Merge branch 'for_paulus' of master.kernel.org:/pub/scm/linux/kernel/git/galak/powerpc
[pandora-kernel.git] / net / ipv4 / tcp_ipv4.c
1 /*
2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
3  *              operating system.  INET is implemented using the  BSD Socket
4  *              interface as the means of communication with the user level.
5  *
6  *              Implementation of the Transmission Control Protocol(TCP).
7  *
8  * Version:     $Id: tcp_ipv4.c,v 1.240 2002/02/01 22:01:04 davem Exp $
9  *
10  *              IPv4 specific functions
11  *
12  *
13  *              code split from:
14  *              linux/ipv4/tcp.c
15  *              linux/ipv4/tcp_input.c
16  *              linux/ipv4/tcp_output.c
17  *
18  *              See tcp.c for author information
19  *
20  *      This program is free software; you can redistribute it and/or
21  *      modify it under the terms of the GNU General Public License
22  *      as published by the Free Software Foundation; either version
23  *      2 of the License, or (at your option) any later version.
24  */
25
26 /*
27  * Changes:
28  *              David S. Miller :       New socket lookup architecture.
29  *                                      This code is dedicated to John Dyson.
30  *              David S. Miller :       Change semantics of established hash,
31  *                                      half is devoted to TIME_WAIT sockets
32  *                                      and the rest go in the other half.
33  *              Andi Kleen :            Add support for syncookies and fixed
34  *                                      some bugs: ip options weren't passed to
35  *                                      the TCP layer, missed a check for an
36  *                                      ACK bit.
37  *              Andi Kleen :            Implemented fast path mtu discovery.
38  *                                      Fixed many serious bugs in the
39  *                                      request_sock handling and moved
40  *                                      most of it into the af independent code.
41  *                                      Added tail drop and some other bugfixes.
42  *                                      Added new listen semantics.
43  *              Mike McLagan    :       Routing by source
44  *      Juan Jose Ciarlante:            ip_dynaddr bits
45  *              Andi Kleen:             various fixes.
46  *      Vitaly E. Lavrov        :       Transparent proxy revived after year
47  *                                      coma.
48  *      Andi Kleen              :       Fix new listen.
49  *      Andi Kleen              :       Fix accept error reporting.
50  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
51  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
52  *                                      a single port at the same time.
53  */
54
55 #include <linux/config.h>
56
57 #include <linux/types.h>
58 #include <linux/fcntl.h>
59 #include <linux/module.h>
60 #include <linux/random.h>
61 #include <linux/cache.h>
62 #include <linux/jhash.h>
63 #include <linux/init.h>
64 #include <linux/times.h>
65
66 #include <net/icmp.h>
67 #include <net/inet_hashtables.h>
68 #include <net/tcp.h>
69 #include <net/transp_v6.h>
70 #include <net/ipv6.h>
71 #include <net/inet_common.h>
72 #include <net/timewait_sock.h>
73 #include <net/xfrm.h>
74
75 #include <linux/inet.h>
76 #include <linux/ipv6.h>
77 #include <linux/stddef.h>
78 #include <linux/proc_fs.h>
79 #include <linux/seq_file.h>
80
81 int sysctl_tcp_tw_reuse;
82 int sysctl_tcp_low_latency;
83
84 /* Check TCP sequence numbers in ICMP packets. */
85 #define ICMP_MIN_LENGTH 8
86
87 /* Socket used for sending RSTs */
88 static struct socket *tcp_socket;
89
90 void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb);
91
92 struct inet_hashinfo __cacheline_aligned tcp_hashinfo = {
93         .lhash_lock     = RW_LOCK_UNLOCKED,
94         .lhash_users    = ATOMIC_INIT(0),
95         .lhash_wait     = __WAIT_QUEUE_HEAD_INITIALIZER(tcp_hashinfo.lhash_wait),
96 };
97
98 static int tcp_v4_get_port(struct sock *sk, unsigned short snum)
99 {
100         return inet_csk_get_port(&tcp_hashinfo, sk, snum,
101                                  inet_csk_bind_conflict);
102 }
103
104 static void tcp_v4_hash(struct sock *sk)
105 {
106         inet_hash(&tcp_hashinfo, sk);
107 }
108
109 void tcp_unhash(struct sock *sk)
110 {
111         inet_unhash(&tcp_hashinfo, sk);
112 }
113
114 static inline __u32 tcp_v4_init_sequence(struct sock *sk, struct sk_buff *skb)
115 {
116         return secure_tcp_sequence_number(skb->nh.iph->daddr,
117                                           skb->nh.iph->saddr,
118                                           skb->h.th->dest,
119                                           skb->h.th->source);
120 }
121
122 int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
123 {
124         const struct tcp_timewait_sock *tcptw = tcp_twsk(sktw);
125         struct tcp_sock *tp = tcp_sk(sk);
126
127         /* With PAWS, it is safe from the viewpoint
128            of data integrity. Even without PAWS it is safe provided sequence
129            spaces do not overlap i.e. at data rates <= 80Mbit/sec.
130
131            Actually, the idea is close to VJ's one, only timestamp cache is
132            held not per host, but per port pair and TW bucket is used as state
133            holder.
134
135            If TW bucket has been already destroyed we fall back to VJ's scheme
136            and use initial timestamp retrieved from peer table.
137          */
138         if (tcptw->tw_ts_recent_stamp &&
139             (twp == NULL || (sysctl_tcp_tw_reuse &&
140                              xtime.tv_sec - tcptw->tw_ts_recent_stamp > 1))) {
141                 tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
142                 if (tp->write_seq == 0)
143                         tp->write_seq = 1;
144                 tp->rx_opt.ts_recent       = tcptw->tw_ts_recent;
145                 tp->rx_opt.ts_recent_stamp = tcptw->tw_ts_recent_stamp;
146                 sock_hold(sktw);
147                 return 1;
148         }
149
150         return 0;
151 }
152
153 EXPORT_SYMBOL_GPL(tcp_twsk_unique);
154
155 /* This will initiate an outgoing connection. */
156 int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
157 {
158         struct inet_sock *inet = inet_sk(sk);
159         struct tcp_sock *tp = tcp_sk(sk);
160         struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
161         struct rtable *rt;
162         u32 daddr, nexthop;
163         int tmp;
164         int err;
165
166         if (addr_len < sizeof(struct sockaddr_in))
167                 return -EINVAL;
168
169         if (usin->sin_family != AF_INET)
170                 return -EAFNOSUPPORT;
171
172         nexthop = daddr = usin->sin_addr.s_addr;
173         if (inet->opt && inet->opt->srr) {
174                 if (!daddr)
175                         return -EINVAL;
176                 nexthop = inet->opt->faddr;
177         }
178
179         tmp = ip_route_connect(&rt, nexthop, inet->saddr,
180                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
181                                IPPROTO_TCP,
182                                inet->sport, usin->sin_port, sk);
183         if (tmp < 0)
184                 return tmp;
185
186         if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) {
187                 ip_rt_put(rt);
188                 return -ENETUNREACH;
189         }
190
191         if (!inet->opt || !inet->opt->srr)
192                 daddr = rt->rt_dst;
193
194         if (!inet->saddr)
195                 inet->saddr = rt->rt_src;
196         inet->rcv_saddr = inet->saddr;
197
198         if (tp->rx_opt.ts_recent_stamp && inet->daddr != daddr) {
199                 /* Reset inherited state */
200                 tp->rx_opt.ts_recent       = 0;
201                 tp->rx_opt.ts_recent_stamp = 0;
202                 tp->write_seq              = 0;
203         }
204
205         if (tcp_death_row.sysctl_tw_recycle &&
206             !tp->rx_opt.ts_recent_stamp && rt->rt_dst == daddr) {
207                 struct inet_peer *peer = rt_get_peer(rt);
208
209                 /* VJ's idea. We save last timestamp seen from
210                  * the destination in peer table, when entering state TIME-WAIT
211                  * and initialize rx_opt.ts_recent from it, when trying new connection.
212                  */
213
214                 if (peer && peer->tcp_ts_stamp + TCP_PAWS_MSL >= xtime.tv_sec) {
215                         tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
216                         tp->rx_opt.ts_recent = peer->tcp_ts;
217                 }
218         }
219
220         inet->dport = usin->sin_port;
221         inet->daddr = daddr;
222
223         inet_csk(sk)->icsk_ext_hdr_len = 0;
224         if (inet->opt)
225                 inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
226
227         tp->rx_opt.mss_clamp = 536;
228
229         /* Socket identity is still unknown (sport may be zero).
