net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65
  66 #include <asm/uaccess.h>
  67
  68 #include <linux/proc_fs.h>
  69 #include <linux/seq_file.h>
  70
  71 #include <linux/crypto.h>
  72 #include <linux/scatterlist.h>
  73
  74 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79 static void     __tcp_v6_send_check(struct sk_buff *skb,
  80                                     const struct in6_addr *saddr,
  81                                     const struct in6_addr *daddr);
  82
  83 static const struct inet_connection_sock_af_ops ipv6_mapped;
  84 static const struct inet_connection_sock_af_ops ipv6_specific;
  85 #ifdef CONFIG_TCP_MD5SIG
  86 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  87 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  88 #else
  89 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  90                                                    const struct in6_addr *addr)
  91 {
  92         return NULL;
  93 }
  94 #endif
  95
  96 static void tcp_v6_hash(struct sock *sk)
  97 {
  98         if (sk->sk_state != TCP_CLOSE) {
  99                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 100                         tcp_prot.hash(sk);
 101                         return;
 102                 }
 103                 local_bh_disable();
 104                 __inet6_hash(sk, NULL);
 105                 local_bh_enable();
 106         }
 107 }
 108
 109 static __inline__ __sum16 tcp_v6_check(int len,
 110                                    const struct in6_addr *saddr,
 111                                    const struct in6_addr *daddr,
 112                                    __wsum base)
 113 {
 114         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 115 }
 116
 117 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 118 {
 119         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 120                                             ipv6_hdr(skb)->saddr.s6_addr32,
 121                                             tcp_hdr(skb)->dest,
 122                                             tcp_hdr(skb)->source);
 123 }
 124
 125 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 126                           int addr_len)
 127 {
 128         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 129         struct inet_sock *inet = inet_sk(sk);
 130         struct inet_connection_sock *icsk = inet_csk(sk);
 131         struct ipv6_pinfo *np = inet6_sk(sk);
 132         struct tcp_sock *tp = tcp_sk(sk);
 133         struct in6_addr *saddr = NULL, *final_p, final;
 134         struct ipv6_txoptions *opt;
 135         struct rt6_info *rt;
 136         struct flowi6 fl6;
 137         struct dst_entry *dst;
 138         int addr_type;
 139         int err;
 140
 141         if (addr_len < SIN6_LEN_RFC2133)
 142                 return -EINVAL;
 143
 144         if (usin->sin6_family != AF_INET6)
 145                 return -EAFNOSUPPORT;
 146
 147         memset(&fl6, 0, sizeof(fl6));
 148
 149         if (np->sndflow) {
 150                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 151                 IP6_ECN_flow_init(fl6.flowlabel);
 152                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 153                         struct ip6_flowlabel *flowlabel;
 154                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 155                         if (flowlabel == NULL)
 156                                 return -EINVAL;
 157                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 158                         fl6_sock_release(flowlabel);
 159                 }
 160         }
 161
 162         /*
 163          *      connect() to INADDR_ANY means loopback (BSD'ism).
 164          */
 165
 166         if(ipv6_addr_any(&usin->sin6_addr))
 167                 usin->sin6_addr.s6_addr[15] = 0x1;
 168
 169         addr_type = ipv6_addr_type(&usin->sin6_addr);
 170
 171         if(addr_type & IPV6_ADDR_MULTICAST)
 172                 return -ENETUNREACH;
 173
 174         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 175                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 176                     usin->sin6_scope_id) {
 177                         /* If interface is set while binding, indices
 178                          * must coincide.
