net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/config.h>
  30 #include <linux/errno.h>
  31 #include <linux/types.h>
  32 #include <linux/socket.h>
  33 #include <linux/sockios.h>
  34 #include <linux/net.h>
  35 #include <linux/jiffies.h>
  36 #include <linux/in.h>
  37 #include <linux/in6.h>
  38 #include <linux/netdevice.h>
  39 #include <linux/init.h>
  40 #include <linux/jhash.h>
  41 #include <linux/ipsec.h>
  42 #include <linux/times.h>
  43
  44 #include <linux/ipv6.h>
  45 #include <linux/icmpv6.h>
  46 #include <linux/random.h>
  47
  48 #include <net/tcp.h>
  49 #include <net/ndisc.h>
  50 #include <net/inet6_hashtables.h>
  51 #include <net/inet6_connection_sock.h>
  52 #include <net/ipv6.h>
  53 #include <net/transp_v6.h>
  54 #include <net/addrconf.h>
  55 #include <net/ip6_route.h>
  56 #include <net/ip6_checksum.h>
  57 #include <net/inet_ecn.h>
  58 #include <net/protocol.h>
  59 #include <net/xfrm.h>
  60 #include <net/addrconf.h>
  61 #include <net/snmp.h>
  62 #include <net/dsfield.h>
  63 #include <net/timewait_sock.h>
  64
  65 #include <asm/uaccess.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 /* Socket used for sending RSTs and ACKs */
  71 static struct socket *tcp6_socket;
  72
  73 static void     tcp_v6_send_reset(struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
  75 static void     tcp_v6_send_check(struct sock *sk, int len,
  76                                   struct sk_buff *skb);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80 static struct inet_connection_sock_af_ops ipv6_mapped;
  81 static struct inet_connection_sock_af_ops ipv6_specific;
  82
  83 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
  84 {
  85         return inet_csk_get_port(&tcp_hashinfo, sk, snum,
  86                                  inet6_csk_bind_conflict);
  87 }
  88
  89 static void tcp_v6_hash(struct sock *sk)
  90 {
  91         if (sk->sk_state != TCP_CLOSE) {
  92                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  93                         tcp_prot.hash(sk);
  94                         return;
  95                 }
  96                 local_bh_disable();
  97                 __inet6_hash(&tcp_hashinfo, sk);
  98                 local_bh_enable();
  99         }
 100 }
 101
 102 static __inline__ u16 tcp_v6_check(struct tcphdr *th, int len,
 103                                    struct in6_addr *saddr,
 104                                    struct in6_addr *daddr,
 105                                    unsigned long base)
 106 {
 107         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 108 }
 109
 110 static __u32 tcp_v6_init_sequence(struct sock *sk, struct sk_buff *skb)
 111 {
 112         if (skb->protocol == htons(ETH_P_IPV6)) {
 113                 return secure_tcpv6_sequence_number(skb->nh.ipv6h->daddr.s6_addr32,
 114                                                     skb->nh.ipv6h->saddr.s6_addr32,
 115                                                     skb->h.th->dest,
 116                                                     skb->h.th->source);
 117         } else {
 118                 return secure_tcp_sequence_number(skb->nh.iph->daddr,
 119                                                   skb->nh.iph->saddr,
 120                                                   skb->h.th->dest,
 121                                                   skb->h.th->source);
 122         }
 123 }
 124
 125 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 126                           int addr_len)
 127 {
 128         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 129         struct inet_sock *inet = inet_sk(sk);
 130         struct inet_connection_sock *icsk = inet_csk(sk);
 131         struct ipv6_pinfo *np = inet6_sk(sk);
 132         struct tcp_sock *tp = tcp_sk(sk);
 133         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 134         struct flowi fl;
 135         struct dst_entry *dst;
 136         int addr_type;
 137         int err;
 138
 139         if (addr_len < SIN6_LEN_RFC2133)
 140                 return -EINVAL;
 141
 142         if (usin->sin6_family != AF_INET6)
 143                 return(-EAFNOSUPPORT);
 144
 145         memset(&fl, 0, sizeof(fl));
 146
 147         if (np->sndflow) {
 148                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 149                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 150                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 151                         struct ip6_flowlabel *flowlabel;
 152                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 153                         if (flowlabel == NULL)
 154                                 return -EINVAL;
 155                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 156                         fl6_sock_release(flowlabel);
 157                 }
 158         }
 159
 160         /*
 161          *      connect() to INADDR_ANY means loopback (BSD'ism).
 162          */
 163
 164         if(ipv6_addr_any(&usin->sin6_addr))
 165                 usin->sin6_addr.s6_addr[15] = 0x1;
 166
 167         addr_type = ipv6_addr_type(&usin->sin6_addr);
 168
 169         if(addr_type & IPV6_ADDR_MULTICAST)
 170                 return -ENETUNREACH;
 171
 172         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 173                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 174                     usin->sin6_scope_id) {
 175                         /* If interface is set while binding, indices
 176                          * must coincide.