230          * However we set state to SYN-SENT and not releasing socket
231          * lock select source port, enter ourselves into the hash tables and
232          * complete initialization after this.
233          */
234         tcp_set_state(sk, TCP_SYN_SENT);
235         err = inet_hash_connect(&tcp_death_row, sk);
236         if (err)
237                 goto failure;
238
239         err = ip_route_newports(&rt, IPPROTO_TCP, inet->sport, inet->dport, sk);
240         if (err)
241                 goto failure;
242
243         /* OK, now commit destination to socket.  */
244         sk_setup_caps(sk, &rt->u.dst);
245
246         if (!tp->write_seq)
247                 tp->write_seq = secure_tcp_sequence_number(inet->saddr,
248                                                            inet->daddr,
249                                                            inet->sport,
250                                                            usin->sin_port);
251
252         inet->id = tp->write_seq ^ jiffies;
253
254         err = tcp_connect(sk);
255         rt = NULL;
256         if (err)
257                 goto failure;
258
259         return 0;
260
261 failure:
262         /* This unhashes the socket and releases the local port, if necessary. */
263         tcp_set_state(sk, TCP_CLOSE);
264         ip_rt_put(rt);
265         sk->sk_route_caps = 0;
266         inet->dport = 0;
267         return err;
268 }
269
270 /*
271  * This routine does path mtu discovery as defined in RFC1191.
272  */
273 static void do_pmtu_discovery(struct sock *sk, struct iphdr *iph, u32 mtu)
274 {
275         struct dst_entry *dst;
276         struct inet_sock *inet = inet_sk(sk);
277
278         /* We are not interested in TCP_LISTEN and open_requests (SYN-ACKs
279          * send out by Linux are always <576bytes so they should go through
280          * unfragmented).
281          */
282         if (sk->sk_state == TCP_LISTEN)
283                 return;
284
285         /* We don't check in the destentry if pmtu discovery is forbidden
286          * on this route. We just assume that no packet_to_big packets
287          * are send back when pmtu discovery is not active.
288          * There is a small race when the user changes this flag in the
289          * route, but I think that's acceptable.
290          */
291         if ((dst = __sk_dst_check(sk, 0)) == NULL)
292                 return;
293
294         dst->ops->update_pmtu(dst, mtu);
295
296         /* Something is about to be wrong... Remember soft error
297          * for the case, if this connection will not able to recover.
298          */
299         if (mtu < dst_mtu(dst) && ip_dont_fragment(sk, dst))
300                 sk->sk_err_soft = EMSGSIZE;
301
302         mtu = dst_mtu(dst);
303
304         if (inet->pmtudisc != IP_PMTUDISC_DONT &&
305             inet_csk(sk)->icsk_pmtu_cookie > mtu) {
306                 tcp_sync_mss(sk, mtu);
307
308                 /* Resend the TCP packet because it's
309                  * clear that the old packet has been
310                  * dropped. This is the new "fast" path mtu
311                  * discovery.
312                  */
313                 tcp_simple_retransmit(sk);
314         } /* else let the usual retransmit timer handle it */
315 }
316
317 /*
318  * This routine is called by the ICMP module when it gets some
319  * sort of error condition.  If err < 0 then the socket should
320  * be closed and the error returned to the user.  If err > 0
321  * it's just the icmp type << 8 | icmp code.  After adjustment
322  * header points to the first 8 bytes of the tcp header.  We need
323  * to find the appropriate port.
324  *
325  * The locking strategy used here is very "optimistic". When
326  * someone else accesses the socket the ICMP is just dropped
327  * and for some paths there is no check at all.
328  * A more general error queue to queue errors for later handling
329  * is probably better.
330  *
331  */
332
333 void tcp_v4_err(struct sk_buff *skb, u32 info)
334 {
335         struct iphdr *iph = (struct iphdr *)skb->data;
336         struct tcphdr *th = (struct tcphdr *)(skb->data + (iph->ihl << 2));
337         struct tcp_sock *tp;
338         struct inet_sock *inet;
339         int type = skb->h.icmph->type;
340         int code = skb->h.icmph->code;
341         struct sock *sk;
342         __u32 seq;
343         int err;
344
345         if (skb->len < (iph->ihl << 2) + 8) {
346                 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
347                 return;
348         }
349
350         sk = inet_lookup(&tcp_hashinfo, iph->daddr, th->dest, iph->saddr,
351                          th->source, inet_iif(skb));
352         if (!sk) {
353                 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
354                 return;
355         }
356         if (sk->sk_state == TCP_TIME_WAIT) {
357                 inet_twsk_put((struct inet_timewait_sock *)sk);
358                 return;
359         }
360
361         bh_lock_sock(sk);
362         /* If too many ICMPs get dropped on busy
363          * servers this needs to be solved differently.
364          */
365         if (sock_owned_by_user(sk))
366                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
367
368         if (sk->sk_state == TCP_CLOSE)
369                 goto out;
370
371         tp = tcp_sk(sk);
372         seq = ntohl(th->seq);
373         if (sk->sk_state != TCP_LISTEN &&
374             !between(seq, tp->snd_una, tp->snd_nxt)) {
375                 NET_INC_STATS(LINUX_MIB_OUTOFWINDOWICMPS);
376                 goto out;
377         }
378
379         switch (type) {
380         case ICMP_SOURCE_QUENCH:
381                 /* Just silently ignore these. */
382                 goto out;
383         case ICMP_PARAMETERPROB:
384                 err = EPROTO;
385                 break;
386         case ICMP_DEST_UNREACH:
387                 if (code > NR_ICMP_UNREACH)
388                         goto out;
389
390                 if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */
391                         if (!sock_owned_by_user(sk))
392                                 do_pmtu_discovery(sk, iph, info);
393                         goto out;
394                 }
395
396                 err = icmp_err_convert[code].errno;
397                 break;
398         case ICMP_TIME_EXCEEDED:
399                 err = EHOSTUNREACH;
400                 break;
401         default:
402                 goto out;
403         }
404
405         switch (sk->sk_state) {
406                 struct request_sock *req, **prev;
407         case TCP_LISTEN:
408                 if (sock_owned_by_user(sk))
409                         goto out;
410
411                 req = inet_csk_search_req(sk, &prev, th->dest,
412                                           iph->daddr, iph->saddr);
413                 if (!req)
414                         goto out;
415
416                 /* ICMPs are not backlogged, hence we cannot get
417                    an established socket here.
418                  */
419                 BUG_TRAP(!req->sk);
420
421                 if (seq != tcp_rsk(req)->snt_isn) {
422                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
423                         goto out;
424                 }
425
426                 /*
427                  * Still in SYN_RECV, just remove it silently.
428                  * There is no good way to pass the error to the newly
429                  * created socket, and POSIX does not want network
430                  * errors returned from accept().
431                  */
432                 inet_csk_reqsk_queue_drop(sk, req, prev);
433                 goto out;
434
435         case TCP_SYN_SENT:
436         case TCP_SYN_RECV:  /* Cannot happen.
437                                It can f.e. if SYNs crossed.
438                              */
439                 if (!sock_owned_by_user(sk)) {
440                         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
441                         sk->sk_err = err;
442
443                         sk->sk_error_report(sk);
444
445                         tcp_done(sk);
446                 } else {
447                         sk->sk_err_soft = err;
448                 }
449                 goto out;
450         }
451
452         /* If we've already connected we will keep trying
453          * until we time out, or the user gives up.
454          *
455          * rfc1122 4.2.3.9 allows to consider as hard errors
456          * only PROTO_UNREACH and PORT_UNREACH (well, FRAG_FAILED too,
457          * but it is obsoleted by pmtu discovery).
458          *
459          * Note, that in modern internet, where routing is unreliable
460          * and in each dark corner broken firewalls sit, sending random
461          * errors ordered by their masters even this two messages finally lose
462          * their original sense (even Linux sends invalid PORT_UNREACHs)
463          *
464          * Now we are in compliance with RFCs.
