net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65
  66 #include <asm/uaccess.h>
  67
  68 #include <linux/proc_fs.h>
  69 #include <linux/seq_file.h>
  70
  71 #include <linux/crypto.h>
  72 #include <linux/scatterlist.h>
  73
  74 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79 static void     __tcp_v6_send_check(struct sk_buff *skb,
  80                                     const struct in6_addr *saddr,
  81                                     const struct in6_addr *daddr);
  82
  83 static const struct inet_connection_sock_af_ops ipv6_mapped;
  84 static const struct inet_connection_sock_af_ops ipv6_specific;
  85 #ifdef CONFIG_TCP_MD5SIG
  86 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  87 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  88 #else
  89 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  90                                                    const struct in6_addr *addr)
  91 {
  92         return NULL;
  93 }
  94 #endif
  95
  96 static void tcp_v6_hash(struct sock *sk)
  97 {
  98         if (sk->sk_state != TCP_CLOSE) {
  99                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 100                         tcp_prot.hash(sk);
 101                         return;
 102                 }
 103                 local_bh_disable();
 104                 __inet6_hash(sk, NULL);
 105                 local_bh_enable();
 106         }
 107 }
 108
 109 static __inline__ __sum16 tcp_v6_check(int len,
 110                                    const struct in6_addr *saddr,
 111                                    const struct in6_addr *daddr,
 112                                    __wsum base)
 113 {
 114         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 115 }
 116
 117 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 118 {
 119         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 120                                             ipv6_hdr(skb)->saddr.s6_addr32,
 121                                             tcp_hdr(skb)->dest,
 122                                             tcp_hdr(skb)->source);
 123 }
 124
 125 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 126                           int addr_len)
 127 {
 128         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 129         struct inet_sock *inet = inet_sk(sk);
 130         struct inet_connection_sock *icsk = inet_csk(sk);
 131         struct ipv6_pinfo *np = inet6_sk(sk);
 132         struct tcp_sock *tp = tcp_sk(sk);
 133         struct in6_addr *saddr = NULL, *final_p, final;
 134         struct rt6_info *rt;
 135         struct flowi6 fl6;
 136         struct dst_entry *dst;
 137         int addr_type;
 138         int err;
 139
 140         if (addr_len < SIN6_LEN_RFC2133)
 141                 return -EINVAL;
 142
 143         if (usin->sin6_family != AF_INET6)
 144                 return -EAFNOSUPPORT;
 145
 146         memset(&fl6, 0, sizeof(fl6));
 147
 148         if (np->sndflow) {
 149                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 150                 IP6_ECN_flow_init(fl6.flowlabel);
 151                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 152                         struct ip6_flowlabel *flowlabel;
 153                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 154                         if (flowlabel == NULL)
 155                                 return -EINVAL;
 156                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 157                         fl6_sock_release(flowlabel);
 158                 }
 159         }
 160
 161         /*
 162          *      connect() to INADDR_ANY means loopback (BSD'ism).
 163          */
 164
 165         if(ipv6_addr_any(&usin->sin6_addr))
 166                 usin->sin6_addr.s6_addr[15] = 0x1;
 167
 168         addr_type = ipv6_addr_type(&usin->sin6_addr);
 169
 170         if(addr_type & IPV6_ADDR_MULTICAST)
 171                 return -ENETUNREACH;
 172
 173         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 174                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 175                     usin->sin6_scope_id) {
 176                         /* If interface is set while binding, indices
 177                          * must coincide.
 178                          */
 179                         if (sk->sk_bound_dev_if &&
 180                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 181                                 return -EINVAL;
 182
 183                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 184                 }
 185
 186                 /* Connect to link-local address requires an interface */
 187                 if (!sk->sk_bound_dev_if)
 188                         return -EINVAL;
 189         }
 190
 191         if (tp->rx_opt.ts_recent_stamp &&
 192             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 193                 tp->rx_opt.ts_recent = 0;
 194                 tp->rx_opt.ts_recent_stamp = 0;
 195                 tp->write_seq = 0;
 196         }
 197
 198         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 199         np->flow_label = fl6.flowlabel;
 200
 201         /*
 202          *      TCP over IPv4
 203          */
 204
 205         if (addr_type == IPV6_ADDR_MAPPED) {
 206                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 207                 struct sockaddr_in sin;
 208
 209                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 210
 211                 if (__ipv6_only_sock(sk))
 212                         return -ENETUNREACH;
 213
 214                 sin.sin_family = AF_INET;
 215                 sin.sin_port = usin->sin6_port;
 216                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 217
 218                 icsk->icsk_af_ops = &ipv6_mapped;
 219                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 220 #ifdef CONFIG_TCP_MD5SIG
 221                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 222 #endif
 223
 224                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 225
 226                 if (err) {
 227                         icsk->icsk_ext_hdr_len = exthdrlen;
 228                         icsk->icsk_af_ops = &ipv6_specific;
 229                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 230 #ifdef CONFIG_TCP_MD5SIG
 231                         tp->af_specific = &tcp_sock_ipv6_specific;
 232 #endif
 233                         goto failure;
 234                 } else {
 235                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 236                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 237                                                &np->rcv_saddr);
 238                 }
 239
 240                 return err;
 241         }
 242
 243         if (!ipv6_addr_any(&np->rcv_saddr))
 244                 saddr = &np->rcv_saddr;
 245
 246         fl6.flowi6_proto = IPPROTO_TCP;
 247         ipv6_addr_copy(&fl6.daddr, &np->daddr);
 248         ipv6_addr_copy(&fl6.saddr,
 249                        (saddr ? saddr : &np->saddr));
 250         fl6.flowi6_oif = sk->sk_bound_dev_if;
 251         fl6.flowi6_mark = sk->sk_mark;
 252         fl6.fl6_dport = usin->sin6_port;
 253         fl6.fl6_sport = inet->inet_sport;
 254
 255         final_p = fl6_update_dst(&fl6, np->opt, &final);
 256
 257         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 258
 259         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 260         if (IS_ERR(dst)) {
 261                 err = PTR_ERR(dst);
 262                 goto failure;
 263         }
 264
 265         if (saddr == NULL) {
 266                 saddr = &fl6.saddr;
 267                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 268         }
 269
 270         /* set the source address */
 271         ipv6_addr_copy(&np->saddr, saddr);
 272         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 273
 274         sk->sk_gso_type = SKB_GSO_TCPV6;
 275         __ip6_dst_store(sk, dst, NULL, NULL);
 276
 277         rt = (struct rt6_info *) dst;
 278         if (tcp_death_row.sysctl_tw_recycle &&
 279             !tp->rx_opt.ts_recent_stamp &&
 280             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
 281                 struct inet_peer *peer = rt6_get_peer(rt);
 282                 /*
 283                  * VJ's idea. We save last timestamp seen from
 284                  * the destination in peer table, when entering state
 285                  * TIME-WAIT * and initialize rx_opt.ts_recent from it,
 286                  * when trying new connection.
 287                  */
 288                 if (peer) {
 289                         inet_peer_refcheck(peer);
 290                         if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
 291                                 tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
 292                                 tp->rx_opt.ts_recent = peer->tcp_ts;
 293                         }
 294                 }
 295         }
 296
 297         icsk->icsk_ext_hdr_len = 0;
 298         if (np->opt)
 299                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 300                                           np->opt->opt_nflen);
 301
 302         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 303
 304         inet->inet_dport = usin->sin6_port;
 305
 306         tcp_set_state(sk, TCP_SYN_SENT);
 307         err = inet6_hash_connect(&tcp_death_row, sk);
 308         if (err)
 309                 goto late_failure;
 310
 311         if (!tp->write_seq)
 312                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 313                                                              np->daddr.s6_addr32,
 314                                                              inet->inet_sport,
 315                                                              inet->inet_dport);
 316
 317         err = tcp_connect(sk);
 318         if (err)
 319                 goto late_failure;
 320
 321         return 0;
 322
 323 late_failure:
 324         tcp_set_state(sk, TCP_CLOSE);
 325         __sk_dst_reset(sk);
 326 failure:
 327         inet->inet_dport = 0;
 328         sk->sk_route_caps = 0;
 329         return err;
 330 }
 331
 332 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 333                 u8 type, u8 code, int offset, __be32 info)
 334 {
 335         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 336         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 337         struct ipv6_pinfo *np;
 338         struct sock *sk;
 339         int err;
 340         struct tcp_sock *tp;
 341         __u32 seq;
 342         struct net *net = dev_net(skb->dev);
 343
 344         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 345                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 346
 347         if (sk == NULL) {
 348                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 349                                    ICMP6_MIB_INERRORS);
 350                 return;
 351         }
 352
 353         if (sk->sk_state == TCP_TIME_WAIT) {
 354                 inet_twsk_put(inet_twsk(sk));
 355                 return;
 356         }
 357
 358         bh_lock_sock(sk);
 359         if (sock_owned_by_user(sk))
 360                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 361
 362         if (sk->sk_state == TCP_CLOSE)
 363                 goto out;
 364
 365         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 366                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 367                 goto out;
 368         }
 369
 370         tp = tcp_sk(sk);
 371         seq = ntohl(th->seq);
 372         if (sk->sk_state != TCP_LISTEN &&
 373             !between(seq, tp->snd_una, tp->snd_nxt)) {
 374                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 375                 goto out;
 376         }
 377
 378         np = inet6_sk(sk);
 379
 380         if (type == ICMPV6_PKT_TOOBIG) {
 381                 struct dst_entry *dst;
 382
 383                 if (sock_owned_by_user(sk))
 384                         goto out;
 385                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 386                         goto out;
 387
 388                 /* icmp should have updated the destination cache entry */
 389                 dst = __sk_dst_check(sk, np->dst_cookie);
 390
 391                 if (dst == NULL) {
 392                         struct inet_sock *inet = inet_sk(sk);
 393                         struct flowi6 fl6;
 394
 395                         /* BUGGG_FUTURE: Again, it is not clear how
 396                            to handle rthdr case. Ignore this complexity
 397                            for now.