 177                          */
 178                         if (sk->sk_bound_dev_if &&
 179                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 180                                 return -EINVAL;
 181
 182                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 183                 }
 184
 185                 /* Connect to link-local address requires an interface */
 186                 if (!sk->sk_bound_dev_if)
 187                         return -EINVAL;
 188         }
 189
 190         if (tp->rx_opt.ts_recent_stamp &&
 191             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 192                 tp->rx_opt.ts_recent = 0;
 193                 tp->rx_opt.ts_recent_stamp = 0;
 194                 tp->write_seq = 0;
 195         }
 196
 197         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 198         np->flow_label = fl.fl6_flowlabel;
 199
 200         /*
 201          *      TCP over IPv4
 202          */
 203
 204         if (addr_type == IPV6_ADDR_MAPPED) {
 205                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 206                 struct sockaddr_in sin;
 207
 208                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 209
 210                 if (__ipv6_only_sock(sk))
 211                         return -ENETUNREACH;
 212
 213                 sin.sin_family = AF_INET;
 214                 sin.sin_port = usin->sin6_port;
 215                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 216
 217                 icsk->icsk_af_ops = &ipv6_mapped;
 218                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 219
 220                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 221
 222                 if (err) {
 223                         icsk->icsk_ext_hdr_len = exthdrlen;
 224                         icsk->icsk_af_ops = &ipv6_specific;
 225                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 226                         goto failure;
 227                 } else {
 228                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 229                                       inet->saddr);
 230                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 231                                       inet->rcv_saddr);
 232                 }
 233
 234                 return err;
 235         }
 236
 237         if (!ipv6_addr_any(&np->rcv_saddr))
 238                 saddr = &np->rcv_saddr;
 239
 240         fl.proto = IPPROTO_TCP;
 241         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 242         ipv6_addr_copy(&fl.fl6_src,
 243                        (saddr ? saddr : &np->saddr));
 244         fl.oif = sk->sk_bound_dev_if;
 245         fl.fl_ip_dport = usin->sin6_port;
 246         fl.fl_ip_sport = inet->sport;
 247
 248         if (np->opt && np->opt->srcrt) {
 249                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 250                 ipv6_addr_copy(&final, &fl.fl6_dst);
 251                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 252                 final_p = &final;
 253         }
 254
 255         err = ip6_dst_lookup(sk, &dst, &fl);
 256         if (err)
 257                 goto failure;
 258         if (final_p)
 259                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 260
 261         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 262                 goto failure;
 263
 264         if (saddr == NULL) {
 265                 saddr = &fl.fl6_src;
 266                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 267         }
 268
 269         /* set the source address */
 270         ipv6_addr_copy(&np->saddr, saddr);
 271         inet->rcv_saddr = LOOPBACK4_IPV6;
 272
 273         ip6_dst_store(sk, dst, NULL);
 274         sk->sk_route_caps = dst->dev->features &
 275                 ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
 276
 277         icsk->icsk_ext_hdr_len = 0;
 278         if (np->opt)
 279                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 280                                           np->opt->opt_nflen);
 281
 282         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 283
 284         inet->dport = usin->sin6_port;
 285
 286         tcp_set_state(sk, TCP_SYN_SENT);
 287         err = inet6_hash_connect(&tcp_death_row, sk);
 288         if (err)
 289                 goto late_failure;
 290
 291         if (!tp->write_seq)
 292                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 293                                                              np->daddr.s6_addr32,
 294                                                              inet->sport,
 295                                                              inet->dport);
 296
 297         err = tcp_connect(sk);
 298         if (err)
 299                 goto late_failure;
 300
 301         return 0;
 302
 303 late_failure:
 304         tcp_set_state(sk, TCP_CLOSE);
 305         __sk_dst_reset(sk);
 306 failure:
 307         inet->dport = 0;
 308         sk->sk_route_caps = 0;
 309         return err;
 310 }
 311
 312 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 313                 int type, int code, int offset, __u32 info)
 314 {
 315         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 316         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 317         struct ipv6_pinfo *np;
 318         struct sock *sk;
 319         int err;
 320         struct tcp_sock *tp;
 321         __u32 seq;
 322
 323         sk = inet6_lookup(&tcp_hashinfo, &hdr->daddr, th->dest, &hdr->saddr,
 324                           th->source, skb->dev->ifindex);
 325
 326         if (sk == NULL) {
 327                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 328                 return;
 329         }
 330
 331         if (sk->sk_state == TCP_TIME_WAIT) {
 332                 inet_twsk_put((struct inet_timewait_sock *)sk);
 333                 return;
 334         }
 335
 336         bh_lock_sock(sk);
 337         if (sock_owned_by_user(sk))
 338                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 339
 340         if (sk->sk_state == TCP_CLOSE)
 341                 goto out;
 342
 343         tp = tcp_sk(sk);
 344         seq = ntohl(th->seq);
 345         if (sk->sk_state != TCP_LISTEN &&
 346             !between(seq, tp->snd_una, tp->snd_nxt)) {
 347                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 348                 goto out;
 349         }
 350
 351         np = inet6_sk(sk);
 352
 353         if (type == ICMPV6_PKT_TOOBIG) {
 354                 struct dst_entry *dst = NULL;
 355
 356                 if (sock_owned_by_user(sk))
 357                         goto out;
 358                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 359                         goto out;
 360
 361                 /* icmp should have updated the destination cache entry */
 362                 dst = __sk_dst_check(sk, np->dst_cookie);
 363
 364                 if (dst == NULL) {
 365                         struct inet_sock *inet = inet_sk(sk);
 366                         struct flowi fl;
 367
 368                         /* BUGGG_FUTURE: Again, it is not clear how
 369                            to handle rthdr case. Ignore this complexity
 370                            for now.
 371                          */
 372                         memset(&fl, 0, sizeof(fl));
 373                         fl.proto = IPPROTO_TCP;
 374                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 375                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 376                         fl.oif = sk->sk_bound_dev_if;
 377                         fl.fl_ip_dport = inet->dport;
 378                         fl.fl_ip_sport = inet->sport;
 379
 380                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 381                                 sk->sk_err_soft = -err;
 382                                 goto out;
 383                         }
 384
 385                         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 386                                 sk->sk_err_soft = -err;
 387                                 goto out;
 388                         }
 389
 390                 } else
 391                         dst_hold(dst);
 392
 393                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 394                         tcp_sync_mss(sk, dst_mtu(dst));
 395                         tcp_simple_retransmit(sk);
 396                 } /* else let the usual retransmit timer handle it */
 397                 dst_release(dst);
 398                 goto out;
 399         }
 400
 401         icmpv6_err_convert(type, code, &err);
 402
 403         /* Might be for an request_sock */
 404         switch (sk->sk_state) {
 405                 struct request_sock *req, **prev;
 406         case TCP_LISTEN:
 407                 if (sock_owned_by_user(sk))
 408                         goto out;
 409
 410                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 411                                            &hdr->saddr, inet6_iif(skb));
 412                 if (!req)
 413                         goto out;
 414
 415                 /* ICMPs are not backlogged, hence we cannot get
 416                  * an established socket here.
 417                  */
 418                 BUG_TRAP(req->sk == NULL);
 419
 420                 if (seq != tcp_rsk(req)->snt_isn) {
 421                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 422                         goto out;
 423                 }
 424
 425                 inet_csk_reqsk_queue_drop(sk, req, prev);
 426                 goto out;
 427
 428         case TCP_SYN_SENT:
 429         case TCP_SYN_RECV:  /* Cannot happen.