465          *                                                      --ANK (980905)
466          */
467
468         inet = inet_sk(sk);
469         if (!sock_owned_by_user(sk) && inet->recverr) {
470                 sk->sk_err = err;
471                 sk->sk_error_report(sk);
472         } else  { /* Only an error on timeout */
473                 sk->sk_err_soft = err;
474         }
475
476 out:
477         bh_unlock_sock(sk);
478         sock_put(sk);
479 }
480
481 /* This routine computes an IPv4 TCP checksum. */
482 void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb)
483 {
484         struct inet_sock *inet = inet_sk(sk);
485         struct tcphdr *th = skb->h.th;
486
487         if (skb->ip_summed == CHECKSUM_HW) {
488                 th->check = ~tcp_v4_check(th, len, inet->saddr, inet->daddr, 0);
489                 skb->csum = offsetof(struct tcphdr, check);
490         } else {
491                 th->check = tcp_v4_check(th, len, inet->saddr, inet->daddr,
492                                          csum_partial((char *)th,
493                                                       th->doff << 2,
494                                                       skb->csum));
495         }
496 }
497
498 /*
499  *      This routine will send an RST to the other tcp.
500  *
501  *      Someone asks: why I NEVER use socket parameters (TOS, TTL etc.)
502  *                    for reset.
503  *      Answer: if a packet caused RST, it is not for a socket
504  *              existing in our system, if it is matched to a socket,
505  *              it is just duplicate segment or bug in other side's TCP.
506  *              So that we build reply only basing on parameters
507  *              arrived with segment.
508  *      Exception: precedence violation. We do not implement it in any case.
509  */
510
511 static void tcp_v4_send_reset(struct sk_buff *skb)
512 {
513         struct tcphdr *th = skb->h.th;
514         struct tcphdr rth;
515         struct ip_reply_arg arg;
516
517         /* Never send a reset in response to a reset. */
518         if (th->rst)
519                 return;
520
521         if (((struct rtable *)skb->dst)->rt_type != RTN_LOCAL)
522                 return;
523
524         /* Swap the send and the receive. */
525         memset(&rth, 0, sizeof(struct tcphdr));
526         rth.dest   = th->source;
527         rth.source = th->dest;
528         rth.doff   = sizeof(struct tcphdr) / 4;
529         rth.rst    = 1;
530
531         if (th->ack) {
532                 rth.seq = th->ack_seq;
533         } else {
534                 rth.ack = 1;
535                 rth.ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin +
536                                     skb->len - (th->doff << 2));
537         }
538
539         memset(&arg, 0, sizeof arg);
540         arg.iov[0].iov_base = (unsigned char *)&rth;
541         arg.iov[0].iov_len  = sizeof rth;
542         arg.csum = csum_tcpudp_nofold(skb->nh.iph->daddr,
543                                       skb->nh.iph->saddr, /*XXX*/
544                                       sizeof(struct tcphdr), IPPROTO_TCP, 0);
545         arg.csumoffset = offsetof(struct tcphdr, check) / 2;
546
547         ip_send_reply(tcp_socket->sk, skb, &arg, sizeof rth);
548
549         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
550         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
551 }
552
553 /* The code following below sending ACKs in SYN-RECV and TIME-WAIT states
554    outside socket context is ugly, certainly. What can I do?
555  */
556
557 static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
558                             u32 win, u32 ts)
559 {
560         struct tcphdr *th = skb->h.th;
561         struct {
562                 struct tcphdr th;
563                 u32 tsopt[3];
564         } rep;
565         struct ip_reply_arg arg;
566
567         memset(&rep.th, 0, sizeof(struct tcphdr));
568         memset(&arg, 0, sizeof arg);
569
570         arg.iov[0].iov_base = (unsigned char *)&rep;
571         arg.iov[0].iov_len  = sizeof(rep.th);
572         if (ts) {
573                 rep.tsopt[0] = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
574                                      (TCPOPT_TIMESTAMP << 8) |
575                                      TCPOLEN_TIMESTAMP);
576                 rep.tsopt[1] = htonl(tcp_time_stamp);
577                 rep.tsopt[2] = htonl(ts);
578                 arg.iov[0].iov_len = sizeof(rep);
579         }
580
581         /* Swap the send and the receive. */
582         rep.th.dest    = th->source;
583         rep.th.source  = th->dest;
584         rep.th.doff    = arg.iov[0].iov_len / 4;
585         rep.th.seq     = htonl(seq);
586         rep.th.ack_seq = htonl(ack);
587         rep.th.ack     = 1;
588         rep.th.window  = htons(win);
589
590         arg.csum = csum_tcpudp_nofold(skb->nh.iph->daddr,
591                                       skb->nh.iph->saddr, /*XXX*/
592                                       arg.iov[0].iov_len, IPPROTO_TCP, 0);
593         arg.csumoffset = offsetof(struct tcphdr, check) / 2;
594
595         ip_send_reply(tcp_socket->sk, skb, &arg, arg.iov[0].iov_len);
596
597         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
598 }
599
600 static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
601 {
602         struct inet_timewait_sock *tw = inet_twsk(sk);
603         const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
604
605         tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
606                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale, tcptw->tw_ts_recent);
607
608         inet_twsk_put(tw);
609 }
610
611 static void tcp_v4_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
612 {
613         tcp_v4_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd,
614                         req->ts_recent);
615 }
616
617 /*
618  *      Send a SYN-ACK after having received an ACK.
619  *      This still operates on a request_sock only, not on a big
620  *      socket.
621  */
622 static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
623                               struct dst_entry *dst)
624 {
625         const struct inet_request_sock *ireq = inet_rsk(req);
626         int err = -1;
627         struct sk_buff * skb;
628
629         /* First, grab a route. */
630         if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)
631                 goto out;
632
633         skb = tcp_make_synack(sk, dst, req);
634
635         if (skb) {
636                 struct tcphdr *th = skb->h.th;
637
638                 th->check = tcp_v4_check(th, skb->len,
639                                          ireq->loc_addr,
640                                          ireq->rmt_addr,
641                                          csum_partial((char *)th, skb->len,
642                                                       skb->csum));
643
644                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
645                                             ireq->rmt_addr,
646                                             ireq->opt);
647                 if (err == NET_XMIT_CN)
648                         err = 0;
649         }
650
651 out:
652         dst_release(dst);
653         return err;
654 }
655
656 /*
657  *      IPv4 request_sock destructor.
658  */
659 static void tcp_v4_reqsk_destructor(struct request_sock *req)
660 {
661         kfree(inet_rsk(req)->opt);
662 }
663
664 #ifdef CONFIG_SYN_COOKIES
665 static void syn_flood_warning(struct sk_buff *skb)
666 {
667         static unsigned long warntime;
668
669         if (time_after(jiffies, (warntime + HZ * 60))) {
670                 warntime = jiffies;
671                 printk(KERN_INFO
672                        "possible SYN flooding on port %d. Sending cookies.\n",
673                        ntohs(skb->h.th->dest));
674         }
675 }
676 #endif
677
678 /*
679  * Save and compile IPv4 options into the request_sock if needed.
680  */
681 static struct ip_options *tcp_v4_save_options(struct sock *sk,
682                                               struct sk_buff *skb)
683 {
684         struct ip_options *opt = &(IPCB(skb)->opt);
685         struct ip_options *dopt = NULL;
686
687         if (opt && opt->optlen) {
688                 int opt_size = optlength(opt);
689                 dopt = kmalloc(opt_size, GFP_ATOMIC);
690                 if (dopt) {
691                         if (ip_options_echo(dopt, skb)) {
692                                 kfree(dopt);
693                                 dopt = NULL;
694                         }
695                 }
696         }
697         return dopt;
698 }
699
700 struct request_sock_ops tcp_request_sock_ops = {
701         .family         =       PF_INET,
702         .obj_size       =       sizeof(struct tcp_request_sock),
703         .rtx_syn_ack    =       tcp_v4_send_synack,
704         .send_ack       =       tcp_v4_reqsk_send_ack,
705         .destructor     =       tcp_v4_reqsk_destructor,
706         .send_reset     =       tcp_v4_send_reset,
707 };
708
709 static struct timewait_sock_ops tcp_timewait_sock_ops = {
710         .twsk_obj_size  = sizeof(struct tcp_timewait_sock),
711         .twsk_unique    = tcp_twsk_unique,
712 };
713
714 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
715 {
716         struct inet_request_sock *ireq;
717         struct tcp_options_received tmp_opt;
718         struct request_sock *req;
719         __u32 saddr = skb->nh.iph->saddr;
720         __u32 daddr = skb->nh.iph->daddr;
721         __u32 isn = TCP_SKB_CB(skb)->when;
722         struct dst_entry *dst = NULL;
723 #ifdef CONFIG_SYN_COOKIES
724         int want_cookie = 0;
725 #else
726 #define want_cookie 0 /* Argh, why doesn't gcc optimize this :( */
727 #endif
728
729         /* Never answer to SYNs send to broadcast or multicast */
730         if (((struct rtable *)skb->dst)->rt_flags &
731             (RTCF_BROADCAST | RTCF_MULTICAST))
732                 goto drop;
733
734         /* TW buckets are converted to open requests without
735          * limitations, they conserve resources and peer is
736          * evidently real one.