 398                          */
 399                         memset(&fl6, 0, sizeof(fl6));
 400                         fl6.flowi6_proto = IPPROTO_TCP;
 401                         ipv6_addr_copy(&fl6.daddr, &np->daddr);
 402                         ipv6_addr_copy(&fl6.saddr, &np->saddr);
 403                         fl6.flowi6_oif = sk->sk_bound_dev_if;
 404                         fl6.flowi6_mark = sk->sk_mark;
 405                         fl6.fl6_dport = inet->inet_dport;
 406                         fl6.fl6_sport = inet->inet_sport;
 407                         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 408
 409                         dst = ip6_dst_lookup_flow(sk, &fl6, NULL, false);
 410                         if (IS_ERR(dst)) {
 411                                 sk->sk_err_soft = -PTR_ERR(dst);
 412                                 goto out;
 413                         }
 414
 415                 } else
 416                         dst_hold(dst);
 417
 418                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 419                         tcp_sync_mss(sk, dst_mtu(dst));
 420                         tcp_simple_retransmit(sk);
 421                 } /* else let the usual retransmit timer handle it */
 422                 dst_release(dst);
 423                 goto out;
 424         }
 425
 426         icmpv6_err_convert(type, code, &err);
 427
 428         /* Might be for an request_sock */
 429         switch (sk->sk_state) {
 430                 struct request_sock *req, **prev;
 431         case TCP_LISTEN:
 432                 if (sock_owned_by_user(sk))
 433                         goto out;
 434
 435                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 436                                            &hdr->saddr, inet6_iif(skb));
 437                 if (!req)
 438                         goto out;
 439
 440                 /* ICMPs are not backlogged, hence we cannot get
 441                  * an established socket here.
 442                  */
 443                 WARN_ON(req->sk != NULL);
 444
 445                 if (seq != tcp_rsk(req)->snt_isn) {
 446                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 447                         goto out;
 448                 }
 449
 450                 inet_csk_reqsk_queue_drop(sk, req, prev);
 451                 goto out;
 452
 453         case TCP_SYN_SENT:
 454         case TCP_SYN_RECV:  /* Cannot happen.
 455                                It can, it SYNs are crossed. --ANK */
 456                 if (!sock_owned_by_user(sk)) {
 457                         sk->sk_err = err;
 458                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 459
 460                         tcp_done(sk);
 461                 } else
 462                         sk->sk_err_soft = err;
 463                 goto out;
 464         }
 465
 466         if (!sock_owned_by_user(sk) && np->recverr) {
 467                 sk->sk_err = err;
 468                 sk->sk_error_report(sk);
 469         } else
 470                 sk->sk_err_soft = err;
 471
 472 out:
 473         bh_unlock_sock(sk);
 474         sock_put(sk);
 475 }
 476
 477
 478 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 479                               struct request_values *rvp)
 480 {
 481         struct inet6_request_sock *treq = inet6_rsk(req);
 482         struct ipv6_pinfo *np = inet6_sk(sk);
 483         struct sk_buff * skb;
 484         struct ipv6_txoptions *opt = NULL;
 485         struct in6_addr * final_p, final;
 486         struct flowi6 fl6;
 487         struct dst_entry *dst;
 488         int err;
 489
 490         memset(&fl6, 0, sizeof(fl6));
 491         fl6.flowi6_proto = IPPROTO_TCP;
 492         ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
 493         ipv6_addr_copy(&fl6.saddr, &treq->loc_addr);
 494         fl6.flowlabel = 0;
 495         fl6.flowi6_oif = treq->iif;
 496         fl6.flowi6_mark = sk->sk_mark;
 497         fl6.fl6_dport = inet_rsk(req)->rmt_port;
 498         fl6.fl6_sport = inet_rsk(req)->loc_port;
 499         security_req_classify_flow(req, flowi6_to_flowi(&fl6));
 500
 501         opt = np->opt;
 502         final_p = fl6_update_dst(&fl6, opt, &final);
 503
 504         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
 505         if (IS_ERR(dst)) {
 506                 err = PTR_ERR(dst);
 507                 dst = NULL;
 508                 goto done;
 509         }
 510         skb = tcp_make_synack(sk, dst, req, rvp);
 511         err = -ENOMEM;
 512         if (skb) {
 513                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 514
 515                 ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
 516                 err = ip6_xmit(sk, skb, &fl6, opt);
 517                 err = net_xmit_eval(err);
 518         }
 519
 520 done:
 521         if (opt && opt != np->opt)
 522                 sock_kfree_s(sk, opt, opt->tot_len);
 523         dst_release(dst);
 524         return err;
 525 }
 526
 527 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 528                              struct request_values *rvp)
 529 {
 530         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 531         return tcp_v6_send_synack(sk, req, rvp);
 532 }
 533
 534 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 535 {
 536         kfree_skb(inet6_rsk(req)->pktopts);
 537 }
 538
 539 #ifdef CONFIG_TCP_MD5SIG
 540 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 541                                                    const struct in6_addr *addr)
 542 {
 543         struct tcp_sock *tp = tcp_sk(sk);
 544         int i;
 545
 546         BUG_ON(tp == NULL);
 547
 548         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 549                 return NULL;
 550
 551         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 552                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
 553                         return &tp->md5sig_info->keys6[i].base;
 554         }
 555         return NULL;
 556 }
 557
 558 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 559                                                 struct sock *addr_sk)
 560 {
 561         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 562 }
 563
 564 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 565                                                       struct request_sock *req)
 566 {
 567         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 568 }
 569
 570 static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
 571                              char *newkey, u8 newkeylen)
 572 {
 573         /* Add key to the list */
 574         struct tcp_md5sig_key *key;
 575         struct tcp_sock *tp = tcp_sk(sk);
 576         struct tcp6_md5sig_key *keys;
 577
 578         key = tcp_v6_md5_do_lookup(sk, peer);
 579         if (key) {
 580                 /* modify existing entry - just update that one */
 581                 kfree(key->key);
 582                 key->key = newkey;
 583                 key->keylen = newkeylen;
 584         } else {
 585                 /* reallocate new list if current one is full. */
 586                 if (!tp->md5sig_info) {
 587                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 588                         if (!tp->md5sig_info) {
 589                                 kfree(newkey);
 590                                 return -ENOMEM;
 591                         }
 592                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 593                 }
 594                 if (tcp_alloc_md5sig_pool(sk) == NULL) {
 595                         kfree(newkey);
 596                         return -ENOMEM;
 597                 }
 598                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 599                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 600                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 601
 602                         if (!keys) {
 603                                 tcp_free_md5sig_pool();
 604                                 kfree(newkey);
 605                                 return -ENOMEM;
 606                         }
 607
 608                         if (tp->md5sig_info->entries6)
 609                                 memmove(keys, tp->md5sig_info->keys6,
 610                                         (sizeof (tp->md5sig_info->keys6[0]) *
 611                                          tp->md5sig_info->entries6));
 612
 613                         kfree(tp->md5sig_info->keys6);
 614                         tp->md5sig_info->keys6 = keys;
 615                         tp->md5sig_info->alloced6++;
 616                 }
 617
 618                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 619                                peer);
 620                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 621                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 622
 623                 tp->md5sig_info->entries6++;
 624         }
 625         return 0;
 626 }
 627
 628 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 629                                u8 *newkey, __u8 newkeylen)
 630 {
 631         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 632                                  newkey, newkeylen);
 633 }
 634
 635 static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
 636 {
 637         struct tcp_sock *tp = tcp_sk(sk);
 638         int i;
 639
 640         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 641                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
 642                         /* Free the key */
 643                         kfree(tp->md5sig_info->keys6[i].base.key);
 644                         tp->md5sig_info->entries6--;
 645
 646                         if (tp->md5sig_info->entries6 == 0) {
 647                                 kfree(tp->md5sig_info->keys6);
 648                                 tp->md5sig_info->keys6 = NULL;
 649                                 tp->md5sig_info->alloced6 = 0;
 650                         } else {
 651                                 /* shrink the database */
 652                                 if (tp->md5sig_info->entries6 != i)
 653                                         memmove(&tp->md5sig_info->keys6[i],
 654                                                 &tp->md5sig_info->keys6[i+1],
 655                                                 (tp->md5sig_info->entries6 - i)
 656                                                 * sizeof (tp->md5sig_info->keys6[0]));
 657                         }
 658                         tcp_free_md5sig_pool();
 659                         return 0;
 660                 }
 661         }
 662         return -ENOENT;
 663 }
 664
 665 static void tcp_v6_clear_md5_list (struct sock *sk)
 666 {
 667         struct tcp_sock *tp = tcp_sk(sk);
 668         int i;
 669
 670         if (tp->md5sig_info->entries6) {
 671                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 672                         kfree(tp->md5sig_info->keys6[i].base.key);
 673                 tp->md5sig_info->entries6 = 0;
 674                 tcp_free_md5sig_pool();
 675         }
 676
 677         kfree(tp->md5sig_info->keys6);
 678         tp->md5sig_info->keys6 = NULL;
 679         tp->md5sig_info->alloced6 = 0;
 680
