net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/config.h>
  30 #include <linux/errno.h>
  31 #include <linux/types.h>
  32 #include <linux/socket.h>
  33 #include <linux/sockios.h>
  34 #include <linux/net.h>
  35 #include <linux/jiffies.h>
  36 #include <linux/in.h>
  37 #include <linux/in6.h>
  38 #include <linux/netdevice.h>
  39 #include <linux/init.h>
  40 #include <linux/jhash.h>
  41 #include <linux/ipsec.h>
  42 #include <linux/times.h>
  43
  44 #include <linux/ipv6.h>
  45 #include <linux/icmpv6.h>
  46 #include <linux/random.h>
  47
  48 #include <net/tcp.h>
  49 #include <net/ndisc.h>
  50 #include <net/inet6_hashtables.h>
  51 #include <net/inet6_connection_sock.h>
  52 #include <net/ipv6.h>
  53 #include <net/transp_v6.h>
  54 #include <net/addrconf.h>
  55 #include <net/ip6_route.h>
  56 #include <net/ip6_checksum.h>
  57 #include <net/inet_ecn.h>
  58 #include <net/protocol.h>
  59 #include <net/xfrm.h>
  60 #include <net/addrconf.h>
  61 #include <net/snmp.h>
  62 #include <net/dsfield.h>
  63 #include <net/timewait_sock.h>
  64
  65 #include <asm/uaccess.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 /* Socket used for sending RSTs and ACKs */
  71 static struct socket *tcp6_socket;
  72
  73 static void     tcp_v6_send_reset(struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
  75 static void     tcp_v6_send_check(struct sock *sk, int len,
  76                                   struct sk_buff *skb);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80 static struct inet_connection_sock_af_ops ipv6_mapped;
  81 static struct inet_connection_sock_af_ops ipv6_specific;
  82
  83 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
  84 {
  85         return inet_csk_get_port(&tcp_hashinfo, sk, snum,
  86                                  inet6_csk_bind_conflict);
  87 }
  88
  89 static void tcp_v6_hash(struct sock *sk)
  90 {
  91         if (sk->sk_state != TCP_CLOSE) {
  92                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  93                         tcp_prot.hash(sk);
  94                         return;
  95                 }
  96                 local_bh_disable();
  97                 __inet6_hash(&tcp_hashinfo, sk);
  98                 local_bh_enable();
  99         }
 100 }
 101
 102 static __inline__ u16 tcp_v6_check(struct tcphdr *th, int len,
 103                                    struct in6_addr *saddr,
 104                                    struct in6_addr *daddr,
 105                                    unsigned long base)
 106 {
 107         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 108 }
 109
 110 static __u32 tcp_v6_init_sequence(struct sock *sk, struct sk_buff *skb)
 111 {
 112         if (skb->protocol == htons(ETH_P_IPV6)) {
 113                 return secure_tcpv6_sequence_number(skb->nh.ipv6h->daddr.s6_addr32,
 114                                                     skb->nh.ipv6h->saddr.s6_addr32,
 115                                                     skb->h.th->dest,
 116                                                     skb->h.th->source);
 117         } else {
 118                 return secure_tcp_sequence_number(skb->nh.iph->daddr,
 119                                                   skb->nh.iph->saddr,
 120                                                   skb->h.th->dest,
 121                                                   skb->h.th->source);
 122         }
 123 }
 124
 125 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 126                           int addr_len)
 127 {
 128         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 129         struct inet_sock *inet = inet_sk(sk);
 130         struct inet_connection_sock *icsk = inet_csk(sk);
 131         struct ipv6_pinfo *np = inet6_sk(sk);
 132         struct tcp_sock *tp = tcp_sk(sk);
 133         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 134         struct flowi fl;
 135         struct dst_entry *dst;
 136         int addr_type;
 137         int err;
 138
 139         if (addr_len < SIN6_LEN_RFC2133)
 140                 return -EINVAL;
 141
 142         if (usin->sin6_family != AF_INET6)
 143                 return(-EAFNOSUPPORT);
 144
 145         memset(&fl, 0, sizeof(fl));
 146
 147         if (np->sndflow) {
 148                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 149                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 150                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 151                         struct ip6_flowlabel *flowlabel;
 152                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 153                         if (flowlabel == NULL)
 154                                 return -EINVAL;
 155                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 156                         fl6_sock_release(flowlabel);
 157                 }
 158         }
 159
 160         /*
 161          *      connect() to INADDR_ANY means loopback (BSD'ism).
 162          */
 163
 164         if(ipv6_addr_any(&usin->sin6_addr))
 165                 usin->sin6_addr.s6_addr[15] = 0x1;
 166
 167         addr_type = ipv6_addr_type(&usin->sin6_addr);
 168
 169         if(addr_type & IPV6_ADDR_MULTICAST)
 170                 return -ENETUNREACH;
 171
 172         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 173                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 174                     usin->sin6_scope_id) {
 175                         /* If interface is set while binding, indices
 176                          * must coincide.