737          */
738         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
739 #ifdef CONFIG_SYN_COOKIES
740                 if (sysctl_tcp_syncookies) {
741                         want_cookie = 1;
742                 } else
743 #endif
744                 goto drop;
745         }
746
747         /* Accept backlog is full. If we have already queued enough
748          * of warm entries in syn queue, drop request. It is better than
749          * clogging syn queue with openreqs with exponentially increasing
750          * timeout.
751          */
752         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
753                 goto drop;
754
755         req = reqsk_alloc(&tcp_request_sock_ops);
756         if (!req)
757                 goto drop;
758
759         tcp_clear_options(&tmp_opt);
760         tmp_opt.mss_clamp = 536;
761         tmp_opt.user_mss  = tcp_sk(sk)->rx_opt.user_mss;
762
763         tcp_parse_options(skb, &tmp_opt, 0);
764
765         if (want_cookie) {
766                 tcp_clear_options(&tmp_opt);
767                 tmp_opt.saw_tstamp = 0;
768         }
769
770         if (tmp_opt.saw_tstamp && !tmp_opt.rcv_tsval) {
771                 /* Some OSes (unknown ones, but I see them on web server, which
772                  * contains information interesting only for windows'
773                  * users) do not send their stamp in SYN. It is easy case.
774                  * We simply do not advertise TS support.
775                  */
776                 tmp_opt.saw_tstamp = 0;
777                 tmp_opt.tstamp_ok  = 0;
778         }
779         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
780
781         tcp_openreq_init(req, &tmp_opt, skb);
782
783         ireq = inet_rsk(req);
784         ireq->loc_addr = daddr;
785         ireq->rmt_addr = saddr;
786         ireq->opt = tcp_v4_save_options(sk, skb);
787         if (!want_cookie)
788                 TCP_ECN_create_request(req, skb->h.th);
789
790         if (want_cookie) {
791 #ifdef CONFIG_SYN_COOKIES
792                 syn_flood_warning(skb);
793 #endif
794                 isn = cookie_v4_init_sequence(sk, skb, &req->mss);
795         } else if (!isn) {
796                 struct inet_peer *peer = NULL;
797
798                 /* VJ's idea. We save last timestamp seen
799                  * from the destination in peer table, when entering
800                  * state TIME-WAIT, and check against it before
801                  * accepting new connection request.
802                  *
803                  * If "isn" is not zero, this request hit alive
804                  * timewait bucket, so that all the necessary checks
805                  * are made in the function processing timewait state.
806                  */
807                 if (tmp_opt.saw_tstamp &&
808                     tcp_death_row.sysctl_tw_recycle &&
809                     (dst = inet_csk_route_req(sk, req)) != NULL &&
810                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
811                     peer->v4daddr == saddr) {
812                         if (xtime.tv_sec < peer->tcp_ts_stamp + TCP_PAWS_MSL &&
813                             (s32)(peer->tcp_ts - req->ts_recent) >
814                                                         TCP_PAWS_WINDOW) {
815                                 NET_INC_STATS_BH(LINUX_MIB_PAWSPASSIVEREJECTED);
816                                 dst_release(dst);
817                                 goto drop_and_free;
818                         }
819                 }
820                 /* Kill the following clause, if you dislike this way. */
821                 else if (!sysctl_tcp_syncookies &&
822                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
823                           (sysctl_max_syn_backlog >> 2)) &&
824                          (!peer || !peer->tcp_ts_stamp) &&
825                          (!dst || !dst_metric(dst, RTAX_RTT))) {
826                         /* Without syncookies last quarter of
827                          * backlog is filled with destinations,
828                          * proven to be alive.
829                          * It means that we continue to communicate
830                          * to destinations, already remembered
831                          * to the moment of synflood.
832                          */
833                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open "
834                                        "request from %u.%u.%u.%u/%u\n",
835                                        NIPQUAD(saddr),
836                                        ntohs(skb->h.th->source));
837                         dst_release(dst);
838                         goto drop_and_free;
839                 }
840
841                 isn = tcp_v4_init_sequence(sk, skb);
842         }
843         tcp_rsk(req)->snt_isn = isn;
844
845         if (tcp_v4_send_synack(sk, req, dst))
846                 goto drop_and_free;
847
848         if (want_cookie) {
849                 reqsk_free(req);
850         } else {
851                 inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
852         }
853         return 0;
854
855 drop_and_free:
856         reqsk_free(req);
857 drop:
858         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
859         return 0;
860 }
861
862
863 /*
864  * The three way handshake has completed - we got a valid synack -
865  * now create the new socket.
866  */
867 struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
868                                   struct request_sock *req,
869                                   struct dst_entry *dst)
870 {
871         struct inet_request_sock *ireq;
872         struct inet_sock *newinet;
873         struct tcp_sock *newtp;
874         struct sock *newsk;
875
876         if (sk_acceptq_is_full(sk))
877                 goto exit_overflow;
878
879         if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)
880                 goto exit;
881
882         newsk = tcp_create_openreq_child(sk, req, skb);
883         if (!newsk)
884                 goto exit;
885
886         sk_setup_caps(newsk, dst);
887
888         newtp                 = tcp_sk(newsk);
889         newinet               = inet_sk(newsk);
890         ireq                  = inet_rsk(req);
891         newinet->daddr        = ireq->rmt_addr;
892         newinet->rcv_saddr    = ireq->loc_addr;
893         newinet->saddr        = ireq->loc_addr;
894         newinet->opt          = ireq->opt;
895         ireq->opt             = NULL;
896         newinet->mc_index     = inet_iif(skb);
897         newinet->mc_ttl       = skb->nh.iph->ttl;
898         inet_csk(newsk)->icsk_ext_hdr_len = 0;
899         if (newinet->opt)
900                 inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
901         newinet->id = newtp->write_seq ^ jiffies;
902
903         tcp_mtup_init(newsk);
904         tcp_sync_mss(newsk, dst_mtu(dst));
905         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
906         tcp_initialize_rcv_mss(newsk);
907
908         __inet_hash(&tcp_hashinfo, newsk, 0);
909         __inet_inherit_port(&tcp_hashinfo, sk, newsk);
910
911         return newsk;
912
913 exit_overflow:
914         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
915 exit:
916         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
917         dst_release(dst);
918         return NULL;
919 }
920
921 static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
922 {
923         struct tcphdr *th = skb->h.th;
924         struct iphdr *iph = skb->nh.iph;
925         struct sock *nsk;
926         struct request_sock **prev;
927         /* Find possible connection requests. */
928         struct request_sock *req = inet_csk_search_req(sk, &prev, th->source,
929                                                        iph->saddr, iph->daddr);
930         if (req)
931                 return tcp_check_req(sk, skb, req, prev);
932
933         nsk = __inet_lookup_established(&tcp_hashinfo, skb->nh.iph->saddr,
934                                         th->source, skb->nh.iph->daddr,
935                                         ntohs(th->dest), inet_iif(skb));
936
937         if (nsk) {
938                 if (nsk->sk_state != TCP_TIME_WAIT) {
939                         bh_lock_sock(nsk);
940                         return nsk;
941                 }
942                 inet_twsk_put((struct inet_timewait_sock *)nsk);
943                 return NULL;
944         }
945
946 #ifdef CONFIG_SYN_COOKIES
947         if (!th->rst && !th->syn && th->ack)
948                 sk = cookie_v4_check(sk, skb, &(IPCB(skb)->opt));
949 #endif
950         return sk;
951 }
952
953 static int tcp_v4_checksum_init(struct sk_buff *skb)
954 {
955         if (skb->ip_summed == CHECKSUM_HW) {
956                 if (!tcp_v4_check(skb->h.th, skb->len, skb->nh.iph->saddr,
957                                   skb->nh.iph->daddr, skb->csum)) {
958                         skb->ip_summed = CHECKSUM_UNNECESSARY;
959                         return 0;
960                 }
961         }
962
963         skb->csum = csum_tcpudp_nofold(skb->nh.iph->saddr, skb->nh.iph->daddr,
964                                        skb->len, IPPROTO_TCP, 0);
965
966         if (skb->len <= 76) {
967                 return __skb_checksum_complete(skb);
968         }
969         return 0;
970 }
971
972
973 /* The socket must have it's spinlock held when we get
974  * here.
