq,
1734                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1735                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1736                    i,
1737                    src->s6_addr32[0], src->s6_addr32[1],
1738                    src->s6_addr32[2], src->s6_addr32[3],
1739                    inet_rsk(req)->ir_num,
1740                    dest->s6_addr32[0], dest->s6_addr32[1],
1741                    dest->s6_addr32[2], dest->s6_addr32[3],
1742                    ntohs(inet_rsk(req)->ir_rmt_port),
1743                    TCP_SYN_RECV,
1744                    0, 0, /* could print option size, but that is af dependent. */
1745                    1,   /* timers active (only the expire timer) */
1746                    jiffies_to_clock_t(ttd),
1747                    req->num_timeout,
1748                    from_kuid_munged(seq_user_ns(seq), uid),
1749                    0,  /* non standard timer */
1750                    0, /* open_requests have no inode */
1751                    0, req);
1752 }
1753
1754 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1755 {
1756         const struct in6_addr *dest, *src;
1757         __u16 destp, srcp;
1758         int timer_active;
1759         unsigned long timer_expires;
1760         const struct inet_sock *inet = inet_sk(sp);
1761         const struct tcp_sock *tp = tcp_sk(sp);
1762         const struct inet_connection_sock *icsk = inet_csk(sp);
1763
1764         dest  = &sp->sk_v6_daddr;
1765         src   = &sp->sk_v6_rcv_saddr;
1766         destp = ntohs(inet->inet_dport);
1767         srcp  = ntohs(inet->inet_sport);
1768
1769         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1770                 timer_active    = 1;
1771                 timer_expires   = icsk->icsk_timeout;
1772         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1773                 timer_active    = 4;
1774                 timer_expires   = icsk->icsk_timeout;
1775         } else if (timer_pending(&sp->sk_timer)) {
1776                 timer_active    = 2;
1777                 timer_expires   = sp->sk_timer.expires;
1778         } else {
1779                 timer_active    = 0;
1780                 timer_expires = jiffies;
1781         }
1782
1783         seq_printf(seq,
1784                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1785                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1786                    i,
1787                    src->s6_addr32[0], src->s6_addr32[1],
1788                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1789                    dest->s6_addr32[0], dest->s6_addr32[1],
1790                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1791                    sp->sk_state,
1792                    tp->write_seq-tp->snd_una,
1793                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1794                    timer_active,
1795                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1796                    icsk->icsk_retransmits,
1797                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1798                    icsk->icsk_probes_out,
1799                    sock_i_ino(sp),
1800                    atomic_read(&sp->sk_refcnt), sp,
1801                    jiffies_to_clock_t(icsk->icsk_rto),
1802                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1803                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1804                    tp->snd_cwnd,
1805                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
1806                    );
1807 }
1808
1809 static void get_timewait6_sock(struct seq_file *seq,
1810                                struct inet_timewait_sock *tw, int i)
1811 {
1812         const struct in6_addr *dest, *src;
1813         __u16 destp, srcp;
1814         s32 delta = tw->tw_ttd - inet_tw_time_stamp();
1815
1816         dest = &tw->tw_v6_daddr;
1817         src  = &tw->tw_v6_rcv_saddr;
1818         destp = ntohs(tw->tw_dport);
1819         srcp  = ntohs(tw->tw_sport);
1820
1821         seq_printf(seq,
1822                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1823                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1824                    i,
1825                    src->s6_addr32[0], src->s6_addr32[1],
1826                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1827                    dest->s6_addr32[0], dest->s6_addr32[1],
1828                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1829                    tw->tw_substate, 0, 0,
1830                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1831                    atomic_read(&tw->tw_refcnt), tw);
1832 }
1833
1834 static int tcp6_seq_show(struct seq_file *seq, void *v)
1835 {
1836         struct tcp_iter_state *st;
1837         struct sock *sk = v;
1838
1839         if (v == SEQ_START_TOKEN) {
1840                 seq_puts(seq,
1841                          "  sl  "
1842                          "local_address                         "
1843                          "remote_address                        "
1844                          "st tx_queue rx_queue tr tm->when retrnsmt"
1845                          "   uid  timeout inode\n");
1846                 goto out;
1847         }
1848         st = seq->private;
1849
1850         switch (st->state) {
1851         case TCP_SEQ_STATE_LISTENING:
1852         case TCP_SEQ_STATE_ESTABLISHED:
1853                 if (sk->sk_state == TCP_TIME_WAIT)
1854                         get_timewait6_sock(seq, v, st->num);
1855                 else
1856                         get_tcp6_sock(seq, v, st->num);
1857                 break;
1858         case TCP_SEQ_STATE_OPENREQ:
1859                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1860                 break;
1861         }
1862 out:
1863         return 0;
1864 }
1865
1866 static const struct file_operations tcp6_afinfo_seq_fops = {