 430                                It can, it SYNs are crossed. --ANK */
 431                 if (!sock_owned_by_user(sk)) {
 432                         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 433                         sk->sk_err = err;
 434                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 435
 436                         tcp_done(sk);
 437                 } else
 438                         sk->sk_err_soft = err;
 439                 goto out;
 440         }
 441
 442         if (!sock_owned_by_user(sk) && np->recverr) {
 443                 sk->sk_err = err;
 444                 sk->sk_error_report(sk);
 445         } else
 446                 sk->sk_err_soft = err;
 447
 448 out:
 449         bh_unlock_sock(sk);
 450         sock_put(sk);
 451 }
 452
 453
 454 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 455                               struct dst_entry *dst)
 456 {
 457         struct inet6_request_sock *treq = inet6_rsk(req);
 458         struct ipv6_pinfo *np = inet6_sk(sk);
 459         struct sk_buff * skb;
 460         struct ipv6_txoptions *opt = NULL;
 461         struct in6_addr * final_p = NULL, final;
 462         struct flowi fl;
 463         int err = -1;
 464
 465         memset(&fl, 0, sizeof(fl));
 466         fl.proto = IPPROTO_TCP;
 467         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 468         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 469         fl.fl6_flowlabel = 0;
 470         fl.oif = treq->iif;
 471         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 472         fl.fl_ip_sport = inet_sk(sk)->sport;
 473
 474         if (dst == NULL) {
 475                 opt = np->opt;
 476                 if (opt == NULL &&
 477                     np->rxopt.bits.osrcrt == 2 &&
 478                     treq->pktopts) {
 479                         struct sk_buff *pktopts = treq->pktopts;
 480                         struct inet6_skb_parm *rxopt = IP6CB(pktopts);
 481                         if (rxopt->srcrt)
 482                                 opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(pktopts->nh.raw + rxopt->srcrt));
 483                 }
 484
 485                 if (opt && opt->srcrt) {
 486                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 487                         ipv6_addr_copy(&final, &fl.fl6_dst);
 488                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 489                         final_p = &final;
 490                 }
 491
 492                 err = ip6_dst_lookup(sk, &dst, &fl);
 493                 if (err)
 494                         goto done;
 495                 if (final_p)
 496                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 497                 if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 498                         goto done;
 499         }
 500
 501         skb = tcp_make_synack(sk, dst, req);
 502         if (skb) {
 503                 struct tcphdr *th = skb->h.th;
 504
 505                 th->check = tcp_v6_check(th, skb->len,
 506                                          &treq->loc_addr, &treq->rmt_addr,
 507                                          csum_partial((char *)th, skb->len, skb->csum));
 508
 509                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 510                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 511                 if (err == NET_XMIT_CN)
 512                         err = 0;
 513         }
 514
 515 done:
 516         if (opt && opt != np->opt)
 517                 sock_kfree_s(sk, opt, opt->tot_len);
 518         return err;
 519 }
 520
 521 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 522 {
 523         if (inet6_rsk(req)->pktopts)
 524                 kfree_skb(inet6_rsk(req)->pktopts);
 525 }
 526
 527 static struct request_sock_ops tcp6_request_sock_ops = {
 528         .family         =       AF_INET6,
 529         .obj_size       =       sizeof(struct tcp6_request_sock),
 530         .rtx_syn_ack    =       tcp_v6_send_synack,
 531         .send_ack       =       tcp_v6_reqsk_send_ack,
 532         .destructor     =       tcp_v6_reqsk_destructor,
 533         .send_reset     =       tcp_v6_send_reset
 534 };
 535
 536 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 537         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 538         .twsk_unique    = tcp_twsk_unique,
 539 };
 540
 541 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 542 {
 543         struct ipv6_pinfo *np = inet6_sk(sk);
 544         struct tcphdr *th = skb->h.th;
 545
 546         if (skb->ip_summed == CHECKSUM_HW) {
 547                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 548                 skb->csum = offsetof(struct tcphdr, check);
 549         } else {
 550                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 551                                             csum_partial((char *)th, th->doff<<2,
 552                                                          skb->csum));
 553         }
 554 }
 555
 556
 557 static void tcp_v6_send_reset(struct sk_buff *skb)
 558 {
 559         struct tcphdr *th = skb->h.th, *t1;
 560         struct sk_buff *buff;
 561         struct flowi fl;
 562
 563         if (th->rst)
 564                 return;
 565
 566         if (!ipv6_unicast_destination(skb))
 567                 return;
 568
 569         /*
 570          * We need to grab some memory, and put together an RST,
 571          * and then put it into the queue to be sent.
 572          */
 573
 574         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + sizeof(struct tcphdr),
 575                          GFP_ATOMIC);
 576         if (buff == NULL)
 577                 return;
 578
 579         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + sizeof(struct tcphdr));
 580
 581         t1 = (struct tcphdr *) skb_push(buff,sizeof(struct tcphdr));
 582
 583         /* Swap the send and the receive. */
 584         memset(t1, 0, sizeof(*t1));
 585         t1->dest = th->source;
 586         t1->source = th->dest;
 587         t1->doff = sizeof(*t1)/4;
 588         t1->rst = 1;
 589
 590         if(th->ack) {
 591                 t1->seq = th->ack_seq;
 592         } else {
 593                 t1->ack = 1;
 594                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
 595                                     + skb->len - (th->doff<<2));
 596         }
 597
 598         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
 599
 600         memset(&fl, 0, sizeof(fl));
 601         ipv6_addr_copy(&fl.fl6_dst, &skb->nh.ipv6h->saddr);
 602         ipv6_addr_copy(&fl.fl6_src, &skb->nh.ipv6h->daddr);
 603
 604         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
 605                                     sizeof(*t1), IPPROTO_TCP,
 606                                     buff->csum);
 607
 608         fl.proto = IPPROTO_TCP;
 609         fl.oif = inet6_iif(skb);
 610         fl.fl_ip_dport = t1->dest;
 611         fl.fl_ip_sport = t1->source;
 612
 613         /* sk = NULL, but it is safe for now. RST socket required. */
 614         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 615
 616                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
 617                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
 618                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
 619                         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
 620                         return;
 621                 }
 622         }
 623
 624         kfree_skb(buff);
 625 }
 626
 627 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
 628 {
 629         struct tcphdr *th = skb->h.th, *t1;
 630         struct sk_buff *buff;
 631         struct flowi fl;
 632         int tot_len = sizeof(struct tcphdr);
 633
 634         if (ts)
 635                 tot_len += 3*4;
 636
 637         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 638                          GFP_ATOMIC);
 639         if (buff == NULL)
 640                 return;
 641
 642         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 643
 644         t1 = (struct tcphdr *) skb_push(buff,tot_len);
 645
 646         /* Swap the send and the receive. */
 647         memset(t1, 0, sizeof(*t1));
 648         t1->dest = th->source;
 649         t1->source = th->dest;
 650         t1->doff = tot_len/4;
 651         t1->seq = htonl(seq);
 652         t1->ack_seq = htonl(ack);
 653         t1->ack = 1;