 177                          */
 178                         if (sk->sk_bound_dev_if &&
 179                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 180                                 return -EINVAL;
 181
 182                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 183                 }
 184
 185                 /* Connect to link-local address requires an interface */
 186                 if (!sk->sk_bound_dev_if)
 187                         return -EINVAL;
 188         }
 189
 190         if (tp->rx_opt.ts_recent_stamp &&
 191             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 192                 tp->rx_opt.ts_recent = 0;
 193                 tp->rx_opt.ts_recent_stamp = 0;
 194                 tp->write_seq = 0;
 195         }
 196
 197         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 198         np->flow_label = fl.fl6_flowlabel;
 199
 200         /*
 201          *      TCP over IPv4
 202          */
 203
 204         if (addr_type == IPV6_ADDR_MAPPED) {
 205                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 206                 struct sockaddr_in sin;
 207
 208                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 209
 210                 if (__ipv6_only_sock(sk))
 211                         return -ENETUNREACH;
 212
 213                 sin.sin_family = AF_INET;
 214                 sin.sin_port = usin->sin6_port;
 215                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 216
 217                 icsk->icsk_af_ops = &ipv6_mapped;
 218                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 219
 220                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 221
 222                 if (err) {
 223                         icsk->icsk_ext_hdr_len = exthdrlen;
 224                         icsk->icsk_af_ops = &ipv6_specific;
 225                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 226                         goto failure;
 227                 } else {
 228                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 229                                       inet->saddr);
 230                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 231                                       inet->rcv_saddr);
 232                 }
 233
 234                 return err;
 235         }
 236
 237         if (!ipv6_addr_any(&np->rcv_saddr))
 238                 saddr = &np->rcv_saddr;
 239
 240         fl.proto = IPPROTO_TCP;
 241         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 242         ipv6_addr_copy(&fl.fl6_src,
 243                        (saddr ? saddr : &np->saddr));
 244         fl.oif = sk->sk_bound_dev_if;
 245         fl.fl_ip_dport = usin->sin6_port;
 246         fl.fl_ip_sport = inet->sport;
 247
 248         if (np->opt && np->opt->srcrt) {
 249                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 250                 ipv6_addr_copy(&final, &fl.fl6_dst);
 251                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 252                 final_p = &final;
 253         }
 254
 255         err = ip6_dst_lookup(sk, &dst, &fl);
 256         if (err)
 257                 goto failure;
 258         if (final_p)
 259                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 260
 261         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 262                 goto failure;
 263
 264         if (saddr == NULL) {
 265                 saddr = &fl.fl6_src;
 266                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 267         }
 268
 269         /* set the source address */
 270         ipv6_addr_copy(&np->saddr, saddr);
 271         inet->rcv_saddr = LOOPBACK4_IPV6;
 272
 273         sk->sk_gso_type = SKB_GSO_TCPV6;
 274         ip6_dst_store(sk, dst, NULL);
 275
 276         icsk->icsk_ext_hdr_len = 0;
 277         if (np->opt)
 278                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 279                                           np->opt->opt_nflen);
 280
 281         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 282
 283         inet->dport = usin->sin6_port;
 284
 285         tcp_set_state(sk, TCP_SYN_SENT);
 286         err = inet6_hash_connect(&tcp_death_row, sk);
 287         if (err)
 288                 goto late_failure;
 289
 290         if (!tp->write_seq)
 291                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 292                                                              np->daddr.s6_addr32,
 293                                                              inet->sport,
 294                                                              inet->dport);
 295
 296         err = tcp_connect(sk);
 297         if (err)
 298                 goto late_failure;
 299
 300         return 0;
 301
 302 late_failure:
 303         tcp_set_state(sk, TCP_CLOSE);
 304         __sk_dst_reset(sk);
 305 failure:
 306         inet->dport = 0;
 307         sk->sk_route_caps = 0;
 308         return err;
 309 }
 310
 311 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 312                 int type, int code, int offset, __u32 info)
 313 {
 314         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 315         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 316         struct ipv6_pinfo *np;
 317         struct sock *sk;
 318         int err;
 319         struct tcp_sock *tp;
 320         __u32 seq;
 321
 322         sk = inet6_lookup(&tcp_hashinfo, &hdr->daddr, th->dest, &hdr->saddr,
 323                           th->source, skb->dev->ifindex);
 324
 325         if (sk == NULL) {
 326                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 327                 return;
 328         }
 329
 330         if (sk->sk_state == TCP_TIME_WAIT) {
 331                 inet_twsk_put((struct inet_timewait_sock *)sk);
 332                 return;
 333         }
 334
 335         bh_lock_sock(sk);
 336         if (sock_owned_by_user(sk))
 337                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 338
 339         if (sk->sk_state == TCP_CLOSE)
 340                 goto out;
 341
 342         tp = tcp_sk(sk);
 343         seq = ntohl(th->seq);
 344         if (sk->sk_state != TCP_LISTEN &&
 345             !between(seq, tp->snd_una, tp->snd_nxt)) {
 346                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 347                 goto out;
 348         }
 349
 350         np = inet6_sk(sk);
 351
 352         if (type == ICMPV6_PKT_TOOBIG) {
 353                 struct dst_entry *dst = NULL;
 354
 355                 if (sock_owned_by_user(sk))
 356                         goto out;
 357                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 358                         goto out;
 359
 360                 /* icmp should have updated the destination cache entry */
 361                 dst = __sk_dst_check(sk, np->dst_cookie);
 362
 363                 if (dst == NULL) {
 364                         struct inet_sock *inet = inet_sk(sk);
 365                         struct flowi fl;
 366
 367                         /* BUGGG_FUTURE: Again, it is not clear how
 368                            to handle rthdr case. Ignore this complexity
 369                            for now.
 370                          */
 371                         memset(&fl, 0, sizeof(fl));
 372                         fl.proto = IPPROTO_TCP;
 373                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 374                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 375                         fl.oif = sk->sk_bound_dev_if;
 376                         fl.fl_ip_dport = inet->dport;
 377                         fl.fl_ip_sport = inet->sport;
 378
 379                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 380                                 sk->sk_err_soft = -err;
 381                                 goto out;
 382                         }
 383
 384                         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 385                                 sk->sk_err_soft = -err;
 386                                 goto out;
 387                         }
 388
 389                 } else
 390                         dst_hold(dst);
 391
 392                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 393                         tcp_sync_mss(sk, dst_mtu(dst));
 394                         tcp_simple_retransmit(sk);
 395                 } /* else let the usual retransmit timer handle it */
 396                 dst_release(dst);
 397                 goto out;
 398         }
 399
 400         icmpv6_err_convert(type, code, &err);
 401
 402         /* Might be for an request_sock */
 403         switch (sk->sk_state) {
 404                 struct request_sock *req, **prev;
 405         case TCP_LISTEN:
 406                 if (sock_owned_by_user(sk))
 407                         goto out;
 408
 409                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 410                                            &hdr->saddr, inet6_iif(skb));
 411                 if (!req)
 412                         goto out;
 413
 414                 /* ICMPs are not backlogged, hence we cannot get
 415                  * an established socket here.
 416                  */
 417                 BUG_TRAP(req->sk == NULL);
 418
 419                 if (seq != tcp_rsk(req)->snt_isn) {
 420                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 421                         goto out;
 422                 }
 423
 424                 inet_csk_reqsk_queue_drop(sk, req, prev);
 425                 goto out;
 426
 427         case TCP_SYN_SENT:
 428         case TCP_SYN_RECV:  /* Cannot happen.