1867         .owner   = THIS_MODULE,
1868         .open    = tcp_seq_open,
1869         .read    = seq_read,
1870         .llseek  = seq_lseek,
1871         .release = seq_release_net
1872 };
1873
1874 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1875         .name           = "tcp6",
1876         .family         = AF_INET6,
1877         .seq_fops       = &tcp6_afinfo_seq_fops,
1878         .seq_ops        = {
1879                 .show           = tcp6_seq_show,
1880         },
1881 };
1882
1883 int __net_init tcp6_proc_init(struct net *net)
1884 {
1885         return tcp_proc_register(net, &tcp6_seq_afinfo);
1886 }
1887
1888 void tcp6_proc_exit(struct net *net)
1889 {
1890         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1891 }
1892 #endif
1893
1894 static void tcp_v6_clear_sk(struct sock *sk, int size)
1895 {
1896         struct inet_sock *inet = inet_sk(sk);
1897
1898         /* we do not want to clear pinet6 field, because of RCU lookups */
1899         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1900
1901         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1902         memset(&inet->pinet6 + 1, 0, size);
1903 }
1904
1905 struct proto tcpv6_prot = {
1906         .name                   = "TCPv6",
1907         .owner                  = THIS_MODULE,
1908         .close                  = tcp_close,
1909         .connect                = tcp_v6_connect,
1910         .disconnect             = tcp_disconnect,
1911         .accept                 = inet_csk_accept,
1912         .ioctl                  = tcp_ioctl,
1913         .init                   = tcp_v6_init_sock,
1914         .destroy                = tcp_v6_destroy_sock,
1915         .shutdown               = tcp_shutdown,
1916         .setsockopt             = tcp_setsockopt,
1917         .getsockopt             = tcp_getsockopt,
1918         .recvmsg                = tcp_recvmsg,
1919         .sendmsg                = tcp_sendmsg,
1920         .sendpage               = tcp_sendpage,
1921         .backlog_rcv            = tcp_v6_do_rcv,
1922         .release_cb             = tcp_release_cb,
1923         .mtu_reduced            = tcp_v6_mtu_reduced,
1924         .hash                   = tcp_v6_hash,
1925         .unhash                 = inet_unhash,
1926         .get_port               = inet_csk_get_port,
1927         .enter_memory_pressure  = tcp_enter_memory_pressure,
1928         .stream_memory_free     = tcp_stream_memory_free,
1929         .sockets_allocated      = &tcp_sockets_allocated,
1930         .memory_allocated       = &tcp_memory_allocated,
1931         .memory_pressure        = &tcp_memory_pressure,
1932         .orphan_count           = &tcp_orphan_count,
1933         .sysctl_mem             = sysctl_tcp_mem,
1934         .sysctl_wmem            = sysctl_tcp_wmem,
1935         .sysctl_rmem            = sysctl_tcp_rmem,
1936         .max_header             = MAX_TCP_HEADER,
1937         .obj_size               = sizeof(struct tcp6_sock),
1938         .slab_flags             = SLAB_DESTROY_BY_RCU,
1939         .twsk_prot              = &tcp6_timewait_sock_ops,
1940         .rsk_prot               = &tcp6_request_sock_ops,
1941         .h.hashinfo             = &tcp_hashinfo,
1942         .no_autobind            = true,
1943 #ifdef CONFIG_COMPAT
1944         .compat_setsockopt      = compat_tcp_setsockopt,
1945         .compat_getsockopt      = compat_tcp_getsockopt,
1946 #endif
1947 #ifdef CONFIG_MEMCG_KMEM
1948         .proto_cgroup           = tcp_proto_cgroup,
1949 #endif
1950         .clear_sk               = tcp_v6_clear_sk,
1951 };
1952
1953 static const struct inet6_protocol tcpv6_protocol = {
1954         .early_demux    =       tcp_v6_early_demux,
1955         .handler        =       tcp_v6_rcv,
1956         .err_handler    =       tcp_v6_err,
1957         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1958 };
1959
1960 static struct inet_protosw tcpv6_protosw = {
1961         .type           =       SOCK_STREAM,
1962         .protocol       =       IPPROTO_TCP,
1963         .prot           =       &tcpv6_prot,
1964         .ops            =       &inet6_stream_ops,
1965         .no_check       =       0,
1966         .flags          =       INET_PROTOSW_PERMANENT |
1967                                 INET_PROTOSW_ICSK,
1968 };
1969
1970 static int __net_init tcpv6_net_init(struct net *net)
1971 {
1972         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1973                                     SOCK_RAW, IPPROTO_TCP, net);
1974 }
1975
1976 static void __net_exit tcpv6_net_exit(struct net *net)
1977 {
1978         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1979 }
1980
1981 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1982 {
1983         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1984 }
1985
1986 static struct pernet_operations tcpv6_net_ops = {
1987         .init       = tcpv6_net_init,
1988         .exit       = tcpv6_net_exit,
1989         .exit_batch = tcpv6_net_exit_batch,
1990 };
1991
1992 int __init tcpv6_init(void)
1993 {
1994         int ret;
1995
1996         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1997         if (ret)
1998                 goto out;
1999
2000         /* register inet6 protocol */
2001         ret = inet6_register_protosw(&tcpv6_protosw);
2002         if (ret)
2003                 goto out_tcpv6_protocol;
2004
2005         ret = register_pernet_subsys(&tcpv6_net_ops);
2006         if (ret)
2007                 goto out_tcpv6_protosw;
2008 out:
2009         return ret;
2010
2011 out_tcpv6_protosw:
2012         inet6_unregister_protosw(&tcpv6_protosw);
2013 out_tcpv6_protocol:
2014         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2015         goto out;
2016 }
2017
2018 void tcpv6_exit(void)
2019 {
2020         unregister_pernet_subsys(&tcpv6_net_ops);
2021         inet6_unregister_protosw(&tcpv6_protosw);
2022         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2023 }