975  *
976  * We have a potential double-lock case here, so even when
977  * doing backlog processing we use the BH locking scheme.
978  * This is because we cannot sleep with the original spinlock
979  * held.
980  */
981 int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
982 {
983         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
984                 TCP_CHECK_TIMER(sk);
985                 if (tcp_rcv_established(sk, skb, skb->h.th, skb->len))
986                         goto reset;
987                 TCP_CHECK_TIMER(sk);
988                 return 0;
989         }
990
991         if (skb->len < (skb->h.th->doff << 2) || tcp_checksum_complete(skb))
992                 goto csum_err;
993
994         if (sk->sk_state == TCP_LISTEN) {
995                 struct sock *nsk = tcp_v4_hnd_req(sk, skb);
996                 if (!nsk)
997                         goto discard;
998
999                 if (nsk != sk) {
1000                         if (tcp_child_process(sk, nsk, skb))
1001                                 goto reset;
1002                         return 0;
1003                 }
1004         }
1005
1006         TCP_CHECK_TIMER(sk);
1007         if (tcp_rcv_state_process(sk, skb, skb->h.th, skb->len))
1008                 goto reset;
1009         TCP_CHECK_TIMER(sk);
1010         return 0;
1011
1012 reset:
1013         tcp_v4_send_reset(skb);
1014 discard:
1015         kfree_skb(skb);
1016         /* Be careful here. If this function gets more complicated and
1017          * gcc suffers from register pressure on the x86, sk (in %ebx)
1018          * might be destroyed here. This current version compiles correctly,
1019          * but you have been warned.
1020          */
1021         return 0;
1022
1023 csum_err:
1024         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1025         goto discard;
1026 }
1027
1028 /*
1029  *      From tcp_input.c
1030  */
1031
1032 int tcp_v4_rcv(struct sk_buff *skb)
1033 {
1034         struct tcphdr *th;
1035         struct sock *sk;
1036         int ret;
1037
1038         if (skb->pkt_type != PACKET_HOST)
1039                 goto discard_it;
1040
1041         /* Count it even if it's bad */
1042         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1043
1044         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1045                 goto discard_it;
1046
1047         th = skb->h.th;
1048
1049         if (th->doff < sizeof(struct tcphdr) / 4)
1050                 goto bad_packet;
1051         if (!pskb_may_pull(skb, th->doff * 4))
1052                 goto discard_it;
1053
1054         /* An explanation is required here, I think.
1055          * Packet length and doff are validated by header prediction,
1056          * provided case of th->doff==0 is eliminated.
1057          * So, we defer the checks. */
1058         if ((skb->ip_summed != CHECKSUM_UNNECESSARY &&
1059              tcp_v4_checksum_init(skb)))
1060                 goto bad_packet;
1061
1062         th = skb->h.th;
1063         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1064         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1065                                     skb->len - th->doff * 4);
1066         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1067         TCP_SKB_CB(skb)->when    = 0;
1068         TCP_SKB_CB(skb)->flags   = skb->nh.iph->tos;
1069         TCP_SKB_CB(skb)->sacked  = 0;
1070
1071         sk = __inet_lookup(&tcp_hashinfo, skb->nh.iph->saddr, th->source,
1072                            skb->nh.iph->daddr, ntohs(th->dest),
1073                            inet_iif(skb));
1074
1075         if (!sk)
1076                 goto no_tcp_socket;
1077
1078 process:
1079         if (sk->sk_state == TCP_TIME_WAIT)
1080                 goto do_time_wait;
1081
1082         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
1083                 goto discard_and_relse;
1084         nf_reset(skb);
1085
1086         if (sk_filter(sk, skb, 0))
1087                 goto discard_and_relse;
1088
1089         skb->dev = NULL;
1090
1091         bh_lock_sock(sk);
1092         ret = 0;
1093         if (!sock_owned_by_user(sk)) {
1094                 if (!tcp_prequeue(sk, skb))
1095                         ret = tcp_v4_do_rcv(sk, skb);
1096         } else
1097                 sk_add_backlog(sk, skb);
1098         bh_unlock_sock(sk);
1099
1100         sock_put(sk);
1101
1102         return ret;
1103
1104 no_tcp_socket:
1105         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
1106                 goto discard_it;
1107
1108         if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
1109 bad_packet:
1110                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1111         } else {
1112                 tcp_v4_send_reset(skb);
1113         }
1114
1115 discard_it:
1116         /* Discard frame. */
1117         kfree_skb(skb);
1118         return 0;
1119
1120 discard_and_relse:
1121         sock_put(sk);
1122         goto discard_it;
1123
1124 do_time_wait:
1125         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1126                 inet_twsk_put((struct inet_timewait_sock *) sk);
1127                 goto discard_it;
1128         }
1129
1130         if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
1131                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1132                 inet_twsk_put((struct inet_timewait_sock *) sk);
1133                 goto discard_it;
1134         }
1135         switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
1136                                            skb, th)) {
1137         case TCP_TW_SYN: {
1138                 struct sock *sk2 = inet_lookup_listener(&tcp_hashinfo,
1139                                                         skb->nh.iph->daddr,
1140                                                         ntohs(th->dest),
1141                                                         inet_iif(skb));
1142                 if (sk2) {
1143                         inet_twsk_deschedule((struct inet_timewait_sock *)sk,
1144                                              &tcp_death_row);
1145                         inet_twsk_put((struct inet_timewait_sock *)sk);
1146                         sk = sk2;
1147                         goto process;
1148                 }
1149                 /* Fall through to ACK */
1150         }
1151         case TCP_TW_ACK:
1152                 tcp_v4_timewait_ack(sk, skb);
1153                 break;
1154         case TCP_TW_RST:
1155                 goto no_tcp_socket;
1156         case TCP_TW_SUCCESS:;
1157         }
1158         goto discard_it;
1159 }
1160
1161 /* VJ's idea. Save last timestamp seen from this destination
1162  * and hold it at least for normal timewait interval to use for duplicate
1163  * segment detection in subsequent connections, before they enter synchronized
1164  * state.
1165  */
1166
1167 int tcp_v4_remember_stamp(struct sock *sk)
1168 {
1169         struct inet_sock *inet = inet_sk(sk);
1170         struct tcp_sock *tp = tcp_sk(sk);
1171         struct rtable *rt = (struct rtable *)__sk_dst_get(sk);
1172         struct inet_peer *peer = NULL;
1173         int release_it = 0;
1174
1175         if (!rt || rt->rt_dst != inet->daddr) {
1176                 peer = inet_getpeer(inet->daddr, 1);
1177                 release_it = 1;
1178         } else {
1179                 if (!rt->peer)
1180                         rt_bind_peer(rt, 1);
1181                 peer = rt->peer;
1182         }
1183
1184         if (peer) {
1185                 if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
1186                     (peer->tcp_ts_stamp + TCP_PAWS_MSL < xtime.tv_sec &&
1187                      peer->tcp_ts_stamp <= tp->rx_opt.ts_recent_stamp)) {
1188                         peer->tcp_ts_stamp = tp->rx_opt.ts_recent_stamp;
1189                         peer->tcp_ts = tp->rx_opt.ts_recent;
1190                 }
1191                 if (release_it)
1192                         inet_putpeer(peer);
1193                 return 1;
1194         }
1195
1196         return 0;
1197 }
1198
1199 int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
1200 {
1201         struct inet_peer *peer = inet_getpeer(tw->tw_daddr, 1);
1202
1203         if (peer) {
1204                 const struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
1205
1206                 if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
1207                     (peer->tcp_ts_stamp + TCP_PAWS_MSL < xtime.tv_sec &&
1208                      peer->tcp_ts_stamp <= tcptw->tw_ts_recent_stamp)) {
1209                         peer->tcp_ts_stamp = tcptw->tw_ts_recent_stamp;
1210                         peer->tcp_ts       = tcptw->tw_ts_recent;
1211                 }
1212                 inet_putpeer(peer);
1213                 return 1;
1214         }
1215
1216         return 0;
1217 }
1218
1219 struct inet_connection_sock_af_ops ipv4_specific = {
1220         .queue_xmit        = ip_queue_xmit,
1221         .send_check        = tcp_v4_send_check,
1222         .rebuild_header    = inet_sk_rebuild_header,
1223         .conn_request      = tcp_v4_conn_request,
1224         .syn_recv_sock     = tcp_v4_syn_recv_sock,
1225         .remember_stamp    = tcp_v4_remember_stamp,
1226         .net_header_len    = sizeof(struct iphdr),
1227         .setsockopt        = ip_setsockopt,
1228         .getsockopt        = ip_getsockopt,
1229         .addr2sockaddr     = inet_csk_addr2sockaddr,
1230         .sockaddr_len      = sizeof(struct sockaddr_in),
1231 #ifdef CONFIG_COMPAT
1232         .compat_setsockopt = compat_ip_setsockopt,
1233         .compat_getsockopt = compat_ip_getsockopt,
1234 #endif
1235 };
1236
1237 /* NOTE: A lot of things set to zero explicitly by call to
1238  *       sk_alloc() so need not be done here.