 429                                It can, it SYNs are crossed. --ANK */
 430                 if (!sock_owned_by_user(sk)) {
 431                         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 432                         sk->sk_err = err;
 433                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 434
 435                         tcp_done(sk);
 436                 } else
 437                         sk->sk_err_soft = err;
 438                 goto out;
 439         }
 440
 441         if (!sock_owned_by_user(sk) && np->recverr) {
 442                 sk->sk_err = err;
 443                 sk->sk_error_report(sk);
 444         } else
 445                 sk->sk_err_soft = err;
 446
 447 out:
 448         bh_unlock_sock(sk);
 449         sock_put(sk);
 450 }
 451
 452
 453 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 454                               struct dst_entry *dst)
 455 {
 456         struct inet6_request_sock *treq = inet6_rsk(req);
 457         struct ipv6_pinfo *np = inet6_sk(sk);
 458         struct sk_buff * skb;
 459         struct ipv6_txoptions *opt = NULL;
 460         struct in6_addr * final_p = NULL, final;
 461         struct flowi fl;
 462         int err = -1;
 463
 464         memset(&fl, 0, sizeof(fl));
 465         fl.proto = IPPROTO_TCP;
 466         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 467         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 468         fl.fl6_flowlabel = 0;
 469         fl.oif = treq->iif;
 470         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 471         fl.fl_ip_sport = inet_sk(sk)->sport;
 472
 473         if (dst == NULL) {
 474                 opt = np->opt;
 475                 if (opt == NULL &&
 476                     np->rxopt.bits.osrcrt == 2 &&
 477                     treq->pktopts) {
 478                         struct sk_buff *pktopts = treq->pktopts;
 479                         struct inet6_skb_parm *rxopt = IP6CB(pktopts);
 480                         if (rxopt->srcrt)
 481                                 opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(pktopts->nh.raw + rxopt->srcrt));
 482                 }
 483
 484                 if (opt && opt->srcrt) {
 485                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 486                         ipv6_addr_copy(&final, &fl.fl6_dst);
 487                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 488                         final_p = &final;
 489                 }
 490
 491                 err = ip6_dst_lookup(sk, &dst, &fl);
 492                 if (err)
 493                         goto done;
 494                 if (final_p)
 495                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 496                 if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 497                         goto done;
 498         }
 499
 500         skb = tcp_make_synack(sk, dst, req);
 501         if (skb) {
 502                 struct tcphdr *th = skb->h.th;
 503
 504                 th->check = tcp_v6_check(th, skb->len,
 505                                          &treq->loc_addr, &treq->rmt_addr,
 506                                          csum_partial((char *)th, skb->len, skb->csum));
 507
 508                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 509                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 510                 if (err == NET_XMIT_CN)
 511                         err = 0;
 512         }
 513
 514 done:
 515         if (opt && opt != np->opt)
 516                 sock_kfree_s(sk, opt, opt->tot_len);
 517         dst_release(dst);
 518         return err;
 519 }
 520
 521 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 522 {
 523         if (inet6_rsk(req)->pktopts)
 524                 kfree_skb(inet6_rsk(req)->pktopts);
 525 }
 526
 527 static struct request_sock_ops tcp6_request_sock_ops = {
 528         .family         =       AF_INET6,
 529         .obj_size       =       sizeof(struct tcp6_request_sock),
 530         .rtx_syn_ack    =       tcp_v6_send_synack,
 531         .send_ack       =       tcp_v6_reqsk_send_ack,
 532         .destructor     =       tcp_v6_reqsk_destructor,
 533         .send_reset     =       tcp_v6_send_reset
 534 };
 535
 536 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 537         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 538         .twsk_unique    = tcp_twsk_unique,
 539 };
 540
 541 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 542 {
 543         struct ipv6_pinfo *np = inet6_sk(sk);
 544         struct tcphdr *th = skb->h.th;
 545
 546         if (skb->ip_summed == CHECKSUM_HW) {
 547                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 548                 skb->csum = offsetof(struct tcphdr, check);
 549         } else {
 550                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 551                                             csum_partial((char *)th, th->doff<<2,
 552                                                          skb->csum));
 553         }
 554 }
 555
 556
 557 static void tcp_v6_send_reset(struct sk_buff *skb)
 558 {
 559         struct tcphdr *th = skb->h.th, *t1;
 560         struct sk_buff *buff;
 561         struct flowi fl;
 562
 563         if (th->rst)
 564                 return;
 565
 566         if (!ipv6_unicast_destination(skb))
 567                 return;
 568
 569         /*
 570          * We need to grab some memory, and put together an RST,
 571          * and then put it into the queue to be sent.
 572          */
 573
 574         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + sizeof(struct tcphdr),
 575                          GFP_ATOMIC);
 576         if (buff == NULL)
 577                 return;
 578
 579         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + sizeof(struct tcphdr));
 580
 581         t1 = (struct tcphdr *) skb_push(buff,sizeof(struct tcphdr));
 582
 583         /* Swap the send and the receive. */
 584         memset(t1, 0, sizeof(*t1));
 585         t1->dest = th->source;
 586         t1->source = th->dest;
 587         t1->doff = sizeof(*t1)/4;
 588         t1->rst = 1;
 589
 590         if(th->ack) {
 591                 t1->seq = th->ack_seq;
 592         } else {
 593                 t1->ack = 1;
 594                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
 595                                     + skb->len - (th->doff<<2));
 596         }
 597
 598         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
 599
 600         memset(&fl, 0, sizeof(fl));
 601         ipv6_addr_copy(&fl.fl6_dst, &skb->nh.ipv6h->saddr);
 602         ipv6_addr_copy(&fl.fl6_src, &skb->nh.ipv6h->daddr);
 603
 604         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
 605                                     sizeof(*t1), IPPROTO_TCP,
 606                                     buff->csum);
 607
 608         fl.proto = IPPROTO_TCP;
 609         fl.oif = inet6_iif(skb);
 610         fl.fl_ip_dport = t1->dest;
 611         fl.fl_ip_sport = t1->source;
 612
 613         /* sk = NULL, but it is safe for now. RST socket required. */
 614         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 615
 616                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
 617                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
 618                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
 619                         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
 620                         return;
 621                 }
 622         }
 623
 624         kfree_skb(buff);
 625 }
 626
 627 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
 628 {
 629         struct tcphdr *th = skb->h.th, *t1;
 630         struct sk_buff *buff;
 631         struct flowi fl;
 632         int tot_len = sizeof(struct tcphdr);
 633
 634         if (ts)
 635                 tot_len += 3*4;
 636
 637         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 638                          GFP_ATOMIC);
 639         if (buff == NULL)
 640                 return;
 641
 642         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 643
 644         t1 = (struct tcphdr *) skb_push(buff,tot_len);
 645
 646         /* Swap the send and the receive. */
 647         memset(t1, 0, sizeof(*t1));
 648         t1->dest = th->source;
 649         t1->source = th->dest;
 650         t1->doff = tot_len/4;
 651         t1->seq = htonl(seq);
 652         t1->ack_seq = htonl(ack);
 653         t1->ack = 1;