 179                          */
 180                         if (sk->sk_bound_dev_if &&
 181                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 182                                 return -EINVAL;
 183
 184                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 185                 }
 186
 187                 /* Connect to link-local address requires an interface */
 188                 if (!sk->sk_bound_dev_if)
 189                         return -EINVAL;
 190         }
 191
 192         if (tp->rx_opt.ts_recent_stamp &&
 193             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 194                 tp->rx_opt.ts_recent = 0;
 195                 tp->rx_opt.ts_recent_stamp = 0;
 196                 tp->write_seq = 0;
 197         }
 198
 199         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 200         np->flow_label = fl6.flowlabel;
 201
 202         /*
 203          *      TCP over IPv4
 204          */
 205
 206         if (addr_type == IPV6_ADDR_MAPPED) {
 207                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 208                 struct sockaddr_in sin;
 209
 210                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 211
 212                 if (__ipv6_only_sock(sk))
 213                         return -ENETUNREACH;
 214
 215                 sin.sin_family = AF_INET;
 216                 sin.sin_port = usin->sin6_port;
 217                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 218
 219                 icsk->icsk_af_ops = &ipv6_mapped;
 220                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 221 #ifdef CONFIG_TCP_MD5SIG
 222                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 223 #endif
 224
 225                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 226
 227                 if (err) {
 228                         icsk->icsk_ext_hdr_len = exthdrlen;
 229                         icsk->icsk_af_ops = &ipv6_specific;
 230                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 231 #ifdef CONFIG_TCP_MD5SIG
 232                         tp->af_specific = &tcp_sock_ipv6_specific;
 233 #endif
 234                         goto failure;
 235                 } else {
 236                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 237                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 238                                                &np->rcv_saddr);
 239                 }
 240
 241                 return err;
 242         }
 243
 244         if (!ipv6_addr_any(&np->rcv_saddr))
 245                 saddr = &np->rcv_saddr;
 246
 247         fl6.flowi6_proto = IPPROTO_TCP;
 248         ipv6_addr_copy(&fl6.daddr, &np->daddr);
 249         ipv6_addr_copy(&fl6.saddr,
 250                        (saddr ? saddr : &np->saddr));
 251         fl6.flowi6_oif = sk->sk_bound_dev_if;
 252         fl6.flowi6_mark = sk->sk_mark;
 253         fl6.fl6_dport = usin->sin6_port;
 254         fl6.fl6_sport = inet->inet_sport;
 255
 256         opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
 257         final_p = fl6_update_dst(&fl6, opt, &final);
 258
 259         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 260
 261         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 262         if (IS_ERR(dst)) {
 263                 err = PTR_ERR(dst);
 264                 goto failure;
 265         }
 266
 267         if (saddr == NULL) {
 268                 saddr = &fl6.saddr;
 269                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 270         }
 271
 272         /* set the source address */
 273         ipv6_addr_copy(&np->saddr, saddr);
 274         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 275
 276         sk->sk_gso_type = SKB_GSO_TCPV6;
 277         __ip6_dst_store(sk, dst, NULL, NULL);
 278
 279         rt = (struct rt6_info *) dst;
 280         if (tcp_death_row.sysctl_tw_recycle &&
 281             !tp->rx_opt.ts_recent_stamp &&
 282             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
 283                 struct inet_peer *peer = rt6_get_peer(rt);
 284                 /*
 285                  * VJ's idea. We save last timestamp seen from
 286                  * the destination in peer table, when entering state
 287                  * TIME-WAIT * and initialize rx_opt.ts_recent from it,
 288                  * when trying new connection.
 289                  */
 290                 if (peer) {
 291                         inet_peer_refcheck(peer);
 292                         if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
 293                                 tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
 294                                 tp->rx_opt.ts_recent = peer->tcp_ts;
 295                         }
 296                 }
 297         }
 298
 299         icsk->icsk_ext_hdr_len = 0;
 300         if (opt)
 301                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 302                                          opt->opt_nflen;
 303
 304         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 305
 306         inet->inet_dport = usin->sin6_port;
 307
 308         tcp_set_state(sk, TCP_SYN_SENT);
 309         err = inet6_hash_connect(&tcp_death_row, sk);
 310         if (err)
 311                 goto late_failure;
 312
 313         if (!tp->write_seq)
 314                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 315                                                              np->daddr.s6_addr32,