 681         if (tp->md5sig_info->entries4) {
 682                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 683                         kfree(tp->md5sig_info->keys4[i].base.key);
 684                 tp->md5sig_info->entries4 = 0;
 685                 tcp_free_md5sig_pool();
 686         }
 687
 688         kfree(tp->md5sig_info->keys4);
 689         tp->md5sig_info->keys4 = NULL;
 690         tp->md5sig_info->alloced4 = 0;
 691 }
 692
 693 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 694                                   int optlen)
 695 {
 696         struct tcp_md5sig cmd;
 697         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 698         u8 *newkey;
 699
 700         if (optlen < sizeof(cmd))
 701                 return -EINVAL;
 702
 703         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 704                 return -EFAULT;
 705
 706         if (sin6->sin6_family != AF_INET6)
 707                 return -EINVAL;
 708
 709         if (!cmd.tcpm_keylen) {
 710                 if (!tcp_sk(sk)->md5sig_info)
 711                         return -ENOENT;
 712                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 713                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 714                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 715         }
 716
 717         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 718                 return -EINVAL;
 719
 720         if (!tcp_sk(sk)->md5sig_info) {
 721                 struct tcp_sock *tp = tcp_sk(sk);
 722                 struct tcp_md5sig_info *p;
 723
 724                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 725                 if (!p)
 726                         return -ENOMEM;
 727
 728                 tp->md5sig_info = p;
 729                 sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 730         }
 731
 732         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 733         if (!newkey)
 734                 return -ENOMEM;
 735         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 736                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 737                                          newkey, cmd.tcpm_keylen);
 738         }
 739         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 740 }
 741
 742 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 743                                         const struct in6_addr *daddr,
 744                                         const struct in6_addr *saddr, int nbytes)
 745 {
 746         struct tcp6_pseudohdr *bp;
 747         struct scatterlist sg;
 748
 749         bp = &hp->md5_blk.ip6;
 750         /* 1. TCP pseudo-header (RFC2460) */
 751         ipv6_addr_copy(&bp->saddr, saddr);
 752         ipv6_addr_copy(&bp->daddr, daddr);
 753         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 754         bp->len = cpu_to_be32(nbytes);
 755
 756         sg_init_one(&sg, bp, sizeof(*bp));
 757         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 758 }
 759
 760 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 761                                const struct in6_addr *daddr, struct in6_addr *saddr,
 762                                struct tcphdr *th)
 763 {
 764         struct tcp_md5sig_pool *hp;
 765         struct hash_desc *desc;
 766
 767         hp = tcp_get_md5sig_pool();
 768         if (!hp)
 769                 goto clear_hash_noput;
 770         desc = &hp->md5_desc;
 771
 772         if (crypto_hash_init(desc))
 773                 goto clear_hash;
 774         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 775                 goto clear_hash;
 776         if (tcp_md5_hash_header(hp, th))
 777                 goto clear_hash;
 778         if (tcp_md5_hash_key(hp, key))
 779                 goto clear_hash;
 780         if (crypto_hash_final(desc, md5_hash))
 781                 goto clear_hash;
 782
 783         tcp_put_md5sig_pool();
 784         return 0;
 785
 786 clear_hash:
 787         tcp_put_md5sig_pool();
 788 clear_hash_noput:
 789         memset(md5_hash, 0, 16);
 790         return 1;
 791 }
 792
 793 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 794                                struct sock *sk, struct request_sock *req,
 795                                struct sk_buff *skb)
 796 {
 797         const struct in6_addr *saddr, *daddr;
 798         struct tcp_md5sig_pool *hp;
 799         struct hash_desc *desc;
 800         struct tcphdr *th = tcp_hdr(skb);
 801
 802         if (sk) {
 803                 saddr = &inet6_sk(sk)->saddr;
 804                 daddr = &inet6_sk(sk)->daddr;
 805         } else if (req) {
 806                 saddr = &inet6_rsk(req)->loc_addr;
 807                 daddr = &inet6_rsk(req)->rmt_addr;
 808         } else {
 809                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 810                 saddr = &ip6h->saddr;
 811                 daddr = &ip6h->daddr;
 812         }
 813
 814         hp = tcp_get_md5sig_pool();
 815         if (!hp)
 816                 goto clear_hash_noput;
 817         desc = &hp->md5_desc;
 818
 819         if (crypto_hash_init(desc))
 820                 goto clear_hash;
 821
 822         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 823                 goto clear_hash;
 824         if (tcp_md5_hash_header(hp, th))
 825                 goto clear_hash;
 826         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 827                 goto clear_hash;
 828         if (tcp_md5_hash_key(hp, key))
 829                 goto clear_hash;
 830         if (crypto_hash_final(desc, md5_hash))
 831                 goto clear_hash;
 832
 833         tcp_put_md5sig_pool();
 834         return 0;
 835
 836 clear_hash:
 837         tcp_put_md5sig_pool();
 838 clear_hash_noput:
 839         memset(md5_hash, 0, 16);
 840         return 1;
 841 }
 842
 843 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 844 {
 845         __u8 *hash_location = NULL;
 846         struct tcp_md5sig_key *hash_expected;
 847         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 848         struct tcphdr *th = tcp_hdr(skb);
 849         int genhash;
 850         u8 newhash[16];
 851
 852         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 853         hash_location = tcp_parse_md5sig_option(th);
 854
 855         /* We've parsed the options - do we have a hash? */
 856         if (!hash_expected && !hash_location)
 857                 return 0;
 858
 859         if (hash_expected && !hash_location) {
 860                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 861                 return 1;
 862         }
 863
 864         if (!hash_expected && hash_location) {
 865                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 866                 return 1;
 867         }
 868
 869         /* check the signature */
 870         genhash = tcp_v6_md5_hash_skb(newhash,
 871                                       hash_expected,
 872                                       NULL, NULL, skb);
 873
 874         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 875                 if (net_ratelimit()) {
 876                         printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 877                                genhash ? "failed" : "mismatch",
 878                                &ip6h->saddr, ntohs(th->source),
 879                                &ip6h->daddr, ntohs(th->dest));
 880                 }
 881                 return 1;
 882         }
 883         return 0;
 884 }
 885 #endif
 886
 887 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 888         .family         =       AF_INET6,
 889         .obj_size       =       sizeof(struct tcp6_request_sock),
 890         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 891         .send_ack       =       tcp_v6_reqsk_send_ack,
 892         .destructor     =       tcp_v6_reqsk_destructor,
 893         .send_reset     =       tcp_v6_send_reset,
 894         .syn_ack_timeout =      tcp_syn_ack_timeout,
 895 };
 896
 897 #ifdef CONFIG_TCP_MD5SIG
 898 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 899         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 900         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 901 };
 902 #endif
 903
 904 static void __tcp_v6_send_check(struct sk_buff *skb,
 905                                 const struct in6_addr *saddr, const struct in6_addr *daddr)
 906 {
 907         struct tcphdr *th = tcp_hdr(skb);
 908
 909         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 910                 th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
 911                 skb->csum_start = skb_transport_header(skb) - skb->head;
 912                 skb->csum_offset = offsetof(struct tcphdr, check);
 913         } else {
 914                 th->check = tcp_v6_check(skb->len, saddr, daddr,
 915                                          csum_partial(th, th->doff << 2,
 916                                                       skb->csum));
 917         }
 918 }
 919
 920 static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 921 {
 922         struct ipv6_pinfo *np = inet6_sk(sk);
 923
 924         __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
 925 }
 926
 927 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 928 {
 929         const struct ipv6hdr *ipv6h;
 930         struct tcphdr *th;
 931
 932         if (!pskb_may_pull(skb, sizeof(*th)))
 933                 return -EINVAL;
 934
 935         ipv6h = ipv6_hdr(skb);
 936         th = tcp_hdr(skb);
 937
 938         th->check = 0;
 939         skb->ip_summed = CHECKSUM_PARTIAL;
 940         __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
 941         return 0;
 942 }
 943
 944 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 945                                          struct sk_buff *skb)
 946 {
 947         const struct ipv6hdr *iph = skb_gro_network_header(skb);
 948
 949         switch (skb->ip_summed) {
 950         case CHECKSUM_COMPLETE:
 951                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
 952                                   skb->csum)) {
 953                         skb->ip_summed = CHECKSUM_UNNECESSARY;
 954                         break;
 955                 }
 956
 957                 /* fall through */
 958         case CHECKSUM_NONE:
 959                 NAPI_GRO_CB(skb)->flush = 1;
 960                 return NULL;
 961         }
 962
 963         return tcp_gro_receive(head, skb);
 964 }
 965
 966 static int tcp6_gro_complete(struct sk_buff *skb)
 967 {
 968         const struct ipv6hdr *iph = ipv6_hdr(skb);
 969         struct tcphdr *th = tcp_hdr(skb);
 970
 971         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
 972                                   &iph->saddr, &iph->daddr, 0);
 973         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
 974
 975         return tcp_gro_complete(skb);
 976 }
 977
 978 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 979                                  u32 ts, struct tcp_md5sig_key *key, int rst)
 980 {
 981         struct tcphdr *th = tcp_hdr(skb), *t1;
 982         struct sk_buff *buff;
 983         struct flowi6 fl6;
 984         struct net *net = dev_net(skb_dst(skb)->dev);
 985         struct sock *ctl_sk = net->ipv6.tcp_sk;