 654         t1->window = htons(win);
 655
 656         if (ts) {
 657                 u32 *ptr = (u32*)(t1 + 1);
 658                 *ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 659                                (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 660                 *ptr++ = htonl(tcp_time_stamp);
 661                 *ptr = htonl(ts);
 662         }
 663
 664         buff->csum = csum_partial((char *)t1, tot_len, 0);
 665
 666         memset(&fl, 0, sizeof(fl));
 667         ipv6_addr_copy(&fl.fl6_dst, &skb->nh.ipv6h->saddr);
 668         ipv6_addr_copy(&fl.fl6_src, &skb->nh.ipv6h->daddr);
 669
 670         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
 671                                     tot_len, IPPROTO_TCP,
 672                                     buff->csum);
 673
 674         fl.proto = IPPROTO_TCP;
 675         fl.oif = inet6_iif(skb);
 676         fl.fl_ip_dport = t1->dest;
 677         fl.fl_ip_sport = t1->source;
 678
 679         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 680                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
 681                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
 682                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
 683                         return;
 684                 }
 685         }
 686
 687         kfree_skb(buff);
 688 }
 689
 690 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 691 {
 692         struct inet_timewait_sock *tw = inet_twsk(sk);
 693         const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 694
 695         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 696                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 697                         tcptw->tw_ts_recent);
 698
 699         inet_twsk_put(tw);
 700 }
 701
 702 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 703 {
 704         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
 705 }
 706
 707
 708 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 709 {
 710         struct request_sock *req, **prev;
 711         const struct tcphdr *th = skb->h.th;
 712         struct sock *nsk;
 713
 714         /* Find possible connection requests. */
 715         req = inet6_csk_search_req(sk, &prev, th->source,
 716                                    &skb->nh.ipv6h->saddr,
 717                                    &skb->nh.ipv6h->daddr, inet6_iif(skb));
 718         if (req)
 719                 return tcp_check_req(sk, skb, req, prev);
 720
 721         nsk = __inet6_lookup_established(&tcp_hashinfo, &skb->nh.ipv6h->saddr,
 722                                          th->source, &skb->nh.ipv6h->daddr,
 723                                          ntohs(th->dest), inet6_iif(skb));
 724
 725         if (nsk) {
 726                 if (nsk->sk_state != TCP_TIME_WAIT) {
 727                         bh_lock_sock(nsk);
 728                         return nsk;
 729                 }
 730                 inet_twsk_put((struct inet_timewait_sock *)nsk);
 731                 return NULL;
 732         }
 733
 734 #if 0 /*def CONFIG_SYN_COOKIES*/
 735         if (!th->rst && !th->syn && th->ack)
 736                 sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
 737 #endif
 738         return sk;
 739 }
 740
 741 /* FIXME: this is substantially similar to the ipv4 code.
 742  * Can some kind of merge be done? -- erics
 743  */
 744 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 745 {
 746         struct inet6_request_sock *treq;
 747         struct ipv6_pinfo *np = inet6_sk(sk);
 748         struct tcp_options_received tmp_opt;
 749         struct tcp_sock *tp = tcp_sk(sk);
 750         struct request_sock *req = NULL;
 751         __u32 isn = TCP_SKB_CB(skb)->when;
 752
 753         if (skb->protocol == htons(ETH_P_IP))
 754                 return tcp_v4_conn_request(sk, skb);
 755
 756         if (!ipv6_unicast_destination(skb))
 757                 goto drop;
 758
 759         /*
 760          *      There are no SYN attacks on IPv6, yet...
 761          */
 762         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
 763                 if (net_ratelimit())
 764                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
 765                 goto drop;
 766         }
 767
 768         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
 769                 goto drop;
 770
 771         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 772         if (req == NULL)
 773                 goto drop;
 774
 775         tcp_clear_options(&tmp_opt);
 776         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 777         tmp_opt.user_mss = tp->rx_opt.user_mss;
 778
 779         tcp_parse_options(skb, &tmp_opt, 0);
 780
 781         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
 782         tcp_openreq_init(req, &tmp_opt, skb);
 783
 784         treq = inet6_rsk(req);
 785         ipv6_addr_copy(&treq->rmt_addr, &skb->nh.ipv6h->saddr);
 786         ipv6_addr_copy(&treq->loc_addr, &skb->nh.ipv6h->daddr);
 787         TCP_ECN_create_request(req, skb->h.th);
 788         treq->pktopts = NULL;
 789         if (ipv6_opt_accepted(sk, skb) ||
 790             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
 791             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
 792                 atomic_inc(&skb->users);
 793                 treq->pktopts = skb;
 794         }
 795         treq->iif = sk->sk_bound_dev_if;
 796
 797         /* So that link locals have meaning */
 798         if (!sk->sk_bound_dev_if &&
 799             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
 800                 treq->iif = inet6_iif(skb);
 801
 802         if (isn == 0)
 803                 isn = tcp_v6_init_sequence(sk,skb);
 804
 805         tcp_rsk(req)->snt_isn = isn;
 806
 807         if (tcp_v6_send_synack(sk, req, NULL))
 808                 goto drop;
 809
 810         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
 811         return 0;
 812
 813 drop:
 814         if (req)
 815                 reqsk_free(req);
 816
 817         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 818         return 0; /* don't send reset */
 819 }
 820
 821 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 822                                           struct request_sock *req,
 823                                           struct dst_entry *dst)
 824 {
 825         struct inet6_request_sock *treq = inet6_rsk(req);
 826         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
 827         struct tcp6_sock *newtcp6sk;
 828         struct inet_sock *newinet;
 829         struct tcp_sock *newtp;
 830         struct sock *newsk;
 831         struct ipv6_txoptions *opt;
 832
 833         if (skb->protocol == htons(ETH_P_IP)) {
 834                 /*
 835                  *      v6 mapped
 836                  */
 837
 838                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
 839
 840                 if (newsk == NULL)
 841                         return NULL;
 842
 843                 newtcp6sk = (struct tcp6_sock *)newsk;
 844                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
 845
 846                 newinet = inet_sk(newsk);
 847                 newnp = inet6_sk(newsk);
 848                 newtp = tcp_sk(newsk);
 849
 850                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 851
 852                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
 853                               newinet->daddr);
 854
 855                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
 856                               newinet->saddr);
 857
 858                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
 859
 860                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
 861                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
 862                 newnp->pktoptions  = NULL;
 863                 newnp->opt         = NULL;
 864                 newnp->mcast_oif   = inet6_iif(skb);
 865                 newnp->mcast_hops  = skb->nh.ipv6h->hop_limit;
 866
 867                 /*
 868                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
 869                  * here, tcp_create_openreq_child now does this for us, see the comment in
 870                  * that function for the gory details. -acme
 871                  */
 872
 873                 /* It is tricky place. Until this moment IPv4 tcp
 874                    worked with IPv6 icsk.icsk_af_ops.