 654         t1->window = htons(win);
 655
 656         if (ts) {
 657                 u32 *ptr = (u32*)(t1 + 1);
 658                 *ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 659                                (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 660                 *ptr++ = htonl(tcp_time_stamp);
 661                 *ptr = htonl(ts);
 662         }
 663
 664         buff->csum = csum_partial((char *)t1, tot_len, 0);
 665
 666         memset(&fl, 0, sizeof(fl));
 667         ipv6_addr_copy(&fl.fl6_dst, &skb->nh.ipv6h->saddr);
 668         ipv6_addr_copy(&fl.fl6_src, &skb->nh.ipv6h->daddr);
 669
 670         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
 671                                     tot_len, IPPROTO_TCP,
 672                                     buff->csum);
 673
 674         fl.proto = IPPROTO_TCP;
 675         fl.oif = inet6_iif(skb);
 676         fl.fl_ip_dport = t1->dest;
 677         fl.fl_ip_sport = t1->source;
 678
 679         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 680                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
 681                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
 682                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
 683                         return;
 684                 }
 685         }
 686
 687         kfree_skb(buff);
 688 }
 689
 690 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 691 {
 692         struct inet_timewait_sock *tw = inet_twsk(sk);
 693         const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 694
 695         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 696                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 697                         tcptw->tw_ts_recent);
 698
 699         inet_twsk_put(tw);
 700 }
 701
 702 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 703 {
 704         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
 705 }
 706
 707
 708 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 709 {
 710         struct request_sock *req, **prev;
 711         const struct tcphdr *th = skb->h.th;
 712         struct sock *nsk;
 713
 714         /* Find possible connection requests. */
 715         req = inet6_csk_search_req(sk, &prev, th->source,
 716                                    &skb->nh.ipv6h->saddr,
 717                                    &skb->nh.ipv6h->daddr, inet6_iif(skb));
 718         if (req)
 719                 return tcp_check_req(sk, skb, req, prev);
 720
 721         nsk = __inet6_lookup_established(&tcp_hashinfo, &skb->nh.ipv6h->saddr,
 722                                          th->source, &skb->nh.ipv6h->daddr,
 723                                          ntohs(th->dest), inet6_iif(skb));
 724
 725         if (nsk) {
 726                 if (nsk->sk_state != TCP_TIME_WAIT) {
 727                         bh_lock_sock(nsk);
 728                         return nsk;
 729                 }
 730                 inet_twsk_put((struct inet_timewait_sock *)nsk);
 731                 return NULL;
 732         }
 733
 734 #if 0 /*def CONFIG_SYN_COOKIES*/
 735         if (!th->rst && !th->syn && th->ack)
 736                 sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
 737 #endif
 738         return sk;
 739 }
 740
 741 /* FIXME: this is substantially similar to the ipv4 code.
 742  * Can some kind of merge be done? -- erics
 743  */
 744 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 745 {
 746         struct inet6_request_sock *treq;
 747         struct ipv6_pinfo *np = inet6_sk(sk);
 748         struct tcp_options_received tmp_opt;
 749         struct tcp_sock *tp = tcp_sk(sk);
 750         struct request_sock *req = NULL;
 751         __u32 isn = TCP_SKB_CB(skb)->when;
 752
 753         if (skb->protocol == htons(ETH_P_IP))
 754                 return tcp_v4_conn_request(sk, skb);
 755
 756         if (!ipv6_unicast_destination(skb))
 757                 goto drop;
 758
 759         /*
 760          *      There are no SYN attacks on IPv6, yet...
 761          */
 762         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
 763                 if (net_ratelimit())
 764                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
 765                 goto drop;
 766         }
 767
 768         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
 769                 goto drop;
 770
 771         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 772         if (req == NULL)
 773                 goto drop;
 774
 775         tcp_clear_options(&tmp_opt);
 776         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 777         tmp_opt.user_mss = tp->rx_opt.user_mss;
 778
 779         tcp_parse_options(skb, &tmp_opt, 0);
 780
 781         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
 782         tcp_openreq_init(req, &tmp_opt, skb);
 783
 784         treq = inet6_rsk(req);
 785         ipv6_addr_copy(&treq->rmt_addr, &skb->nh.ipv6h->saddr);
 786         ipv6_addr_copy(&treq->loc_addr, &skb->nh.ipv6h->daddr);
 787         TCP_ECN_create_request(req, skb->h.th);
 788         treq->pktopts = NULL;
 789         if (ipv6_opt_accepted(sk, skb) ||
 790             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
 791             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
 792                 atomic_inc(&skb->users);
 793                 treq->pktopts = skb;
 794         }
 795         treq->iif = sk->sk_bound_dev_if;
 796
 797         /* So that link locals have meaning */
 798         if (!sk->sk_bound_dev_if &&
 799             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
 800                 treq->iif = inet6_iif(skb);
 801
 802         if (isn == 0)
 803                 isn = tcp_v6_init_sequence(sk,skb);
 804
 805         tcp_rsk(req)->snt_isn = isn;
 806
 807         if (tcp_v6_send_synack(sk, req, NULL))
 808                 goto drop;
 809
 810         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
 811         return 0;
 812
 813 drop:
 814         if (req)
 815                 reqsk_free(req);
 816
 817         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 818         return 0; /* don't send reset */
 819 }
 820
 821 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 822                                           struct request_sock *req,
 823                                           struct dst_entry *dst)
 824 {
 825         struct inet6_request_sock *treq = inet6_rsk(req);
 826         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
 827         struct tcp6_sock *newtcp6sk;
 828         struct inet_sock *newinet;
 829         struct tcp_sock *newtp;
 830         struct sock *newsk;
 831         struct ipv6_txoptions *opt;
 832
 833         if (skb->protocol == htons(ETH_P_IP)) {
 834                 /*
 835                  *      v6 mapped
 836                  */
 837
 838                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
 839
 840                 if (newsk == NULL)
 841                         return NULL;
 842
 843                 newtcp6sk = (struct tcp6_sock *)newsk;
 844                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
 845
 846                 newinet = inet_sk(newsk);
 847                 newnp = inet6_sk(newsk);
 848                 newtp = tcp_sk(newsk);
 849
 850                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 851
 852                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
 853                               newinet->daddr);
 854
 855                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
 856                               newinet->saddr);
 857
 858                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
 859
 860                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
 861                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
 862                 newnp->pktoptions  = NULL;
 863                 newnp->opt         = NULL;
 864                 newnp->mcast_oif   = inet6_iif(skb);
 865                 newnp->mcast_hops  = skb->nh.ipv6h->hop_limit;
 866
 867                 /*
 868                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
 869                  * here, tcp_create_openreq_child now does this for us, see the comment in
 870                  * that function for the gory details. -acme
 871                  */
 872
 873                 /* It is tricky place. Until this moment IPv4 tcp
 874                    worked with IPv6 icsk.icsk_af_ops.