 986         unsigned int tot_len = sizeof(struct tcphdr);
 987         struct dst_entry *dst;
 988         __be32 *topt;
 989
 990         if (ts)
 991                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 992 #ifdef CONFIG_TCP_MD5SIG
 993         if (key)
 994                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 995 #endif
 996
 997         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 998                          GFP_ATOMIC);
 999         if (buff == NULL)
1000                 return;
1001
1002         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1003
1004         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1005         skb_reset_transport_header(buff);
1006
1007         /* Swap the send and the receive. */
1008         memset(t1, 0, sizeof(*t1));
1009         t1->dest = th->source;
1010         t1->source = th->dest;
1011         t1->doff = tot_len / 4;
1012         t1->seq = htonl(seq);
1013         t1->ack_seq = htonl(ack);
1014         t1->ack = !rst || !th->ack;
1015         t1->rst = rst;
1016         t1->window = htons(win);
1017
1018         topt = (__be32 *)(t1 + 1);
1019
1020         if (ts) {
1021                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1022                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1023                 *topt++ = htonl(tcp_time_stamp);
1024                 *topt++ = htonl(ts);
1025         }
1026
1027 #ifdef CONFIG_TCP_MD5SIG
1028         if (key) {
1029                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1030                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1031                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
1032                                     &ipv6_hdr(skb)->saddr,
1033                                     &ipv6_hdr(skb)->daddr, t1);
1034         }
1035 #endif
1036
1037         memset(&fl6, 0, sizeof(fl6));
1038         ipv6_addr_copy(&fl6.daddr, &ipv6_hdr(skb)->saddr);
1039         ipv6_addr_copy(&fl6.saddr, &ipv6_hdr(skb)->daddr);
1040
1041         buff->ip_summed = CHECKSUM_PARTIAL;
1042         buff->csum = 0;
1043
1044         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
1045
1046         fl6.flowi6_proto = IPPROTO_TCP;
1047         fl6.flowi6_oif = inet6_iif(skb);
1048         fl6.fl6_dport = t1->dest;
1049         fl6.fl6_sport = t1->source;
1050         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
1051
1052         /* Pass a socket to ip6_dst_lookup either it is for RST
1053          * Underlying function will use this to retrieve the network
1054          * namespace
1055          */
1056         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
1057         if (!IS_ERR(dst)) {
1058                 skb_dst_set(buff, dst);
1059                 ip6_xmit(ctl_sk, buff, &fl6, NULL);
1060                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
1061                 if (rst)
1062                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
1063                 return;
1064         }
1065
1066         kfree_skb(buff);
1067 }
1068
1069 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
1070 {
1071         struct tcphdr *th = tcp_hdr(skb);
1072         u32 seq = 0, ack_seq = 0;
1073         struct tcp_md5sig_key *key = NULL;
1074
1075         if (th->rst)
1076                 return;
1077
1078         if (!ipv6_unicast_destination(skb))
1079                 return;
1080
1081 #ifdef CONFIG_TCP_MD5SIG
1082         if (sk)
1083                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1084 #endif
1085
1086         if (th->ack)
1087                 seq = ntohl(th->ack_seq);
1088         else
1089                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
1090                           (th->doff << 2);
1091
1092         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1);
1093 }
1094
1095 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
1096                             struct tcp_md5sig_key *key)
1097 {
1098         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0);
1099 }
1100
1101 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1102 {
1103         struct inet_timewait_sock *tw = inet_twsk(sk);
1104         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1105
1106         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1107                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1108                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw));
1109
1110         inet_twsk_put(tw);
1111 }
1112
1113 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1114                                   struct request_sock *req)
1115 {
1116         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1117                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
1118 }
1119
1120
1121 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1122 {
1123         struct request_sock *req, **prev;
1124         const struct tcphdr *th = tcp_hdr(skb);
1125         struct sock *nsk;
1126
1127         /* Find possible connection requests. */
1128         req = inet6_csk_search_req(sk, &prev, th->source,
1129                                    &ipv6_hdr(skb)->saddr,
1130                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1131         if (req)
1132                 return tcp_check_req(sk, skb, req, prev);
1133
1134         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1135                         &ipv6_hdr(skb)->saddr, th->source,
1136                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1137
1138         if (nsk) {
1139                 if (nsk->sk_state != TCP_TIME_WAIT) {
1140                         bh_lock_sock(nsk);
1141                         return nsk;
1142                 }
1143                 inet_twsk_put(inet_twsk(nsk));
1144                 return NULL;
1145         }
1146
1147 #ifdef CONFIG_SYN_COOKIES
1148         if (!th->syn)
1149                 sk = cookie_v6_check(sk, skb);
1150 #endif
1151         return sk;
1152 }
1153
1154 /* FIXME: this is substantially similar to the ipv4 code.
1155  * Can some kind of merge be done? -- erics
1156  */
1157 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1158 {
1159         struct tcp_extend_values tmp_ext;
1160         struct tcp_options_received tmp_opt;
1161         u8 *hash_location;
1162         struct request_sock *req;
1163         struct inet6_request_sock *treq;
1164         struct ipv6_pinfo *np = inet6_sk(sk);
1165         struct tcp_sock *tp = tcp_sk(sk);
1166         __u32 isn = TCP_SKB_CB(skb)->when;
1167         struct dst_entry *dst = NULL;
1168         int want_cookie = 0;
1169
1170         if (skb->protocol == htons(ETH_P_IP))
1171                 return tcp_v4_conn_request(sk, skb);
1172
1173         if (!ipv6_unicast_destination(skb))
1174                 goto drop;
1175
1176         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1177                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
1178                 if (!want_cookie)
1179                         goto drop;
1180         }
1181
1182         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1183                 goto drop;
1184
1185         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1186         if (req == NULL)
1187                 goto drop;
1188
1189 #ifdef CONFIG_TCP_MD5SIG
1190         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1191 #endif
1192
1193         tcp_clear_options(&tmp_opt);
1194         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1195         tmp_opt.user_mss = tp->rx_opt.user_mss;
1196         tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1197
1198         if (tmp_opt.cookie_plus > 0 &&
1199             tmp_opt.saw_tstamp &&
1200             !tp->rx_opt.cookie_out_never &&
1201             (sysctl_tcp_cookie_size > 0 ||
1202              (tp->cookie_values != NULL &&
1203               tp->cookie_values->cookie_desired > 0))) {
1204                 u8 *c;
1205                 u32 *d;
1206                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1207                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1208
1209                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1210                         goto drop_and_free;
1211
1212                 /* Secret recipe starts with IP addresses */
1213                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1214                 *mess++ ^= *d++;
1215                 *mess++ ^= *d++;
1216                 *mess++ ^= *d++;
1217                 *mess++ ^= *d++;
1218                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1219                 *mess++ ^= *d++;
1220                 *mess++ ^= *d++;
1221                 *mess++ ^= *d++;
1222                 *mess++ ^= *d++;
1223
1224                 /* plus variable length Initiator Cookie */
1225                 c = (u8 *)mess;
1226                 while (l-- > 0)
1227                         *c++ ^= *hash_location++;
1228
1229                 want_cookie = 0;        /* not our kind of cookie */
1230                 tmp_ext.cookie_out_never = 0; /* false */
1231                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1232         } else if (!tp->rx_opt.cookie_in_always) {
1233                 /* redundant indications, but ensure initialization. */
1234                 tmp_ext.cookie_out_never = 1; /* true */
1235                 tmp_ext.cookie_plus = 0;
1236         } else {
1237                 goto drop_and_free;
1238         }
1239         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1240
1241         if (want_cookie && !tmp_opt.saw_tstamp)
1242                 tcp_clear_options(&tmp_opt);
1243
1244         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1245         tcp_openreq_init(req, &tmp_opt, skb);
1246
1247         treq = inet6_rsk(req);
1248         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1249         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1250         if (!want_cookie || tmp_opt.tstamp_ok)
1251                 TCP_ECN_create_request(req, tcp_hdr(skb));
1252
1253         if (!isn) {
1254                 struct inet_peer *peer = NULL;
1255
1256                 if (ipv6_opt_accepted(sk, skb) ||
1257                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1258                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1259                         atomic_inc(&skb->users);
1260                         treq->pktopts = skb;
1261                 }
1262                 treq->iif = sk->sk_bound_dev_if;
1263
1264                 /* So that link locals have meaning */
1265                 if (!sk->sk_bound_dev_if &&
1266                     ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1267                         treq->iif = inet6_iif(skb);
1268
1269                 if (want_cookie) {
1270                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1271                         req->cookie_ts = tmp_opt.tstamp_ok;
1272                         goto have_isn;
1273                 }
1274
1275                 /* VJ's idea. We save last timestamp seen
1276                  * from the destination in peer table, when entering
1277                  * state TIME-WAIT, and check against it before
1278                  * accepting new connection request.