 875                    Sync it now.
 876                  */
 877                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
 878
 879                 return newsk;
 880         }
 881
 882         opt = np->opt;
 883
 884         if (sk_acceptq_is_full(sk))
 885                 goto out_overflow;
 886
 887         if (np->rxopt.bits.osrcrt == 2 &&
 888             opt == NULL && treq->pktopts) {
 889                 struct inet6_skb_parm *rxopt = IP6CB(treq->pktopts);
 890                 if (rxopt->srcrt)
 891                         opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr *)(treq->pktopts->nh.raw + rxopt->srcrt));
 892         }
 893
 894         if (dst == NULL) {
 895                 struct in6_addr *final_p = NULL, final;
 896                 struct flowi fl;
 897
 898                 memset(&fl, 0, sizeof(fl));
 899                 fl.proto = IPPROTO_TCP;
 900                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 901                 if (opt && opt->srcrt) {
 902                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 903                         ipv6_addr_copy(&final, &fl.fl6_dst);
 904                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 905                         final_p = &final;
 906                 }
 907                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 908                 fl.oif = sk->sk_bound_dev_if;
 909                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 910                 fl.fl_ip_sport = inet_sk(sk)->sport;
 911
 912                 if (ip6_dst_lookup(sk, &dst, &fl))
 913                         goto out;
 914
 915                 if (final_p)
 916                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 917
 918                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 919                         goto out;
 920         }
 921
 922         newsk = tcp_create_openreq_child(sk, req, skb);
 923         if (newsk == NULL)
 924                 goto out;
 925
 926         /*
 927          * No need to charge this sock to the relevant IPv6 refcnt debug socks
 928          * count here, tcp_create_openreq_child now does this for us, see the
 929          * comment in that function for the gory details. -acme
 930          */
 931
 932         sk->sk_gso_type = SKB_GSO_TCPV6;
 933         ip6_dst_store(newsk, dst, NULL);
 934
 935         newtcp6sk = (struct tcp6_sock *)newsk;
 936         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
 937
 938         newtp = tcp_sk(newsk);
 939         newinet = inet_sk(newsk);
 940         newnp = inet6_sk(newsk);
 941
 942         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 943
 944         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
 945         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
 946         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
 947         newsk->sk_bound_dev_if = treq->iif;
 948
 949         /* Now IPv6 options...
 950
 951            First: no IPv4 options.
 952          */
 953         newinet->opt = NULL;
 954
 955         /* Clone RX bits */
 956         newnp->rxopt.all = np->rxopt.all;
 957
 958         /* Clone pktoptions received with SYN */
 959         newnp->pktoptions = NULL;
 960         if (treq->pktopts != NULL) {
 961                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
 962                 kfree_skb(treq->pktopts);
 963                 treq->pktopts = NULL;
 964                 if (newnp->pktoptions)
 965                         skb_set_owner_r(newnp->pktoptions, newsk);
 966         }
 967         newnp->opt        = NULL;
 968         newnp->mcast_oif  = inet6_iif(skb);
 969         newnp->mcast_hops = skb->nh.ipv6h->hop_limit;
 970
 971         /* Clone native IPv6 options from listening socket (if any)
 972
 973            Yes, keeping reference count would be much more clever,
 974            but we make one more one thing there: reattach optmem
 975            to newsk.
 976          */
 977         if (opt) {
 978                 newnp->opt = ipv6_dup_options(newsk, opt);
 979                 if (opt != np->opt)
 980                         sock_kfree_s(sk, opt, opt->tot_len);
 981         }
 982
 983         inet_csk(newsk)->icsk_ext_hdr_len = 0;
 984         if (newnp->opt)
 985                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
 986                                                      newnp->opt->opt_flen);
 987
 988         tcp_mtup_init(newsk);
 989         tcp_sync_mss(newsk, dst_mtu(dst));
 990         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
 991         tcp_initialize_rcv_mss(newsk);
 992
 993         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
 994
 995         __inet6_hash(&tcp_hashinfo, newsk);
 996         inet_inherit_port(&tcp_hashinfo, sk, newsk);
 997
 998         return newsk;
 999
1000 out_overflow:
1001         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
1002 out:
1003         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
1004         if (opt && opt != np->opt)
1005                 sock_kfree_s(sk, opt, opt->tot_len);
1006         dst_release(dst);
1007         return NULL;
1008 }
1009
1010 static int tcp_v6_checksum_init(struct sk_buff *skb)
1011 {
1012         if (skb->ip_summed == CHECKSUM_HW) {
1013                 if (!tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1014                                   &skb->nh.ipv6h->daddr,skb->csum)) {
1015                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1016                         return 0;
1017                 }
1018         }
1019
1020         skb->csum = ~tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1021                                   &skb->nh.ipv6h->daddr, 0);
1022
1023         if (skb->len <= 76) {
1024                 return __skb_checksum_complete(skb);
1025         }
1026         return 0;
1027 }
1028
1029 /* The socket must have it's spinlock held when we get
1030  * here.
1031  *
1032  * We have a potential double-lock case here, so even when
1033  * doing backlog processing we use the BH locking scheme.
1034  * This is because we cannot sleep with the original spinlock
1035  * held.
1036  */
1037 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1038 {
1039         struct ipv6_pinfo *np = inet6_sk(sk);
1040         struct tcp_sock *tp;
1041         struct sk_buff *opt_skb = NULL;
1042
1043         /* Imagine: socket is IPv6. IPv4 packet arrives,
1044            goes to IPv4 receive handler and backlogged.
1045            From backlog it always goes here. Kerboom...
1046            Fortunately, tcp_rcv_established and rcv_established
1047            handle them correctly, but it is not case with
1048            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1049          */
1050
1051         if (skb->protocol == htons(ETH_P_IP))
1052                 return tcp_v4_do_rcv(sk, skb);
1053
1054         if (sk_filter(sk, skb, 0))
1055                 goto discard;
1056
1057         /*
1058          *      socket locking is here for SMP purposes as backlog rcv
1059          *      is currently called with bh processing disabled.
1060          */
1061
1062         /* Do Stevens' IPV6_PKTOPTIONS.
1063
1064            Yes, guys, it is the only place in our code, where we
1065            may make it not affecting IPv4.
1066            The rest of code is protocol independent,
1067            and I do not like idea to uglify IPv4.
1068
1069            Actually, all the idea behind IPV6_PKTOPTIONS
1070            looks not very well thought. For now we latch
1071            options, received in the last packet, enqueued
1072            by tcp. Feel free to propose better solution.