 316                                                              inet->inet_sport,
 317                                                              inet->inet_dport);
 318
 319         err = tcp_connect(sk);
 320         if (err)
 321                 goto late_failure;
 322
 323         return 0;
 324
 325 late_failure:
 326         tcp_set_state(sk, TCP_CLOSE);
 327         __sk_dst_reset(sk);
 328 failure:
 329         inet->inet_dport = 0;
 330         sk->sk_route_caps = 0;
 331         return err;
 332 }
 333
 334 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 335                 u8 type, u8 code, int offset, __be32 info)
 336 {
 337         const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 338         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 339         struct ipv6_pinfo *np;
 340         struct sock *sk;
 341         int err;
 342         struct tcp_sock *tp;
 343         __u32 seq;
 344         struct net *net = dev_net(skb->dev);
 345
 346         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 347                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 348
 349         if (sk == NULL) {
 350                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 351                                    ICMP6_MIB_INERRORS);
 352                 return;
 353         }
 354
 355         if (sk->sk_state == TCP_TIME_WAIT) {
 356                 inet_twsk_put(inet_twsk(sk));
 357                 return;
 358         }
 359
 360         bh_lock_sock(sk);
 361         if (sock_owned_by_user(sk))
 362                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 363
 364         if (sk->sk_state == TCP_CLOSE)
 365                 goto out;
 366
 367         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 368                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 369                 goto out;
 370         }
 371
 372         tp = tcp_sk(sk);
 373         seq = ntohl(th->seq);
 374         if (sk->sk_state != TCP_LISTEN &&
 375             !between(seq, tp->snd_una, tp->snd_nxt)) {
 376                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 377                 goto out;
 378         }
 379
 380         np = inet6_sk(sk);
 381
 382         if (type == ICMPV6_PKT_TOOBIG) {
 383                 struct dst_entry *dst;
 384
 385                 if (sock_owned_by_user(sk))
 386                         goto out;
 387                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 388                         goto out;
 389
 390                 /* icmp should have updated the destination cache entry */
 391                 dst = __sk_dst_check(sk, np->dst_cookie);
 392
 393                 if (dst == NULL) {
 394                         struct inet_sock *inet = inet_sk(sk);
 395                         struct flowi6 fl6;
 396
 397                         /* BUGGG_FUTURE: Again, it is not clear how
 398                            to handle rthdr case. Ignore this complexity
 399                            for now.
 400                          */
 401                         memset(&fl6, 0, sizeof(fl6));
 402                         fl6.flowi6_proto = IPPROTO_TCP;
 403                         ipv6_addr_copy(&fl6.daddr, &np->daddr);
 404                         ipv6_addr_copy(&fl6.saddr, &np->saddr);
 405                         fl6.flowi6_oif = sk->sk_bound_dev_if;
 406                         fl6.flowi6_mark = sk->sk_mark;
 407                         fl6.fl6_dport = inet->inet_dport;
 408                         fl6.fl6_sport = inet->inet_sport;
 409                         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 410
 411                         dst = ip6_dst_lookup_flow(sk, &fl6, NULL, false);
 412                         if (IS_ERR(dst)) {
 413                                 sk->sk_err_soft = -PTR_ERR(dst);
 414                                 goto out;
 415                         }
 416
 417                 } else
 418                         dst_hold(dst);
 419
 420                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 421                         tcp_sync_mss(sk, dst_mtu(dst));
 422                         tcp_simple_retransmit(sk);
 423                 } /* else let the usual retransmit timer handle it */
 424                 dst_release(dst);
 425                 goto out;
 426         }
 427
 428         icmpv6_err_convert(type, code, &err);
 429
 430         /* Might be for an request_sock */
 431         switch (sk->sk_state) {
 432                 struct request_sock *req, **prev;
 433         case TCP_LISTEN:
 434                 if (sock_owned_by_user(sk))
 435                         goto out;
 436
 437                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 438                                            &hdr->saddr, inet6_iif(skb));
 439                 if (!req)
 440                         goto out;
 441
 442                 /* ICMPs are not backlogged, hence we cannot get
 443                  * an established socket here.
 444                  */
 445                 WARN_ON(req->sk != NULL);
 446
 447                 if (seq != tcp_rsk(req)->snt_isn) {
 448                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 449                         goto out;
 450                 }
 451
 452                 inet_csk_reqsk_queue_drop(sk, req, prev);
 453                 goto out;
 454
 455         case TCP_SYN_SENT:
 456         case TCP_SYN_RECV:  /* Cannot happen.