1239  */
1240 static int tcp_v4_init_sock(struct sock *sk)
1241 {
1242         struct inet_connection_sock *icsk = inet_csk(sk);
1243         struct tcp_sock *tp = tcp_sk(sk);
1244
1245         skb_queue_head_init(&tp->out_of_order_queue);
1246         tcp_init_xmit_timers(sk);
1247         tcp_prequeue_init(tp);
1248
1249         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1250         tp->mdev = TCP_TIMEOUT_INIT;
1251
1252         /* So many TCP implementations out there (incorrectly) count the
1253          * initial SYN frame in their delayed-ACK and congestion control
1254          * algorithms that we must have the following bandaid to talk
1255          * efficiently to them.  -DaveM
1256          */
1257         tp->snd_cwnd = 2;
1258
1259         /* See draft-stevens-tcpca-spec-01 for discussion of the
1260          * initialization of these values.
1261          */
1262         tp->snd_ssthresh = 0x7fffffff;  /* Infinity */
1263         tp->snd_cwnd_clamp = ~0;
1264         tp->mss_cache = 536;
1265
1266         tp->reordering = sysctl_tcp_reordering;
1267         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1268
1269         sk->sk_state = TCP_CLOSE;
1270
1271         sk->sk_write_space = sk_stream_write_space;
1272         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1273
1274         icsk->icsk_af_ops = &ipv4_specific;
1275         icsk->icsk_sync_mss = tcp_sync_mss;
1276
1277         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1278         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1279
1280         atomic_inc(&tcp_sockets_allocated);
1281
1282         return 0;
1283 }
1284
1285 int tcp_v4_destroy_sock(struct sock *sk)
1286 {
1287         struct tcp_sock *tp = tcp_sk(sk);
1288
1289         tcp_clear_xmit_timers(sk);
1290
1291         tcp_cleanup_congestion_control(sk);
1292
1293         /* Cleanup up the write buffer. */
1294         sk_stream_writequeue_purge(sk);
1295
1296         /* Cleans up our, hopefully empty, out_of_order_queue. */
1297         __skb_queue_purge(&tp->out_of_order_queue);
1298
1299         /* Clean prequeue, it must be empty really */
1300         __skb_queue_purge(&tp->ucopy.prequeue);
1301
1302         /* Clean up a referenced TCP bind bucket. */
1303         if (inet_csk(sk)->icsk_bind_hash)
1304                 inet_put_port(&tcp_hashinfo, sk);
1305
1306         /*
1307          * If sendmsg cached page exists, toss it.
1308          */
1309         if (sk->sk_sndmsg_page) {
1310                 __free_page(sk->sk_sndmsg_page);
1311                 sk->sk_sndmsg_page = NULL;
1312         }
1313
1314         atomic_dec(&tcp_sockets_allocated);
1315
1316         return 0;
1317 }
1318
1319 EXPORT_SYMBOL(tcp_v4_destroy_sock);
1320
1321 #ifdef CONFIG_PROC_FS
1322 /* Proc filesystem TCP sock list dumping. */
1323
1324 static inline struct inet_timewait_sock *tw_head(struct hlist_head *head)
1325 {
1326         return hlist_empty(head) ? NULL :
1327                 list_entry(head->first, struct inet_timewait_sock, tw_node);
1328 }
1329
1330 static inline struct inet_timewait_sock *tw_next(struct inet_timewait_sock *tw)
1331 {
1332         return tw->tw_node.next ?
1333                 hlist_entry(tw->tw_node.next, typeof(*tw), tw_node) : NULL;
1334 }
1335
1336 static void *listening_get_next(struct seq_file *seq, void *cur)
1337 {
1338         struct inet_connection_sock *icsk;
1339         struct hlist_node *node;
1340         struct sock *sk = cur;
1341         struct tcp_iter_state* st = seq->private;
1342
1343         if (!sk) {
1344                 st->bucket = 0;
1345                 sk = sk_head(&tcp_hashinfo.listening_hash[0]);
1346                 goto get_sk;
1347         }
1348
1349         ++st->num;
1350
1351         if (st->state == TCP_SEQ_STATE_OPENREQ) {
1352                 struct request_sock *req = cur;
1353
1354                 icsk = inet_csk(st->syn_wait_sk);
1355                 req = req->dl_next;
1356                 while (1) {
1357                         while (req) {
1358                                 if (req->rsk_ops->family == st->family) {
1359                                         cur = req;
1360                                         goto out;
1361                                 }
1362                                 req = req->dl_next;
1363                         }
1364                         if (++st->sbucket >= TCP_SYNQ_HSIZE)
1365                                 break;
1366 get_req:
1367                         req = icsk->icsk_accept_queue.listen_opt->syn_table[st->sbucket];
1368                 }
1369                 sk        = sk_next(st->syn_wait_sk);
1370                 st->state = TCP_SEQ_STATE_LISTENING;
1371                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
1372         } else {
1373                 icsk = inet_csk(sk);
1374                 read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
1375                 if (reqsk_queue_len(&icsk->icsk_accept_queue))
1376                         goto start_req;
1377                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
1378                 sk = sk_next(sk);
1379         }
1380 get_sk:
1381         sk_for_each_from(sk, node) {
1382                 if (sk->sk_family == st->family) {
1383                         cur = sk;
1384                         goto out;
1385                 }
1386                 icsk = inet_csk(sk);
1387                 read_lock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
1388                 if (reqsk_queue_len(&icsk->icsk_accept_queue)) {
1389 start_req:
1390                         st->uid         = sock_i_uid(sk);
1391                         st->syn_wait_sk = sk;
1392                         st->state       = TCP_SEQ_STATE_OPENREQ;
1393                         st->sbucket     = 0;
1394                         goto get_req;
1395                 }
1396                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
1397         }
1398         if (++st->bucket < INET_LHTABLE_SIZE) {
1399                 sk = sk_head(&tcp_hashinfo.listening_hash[st->bucket]);
1400                 goto get_sk;
1401         }
1402         cur = NULL;
1403 out:
1404         return cur;
1405 }
1406
1407 static void *listening_get_idx(struct seq_file *seq, loff_t *pos)
1408 {
1409         void *rc = listening_get_next(seq, NULL);
1410
1411         while (rc && *pos) {
1412                 rc = listening_get_next(seq, rc);
1413                 --*pos;
1414         }
1415         return rc;
1416 }
1417
1418 static void *established_get_first(struct seq_file *seq)
1419 {
1420         struct tcp_iter_state* st = seq->private;
1421         void *rc = NULL;
1422
1423         for (st->bucket = 0; st->bucket < tcp_hashinfo.ehash_size; ++st->bucket) {
1424                 struct sock *sk;
1425                 struct hlist_node *node;
1426                 struct inet_timewait_sock *tw;
1427
1428                 /* We can reschedule _before_ having picked the target: */
1429                 cond_resched_softirq();
1430
1431                 read_lock(&tcp_hashinfo.ehash[st->bucket].lock);
1432                 sk_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
1433                         if (sk->sk_family != st->family) {
1434                                 continue;
1435                         }
1436                         rc = sk;
1437                         goto out;
1438                 }
1439                 st->state = TCP_SEQ_STATE_TIME_WAIT;
1440                 inet_twsk_for_each(tw, node,
1441                                    &tcp_hashinfo.ehash[st->bucket + tcp_hashinfo.ehash_size].chain) {
1442                         if (tw->tw_family != st->family) {
1443                                 continue;
1444                         }