1073                                                --ANK (980728)
1074          */
1075         if (np->rxopt.all)
1076                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1077
1078         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1079                 TCP_CHECK_TIMER(sk);
1080                 if (tcp_rcv_established(sk, skb, skb->h.th, skb->len))
1081                         goto reset;
1082                 TCP_CHECK_TIMER(sk);
1083                 if (opt_skb)
1084                         goto ipv6_pktoptions;
1085                 return 0;
1086         }
1087
1088         if (skb->len < (skb->h.th->doff<<2) || tcp_checksum_complete(skb))
1089                 goto csum_err;
1090
1091         if (sk->sk_state == TCP_LISTEN) {
1092                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1093                 if (!nsk)
1094                         goto discard;
1095
1096                 /*
1097                  * Queue it on the new socket if the new socket is active,
1098                  * otherwise we just shortcircuit this and continue with
1099                  * the new socket..
1100                  */
1101                 if(nsk != sk) {
1102                         if (tcp_child_process(sk, nsk, skb))
1103                                 goto reset;
1104                         if (opt_skb)
1105                                 __kfree_skb(opt_skb);
1106                         return 0;
1107                 }
1108         }
1109
1110         TCP_CHECK_TIMER(sk);
1111         if (tcp_rcv_state_process(sk, skb, skb->h.th, skb->len))
1112                 goto reset;
1113         TCP_CHECK_TIMER(sk);
1114         if (opt_skb)
1115                 goto ipv6_pktoptions;
1116         return 0;
1117
1118 reset:
1119         tcp_v6_send_reset(skb);
1120 discard:
1121         if (opt_skb)
1122                 __kfree_skb(opt_skb);
1123         kfree_skb(skb);
1124         return 0;
1125 csum_err:
1126         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1127         goto discard;
1128
1129
1130 ipv6_pktoptions:
1131         /* Do you ask, what is it?
1132
1133            1. skb was enqueued by tcp.
1134            2. skb is added to tail of read queue, rather than out of order.
1135            3. socket is not in passive state.
1136            4. Finally, it really contains options, which user wants to receive.
1137          */
1138         tp = tcp_sk(sk);
1139         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1140             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1141                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1142                         np->mcast_oif = inet6_iif(opt_skb);
1143                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1144                         np->mcast_hops = opt_skb->nh.ipv6h->hop_limit;
1145                 if (ipv6_opt_accepted(sk, opt_skb)) {
1146                         skb_set_owner_r(opt_skb, sk);
1147                         opt_skb = xchg(&np->pktoptions, opt_skb);
1148                 } else {
1149                         __kfree_skb(opt_skb);
1150                         opt_skb = xchg(&np->pktoptions, NULL);
1151                 }
1152         }
1153
1154         if (opt_skb)
1155                 kfree_skb(opt_skb);
1156         return 0;
1157 }
1158
1159 static int tcp_v6_rcv(struct sk_buff **pskb)
1160 {
1161         struct sk_buff *skb = *pskb;
1162         struct tcphdr *th;
1163         struct sock *sk;
1164         int ret;
1165
1166         if (skb->pkt_type != PACKET_HOST)
1167                 goto discard_it;
1168
1169         /*
1170          *      Count it even if it's bad.
1171          */
1172         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1173
1174         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1175                 goto discard_it;
1176
1177         th = skb->h.th;
1178
1179         if (th->doff < sizeof(struct tcphdr)/4)
1180                 goto bad_packet;
1181         if (!pskb_may_pull(skb, th->doff*4))
1182                 goto discard_it;
1183
1184         if ((skb->ip_summed != CHECKSUM_UNNECESSARY &&
1185              tcp_v6_checksum_init(skb)))
1186                 goto bad_packet;
1187
1188         th = skb->h.th;
1189         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1190         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1191                                     skb->len - th->doff*4);
1192         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1193         TCP_SKB_CB(skb)->when = 0;
1194         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(skb->nh.ipv6h);
1195         TCP_SKB_CB(skb)->sacked = 0;
1196
1197         sk = __inet6_lookup(&tcp_hashinfo, &skb->nh.ipv6h->saddr, th->source,
1198                             &skb->nh.ipv6h->daddr, ntohs(th->dest),
1199                             inet6_iif(skb));
1200
1201         if (!sk)
1202                 goto no_tcp_socket;
1203
1204 process:
1205         if (sk->sk_state == TCP_TIME_WAIT)
1206                 goto do_time_wait;
1207
1208         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1209                 goto discard_and_relse;
1210
1211         if (sk_filter(sk, skb, 0))
1212                 goto discard_and_relse;
1213
1214         skb->dev = NULL;
1215
1216         bh_lock_sock(sk);
1217         ret = 0;
1218         if (!sock_owned_by_user(sk)) {
1219 #ifdef CONFIG_NET_DMA
1220                 struct tcp_sock *tp = tcp_sk(sk);
1221                 if (tp->ucopy.dma_chan)
1222                         ret = tcp_v6_do_rcv(sk, skb);
1223                 else
1224 #endif
1225                 {
1226                         if (!tcp_prequeue(sk, skb))
1227                                 ret = tcp_v6_do_rcv(sk, skb);
1228                 }
1229         } else
1230                 sk_add_backlog(sk, skb);
1231         bh_unlock_sock(sk);
1232
1233         sock_put(sk);
1234         return ret ? -1 : 0;
1235
1236 no_tcp_socket:
1237         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1238                 goto discard_it;
1239
1240         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1241 bad_packet:
1242                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1243         } else {
1244                 tcp_v6_send_reset(skb);
1245         }
1246
1247 discard_it:
1248
1249         /*
1250          *      Discard frame
1251          */
1252
1253         kfree_skb(skb);
1254         return 0;
1255
1256 discard_and_relse:
1257         sock_put(sk);
1258         goto discard_it;
1259
1260 do_time_wait:
1261         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1262                 inet_twsk_put((struct inet_timewait_sock *)sk);
1263                 goto discard_it;
1264         }
1265
1266         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1267                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1268                 inet_twsk_put((struct inet_timewait_sock *)sk);
1269                 goto discard_it;
1270         }
1271
1272         switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
1273                                            skb, th)) {
1274         case TCP_TW_SYN:
1275         {
1276                 struct sock *sk2;
1277
1278                 sk2 = inet6_lookup_listener(&tcp_hashinfo,