 875                    Sync it now.
 876                  */
 877                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
 878
 879                 return newsk;
 880         }
 881
 882         opt = np->opt;
 883
 884         if (sk_acceptq_is_full(sk))
 885                 goto out_overflow;
 886
 887         if (np->rxopt.bits.osrcrt == 2 &&
 888             opt == NULL && treq->pktopts) {
 889                 struct inet6_skb_parm *rxopt = IP6CB(treq->pktopts);
 890                 if (rxopt->srcrt)
 891                         opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr *)(treq->pktopts->nh.raw + rxopt->srcrt));
 892         }
 893
 894         if (dst == NULL) {
 895                 struct in6_addr *final_p = NULL, final;
 896                 struct flowi fl;
 897
 898                 memset(&fl, 0, sizeof(fl));
 899                 fl.proto = IPPROTO_TCP;
 900                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 901                 if (opt && opt->srcrt) {
 902                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 903                         ipv6_addr_copy(&final, &fl.fl6_dst);
 904                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 905                         final_p = &final;
 906                 }
 907                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 908                 fl.oif = sk->sk_bound_dev_if;
 909                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 910                 fl.fl_ip_sport = inet_sk(sk)->sport;
 911
 912                 if (ip6_dst_lookup(sk, &dst, &fl))
 913                         goto out;
 914
 915                 if (final_p)
 916                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 917
 918                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 919                         goto out;
 920         }
 921
 922         newsk = tcp_create_openreq_child(sk, req, skb);
 923         if (newsk == NULL)
 924                 goto out;
 925
 926         /*
 927          * No need to charge this sock to the relevant IPv6 refcnt debug socks
 928          * count here, tcp_create_openreq_child now does this for us, see the
 929          * comment in that function for the gory details. -acme
 930          */
 931
 932         ip6_dst_store(newsk, dst, NULL);
 933         newsk->sk_route_caps = dst->dev->features &
 934                 ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
 935
 936         newtcp6sk = (struct tcp6_sock *)newsk;
 937         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
 938
 939         newtp = tcp_sk(newsk);
 940         newinet = inet_sk(newsk);
 941         newnp = inet6_sk(newsk);
 942
 943         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 944
 945         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
 946         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
 947         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
 948         newsk->sk_bound_dev_if = treq->iif;
 949
 950         /* Now IPv6 options...
 951
 952            First: no IPv4 options.
 953          */
 954         newinet->opt = NULL;
 955
 956         /* Clone RX bits */
 957         newnp->rxopt.all = np->rxopt.all;
 958
 959         /* Clone pktoptions received with SYN */
 960         newnp->pktoptions = NULL;
 961         if (treq->pktopts != NULL) {
 962                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
 963                 kfree_skb(treq->pktopts);
 964                 treq->pktopts = NULL;
 965                 if (newnp->pktoptions)
 966                         skb_set_owner_r(newnp->pktoptions, newsk);
 967         }
 968         newnp->opt        = NULL;
 969         newnp->mcast_oif  = inet6_iif(skb);
 970         newnp->mcast_hops = skb->nh.ipv6h->hop_limit;
 971
 972         /* Clone native IPv6 options from listening socket (if any)
 973
 974            Yes, keeping reference count would be much more clever,
 975            but we make one more one thing there: reattach optmem
 976            to newsk.
 977          */
 978         if (opt) {
 979                 newnp->opt = ipv6_dup_options(newsk, opt);
 980                 if (opt != np->opt)
 981                         sock_kfree_s(sk, opt, opt->tot_len);
 982         }
 983
 984         inet_csk(newsk)->icsk_ext_hdr_len = 0;
 985         if (newnp->opt)
 986                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
 987                                                      newnp->opt->opt_flen);
 988
 989         tcp_sync_mss(newsk, dst_mtu(dst));
 990         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
 991         tcp_initialize_rcv_mss(newsk);
 992
 993         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
 994
 995         __inet6_hash(&tcp_hashinfo, newsk);
 996         inet_inherit_port(&tcp_hashinfo, sk, newsk);
 997
 998         return newsk;
 999
1000 out_overflow:
1001         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
1002 out:
1003         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
1004         if (opt && opt != np->opt)
1005                 sock_kfree_s(sk, opt, opt->tot_len);
1006         dst_release(dst);
1007         return NULL;
1008 }
1009
1010 static int tcp_v6_checksum_init(struct sk_buff *skb)
1011 {
1012         if (skb->ip_summed == CHECKSUM_HW) {
1013                 if (!tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1014                                   &skb->nh.ipv6h->daddr,skb->csum)) {
1015                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1016                         return 0;
1017                 }
1018         }
1019
1020         skb->csum = ~tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1021                                   &skb->nh.ipv6h->daddr, 0);
1022
1023         if (skb->len <= 76) {
1024                 return __skb_checksum_complete(skb);
1025         }
1026         return 0;
1027 }
1028
1029 /* The socket must have it's spinlock held when we get
1030  * here.
1031  *
1032  * We have a potential double-lock case here, so even when
1033  * doing backlog processing we use the BH locking scheme.
1034  * This is because we cannot sleep with the original spinlock
1035  * held.
1036  */
1037 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1038 {
1039         struct ipv6_pinfo *np = inet6_sk(sk);
1040         struct tcp_sock *tp;
1041         struct sk_buff *opt_skb = NULL;
1042
1043         /* Imagine: socket is IPv6. IPv4 packet arrives,
1044            goes to IPv4 receive handler and backlogged.
1045            From backlog it always goes here. Kerboom...
1046            Fortunately, tcp_rcv_established and rcv_established
1047            handle them correctly, but it is not case with
1048            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1049          */
1050
1051         if (skb->protocol == htons(ETH_P_IP))
1052                 return tcp_v4_do_rcv(sk, skb);
1053
1054         if (sk_filter(sk, skb, 0))
1055                 goto discard;
1056
1057         /*
1058          *      socket locking is here for SMP purposes as backlog rcv
1059          *      is currently called with bh processing disabled.
1060          */
1061
1062         /* Do Stevens' IPV6_PKTOPTIONS.
1063
1064            Yes, guys, it is the only place in our code, where we
1065            may make it not affecting IPv4.
1066            The rest of code is protocol independent,
1067            and I do not like idea to uglify IPv4.
1068
1069            Actually, all the idea behind IPV6_PKTOPTIONS
1070            looks not very well thought. For now we latch
1071            options, received in the last packet, enqueued
1072            by tcp. Feel free to propose better solution.