1445                         rc = tw;
1446                         goto out;
1447                 }
1448                 read_unlock(&tcp_hashinfo.ehash[st->bucket].lock);
1449                 st->state = TCP_SEQ_STATE_ESTABLISHED;
1450         }
1451 out:
1452         return rc;
1453 }
1454
1455 static void *established_get_next(struct seq_file *seq, void *cur)
1456 {
1457         struct sock *sk = cur;
1458         struct inet_timewait_sock *tw;
1459         struct hlist_node *node;
1460         struct tcp_iter_state* st = seq->private;
1461
1462         ++st->num;
1463
1464         if (st->state == TCP_SEQ_STATE_TIME_WAIT) {
1465                 tw = cur;
1466                 tw = tw_next(tw);
1467 get_tw:
1468                 while (tw && tw->tw_family != st->family) {
1469                         tw = tw_next(tw);
1470                 }
1471                 if (tw) {
1472                         cur = tw;
1473                         goto out;
1474                 }
1475                 read_unlock(&tcp_hashinfo.ehash[st->bucket].lock);
1476                 st->state = TCP_SEQ_STATE_ESTABLISHED;
1477
1478                 /* We can reschedule between buckets: */
1479                 cond_resched_softirq();
1480
1481                 if (++st->bucket < tcp_hashinfo.ehash_size) {
1482                         read_lock(&tcp_hashinfo.ehash[st->bucket].lock);
1483                         sk = sk_head(&tcp_hashinfo.ehash[st->bucket].chain);
1484                 } else {
1485                         cur = NULL;
1486                         goto out;
1487                 }
1488         } else
1489                 sk = sk_next(sk);
1490
1491         sk_for_each_from(sk, node) {
1492                 if (sk->sk_family == st->family)
1493                         goto found;
1494         }
1495
1496         st->state = TCP_SEQ_STATE_TIME_WAIT;
1497         tw = tw_head(&tcp_hashinfo.ehash[st->bucket + tcp_hashinfo.ehash_size].chain);
1498         goto get_tw;
1499 found:
1500         cur = sk;
1501 out:
1502         return cur;
1503 }
1504
1505 static void *established_get_idx(struct seq_file *seq, loff_t pos)
1506 {
1507         void *rc = established_get_first(seq);
1508
1509         while (rc && pos) {
1510                 rc = established_get_next(seq, rc);
1511                 --pos;
1512         }               
1513         return rc;
1514 }
1515
1516 static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
1517 {
1518         void *rc;
1519         struct tcp_iter_state* st = seq->private;
1520
1521         inet_listen_lock(&tcp_hashinfo);
1522         st->state = TCP_SEQ_STATE_LISTENING;
1523         rc        = listening_get_idx(seq, &pos);
1524
1525         if (!rc) {
1526                 inet_listen_unlock(&tcp_hashinfo);
1527                 local_bh_disable();
1528                 st->state = TCP_SEQ_STATE_ESTABLISHED;
1529                 rc        = established_get_idx(seq, pos);
1530         }
1531
1532         return rc;
1533 }
1534
1535 static void *tcp_seq_start(struct seq_file *seq, loff_t *pos)
1536 {
1537         struct tcp_iter_state* st = seq->private;
1538         st->state = TCP_SEQ_STATE_LISTENING;
1539         st->num = 0;
1540         return *pos ? tcp_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
1541 }
1542
1543 static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1544 {
1545         void *rc = NULL;
1546         struct tcp_iter_state* st;
1547
1548         if (v == SEQ_START_TOKEN) {
1549                 rc = tcp_get_idx(seq, 0);
1550                 goto out;
1551         }
1552         st = seq->private;
1553
1554         switch (st->state) {
1555         case TCP_SEQ_STATE_OPENREQ:
1556         case TCP_SEQ_STATE_LISTENING:
1557                 rc = listening_get_next(seq, v);
1558                 if (!rc) {
1559                         inet_listen_unlock(&tcp_hashinfo);
1560                         local_bh_disable();
1561                         st->state = TCP_SEQ_STATE_ESTABLISHED;
1562                         rc        = established_get_first(seq);
1563                 }
1564                 break;
1565         case TCP_SEQ_STATE_ESTABLISHED:
1566         case TCP_SEQ_STATE_TIME_WAIT:
1567                 rc = established_get_next(seq, v);
1568                 break;
1569         }
1570 out:
1571         ++*pos;
1572         return rc;
1573 }
1574
1575 static void tcp_seq_stop(struct seq_file *seq, void *v)
1576 {
1577         struct tcp_iter_state* st = seq->private;
1578
1579         switch (st->state) {
1580         case TCP_SEQ_STATE_OPENREQ:
1581                 if (v) {
1582                         struct inet_connection_sock *icsk = inet_csk(st->syn_wait_sk);
1583                         read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
1584                 }
1585         case TCP_SEQ_STATE_LISTENING:
1586                 if (v != SEQ_START_TOKEN)
1587                         inet_listen_unlock(&tcp_hashinfo);
1588                 break;
1589         case TCP_SEQ_STATE_TIME_WAIT:
1590         case TCP_SEQ_STATE_ESTABLISHED:
1591                 if (v)
1592                         read_unlock(&tcp_hashinfo.ehash[st->bucket].lock);
1593                 local_bh_enable();
1594                 break;
1595         }
1596 }
1597
1598 static int tcp_seq_open(struct inode *inode, struct file *file)
1599 {
1600         struct tcp_seq_afinfo *afinfo = PDE(inode)->data;
1601         struct seq_file *seq;
1602         struct tcp_iter_state *s;
1603         int rc;
1604
1605         if (unlikely(afinfo == NULL))
1606                 return -EINVAL;
1607
1608         s = kmalloc(sizeof(*s), GFP_KERNEL);
1609         if (!s)
1610                 return -ENOMEM;
1611         memset(s, 0, sizeof(*s));
1612         s->family               = afinfo->family;
1613         s->seq_ops.start        = tcp_seq_start;
1614         s->seq_ops.next         = tcp_seq_next;
1615         s->seq_ops.show         = afinfo->seq_show;
1616         s->seq_ops.stop         = tcp_seq_stop;
1617
1618         rc = seq_open(file, &s->seq_ops);
1619         if (rc)
1620                 goto out_kfree;
1621         seq          = file->private_data;
1622         seq->private = s;
1623 out:
1624         return rc;
1625 out_kfree:
1626         kfree(s);
1627         goto out;
1628 }
1629
1630 int tcp_proc_register(struct tcp_seq_afinfo *afinfo)
1631 {
1632         int rc = 0;
1633         struct proc_dir_entry *p;
1634
1635         if (!afinfo)
1636                 return -EINVAL;
1637         afinfo->seq_fops->owner         = afinfo->owner;
1638         afinfo->seq_fops->open          = tcp_seq_open;
1639         afinfo->seq_fops->read          = seq_read;
1640         afinfo->seq_fops->llseek        = seq_lseek;
1641         afinfo->seq_fops->release       = seq_release_private;
1642         
1643         p = proc_net_fops_create(afinfo->name, S_IRUGO, afinfo->seq_fops);
1644         if (p)
1645                 p->data = afinfo;
1646         else
1647                 rc = -ENOMEM;
1648         return rc;
1649 }
1650
1651 void tcp_proc_unregister(struct tcp_seq_afinfo *afinfo)
1652 {
1653         if (!afinfo)
1654                 return;
1655         proc_net_remove(afinfo->name);
1656         memset(afinfo->seq_fops, 0, sizeof(*afinfo->seq_fops)); 
1657 }
1658
1659 static void get_openreq4(struct sock *sk, struct request_sock *req,
1660                          char *tmpbuf, int i, int uid)
1661 {
1662         const struct inet_request_sock *ireq = inet_rsk(req);
1663         int ttd = req->expires - jiffies;
1664
1665         sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
1666                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p",
1667                 i,
1668                 ireq->loc_addr,
1669                 ntohs(inet_sk(sk)->sport),