1279                                             &skb->nh.ipv6h->daddr,
1280                                             ntohs(th->dest), inet6_iif(skb));
1281                 if (sk2 != NULL) {
1282                         struct inet_timewait_sock *tw = inet_twsk(sk);
1283                         inet_twsk_deschedule(tw, &tcp_death_row);
1284                         inet_twsk_put(tw);
1285                         sk = sk2;
1286                         goto process;
1287                 }
1288                 /* Fall through to ACK */
1289         }
1290         case TCP_TW_ACK:
1291                 tcp_v6_timewait_ack(sk, skb);
1292                 break;
1293         case TCP_TW_RST:
1294                 goto no_tcp_socket;
1295         case TCP_TW_SUCCESS:;
1296         }
1297         goto discard_it;
1298 }
1299
1300 static int tcp_v6_remember_stamp(struct sock *sk)
1301 {
1302         /* Alas, not yet... */
1303         return 0;
1304 }
1305
1306 static struct inet_connection_sock_af_ops ipv6_specific = {
1307         .queue_xmit        = inet6_csk_xmit,
1308         .send_check        = tcp_v6_send_check,
1309         .rebuild_header    = inet6_sk_rebuild_header,
1310         .conn_request      = tcp_v6_conn_request,
1311         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1312         .remember_stamp    = tcp_v6_remember_stamp,
1313         .net_header_len    = sizeof(struct ipv6hdr),
1314         .setsockopt        = ipv6_setsockopt,
1315         .getsockopt        = ipv6_getsockopt,
1316         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1317         .sockaddr_len      = sizeof(struct sockaddr_in6),
1318 #ifdef CONFIG_COMPAT
1319         .compat_setsockopt = compat_ipv6_setsockopt,
1320         .compat_getsockopt = compat_ipv6_getsockopt,
1321 #endif
1322 };
1323
1324 /*
1325  *      TCP over IPv4 via INET6 API
1326  */
1327
1328 static struct inet_connection_sock_af_ops ipv6_mapped = {
1329         .queue_xmit        = ip_queue_xmit,
1330         .send_check        = tcp_v4_send_check,
1331         .rebuild_header    = inet_sk_rebuild_header,
1332         .conn_request      = tcp_v6_conn_request,
1333         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1334         .remember_stamp    = tcp_v4_remember_stamp,
1335         .net_header_len    = sizeof(struct iphdr),
1336         .setsockopt        = ipv6_setsockopt,
1337         .getsockopt        = ipv6_getsockopt,
1338         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1339         .sockaddr_len      = sizeof(struct sockaddr_in6),
1340 #ifdef CONFIG_COMPAT
1341         .compat_setsockopt = compat_ipv6_setsockopt,
1342         .compat_getsockopt = compat_ipv6_getsockopt,
1343 #endif
1344 };
1345
1346 /* NOTE: A lot of things set to zero explicitly by call to
1347  *       sk_alloc() so need not be done here.
1348  */
1349 static int tcp_v6_init_sock(struct sock *sk)
1350 {
1351         struct inet_connection_sock *icsk = inet_csk(sk);
1352         struct tcp_sock *tp = tcp_sk(sk);
1353
1354         skb_queue_head_init(&tp->out_of_order_queue);
1355         tcp_init_xmit_timers(sk);
1356         tcp_prequeue_init(tp);
1357
1358         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1359         tp->mdev = TCP_TIMEOUT_INIT;
1360
1361         /* So many TCP implementations out there (incorrectly) count the
1362          * initial SYN frame in their delayed-ACK and congestion control
1363          * algorithms that we must have the following bandaid to talk
1364          * efficiently to them.  -DaveM
1365          */
1366         tp->snd_cwnd = 2;
1367
1368         /* See draft-stevens-tcpca-spec-01 for discussion of the
1369          * initialization of these values.
1370          */
1371         tp->snd_ssthresh = 0x7fffffff;
1372         tp->snd_cwnd_clamp = ~0;
1373         tp->mss_cache = 536;
1374
1375         tp->reordering = sysctl_tcp_reordering;
1376
1377         sk->sk_state = TCP_CLOSE;
1378
1379         icsk->icsk_af_ops = &ipv6_specific;
1380         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1381         icsk->icsk_sync_mss = tcp_sync_mss;
1382         sk->sk_write_space = sk_stream_write_space;
1383         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1384
1385         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1386         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1387
1388         atomic_inc(&tcp_sockets_allocated);
1389
1390         return 0;
1391 }
1392
1393 static int tcp_v6_destroy_sock(struct sock *sk)
1394 {
1395         tcp_v4_destroy_sock(sk);
1396         return inet6_destroy_sock(sk);
1397 }
1398
1399 /* Proc filesystem TCPv6 sock list dumping. */
1400 static void get_openreq6(struct seq_file *seq,
1401                          struct sock *sk, struct request_sock *req, int i, int uid)
1402 {
1403         int ttd = req->expires - jiffies;
1404         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1405         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1406
1407         if (ttd < 0)
1408                 ttd = 0;
1409
1410         seq_printf(seq,
1411                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1412                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1413                    i,
1414                    src->s6_addr32[0], src->s6_addr32[1],
1415                    src->s6_addr32[2], src->s6_addr32[3],
1416                    ntohs(inet_sk(sk)->sport),
1417                    dest->s6_addr32[0], dest->s6_addr32[1],
1418                    dest->s6_addr32[2], dest->s6_addr32[3],
1419                    ntohs(inet_rsk(req)->rmt_port),
1420                    TCP_SYN_RECV,
1421                    0,0, /* could print option size, but that is af dependent. */
1422                    1,   /* timers active (only the expire timer) */
1423                    jiffies_to_clock_t(ttd),
1424                    req->retrans,
1425                    uid,
1426                    0,  /* non standard timer */
1427                    0, /* open_requests have no inode */
1428                    0, req);
1429 }
1430
1431 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1432 {
1433         struct in6_addr *dest, *src;
1434         __u16 destp, srcp;
1435         int timer_active;
1436         unsigned long timer_expires;
1437         struct inet_sock *inet = inet_sk(sp);
1438         struct tcp_sock *tp = tcp_sk(sp);
1439         const struct inet_connection_sock *icsk = inet_csk(sp);
1440         struct ipv6_pinfo *np = inet6_sk(sp);
1441
1442         dest  = &np->daddr;
1443         src   = &np->rcv_saddr;
1444         destp = ntohs(inet->dport);
1445         srcp  = ntohs(inet->sport);
1446
1447         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1448                 timer_active    = 1;
1449                 timer_expires   = icsk->icsk_timeout;
1450         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1451                 timer_active    = 4;
1452                 timer_expires   = icsk->icsk_timeout;
1453         } else if (timer_pending(&sp->sk_timer)) {
1454                 timer_active    = 2;
1455                 timer_expires   = sp->sk_timer.expires;
1456         } else {
1457                 timer_active    = 0;
1458                 timer_expires = jiffies;
1459         }