1073                                                --ANK (980728)
1074          */
1075         if (np->rxopt.all)
1076                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1077
1078         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1079                 TCP_CHECK_TIMER(sk);
1080                 if (tcp_rcv_established(sk, skb, skb->h.th, skb->len))
1081                         goto reset;
1082                 TCP_CHECK_TIMER(sk);
1083                 if (opt_skb)
1084                         goto ipv6_pktoptions;
1085                 return 0;
1086         }
1087
1088         if (skb->len < (skb->h.th->doff<<2) || tcp_checksum_complete(skb))
1089                 goto csum_err;
1090
1091         if (sk->sk_state == TCP_LISTEN) {
1092                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1093                 if (!nsk)
1094                         goto discard;
1095
1096                 /*
1097                  * Queue it on the new socket if the new socket is active,
1098                  * otherwise we just shortcircuit this and continue with
1099                  * the new socket..
1100                  */
1101                 if(nsk != sk) {
1102                         if (tcp_child_process(sk, nsk, skb))
1103                                 goto reset;
1104                         if (opt_skb)
1105                                 __kfree_skb(opt_skb);
1106                         return 0;
1107                 }
1108         }
1109
1110         TCP_CHECK_TIMER(sk);
1111         if (tcp_rcv_state_process(sk, skb, skb->h.th, skb->len))
1112                 goto reset;
1113         TCP_CHECK_TIMER(sk);
1114         if (opt_skb)
1115                 goto ipv6_pktoptions;
1116         return 0;
1117
1118 reset:
1119         tcp_v6_send_reset(skb);
1120 discard:
1121         if (opt_skb)
1122                 __kfree_skb(opt_skb);
1123         kfree_skb(skb);
1124         return 0;
1125 csum_err:
1126         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1127         goto discard;
1128
1129
1130 ipv6_pktoptions:
1131         /* Do you ask, what is it?
1132
1133            1. skb was enqueued by tcp.
1134            2. skb is added to tail of read queue, rather than out of order.
1135            3. socket is not in passive state.
1136            4. Finally, it really contains options, which user wants to receive.
1137          */
1138         tp = tcp_sk(sk);
1139         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1140             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1141                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1142                         np->mcast_oif = inet6_iif(opt_skb);
1143                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1144                         np->mcast_hops = opt_skb->nh.ipv6h->hop_limit;
1145                 if (ipv6_opt_accepted(sk, opt_skb)) {
1146                         skb_set_owner_r(opt_skb, sk);
1147                         opt_skb = xchg(&np->pktoptions, opt_skb);
1148                 } else {
1149                         __kfree_skb(opt_skb);
1150                         opt_skb = xchg(&np->pktoptions, NULL);
1151                 }
1152         }
1153
1154         if (opt_skb)
1155                 kfree_skb(opt_skb);
1156         return 0;
1157 }
1158
1159 static int tcp_v6_rcv(struct sk_buff **pskb)
1160 {
1161         struct sk_buff *skb = *pskb;
1162         struct tcphdr *th;
1163         struct sock *sk;
1164         int ret;
1165
1166         if (skb->pkt_type != PACKET_HOST)
1167                 goto discard_it;
1168
1169         /*
1170          *      Count it even if it's bad.
1171          */
1172         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1173
1174         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1175                 goto discard_it;
1176
1177         th = skb->h.th;
1178
1179         if (th->doff < sizeof(struct tcphdr)/4)
1180                 goto bad_packet;
1181         if (!pskb_may_pull(skb, th->doff*4))
1182                 goto discard_it;
1183
1184         if ((skb->ip_summed != CHECKSUM_UNNECESSARY &&
1185              tcp_v6_checksum_init(skb)))
1186                 goto bad_packet;
1187
1188         th = skb->h.th;
1189         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1190         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1191                                     skb->len - th->doff*4);
1192         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1193         TCP_SKB_CB(skb)->when = 0;
1194         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(skb->nh.ipv6h);
1195         TCP_SKB_CB(skb)->sacked = 0;
1196
1197         sk = __inet6_lookup(&tcp_hashinfo, &skb->nh.ipv6h->saddr, th->source,
1198                             &skb->nh.ipv6h->daddr, ntohs(th->dest),
1199                             inet6_iif(skb));
1200
1201         if (!sk)
1202                 goto no_tcp_socket;
1203
1204 process:
1205         if (sk->sk_state == TCP_TIME_WAIT)
1206                 goto do_time_wait;
1207
1208         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1209                 goto discard_and_relse;
1210
1211         if (sk_filter(sk, skb, 0))
1212                 goto discard_and_relse;
1213
1214         skb->dev = NULL;
1215
1216         bh_lock_sock(sk);
1217         ret = 0;
1218         if (!sock_owned_by_user(sk)) {
1219                 if (!tcp_prequeue(sk, skb))
1220                         ret = tcp_v6_do_rcv(sk, skb);
1221         } else
1222                 sk_add_backlog(sk, skb);
1223         bh_unlock_sock(sk);
1224
1225         sock_put(sk);
1226         return ret ? -1 : 0;
1227
1228 no_tcp_socket:
1229         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1230                 goto discard_it;
1231
1232         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1233 bad_packet:
1234                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1235         } else {
1236                 tcp_v6_send_reset(skb);
1237         }
1238
1239 discard_it:
1240
1241         /*
1242          *      Discard frame
1243          */
1244
1245         kfree_skb(skb);
1246         return 0;
1247
1248 discard_and_relse:
1249         sock_put(sk);
1250         goto discard_it;
1251
1252 do_time_wait:
1253         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1254                 inet_twsk_put((struct inet_timewait_sock *)sk);
1255                 goto discard_it;
1256         }
1257
1258         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1259                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1260                 inet_twsk_put((struct inet_timewait_sock *)sk);
1261                 goto discard_it;
1262         }
1263
1264         switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
1265                                            skb, th)) {
1266         case TCP_TW_SYN:
1267         {
1268                 struct sock *sk2;
1269
1270                 sk2 = inet6_lookup_listener(&tcp_hashinfo,
1271                                             &skb->nh.ipv6h->daddr,