 457                                It can, it SYNs are crossed. --ANK */
 458                 if (!sock_owned_by_user(sk)) {
 459                         sk->sk_err = err;
 460                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 461
 462                         tcp_done(sk);
 463                 } else
 464                         sk->sk_err_soft = err;
 465                 goto out;
 466         }
 467
 468         if (!sock_owned_by_user(sk) && np->recverr) {
 469                 sk->sk_err = err;
 470                 sk->sk_error_report(sk);
 471         } else
 472                 sk->sk_err_soft = err;
 473
 474 out:
 475         bh_unlock_sock(sk);
 476         sock_put(sk);
 477 }
 478
 479
 480 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 481                               struct request_values *rvp)
 482 {
 483         struct inet6_request_sock *treq = inet6_rsk(req);
 484         struct ipv6_pinfo *np = inet6_sk(sk);
 485         struct sk_buff * skb;
 486         struct in6_addr * final_p, final;
 487         struct flowi6 fl6;
 488         struct dst_entry *dst;
 489         int err;
 490
 491         memset(&fl6, 0, sizeof(fl6));
 492         fl6.flowi6_proto = IPPROTO_TCP;
 493         ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
 494         ipv6_addr_copy(&fl6.saddr, &treq->loc_addr);
 495         fl6.flowlabel = 0;
 496         fl6.flowi6_oif = treq->iif;
 497         fl6.flowi6_mark = sk->sk_mark;
 498         fl6.fl6_dport = inet_rsk(req)->rmt_port;
 499         fl6.fl6_sport = inet_rsk(req)->loc_port;
 500         security_req_classify_flow(req, flowi6_to_flowi(&fl6));
 501
 502         final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
 503
 504         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
 505         if (IS_ERR(dst)) {
 506                 err = PTR_ERR(dst);
 507                 dst = NULL;
 508                 goto done;
 509         }
 510         skb = tcp_make_synack(sk, dst, req, rvp);
 511         err = -ENOMEM;
 512         if (skb) {
 513                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 514
 515                 ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
 516                 rcu_read_lock();
 517                 err = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt),
 518                                np->tclass);
 519                 rcu_read_unlock();
 520                 err = net_xmit_eval(err);
 521         }
 522
 523 done:
 524         dst_release(dst);
 525         return err;
 526 }
 527
 528 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 529                              struct request_values *rvp)
 530 {
 531         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 532         return tcp_v6_send_synack(sk, req, rvp);
 533 }
 534
 535 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 536 {
 537         kfree_skb(inet6_rsk(req)->pktopts);
 538 }
 539
 540 #ifdef CONFIG_TCP_MD5SIG
 541 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 542                                                    const struct in6_addr *addr)
 543 {
 544         struct tcp_sock *tp = tcp_sk(sk);
 545         int i;
 546
 547         BUG_ON(tp == NULL);
 548
 549         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 550                 return NULL;
 551
 552         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 553                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
 554                         return &tp->md5sig_info->keys6[i].base;
 555         }
 556         return NULL;
 557 }
 558
 559 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 560                                                 struct sock *addr_sk)
 561 {
 562         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 563 }
 564
 565 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 566                                                       struct request_sock *req)
 567 {
 568         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 569 }
 570
 571 static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
 572                              char *newkey, u8 newkeylen)
 573 {
 574         /* Add key to the list */
 575         struct tcp_md5sig_key *key;
 576         struct tcp_sock *tp = tcp_sk(sk);
 577         struct tcp6_md5sig_key *keys;
 578
 579         key = tcp_v6_md5_do_lookup(sk, peer);
 580         if (key) {
 581                 /* modify existing entry - just update that one */
 582                 kfree(key->key);
 583                 key->key = newkey;
 584                 key->keylen = newkeylen;
 585         } else {
 586                 /* reallocate new list if current one is full. */
 587                 if (!tp->md5sig_info) {
 588                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 589                         if (!tp->md5sig_info) {
 590                                 kfree(newkey);
 591                                 return -ENOMEM;
 592                         }
 593                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 594                 }
 595                 if (tp->md5sig_info->entries6 == 0 &&
 596                     !tcp_alloc_md5sig_pool()) {
 597                         kfree(newkey);
 598                         return -ENOMEM;
 599                 }
 600                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 601                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 602                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 603
 604                         if (!keys) {
 605                                 kfree(newkey);