1279                  *
1280                  * If "isn" is not zero, this request hit alive
1281                  * timewait bucket, so that all the necessary checks
1282                  * are made in the function processing timewait state.
1283                  */
1284                 if (tmp_opt.saw_tstamp &&
1285                     tcp_death_row.sysctl_tw_recycle &&
1286                     (dst = inet6_csk_route_req(sk, req)) != NULL &&
1287                     (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
1288                     ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
1289                                     &treq->rmt_addr)) {
1290                         inet_peer_refcheck(peer);
1291                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1292                             (s32)(peer->tcp_ts - req->ts_recent) >
1293                                                         TCP_PAWS_WINDOW) {
1294                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1295                                 goto drop_and_release;
1296                         }
1297                 }
1298                 /* Kill the following clause, if you dislike this way. */
1299                 else if (!sysctl_tcp_syncookies &&
1300                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1301                           (sysctl_max_syn_backlog >> 2)) &&
1302                          (!peer || !peer->tcp_ts_stamp) &&
1303                          (!dst || !dst_metric(dst, RTAX_RTT))) {
1304                         /* Without syncookies last quarter of
1305                          * backlog is filled with destinations,
1306                          * proven to be alive.
1307                          * It means that we continue to communicate
1308                          * to destinations, already remembered
1309                          * to the moment of synflood.
1310                          */
1311                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1312                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1313                         goto drop_and_release;
1314                 }
1315
1316                 isn = tcp_v6_init_sequence(skb);
1317         }
1318 have_isn:
1319         tcp_rsk(req)->snt_isn = isn;
1320         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1321
1322         security_inet_conn_request(sk, skb, req);
1323
1324         if (tcp_v6_send_synack(sk, req,
1325                                (struct request_values *)&tmp_ext) ||
1326             want_cookie)
1327                 goto drop_and_free;
1328
1329         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1330         return 0;
1331
1332 drop_and_release:
1333         dst_release(dst);
1334 drop_and_free:
1335         reqsk_free(req);
1336 drop:
1337         return 0; /* don't send reset */
1338 }
1339
1340 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1341                                           struct request_sock *req,
1342                                           struct dst_entry *dst)
1343 {
1344         struct inet6_request_sock *treq;
1345         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1346         struct tcp6_sock *newtcp6sk;
1347         struct inet_sock *newinet;
1348         struct tcp_sock *newtp;
1349         struct sock *newsk;
1350         struct ipv6_txoptions *opt;
1351 #ifdef CONFIG_TCP_MD5SIG
1352         struct tcp_md5sig_key *key;
1353 #endif
1354
1355         if (skb->protocol == htons(ETH_P_IP)) {
1356                 /*
1357                  *      v6 mapped
1358                  */
1359
1360                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1361
1362                 if (newsk == NULL)
1363                         return NULL;
1364
1365                 newtcp6sk = (struct tcp6_sock *)newsk;
1366                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1367
1368                 newinet = inet_sk(newsk);
1369                 newnp = inet6_sk(newsk);
1370                 newtp = tcp_sk(newsk);
1371
1372                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1373
1374                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1375
1376                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1377
1378                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1379
1380                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1381                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1382 #ifdef CONFIG_TCP_MD5SIG
1383                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1384 #endif
1385
1386                 newnp->pktoptions  = NULL;
1387                 newnp->opt         = NULL;
1388                 newnp->mcast_oif   = inet6_iif(skb);
1389                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1390
1391                 /*
1392                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1393                  * here, tcp_create_openreq_child now does this for us, see the comment in
1394                  * that function for the gory details. -acme
1395                  */
1396
1397                 /* It is tricky place. Until this moment IPv4 tcp
1398                    worked with IPv6 icsk.icsk_af_ops.
1399                    Sync it now.
1400                  */
1401                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1402
1403                 return newsk;
1404         }
1405
1406         treq = inet6_rsk(req);
1407         opt = np->opt;
1408
1409         if (sk_acceptq_is_full(sk))
1410                 goto out_overflow;
1411
1412         if (!dst) {
1413                 dst = inet6_csk_route_req(sk, req);
1414                 if (!dst)
1415                         goto out;
1416         }
1417
1418         newsk = tcp_create_openreq_child(sk, req, skb);
1419         if (newsk == NULL)
1420                 goto out_nonewsk;
1421
1422         /*
1423          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1424          * count here, tcp_create_openreq_child now does this for us, see the
1425          * comment in that function for the gory details. -acme
1426          */
1427
1428         newsk->sk_gso_type = SKB_GSO_TCPV6;
1429         __ip6_dst_store(newsk, dst, NULL, NULL);
1430
1431         newtcp6sk = (struct tcp6_sock *)newsk;
1432         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1433
1434         newtp = tcp_sk(newsk);
1435         newinet = inet_sk(newsk);
1436         newnp = inet6_sk(newsk);
1437
1438         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1439
1440         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1441         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1442         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1443         newsk->sk_bound_dev_if = treq->iif;
1444
1445         /* Now IPv6 options...
1446
1447            First: no IPv4 options.
1448          */
1449         newinet->inet_opt = NULL;
1450         newnp->ipv6_fl_list = NULL;
1451
1452         /* Clone RX bits */
1453         newnp->rxopt.all = np->rxopt.all;
1454
1455         /* Clone pktoptions received with SYN */
1456         newnp->pktoptions = NULL;
1457         if (treq->pktopts != NULL) {
1458                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1459                 kfree_skb(treq->pktopts);
1460                 treq->pktopts = NULL;
1461                 if (newnp->pktoptions)
1462                         skb_set_owner_r(newnp->pktoptions, newsk);
1463         }
1464         newnp->opt        = NULL;
1465         newnp->mcast_oif  = inet6_iif(skb);
1466         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1467
1468         /* Clone native IPv6 options from listening socket (if any)
1469
1470            Yes, keeping reference count would be much more clever,
1471            but we make one more one thing there: reattach optmem
1472            to newsk.
1473          */
1474         if (opt) {
1475                 newnp->opt = ipv6_dup_options(newsk, opt);
1476                 if (opt != np->opt)
1477                         sock_kfree_s(sk, opt, opt->tot_len);
1478         }
1479
1480         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1481         if (newnp->opt)
1482                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1483                                                      newnp->opt->opt_flen);
1484
1485         tcp_mtup_init(newsk);
1486         tcp_sync_mss(newsk, dst_mtu(dst));
1487         newtp->advmss = dst_metric_advmss(dst);
1488         tcp_initialize_rcv_mss(newsk);
1489         if (tcp_rsk(req)->snt_synack)
1490                 tcp_valid_rtt_meas(newsk,
1491                     tcp_time_stamp - tcp_rsk(req)->snt_synack);
1492         newtp->total_retrans = req->retrans;
1493
1494         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1495         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1496
1497 #ifdef CONFIG_TCP_MD5SIG
1498         /* Copy over the MD5 key from the original socket */
1499         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1500                 /* We're using one, so create a matching key
1501                  * on the newsk structure. If we fail to get
1502                  * memory, then we end up not copying the key
1503                  * across. Shucks.