1272                                             ntohs(th->dest), inet6_iif(skb));
1273                 if (sk2 != NULL) {
1274                         struct inet_timewait_sock *tw = inet_twsk(sk);
1275                         inet_twsk_deschedule(tw, &tcp_death_row);
1276                         inet_twsk_put(tw);
1277                         sk = sk2;
1278                         goto process;
1279                 }
1280                 /* Fall through to ACK */
1281         }
1282         case TCP_TW_ACK:
1283                 tcp_v6_timewait_ack(sk, skb);
1284                 break;
1285         case TCP_TW_RST:
1286                 goto no_tcp_socket;
1287         case TCP_TW_SUCCESS:;
1288         }
1289         goto discard_it;
1290 }
1291
1292 static int tcp_v6_remember_stamp(struct sock *sk)
1293 {
1294         /* Alas, not yet... */
1295         return 0;
1296 }
1297
1298 static struct inet_connection_sock_af_ops ipv6_specific = {
1299         .queue_xmit     =       inet6_csk_xmit,
1300         .send_check     =       tcp_v6_send_check,
1301         .rebuild_header =       inet6_sk_rebuild_header,
1302         .conn_request   =       tcp_v6_conn_request,
1303         .syn_recv_sock  =       tcp_v6_syn_recv_sock,
1304         .remember_stamp =       tcp_v6_remember_stamp,
1305         .net_header_len =       sizeof(struct ipv6hdr),
1306
1307         .setsockopt     =       ipv6_setsockopt,
1308         .getsockopt     =       ipv6_getsockopt,
1309         .addr2sockaddr  =       inet6_csk_addr2sockaddr,
1310         .sockaddr_len   =       sizeof(struct sockaddr_in6)
1311 };
1312
1313 /*
1314  *      TCP over IPv4 via INET6 API
1315  */
1316
1317 static struct inet_connection_sock_af_ops ipv6_mapped = {
1318         .queue_xmit     =       ip_queue_xmit,
1319         .send_check     =       tcp_v4_send_check,
1320         .rebuild_header =       inet_sk_rebuild_header,
1321         .conn_request   =       tcp_v6_conn_request,
1322         .syn_recv_sock  =       tcp_v6_syn_recv_sock,
1323         .remember_stamp =       tcp_v4_remember_stamp,
1324         .net_header_len =       sizeof(struct iphdr),
1325
1326         .setsockopt     =       ipv6_setsockopt,
1327         .getsockopt     =       ipv6_getsockopt,
1328         .addr2sockaddr  =       inet6_csk_addr2sockaddr,
1329         .sockaddr_len   =       sizeof(struct sockaddr_in6)
1330 };
1331
1332
1333
1334 /* NOTE: A lot of things set to zero explicitly by call to
1335  *       sk_alloc() so need not be done here.
1336  */
1337 static int tcp_v6_init_sock(struct sock *sk)
1338 {
1339         struct inet_connection_sock *icsk = inet_csk(sk);
1340         struct tcp_sock *tp = tcp_sk(sk);
1341
1342         skb_queue_head_init(&tp->out_of_order_queue);
1343         tcp_init_xmit_timers(sk);
1344         tcp_prequeue_init(tp);
1345
1346         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1347         tp->mdev = TCP_TIMEOUT_INIT;
1348
1349         /* So many TCP implementations out there (incorrectly) count the
1350          * initial SYN frame in their delayed-ACK and congestion control
1351          * algorithms that we must have the following bandaid to talk
1352          * efficiently to them.  -DaveM
1353          */
1354         tp->snd_cwnd = 2;
1355
1356         /* See draft-stevens-tcpca-spec-01 for discussion of the
1357          * initialization of these values.
1358          */
1359         tp->snd_ssthresh = 0x7fffffff;
1360         tp->snd_cwnd_clamp = ~0;
1361         tp->mss_cache = 536;
1362
1363         tp->reordering = sysctl_tcp_reordering;
1364
1365         sk->sk_state = TCP_CLOSE;
1366
1367         icsk->icsk_af_ops = &ipv6_specific;
1368         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1369         icsk->icsk_sync_mss = tcp_sync_mss;
1370         sk->sk_write_space = sk_stream_write_space;
1371         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1372
1373         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1374         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1375
1376         atomic_inc(&tcp_sockets_allocated);
1377
1378         return 0;
1379 }
1380
1381 static int tcp_v6_destroy_sock(struct sock *sk)
1382 {
1383         tcp_v4_destroy_sock(sk);
1384         return inet6_destroy_sock(sk);
1385 }
1386
1387 /* Proc filesystem TCPv6 sock list dumping. */
1388 static void get_openreq6(struct seq_file *seq,
1389                          struct sock *sk, struct request_sock *req, int i, int uid)
1390 {
1391         int ttd = req->expires - jiffies;
1392         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1393         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1394
1395         if (ttd < 0)
1396                 ttd = 0;
1397
1398         seq_printf(seq,
1399                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1400                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1401                    i,
1402                    src->s6_addr32[0], src->s6_addr32[1],
1403                    src->s6_addr32[2], src->s6_addr32[3],
1404                    ntohs(inet_sk(sk)->sport),
1405                    dest->s6_addr32[0], dest->s6_addr32[1],
1406                    dest->s6_addr32[2], dest->s6_addr32[3],
1407                    ntohs(inet_rsk(req)->rmt_port),
1408                    TCP_SYN_RECV,
1409                    0,0, /* could print option size, but that is af dependent. */
1410                    1,   /* timers active (only the expire timer) */
1411                    jiffies_to_clock_t(ttd),
1412                    req->retrans,
1413                    uid,
1414                    0,  /* non standard timer */
1415                    0, /* open_requests have no inode */
1416                    0, req);
1417 }
1418
1419 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1420 {
1421         struct in6_addr *dest, *src;
1422         __u16 destp, srcp;
1423         int timer_active;
1424         unsigned long timer_expires;
1425         struct inet_sock *inet = inet_sk(sp);
1426         struct tcp_sock *tp = tcp_sk(sp);
1427         const struct inet_connection_sock *icsk = inet_csk(sp);
1428         struct ipv6_pinfo *np = inet6_sk(sp);
1429
1430         dest  = &np->daddr;
1431         src   = &np->rcv_saddr;
1432         destp = ntohs(inet->dport);
1433         srcp  = ntohs(inet->sport);
1434
1435         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1436                 timer_active    = 1;
1437                 timer_expires   = icsk->icsk_timeout;
1438         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1439                 timer_active    = 4;
1440                 timer_expires   = icsk->icsk_timeout;
1441         } else if (timer_pending(&sp->sk_timer)) {
1442                 timer_active    = 2;
1443                 timer_expires   = sp->sk_timer.expires;
1444         } else {
1445                 timer_active    = 0;
1446                 timer_expires = jiffies;
1447         }
1448
1449         seq_printf(seq,
1450                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1451                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
1452                    i,