1460
1461         seq_printf(seq,
1462                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1463                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
1464                    i,
1465                    src->s6_addr32[0], src->s6_addr32[1],
1466                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1467                    dest->s6_addr32[0], dest->s6_addr32[1],
1468                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1469                    sp->sk_state,
1470                    tp->write_seq-tp->snd_una,
1471                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1472                    timer_active,
1473                    jiffies_to_clock_t(timer_expires - jiffies),
1474                    icsk->icsk_retransmits,
1475                    sock_i_uid(sp),
1476                    icsk->icsk_probes_out,
1477                    sock_i_ino(sp),
1478                    atomic_read(&sp->sk_refcnt), sp,
1479                    icsk->icsk_rto,
1480                    icsk->icsk_ack.ato,
1481                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1482                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
1483                    );
1484 }
1485
1486 static void get_timewait6_sock(struct seq_file *seq,
1487                                struct inet_timewait_sock *tw, int i)
1488 {
1489         struct in6_addr *dest, *src;
1490         __u16 destp, srcp;
1491         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1492         int ttd = tw->tw_ttd - jiffies;
1493
1494         if (ttd < 0)
1495                 ttd = 0;
1496
1497         dest = &tw6->tw_v6_daddr;
1498         src  = &tw6->tw_v6_rcv_saddr;
1499         destp = ntohs(tw->tw_dport);
1500         srcp  = ntohs(tw->tw_sport);
1501
1502         seq_printf(seq,
1503                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1504                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1505                    i,
1506                    src->s6_addr32[0], src->s6_addr32[1],
1507                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1508                    dest->s6_addr32[0], dest->s6_addr32[1],
1509                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1510                    tw->tw_substate, 0, 0,
1511                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
1512                    atomic_read(&tw->tw_refcnt), tw);
1513 }
1514
1515 #ifdef CONFIG_PROC_FS
1516 static int tcp6_seq_show(struct seq_file *seq, void *v)
1517 {
1518         struct tcp_iter_state *st;
1519
1520         if (v == SEQ_START_TOKEN) {
1521                 seq_puts(seq,
1522                          "  sl  "
1523                          "local_address                         "
1524                          "remote_address                        "
1525                          "st tx_queue rx_queue tr tm->when retrnsmt"
1526                          "   uid  timeout inode\n");
1527                 goto out;
1528         }
1529         st = seq->private;
1530
1531         switch (st->state) {
1532         case TCP_SEQ_STATE_LISTENING:
1533         case TCP_SEQ_STATE_ESTABLISHED:
1534                 get_tcp6_sock(seq, v, st->num);
1535                 break;
1536         case TCP_SEQ_STATE_OPENREQ:
1537                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1538                 break;
1539         case TCP_SEQ_STATE_TIME_WAIT:
1540                 get_timewait6_sock(seq, v, st->num);
1541                 break;
1542         }
1543 out:
1544         return 0;
1545 }
1546
1547 static struct file_operations tcp6_seq_fops;
1548 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1549         .owner          = THIS_MODULE,
1550         .name           = "tcp6",
1551         .family         = AF_INET6,
1552         .seq_show       = tcp6_seq_show,
1553         .seq_fops       = &tcp6_seq_fops,
1554 };
1555
1556 int __init tcp6_proc_init(void)
1557 {
1558         return tcp_proc_register(&tcp6_seq_afinfo);
1559 }
1560
1561 void tcp6_proc_exit(void)
1562 {
1563         tcp_proc_unregister(&tcp6_seq_afinfo);
1564 }
1565 #endif
1566
1567 struct proto tcpv6_prot = {
1568         .name                   = "TCPv6",
1569         .owner                  = THIS_MODULE,
1570         .close                  = tcp_close,
1571         .connect                = tcp_v6_connect,
1572         .disconnect             = tcp_disconnect,
1573         .accept                 = inet_csk_accept,
1574         .ioctl                  = tcp_ioctl,
1575         .init                   = tcp_v6_init_sock,
1576         .destroy                = tcp_v6_destroy_sock,
1577         .shutdown               = tcp_shutdown,
1578         .setsockopt             = tcp_setsockopt,
1579         .getsockopt             = tcp_getsockopt,
1580         .sendmsg                = tcp_sendmsg,
1581         .recvmsg                = tcp_recvmsg,
1582         .backlog_rcv            = tcp_v6_do_rcv,
1583         .hash                   = tcp_v6_hash,
1584         .unhash                 = tcp_unhash,
1585         .get_port               = tcp_v6_get_port,
1586         .enter_memory_pressure  = tcp_enter_memory_pressure,
1587         .sockets_allocated      = &tcp_sockets_allocated,
1588         .memory_allocated       = &tcp_memory_allocated,
1589         .memory_pressure        = &tcp_memory_pressure,
1590         .orphan_count           = &tcp_orphan_count,
1591         .sysctl_mem             = sysctl_tcp_mem,
1592         .sysctl_wmem            = sysctl_tcp_wmem,
1593         .sysctl_rmem            = sysctl_tcp_rmem,
1594         .max_header             = MAX_TCP_HEADER,
1595         .obj_size               = sizeof(struct tcp6_sock),
1596         .twsk_prot              = &tcp6_timewait_sock_ops,
1597         .rsk_prot               = &tcp6_request_sock_ops,
1598 #ifdef CONFIG_COMPAT
1599         .compat_setsockopt      = compat_tcp_setsockopt,
1600         .compat_getsockopt      = compat_tcp_getsockopt,
1601 #endif
1602 };
1603
1604 static struct inet6_protocol tcpv6_protocol = {
1605         .handler        =       tcp_v6_rcv,
1606         .err_handler    =       tcp_v6_err,
1607         .gso_segment    =       tcp_tso_segment,
1608         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1609 };
1610
1611 static struct inet_protosw tcpv6_protosw = {
1612         .type           =       SOCK_STREAM,
1613         .protocol       =       IPPROTO_TCP,
1614         .prot           =       &tcpv6_prot,
1615         .ops            =       &inet6_stream_ops,
1616         .capability     =       -1,
1617         .no_check       =       0,
1618         .flags          =       INET_PROTOSW_PERMANENT |
1619                                 INET_PROTOSW_ICSK,
1620 };
1621
1622 void __init tcpv6_init(void)
1623 {
1624         /* register inet6 protocol */
1625         if (inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP) < 0)
1626                 printk(KERN_ERR "tcpv6_init: Could not register protocol\n");
1627         inet6_register_protosw(&tcpv6_protosw);
1628
1629         if (inet_csk_ctl_sock_create(&tcp6_socket, PF_INET6, SOCK_RAW,
1630                                      IPPROTO_TCP) < 0)
1631                 panic("Failed to create the TCPv6 control socket.\n");
1632 }