1670                 ireq->rmt_addr,
1671                 ntohs(ireq->rmt_port),
1672                 TCP_SYN_RECV,
1673                 0, 0, /* could print option size, but that is af dependent. */
1674                 1,    /* timers active (only the expire timer) */
1675                 jiffies_to_clock_t(ttd),
1676                 req->retrans,
1677                 uid,
1678                 0,  /* non standard timer */
1679                 0, /* open_requests have no inode */
1680                 atomic_read(&sk->sk_refcnt),
1681                 req);
1682 }
1683
1684 static void get_tcp4_sock(struct sock *sp, char *tmpbuf, int i)
1685 {
1686         int timer_active;
1687         unsigned long timer_expires;
1688         struct tcp_sock *tp = tcp_sk(sp);
1689         const struct inet_connection_sock *icsk = inet_csk(sp);
1690         struct inet_sock *inet = inet_sk(sp);
1691         unsigned int dest = inet->daddr;
1692         unsigned int src = inet->rcv_saddr;
1693         __u16 destp = ntohs(inet->dport);
1694         __u16 srcp = ntohs(inet->sport);
1695
1696         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1697                 timer_active    = 1;
1698                 timer_expires   = icsk->icsk_timeout;
1699         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1700                 timer_active    = 4;
1701                 timer_expires   = icsk->icsk_timeout;
1702         } else if (timer_pending(&sp->sk_timer)) {
1703                 timer_active    = 2;
1704                 timer_expires   = sp->sk_timer.expires;
1705         } else {
1706                 timer_active    = 0;
1707                 timer_expires = jiffies;
1708         }
1709
1710         sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
1711                         "%08X %5d %8d %lu %d %p %u %u %u %u %d",
1712                 i, src, srcp, dest, destp, sp->sk_state,
1713                 tp->write_seq - tp->snd_una, tp->rcv_nxt - tp->copied_seq,
1714                 timer_active,
1715                 jiffies_to_clock_t(timer_expires - jiffies),
1716                 icsk->icsk_retransmits,
1717                 sock_i_uid(sp),
1718                 icsk->icsk_probes_out,
1719                 sock_i_ino(sp),
1720                 atomic_read(&sp->sk_refcnt), sp,
1721                 icsk->icsk_rto,
1722                 icsk->icsk_ack.ato,
1723                 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1724                 tp->snd_cwnd,
1725                 tp->snd_ssthresh >= 0xFFFF ? -1 : tp->snd_ssthresh);
1726 }
1727
1728 static void get_timewait4_sock(struct inet_timewait_sock *tw, char *tmpbuf, int i)
1729 {
1730         unsigned int dest, src;
1731         __u16 destp, srcp;
1732         int ttd = tw->tw_ttd - jiffies;
1733
1734         if (ttd < 0)
1735                 ttd = 0;
1736
1737         dest  = tw->tw_daddr;
1738         src   = tw->tw_rcv_saddr;
1739         destp = ntohs(tw->tw_dport);
1740         srcp  = ntohs(tw->tw_sport);
1741
1742         sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
1743                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p",
1744                 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
1745                 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
1746                 atomic_read(&tw->tw_refcnt), tw);
1747 }
1748
1749 #define TMPSZ 150
1750
1751 static int tcp4_seq_show(struct seq_file *seq, void *v)
1752 {
1753         struct tcp_iter_state* st;
1754         char tmpbuf[TMPSZ + 1];
1755
1756         if (v == SEQ_START_TOKEN) {
1757                 seq_printf(seq, "%-*s\n", TMPSZ - 1,
1758                            "  sl  local_address rem_address   st tx_queue "
1759                            "rx_queue tr tm->when retrnsmt   uid  timeout "
1760                            "inode");
1761                 goto out;
1762         }
1763         st = seq->private;
1764
1765         switch (st->state) {
1766         case TCP_SEQ_STATE_LISTENING:
1767         case TCP_SEQ_STATE_ESTABLISHED:
1768                 get_tcp4_sock(v, tmpbuf, st->num);
1769                 break;
1770         case TCP_SEQ_STATE_OPENREQ:
1771                 get_openreq4(st->syn_wait_sk, v, tmpbuf, st->num, st->uid);
1772                 break;
1773         case TCP_SEQ_STATE_TIME_WAIT:
1774                 get_timewait4_sock(v, tmpbuf, st->num);
1775                 break;
1776         }
1777         seq_printf(seq, "%-*s\n", TMPSZ - 1, tmpbuf);
1778 out:
1779         return 0;
1780 }
1781
1782 static struct file_operations tcp4_seq_fops;
1783 static struct tcp_seq_afinfo tcp4_seq_afinfo = {
1784         .owner          = THIS_MODULE,
1785         .name           = "tcp",
1786         .family         = AF_INET,
1787         .seq_show       = tcp4_seq_show,
1788         .seq_fops       = &tcp4_seq_fops,
1789 };
1790
1791 int __init tcp4_proc_init(void)
1792 {
1793         return tcp_proc_register(&tcp4_seq_afinfo);
1794 }
1795
1796 void tcp4_proc_exit(void)
1797 {
1798         tcp_proc_unregister(&tcp4_seq_afinfo);
1799 }
1800 #endif /* CONFIG_PROC_FS */
1801
1802 struct proto tcp_prot = {
1803         .name                   = "TCP",
1804         .owner                  = THIS_MODULE,
1805         .close                  = tcp_close,
1806         .connect                = tcp_v4_connect,
1807         .disconnect             = tcp_disconnect,
1808         .accept                 = inet_csk_accept,
1809         .ioctl                  = tcp_ioctl,
1810         .init                   = tcp_v4_init_sock,
1811         .destroy                = tcp_v4_destroy_sock,
1812         .shutdown               = tcp_shutdown,
1813         .setsockopt             = tcp_setsockopt,
1814         .getsockopt             = tcp_getsockopt,
1815         .sendmsg                = tcp_sendmsg,
1816         .recvmsg                = tcp_recvmsg,
1817         .backlog_rcv            = tcp_v4_do_rcv,
1818         .hash                   = tcp_v4_hash,
1819         .unhash                 = tcp_unhash,
1820         .get_port               = tcp_v4_get_port,
1821         .enter_memory_pressure  = tcp_enter_memory_pressure,
1822         .sockets_allocated      = &tcp_sockets_allocated,
1823         .orphan_count           = &tcp_orphan_count,
1824         .memory_allocated       = &tcp_memory_allocated,
1825         .memory_pressure        = &tcp_memory_pressure,
1826         .sysctl_mem             = sysctl_tcp_mem,
1827         .sysctl_wmem            = sysctl_tcp_wmem,
1828         .sysctl_rmem            = sysctl_tcp_rmem,
1829         .max_header             = MAX_TCP_HEADER,
1830         .obj_size               = sizeof(struct tcp_sock),
1831         .twsk_prot              = &tcp_timewait_sock_ops,
1832         .rsk_prot               = &tcp_request_sock_ops,
1833 #ifdef CONFIG_COMPAT
1834         .compat_setsockopt      = compat_tcp_setsockopt,
1835         .compat_getsockopt      = compat_tcp_getsockopt,
1836 #endif
1837 };
1838
1839 void __init tcp_v4_init(struct net_proto_family *ops)
1840 {
1841         if (inet_csk_ctl_sock_create(&tcp_socket, PF_INET, SOCK_RAW, IPPROTO_TCP) < 0)
1842                 panic("Failed to create the TCP control socket.\n");
1843 }
1844
1845 EXPORT_SYMBOL(ipv4_specific);
1846 EXPORT_SYMBOL(tcp_hashinfo);
1847 EXPORT_SYMBOL(tcp_prot);
1848 EXPORT_SYMBOL(tcp_unhash);
1849 EXPORT_SYMBOL(tcp_v4_conn_request);
1850 EXPORT_SYMBOL(tcp_v4_connect);
1851 EXPORT_SYMBOL(tcp_v4_do_rcv);
1852 EXPORT_SYMBOL(tcp_v4_remember_stamp);
1853 EXPORT_SYMBOL(tcp_v4_send_check);
1854 EXPORT_SYMBOL(tcp_v4_syn_recv_sock);
1855
1856 #ifdef CONFIG_PROC_FS
1857 EXPORT_SYMBOL(tcp_proc_register);
1858 EXPORT_SYMBOL(tcp_proc_unregister);
1859 #endif
1860 EXPORT_SYMBOL(sysctl_local_port_range);
1861 EXPORT_SYMBOL(sysctl_tcp_low_latency);
1862