1453                    src->s6_addr32[0], src->s6_addr32[1],
1454                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1455                    dest->s6_addr32[0], dest->s6_addr32[1],
1456                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1457                    sp->sk_state,
1458                    tp->write_seq-tp->snd_una, tp->rcv_nxt-tp->copied_seq,
1459                    timer_active,
1460                    jiffies_to_clock_t(timer_expires - jiffies),
1461                    icsk->icsk_retransmits,
1462                    sock_i_uid(sp),
1463                    icsk->icsk_probes_out,
1464                    sock_i_ino(sp),
1465                    atomic_read(&sp->sk_refcnt), sp,
1466                    icsk->icsk_rto,
1467                    icsk->icsk_ack.ato,
1468                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1469                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
1470                    );
1471 }
1472
1473 static void get_timewait6_sock(struct seq_file *seq,
1474                                struct inet_timewait_sock *tw, int i)
1475 {
1476         struct in6_addr *dest, *src;
1477         __u16 destp, srcp;
1478         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1479         int ttd = tw->tw_ttd - jiffies;
1480
1481         if (ttd < 0)
1482                 ttd = 0;
1483
1484         dest = &tw6->tw_v6_daddr;
1485         src  = &tw6->tw_v6_rcv_saddr;
1486         destp = ntohs(tw->tw_dport);
1487         srcp  = ntohs(tw->tw_sport);
1488
1489         seq_printf(seq,
1490                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1491                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1492                    i,
1493                    src->s6_addr32[0], src->s6_addr32[1],
1494                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1495                    dest->s6_addr32[0], dest->s6_addr32[1],
1496                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1497                    tw->tw_substate, 0, 0,
1498                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
1499                    atomic_read(&tw->tw_refcnt), tw);
1500 }
1501
1502 #ifdef CONFIG_PROC_FS
1503 static int tcp6_seq_show(struct seq_file *seq, void *v)
1504 {
1505         struct tcp_iter_state *st;
1506
1507         if (v == SEQ_START_TOKEN) {
1508                 seq_puts(seq,
1509                          "  sl  "
1510                          "local_address                         "
1511                          "remote_address                        "
1512                          "st tx_queue rx_queue tr tm->when retrnsmt"
1513                          "   uid  timeout inode\n");
1514                 goto out;
1515         }
1516         st = seq->private;
1517
1518         switch (st->state) {
1519         case TCP_SEQ_STATE_LISTENING:
1520         case TCP_SEQ_STATE_ESTABLISHED:
1521                 get_tcp6_sock(seq, v, st->num);
1522                 break;
1523         case TCP_SEQ_STATE_OPENREQ:
1524                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1525                 break;
1526         case TCP_SEQ_STATE_TIME_WAIT:
1527                 get_timewait6_sock(seq, v, st->num);
1528                 break;
1529         }
1530 out:
1531         return 0;
1532 }
1533
1534 static struct file_operations tcp6_seq_fops;
1535 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1536         .owner          = THIS_MODULE,
1537         .name           = "tcp6",
1538         .family         = AF_INET6,
1539         .seq_show       = tcp6_seq_show,
1540         .seq_fops       = &tcp6_seq_fops,
1541 };
1542
1543 int __init tcp6_proc_init(void)
1544 {
1545         return tcp_proc_register(&tcp6_seq_afinfo);
1546 }
1547
1548 void tcp6_proc_exit(void)
1549 {
1550         tcp_proc_unregister(&tcp6_seq_afinfo);
1551 }
1552 #endif
1553
1554 struct proto tcpv6_prot = {
1555         .name                   = "TCPv6",
1556         .owner                  = THIS_MODULE,
1557         .close                  = tcp_close,
1558         .connect                = tcp_v6_connect,
1559         .disconnect             = tcp_disconnect,
1560         .accept                 = inet_csk_accept,
1561         .ioctl                  = tcp_ioctl,
1562         .init                   = tcp_v6_init_sock,
1563         .destroy                = tcp_v6_destroy_sock,
1564         .shutdown               = tcp_shutdown,
1565         .setsockopt             = tcp_setsockopt,
1566         .getsockopt             = tcp_getsockopt,
1567         .sendmsg                = tcp_sendmsg,
1568         .recvmsg                = tcp_recvmsg,
1569         .backlog_rcv            = tcp_v6_do_rcv,
1570         .hash                   = tcp_v6_hash,
1571         .unhash                 = tcp_unhash,
1572         .get_port               = tcp_v6_get_port,
1573         .enter_memory_pressure  = tcp_enter_memory_pressure,
1574         .sockets_allocated      = &tcp_sockets_allocated,
1575         .memory_allocated       = &tcp_memory_allocated,
1576         .memory_pressure        = &tcp_memory_pressure,
1577         .orphan_count           = &tcp_orphan_count,
1578         .sysctl_mem             = sysctl_tcp_mem,
1579         .sysctl_wmem            = sysctl_tcp_wmem,
1580         .sysctl_rmem            = sysctl_tcp_rmem,
1581         .max_header             = MAX_TCP_HEADER,
1582         .obj_size               = sizeof(struct tcp6_sock),
1583         .twsk_prot              = &tcp6_timewait_sock_ops,
1584         .rsk_prot               = &tcp6_request_sock_ops,
1585 };
1586
1587 static struct inet6_protocol tcpv6_protocol = {
1588         .handler        =       tcp_v6_rcv,
1589         .err_handler    =       tcp_v6_err,
1590         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1591 };
1592
1593 static struct inet_protosw tcpv6_protosw = {
1594         .type           =       SOCK_STREAM,
1595         .protocol       =       IPPROTO_TCP,
1596         .prot           =       &tcpv6_prot,
1597         .ops            =       &inet6_stream_ops,
1598         .capability     =       -1,
1599         .no_check       =       0,
1600         .flags          =       INET_PROTOSW_PERMANENT |
1601                                 INET_PROTOSW_ICSK,
1602 };
1603
1604 void __init tcpv6_init(void)
1605 {
1606         int err;
1607
1608         /* register inet6 protocol */
1609         if (inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP) < 0)
1610                 printk(KERN_ERR "tcpv6_init: Could not register protocol\n");
1611         inet6_register_protosw(&tcpv6_protosw);
1612
1613         err = sock_create_kern(PF_INET6, SOCK_RAW, IPPROTO_TCP, &tcp6_socket);
1614         if (err < 0)
1615                 panic("Failed to create the TCPv6 control socket.\n");
1616         tcp6_socket->sk->sk_allocation = GFP_ATOMIC;
1617
1618         /* Unhash it so that IP input processing does not even
1619          * see it, we do not wish this socket to see incoming
1620          * packets.
1621          */
1622         tcp6_socket->sk->sk_prot->unhash(tcp6_socket->sk);
1623 }