 606                                 return -ENOMEM;
 607                         }
 608
 609                         if (tp->md5sig_info->entries6)
 610                                 memmove(keys, tp->md5sig_info->keys6,
 611                                         (sizeof (tp->md5sig_info->keys6[0]) *
 612                                          tp->md5sig_info->entries6));
 613
 614                         kfree(tp->md5sig_info->keys6);
 615                         tp->md5sig_info->keys6 = keys;
 616                         tp->md5sig_info->alloced6++;
 617                 }
 618
 619                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 620                                peer);
 621                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 622                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 623
 624                 tp->md5sig_info->entries6++;
 625         }
 626         return 0;
 627 }
 628
 629 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 630                                u8 *newkey, __u8 newkeylen)
 631 {
 632         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 633                                  newkey, newkeylen);
 634 }
 635
 636 static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
 637 {
 638         struct tcp_sock *tp = tcp_sk(sk);
 639         int i;
 640
 641         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 642                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
 643                         /* Free the key */
 644                         kfree(tp->md5sig_info->keys6[i].base.key);
 645                         tp->md5sig_info->entries6--;
 646
 647                         if (tp->md5sig_info->entries6 == 0) {
 648                                 kfree(tp->md5sig_info->keys6);
 649                                 tp->md5sig_info->keys6 = NULL;
 650                                 tp->md5sig_info->alloced6 = 0;
 651                         } else {
 652                                 /* shrink the database */
 653                                 if (tp->md5sig_info->entries6 != i)
 654                                         memmove(&tp->md5sig_info->keys6[i],
 655                                                 &tp->md5sig_info->keys6[i+1],
 656                                                 (tp->md5sig_info->entries6 - i)
 657                                                 * sizeof (tp->md5sig_info->keys6[0]));
 658                         }
 659                         return 0;
 660                 }
 661         }
 662         return -ENOENT;
 663 }
 664
 665 static void tcp_v6_clear_md5_list (struct sock *sk)
 666 {
 667         struct tcp_sock *tp = tcp_sk(sk);
 668         int i;
 669
 670         if (tp->md5sig_info->entries6) {
 671                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 672                         kfree(tp->md5sig_info->keys6[i].base.key);
 673                 tp->md5sig_info->entries6 = 0;
 674         }
 675
 676         kfree(tp->md5sig_info->keys6);
 677         tp->md5sig_info->keys6 = NULL;
 678         tp->md5sig_info->alloced6 = 0;
 679
 680         if (tp->md5sig_info->entries4) {
 681                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 682                         kfree(tp->md5sig_info->keys4[i].base.key);
 683                 tp->md5sig_info->entries4 = 0;
 684         }
 685
 686         kfree(tp->md5sig_info->keys4);
 687         tp->md5sig_info->keys4 = NULL;
 688         tp->md5sig_info->alloced4 = 0;
 689 }
 690
 691 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 692                                   int optlen)
 693 {
 694         struct tcp_md5sig cmd;
 695         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 696         u8 *newkey;
 697
 698         if (optlen < sizeof(cmd))
 699                 return -EINVAL;
 700
 701         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 702                 return -EFAULT;
 703
 704         if (sin6->sin6_family != AF_INET6)
 705                 return -EINVAL;
 706
 707         if (!cmd.tcpm_keylen) {
 708                 if (!tcp_sk(sk)->md5sig_info)
 709                         return -ENOENT;
 710                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 711                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 712                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 713         }
 714
 715         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 716                 return -EINVAL;
 717
 718         if (!tcp_sk(sk)->md5sig_info) {
 719                 struct tcp_sock *tp = tcp_sk(sk);
 720                 struct tcp_md5sig_info *p;
 721
 722                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 723                 if (!p)
 724                         return -ENOMEM;
 725
 726                 tp->md5sig_info = p;
 727                 sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 728         }
 729
 730         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 731         if (!newkey)
 732                 return -ENOMEM;
 733         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 734                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 735                                          newkey, cmd.tcpm_keylen);
 736         }
 737         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 738 }
 739
 740 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 741                                         const struct in6_addr *daddr,
 742                                         const struct in6_addr *saddr, int nbytes)