1504                  */
1505                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1506                 if (newkey != NULL)
1507                         tcp_v6_md5_do_add(newsk, &newnp->daddr,
1508                                           newkey, key->keylen);
1509         }
1510 #endif
1511
1512         if (__inet_inherit_port(sk, newsk) < 0) {
1513                 sock_put(newsk);
1514                 goto out;
1515         }
1516         __inet6_hash(newsk, NULL);
1517
1518         return newsk;
1519
1520 out_overflow:
1521         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1522 out_nonewsk:
1523         if (opt && opt != np->opt)
1524                 sock_kfree_s(sk, opt, opt->tot_len);
1525         dst_release(dst);
1526 out:
1527         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1528         return NULL;
1529 }
1530
1531 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1532 {
1533         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1534                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1535                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1536                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1537                         return 0;
1538                 }
1539         }
1540
1541         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1542                                               &ipv6_hdr(skb)->saddr,
1543                                               &ipv6_hdr(skb)->daddr, 0));
1544
1545         if (skb->len <= 76) {
1546                 return __skb_checksum_complete(skb);
1547         }
1548         return 0;
1549 }
1550
1551 /* The socket must have it's spinlock held when we get
1552  * here.
1553  *
1554  * We have a potential double-lock case here, so even when
1555  * doing backlog processing we use the BH locking scheme.
1556  * This is because we cannot sleep with the original spinlock
1557  * held.
1558  */
1559 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1560 {
1561         struct ipv6_pinfo *np = inet6_sk(sk);
1562         struct tcp_sock *tp;
1563         struct sk_buff *opt_skb = NULL;
1564
1565         /* Imagine: socket is IPv6. IPv4 packet arrives,
1566            goes to IPv4 receive handler and backlogged.
1567            From backlog it always goes here. Kerboom...
1568            Fortunately, tcp_rcv_established and rcv_established
1569            handle them correctly, but it is not case with
1570            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1571          */
1572
1573         if (skb->protocol == htons(ETH_P_IP))
1574                 return tcp_v4_do_rcv(sk, skb);
1575
1576 #ifdef CONFIG_TCP_MD5SIG
1577         if (tcp_v6_inbound_md5_hash (sk, skb))
1578                 goto discard;
1579 #endif
1580
1581         if (sk_filter(sk, skb))
1582                 goto discard;
1583
1584         /*
1585          *      socket locking is here for SMP purposes as backlog rcv
1586          *      is currently called with bh processing disabled.
1587          */
1588
1589         /* Do Stevens' IPV6_PKTOPTIONS.
1590
1591            Yes, guys, it is the only place in our code, where we
1592            may make it not affecting IPv4.
1593            The rest of code is protocol independent,
1594            and I do not like idea to uglify IPv4.
1595
1596            Actually, all the idea behind IPV6_PKTOPTIONS
1597            looks not very well thought. For now we latch
1598            options, received in the last packet, enqueued
1599            by tcp. Feel free to propose better solution.
1600                                                --ANK (980728)
1601          */
1602         if (np->rxopt.all)
1603                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1604
1605         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1606                 sock_rps_save_rxhash(sk, skb->rxhash);
1607                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1608                         goto reset;
1609                 if (opt_skb)
1610                         goto ipv6_pktoptions;
1611                 return 0;
1612         }
1613
1614         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1615                 goto csum_err;
1616
1617         if (sk->sk_state == TCP_LISTEN) {
1618                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1619                 if (!nsk)
1620                         goto discard;
1621
1622                 /*
1623                  * Queue it on the new socket if the new socket is active,
1624                  * otherwise we just shortcircuit this and continue with
1625                  * the new socket..
1626                  */
1627                 if(nsk != sk) {
1628                         sock_rps_save_rxhash(nsk, skb->rxhash);
1629                         if (tcp_child_process(sk, nsk, skb))
1630                                 goto reset;
1631                         if (opt_skb)
1632                                 __kfree_skb(opt_skb);
1633                         return 0;
1634                 }
1635         } else
1636                 sock_rps_save_rxhash(sk, skb->rxhash);
1637
1638         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1639                 goto reset;
1640         if (opt_skb)
1641                 goto ipv6_pktoptions;
1642         return 0;
1643
1644 reset:
1645         tcp_v6_send_reset(sk, skb);
1646 discard:
1647         if (opt_skb)
1648                 __kfree_skb(opt_skb);
1649         kfree_skb(skb);
1650         return 0;
1651 csum_err:
1652         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1653         goto discard;
1654
1655
1656 ipv6_pktoptions:
1657         /* Do you ask, what is it?
1658
1659            1. skb was enqueued by tcp.
1660            2. skb is added to tail of read queue, rather than out of order.
1661            3. socket is not in passive state.
1662            4. Finally, it really contains options, which user wants to receive.
1663          */
1664         tp = tcp_sk(sk);
1665         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1666             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1667                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1668                         np->mcast_oif = inet6_iif(opt_skb);
1669                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1670                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1671                 if (ipv6_opt_accepted(sk, opt_skb)) {
1672                         skb_set_owner_r(opt_skb, sk);
1673                         opt_skb = xchg(&np->pktoptions, opt_skb);
1674                 } else {
1675                         __kfree_skb(opt_skb);
1676                         opt_skb = xchg(&np->pktoptions, NULL);
1677                 }
1678         }
1679
1680         kfree_skb(opt_skb);
1681         return 0;
1682 }
1683
1684 static int tcp_v6_rcv(struct sk_buff *skb)
1685 {
1686         struct tcphdr *th;
1687         const struct ipv6hdr *hdr;
1688         struct sock *sk;
1689         int ret;
1690         struct net *net = dev_net(skb->dev);
1691
1692         if (skb->pkt_type != PACKET_HOST)
1693                 goto discard_it;
1694
1695         /*
1696          *      Count it even if it's bad.
1697          */
1698         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1699
1700         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1701                 goto discard_it;
1702
1703         th = tcp_hdr(skb);
1704
1705         if (th->doff < sizeof(struct tcphdr)/4)
1706                 goto bad_packet;
1707         if (!pskb_may_pull(skb, th->doff*4))
1708                 goto discard_it;
1709
1710         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1711                 goto bad_packet;
1712
1713         th = tcp_hdr(skb);
1714         hdr = ipv6_hdr(skb);
1715         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1716         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1717                                     skb->len - th->doff*4);
1718         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1719         TCP_SKB_CB(skb)->when = 0;
1720         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
1721         TCP_SKB_CB(skb)->sacked = 0;
1722
1723         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1724         if (!sk)
1725                 goto no_tcp_socket;
1726
1727 process:
1728         if (sk->sk_state == TCP_TIME_WAIT)
1729                 goto do_time_wait;
1730
1731         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1732                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1733                 goto discard_and_relse;
1734         }
1735
1736         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1737                 goto discard_and_relse;
1738
1739         if (sk_filter(sk, skb))
1740                 goto discard_and_relse;
1741
1742         skb->dev = NULL;
1743
1744         bh_lock_sock_nested(sk);
1745         ret = 0;
1746         if (!sock_owned_by_user(sk)) {
1747 #ifdef CONFIG_NET_DMA
1748                 struct tcp_sock *tp = tcp_sk(sk);
1749                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1750                         tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
1751                 if (tp->ucopy.dma_chan)
1752                         ret = tcp_v6_do_rcv(sk, skb);
1753                 else
1754 #endif
1755                 {
1756                         if (!tcp_prequeue(sk, skb))
1757                                 ret = tcp_v6_do_rcv(sk, skb);
1758                 }
1759         } else if (unlikely(sk_add_backlog(sk, skb))) {
1760                 bh_unlock_sock(sk);
1761                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1762                 goto discard_and_relse;
1763         }
1764         bh_unlock_sock(sk);
1765
1766         sock_put(sk);
1767         return ret ? -1 : 0;
1768
1769 no_tcp_socket:
1770         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1771                 goto discard_it;
1772
1773         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1774 bad_packet:
1775                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1776         } else {
1777                 tcp_v6_send_reset(NULL, skb);
1778         }
1779
1780 discard_it:
1781
1782         /*
1783          *      Discard frame
1784          */
1785
1786         kfree_skb(skb);
1787         return 0;
1788
1789 discard_and_relse:
1790         sock_put(sk);
1791         goto discard_it;
1792
1793 do_time_wait:
1794         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1795                 inet_twsk_put(inet_twsk(sk));
1796                 goto discard_it;
1797         }
1798
1799         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1800                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1801                 inet_twsk_put(inet_twsk(sk));
1802                 goto discard_it;
1803         }
1804
1805         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1806         case TCP_TW_SYN:
1807         {
1808                 struct sock *sk2;
1809
1810                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1811                                             &ipv6_hdr(skb)->daddr,
1812                                             ntohs(th->dest), inet6_iif(skb));
1813                 if (sk2 != NULL) {
1814                         struct inet_timewait_sock *tw = inet_twsk(sk);
1815                         inet_twsk_deschedule(tw, &tcp_death_row);
1816                         inet_twsk_put(tw);
1817                         sk = sk2;
1818                         goto process;
1819                 }
1820                 /* Fall through to ACK */
1821         }
1822         case TCP_TW_ACK:
1823                 tcp_v6_timewait_ack(sk, skb);
1824                 break;
1825         case TCP_TW_RST:
1826                 goto no_tcp_socket;
1827         case TCP_TW_SUCCESS:;
1828         }
1829         goto discard_it;
1830 }
1831
1832 static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
1833 {
1834         struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
1835         struct ipv6_pinfo *np = inet6_sk(sk);
1836         struct inet_peer *peer;
1837
1838         if (!rt ||
1839             !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
1840                 peer = inet_getpeer_v6(&np->daddr, 1);
1841                 *release_it = true;
1842         } else {
1843                 if (!rt->rt6i_peer)
1844                         rt6_bind_peer(rt, 1);
1845                 peer = rt->rt6i_peer;
1846                 *release_it = false;
1847         }
1848
1849         return peer;
1850 }
1851
1852 static void *tcp_v6_tw_get_peer(struct sock *sk)
1853 {
1854         struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
1855         struct inet_timewait_sock *tw = inet_twsk(sk);
1856
1857         if (tw->tw_family == AF_INET)
1858                 return tcp_v4_tw_get_peer(sk);
1859
1860         return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
1861 }
1862
1863 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1864         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1865         .twsk_unique    = tcp_twsk_unique,
1866         .twsk_destructor= tcp_twsk_destructor,
1867         .twsk_getpeer   = tcp_v6_tw_get_peer,
1868 };
1869
1870 static const struct inet_connection_sock_af_ops ipv6_specific = {
1871         .queue_xmit        = inet6_csk_xmit,
1872         .send_check        = tcp_v6_send_check,
1873         .rebuild_header    = inet6_sk_rebuild_header,
1874         .conn_request      = tcp_v6_conn_request,
1875         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1876         .get_peer          = tcp_v6_get_peer,
1877         .net_header_len    = sizeof(struct ipv6hdr),
1878         .setsockopt        = ipv6_setsockopt,
1879         .getsockopt        = ipv6_getsockopt,
1880         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1881         .sockaddr_len      = sizeof(struct sockaddr_in6),
1882         .bind_conflict     = inet6_csk_bind_conflict,
1883 #ifdef CONFIG_COMPAT
1884         .compat_setsockopt = compat_ipv6_setsockopt,
1885         .compat_getsockopt = compat_ipv6_getsockopt,
1886 #endif
1887 };
1888
1889 #ifdef CONFIG_TCP_MD5SIG
1890 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1891         .md5_lookup     =       tcp_v6_md5_lookup,
1892         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1893         .md5_add        =       tcp_v6_md5_add_func,
1894         .md5_parse      =       tcp_v6_parse_md5_keys,
1895 };
1896 #endif
1897
1898 /*
1899  *      TCP over IPv4 via INET6 API
1900  */
1901
1902 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1903         .queue_xmit        = ip_queue_xmit,
1904         .send_check        = tcp_v4_send_check,
1905         .rebuild_header    = inet_sk_rebuild_header,
1906         .conn_request      = tcp_v6_conn_request,
1907         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1908         .get_peer          = tcp_v4_get_peer,
1909         .net_header_len    = sizeof(struct iphdr),
1910         .setsockopt        = ipv6_setsockopt,
1911         .getsockopt        = ipv6_getsockopt,
1912         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1913         .sockaddr_len      = sizeof(struct sockaddr_in6),
1914         .bind_conflict     = inet6_csk_bind_conflict,
1915 #ifdef CONFIG_COMPAT
1916         .compat_setsockopt = compat_ipv6_setsockopt,
1917         .compat_getsockopt = compat_ipv6_getsockopt,
1918 #endif
1919 };
1920
1921 #ifdef CONFIG_TCP_MD5SIG
1922 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1923         .md5_lookup     =       tcp_v4_md5_lookup,
1924         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1925         .md5_add        =       tcp_v6_md5_add_func,
1926         .md5_parse      =       tcp_v6_parse_md5_keys,
1927 };
1928 #endif
1929
1930 /* NOTE: A lot of things set to zero explicitly by call to
1931  *       sk_alloc() so need not be done here.
1932  */
1933 static int tcp_v6_init_sock(struct sock *sk)
1934 {
1935         struct inet_connection_sock *icsk = inet_csk(sk);
1936         struct tcp_sock *tp = tcp_sk(sk);
1937
1938         skb_queue_head_init(&tp->out_of_order_queue);
1939         tcp_init_xmit_timers(sk);
1940         tcp_prequeue_init(tp);
1941
1942         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1943         tp->mdev = TCP_TIMEOUT_INIT;
1944
1945         /* So many TCP implementations out there (incorrectly) count the
1946          * initial SYN frame in their delayed-ACK and congestion control
1947          * algorithms that we must have the following bandaid to talk
1948          * efficiently to them.  -DaveM
1949          */
1950         tp->snd_cwnd = 2;
1951
1952         /* See draft-stevens-tcpca-spec-01 for discussion of the
1953          * initialization of these values.
1954          */
1955         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
1956         tp->snd_cwnd_clamp = ~0;
1957         tp->mss_cache = TCP_MSS_DEFAULT;
1958
1959         tp->reordering = sysctl_tcp_reordering;
1960
1961         sk->sk_state = TCP_CLOSE;
1962
1963         icsk->icsk_af_ops = &ipv6_specific;
1964         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1965         icsk->icsk_sync_mss = tcp_sync_mss;
1966         sk->sk_write_space = sk_stream_write_space;
1967         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1968
1969 #ifdef CONFIG_TCP_MD5SIG
1970         tp->af_specific = &tcp_sock_ipv6_specific;
1971 #endif
1972
1973         /* TCP Cookie Transactions */
1974         if (sysctl_tcp_cookie_size > 0) {
1975                 /* Default, cookies without s_data_payload. */
1976                 tp->cookie_values =
1977                         kzalloc(sizeof(*tp->cookie_values),
1978                                 sk->sk_allocation);
1979                 if (tp->cookie_values != NULL)
1980                         kref_init(&tp->cookie_values->kref);
1981         }
1982         /* Presumed zeroed, in order of appearance:
1983          *      cookie_in_always, cookie_out_never,
1984          *      s_data_constant, s_data_in, s_data_out
1985          */
1986         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1987         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1988
1989         local_bh_disable();
1990         percpu_counter_inc(&tcp_sockets_allocated);
1991         local_bh_enable();
1992
1993         return 0;
1994 }
1995
1996 static void tcp_v6_destroy_sock(struct sock *sk)
1997 {
1998 #ifdef CONFIG_TCP_MD5SIG
1999         /* Clean up the MD5 key list */
2000         if (tcp_sk(sk)->md5sig_info)
2001                 tcp_v6_clear_md5_list(sk);
2002 #endif
2003         tcp_v4_destroy_sock(sk);
2004         inet6_destroy_sock(sk);
2005 }
2006
2007 #ifdef CONFIG_PROC_FS
2008 /* Proc filesystem TCPv6 sock list dumping. */
2009 static void get_openreq6(struct seq_file *seq,
2010                          struct sock *sk, struct request_sock *req, int i, int uid)
2011 {
2012         int ttd = req->expires - jiffies;
2013         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
2014         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
2015
2016         if (ttd < 0)
2017                 ttd = 0;
2018
2019         seq_printf(seq,
2020                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2021                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2022                    i,
2023                    src->s6_addr32[0], src->s6_addr32[1],
2024                    src->s6_addr32[2], src->s6_addr32[3],
2025                    ntohs(inet_rsk(req)->loc_port),
2026                    dest->s6_addr32[0], dest->s6_addr32[1],
2027                    dest->s6_addr32[2], dest->s6_addr32[3],
2028                    ntohs(inet_rsk(req)->rmt_port),
2029                    TCP_SYN_RECV,
2030                    0,0, /* could print option size, but that is af dependent. */
2031                    1,   /* timers active (only the expire timer) */
2032                    jiffies_to_clock_t(ttd),
2033                    req->retrans,
2034                    uid,
2035                    0,  /* non standard timer */
2036                    0, /* open_requests have no inode */
2037                    0, req);
2038 }
2039
2040 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
2041 {
2042         const struct in6_addr *dest, *src;
2043         __u16 destp, srcp;
2044         int timer_active;
2045         unsigned long timer_expires;
2046         struct inet_sock *inet = inet_sk(sp);
2047         struct tcp_sock *tp = tcp_sk(sp);
2048         const struct inet_connection_sock *icsk = inet_csk(sp);
2049         struct ipv6_pinfo *np = inet6_sk(sp);
2050
2051         dest  = &np->daddr;
2052         src   = &np->rcv_saddr;
2053         destp = ntohs(inet->inet_dport);
2054         srcp  = ntohs(inet->inet_sport);
2055
2056         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2057                 timer_active    = 1;
2058                 timer_expires   = icsk->icsk_timeout;
2059         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2060                 timer_active    = 4;
2061                 timer_expires   = icsk->icsk_timeout;
2062         } else if (timer_pending(&sp->sk_timer)) {
2063                 timer_active    = 2;
2064                 timer_expires   = sp->sk_timer.expires;
2065         } else {
2066                 timer_active    = 0;
2067                 timer_expires = jiffies;
2068         }
2069
2070         seq_printf(seq,
2071                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2072                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
2073                    i,
2074                    src->s6_addr32[0], src->s6_addr32[1],
2075                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2076                    dest->s6_addr32[0], dest->s6_addr32[1],
2077                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2078                    sp->sk_state,
2079                    tp->write_seq-tp->snd_una,
2080                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2081                    timer_active,
2082                    jiffies_to_clock_t(timer_expires - jiffies),
2083                    icsk->icsk_retransmits,
2084                    sock_i_uid(sp),
2085                    icsk->icsk_probes_out,
2086                    sock_i_ino(sp),
2087                    atomic_read(&sp->sk_refcnt), sp,
2088                    jiffies_to_clock_t(icsk->icsk_rto),
2089                    jiffies_to_clock_t(icsk->icsk_ack.ato),
2090                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2091                    tp->snd_cwnd,
2092                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
2093                    );
2094 }
2095
2096 static void get_timewait6_sock(struct seq_file *seq,
2097                                struct inet_timewait_sock *tw, int i)
2098 {
2099         const struct in6_addr *dest, *src;
2100         __u16 destp, srcp;
2101         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2102         int ttd = tw->tw_ttd - jiffies;
2103
2104         if (ttd < 0)
2105                 ttd = 0;
2106
2107         dest = &tw6->tw_v6_daddr;
2108         src  = &tw6->tw_v6_rcv_saddr;
2109         destp = ntohs(tw->tw_dport);
2110         srcp  = ntohs(tw->tw_sport);
2111
2112         seq_printf(seq,
2113                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2114                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2115                    i,
2116                    src->s6_addr32[0], src->s6_addr32[1],
2117                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2118                    dest->s6_addr32[0], dest->s6_addr32[1],
2119                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2120                    tw->tw_substate, 0, 0,
2121                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2122                    atomic_read(&tw->tw_refcnt), tw);
2123 }
2124
2125 static int tcp6_seq_show(struct seq_file *seq, void *v)
2126 {
2127         struct tcp_iter_state *st;
2128
2129         if (v == SEQ_START_TOKEN) {
2130                 seq_puts(seq,
2131                          "  sl  "
2132                          "local_address                         "
2133                          "remote_address                        "
2134                          "st tx_queue rx_queue tr tm->when retrnsmt"
2135                          "   uid  timeout inode\n");
2136                 goto out;
2137         }
2138         st = seq->private;
2139
2140         switch (st->state) {
2141         case TCP_SEQ_STATE_LISTENING:
2142         case TCP_SEQ_STATE_ESTABLISHED:
2143                 get_tcp6_sock(seq, v, st->num);
2144                 break;
2145         case TCP_SEQ_STATE_OPENREQ:
2146                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2147                 break;
2148         case TCP_SEQ_STATE_TIME_WAIT:
2149                 get_timewait6_sock(seq, v, st->num);
2150                 break;
2151         }
2152 out:
2153         return 0;
2154 }
2155
2156 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2157         .name           = "tcp6",
2158         .family         = AF_INET6,
2159         .seq_fops       = {
2160                 .owner          = THIS_MODULE,
2161         },
2162         .seq_ops        = {
2163                 .show           = tcp6_seq_show,
2164         },
2165 };
2166
2167 int __net_init tcp6_proc_init(struct net *net)
2168 {
2169         return tcp_proc_register(net, &tcp6_seq_afinfo);
2170 }
2171
2172 void tcp6_proc_exit(struct net *net)
2173 {
2174         tcp_proc_unregister(net, &tcp6_seq_afinfo);
2175 }
2176 #endif
2177
2178 struct proto tcpv6_prot = {
2179         .name                   = "TCPv6",
2180         .owner                  = THIS_MODULE,
2181         .close                  = tcp_close,
2182         .connect                = tcp_v6_connect,
2183         .disconnect             = tcp_disconnect,
2184         .accept                 = inet_csk_accept,
2185         .ioctl                  = tcp_ioctl,
2186         .init                   = tcp_v6_init_sock,
2187         .destroy                = tcp_v6_destroy_sock,
2188         .shutdown               = tcp_shutdown,
2189         .setsockopt             = tcp_setsockopt,
2190         .getsockopt             = tcp_getsockopt,
2191         .recvmsg                = tcp_recvmsg,
2192         .sendmsg                = tcp_sendmsg,
2193         .sendpage               = tcp_sendpage,
2194         .backlog_rcv            = tcp_v6_do_rcv,
2195         .hash                   = tcp_v6_hash,
2196         .unhash                 = inet_unhash,
2197         .get_port               = inet_csk_get_port,
2198         .enter_memory_pressure  = tcp_enter_memory_pressure,
2199         .sockets_allocated      = &tcp_sockets_allocated,
2200         .memory_allocated       = &tcp_memory_allocated,
2201         .memory_pressure        = &tcp_memory_pressure,
2202         .orphan_count           = &tcp_orphan_count,
2203         .sysctl_mem             = sysctl_tcp_mem,
2204         .sysctl_wmem            = sysctl_tcp_wmem,
2205         .sysctl_rmem            = sysctl_tcp_rmem,
2206         .max_header             = MAX_TCP_HEADER,
2207         .obj_size               = sizeof(struct tcp6_sock),
2208         .slab_flags             = SLAB_DESTROY_BY_RCU,
2209         .twsk_prot              = &tcp6_timewait_sock_ops,
2210         .rsk_prot               = &tcp6_request_sock_ops,
2211         .h.hashinfo             = &tcp_hashinfo,
2212         .no_autobind            = true,
2213 #ifdef CONFIG_COMPAT
2214         .compat_setsockopt      = compat_tcp_setsockopt,
2215         .compat_getsockopt      = compat_tcp_getsockopt,
2216 #endif
2217 };
2218
2219 static const struct inet6_protocol tcpv6_protocol = {
2220         .handler        =       tcp_v6_rcv,
2221         .err_handler    =       tcp_v6_err,
2222         .gso_send_check =       tcp_v6_gso_send_check,
2223         .gso_segment    =       tcp_tso_segment,
2224         .gro_receive    =       tcp6_gro_receive,
2225         .gro_complete   =       tcp6_gro_complete,
2226         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2227 };
2228
2229 static struct inet_protosw tcpv6_protosw = {
2230         .type           =       SOCK_STREAM,
2231         .protocol       =       IPPROTO_TCP,
2232         .prot           =       &tcpv6_prot,
2233         .ops            =       &inet6_stream_ops,
2234         .no_check       =       0,
2235         .flags          =       INET_PROTOSW_PERMANENT |
2236                                 INET_PROTOSW_ICSK,
2237 };
2238
2239 static int __net_init tcpv6_net_init(struct net *net)
2240 {
2241         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2242                                     SOCK_RAW, IPPROTO_TCP, net);
2243 }
2244
2245 static void __net_exit tcpv6_net_exit(struct net *net)
2246 {
2247         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2248 }
2249
2250 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2251 {
2252         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2253 }
2254
2255 static struct pernet_operations tcpv6_net_ops = {
2256         .init       = tcpv6_net_init,
2257         .exit       = tcpv6_net_exit,
2258         .exit_batch = tcpv6_net_exit_batch,
2259 };
2260
2261 int __init tcpv6_init(void)
2262 {
2263         int ret;
2264
2265         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2266         if (ret)
2267                 goto out;
2268
2269         /* register inet6 protocol */
2270         ret = inet6_register_protosw(&tcpv6_protosw);
2271         if (ret)
2272                 goto out_tcpv6_protocol;
2273
2274         ret = register_pernet_subsys(&tcpv6_net_ops);
2275         if (ret)
2276                 goto out_tcpv6_protosw;
2277 out:
2278         return ret;
2279
2280 out_tcpv6_protocol:
2281         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2282 out_tcpv6_protosw:
2283         inet6_unregister_protosw(&tcpv6_protosw);
2284         goto out;
2285 }
2286
2287 void tcpv6_exit(void)
2288 {
2289         unregister_pernet_subsys(&tcpv6_net_ops);
2290         inet6_unregister_protosw(&tcpv6_protosw);
2291         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2292 }