 743 {
 744         struct tcp6_pseudohdr *bp;
 745         struct scatterlist sg;
 746
 747         bp = &hp->md5_blk.ip6;
 748         /* 1. TCP pseudo-header (RFC2460) */
 749         ipv6_addr_copy(&bp->saddr, saddr);
 750         ipv6_addr_copy(&bp->daddr, daddr);
 751         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 752         bp->len = cpu_to_be32(nbytes);
 753
 754         sg_init_one(&sg, bp, sizeof(*bp));
 755         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 756 }
 757
 758 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 759                                const struct in6_addr *daddr, struct in6_addr *saddr,
 760                                const struct tcphdr *th)
 761 {
 762         struct tcp_md5sig_pool *hp;
 763         struct hash_desc *desc;
 764
 765         hp = tcp_get_md5sig_pool();
 766         if (!hp)
 767                 goto clear_hash_noput;
 768         desc = &hp->md5_desc;
 769
 770         if (crypto_hash_init(desc))
 771                 goto clear_hash;
 772         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 773                 goto clear_hash;
 774         if (tcp_md5_hash_header(hp, th))
 775                 goto clear_hash;
 776         if (tcp_md5_hash_key(hp, key))
 777                 goto clear_hash;
 778         if (crypto_hash_final(desc, md5_hash))
 779                 goto clear_hash;
 780
 781         tcp_put_md5sig_pool();
 782         return 0;
 783
 784 clear_hash:
 785         tcp_put_md5sig_pool();
 786 clear_hash_noput:
 787         memset(md5_hash, 0, 16);
 788         return 1;
 789 }
 790
 791 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 792                                const struct sock *sk,
 793                                const struct request_sock *req,
 794                                const struct sk_buff *skb)
 795 {
 796         const struct in6_addr *saddr, *daddr;
 797         struct tcp_md5sig_pool *hp;
 798         struct hash_desc *desc;
 799         const struct tcphdr *th = tcp_hdr(skb);
 800
 801         if (sk) {
 802                 saddr = &inet6_sk(sk)->saddr;
 803                 daddr = &inet6_sk(sk)->daddr;
 804         } else if (req) {
 805                 saddr = &inet6_rsk(req)->loc_addr;
 806                 daddr = &inet6_rsk(req)->rmt_addr;
 807         } else {
 808                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 809                 saddr = &ip6h->saddr;
 810                 daddr = &ip6h->daddr;
 811         }
 812
 813         hp = tcp_get_md5sig_pool();
 814         if (!hp)
 815                 goto clear_hash_noput;
 816         desc = &hp->md5_desc;
 817
 818         if (crypto_hash_init(desc))
 819                 goto clear_hash;
 820
 821         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 822                 goto clear_hash;
 823         if (tcp_md5_hash_header(hp, th))
 824                 goto clear_hash;
 825         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 826                 goto clear_hash;
 827         if (tcp_md5_hash_key(hp, key))
 828                 goto clear_hash;
 829         if (crypto_hash_final(desc, md5_hash))
 830                 goto clear_hash;
 831
 832         tcp_put_md5sig_pool();
 833         return 0;
 834
 835 clear_hash:
 836         tcp_put_md5sig_pool();
 837 clear_hash_noput:
 838         memset(md5_hash, 0, 16);
 839         return 1;
 840 }
 841
 842 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 843 {
 844         const __u8 *hash_location = NULL;
 845         struct tcp_md5sig_key *hash_expected;
 846         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 847         const struct tcphdr *th = tcp_hdr(skb);
 848         int genhash;
 849         u8 newhash[16];
 850
 851         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 852         hash_location = tcp_parse_md5sig_option(th);
 853
 854         /* We've parsed the options - do we have a hash? */
 855         if (!hash_expected && !hash_location)
 856                 return 0;
 857
 858         if (hash_expected && !hash_location) {
 859                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 860                 return 1;
 861         }
 862
 863         if (!hash_expected && hash_location) {
 864                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 865                 return 1;
 866         }
 867
 868         /* check the signature */
 869         genhash = tcp_v6_md5_hash_skb(newhash,
 870                                       hash_expected,
 871                                       NULL, NULL, skb);
 872
 873         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 874                 if (net_ratelimit()) {
 875                         printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 876                                genhash ? "failed" : "mismatch",
 877                                &ip6h->saddr, ntohs(th->source),
 878                                &ip6h->daddr, ntohs(th->dest));
 879                 }
 880                 return 1;
 881         }
 882         return 0;
 883 }
 884 #endif
 885
 886 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 887         .family         =       AF_INET6,
 888         .obj_size       =       sizeof(struct tcp6_request_sock),
 889         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 890         .send_ack       =       tcp_v6_reqsk_send_ack,
 891         .destructor     =       tcp_v6_reqsk_destructor,
 892         .send_reset     =       tcp_v6_send_reset,
 893         .syn_ack_timeout =      tcp_syn_ack_timeout,
 894 };
 895
 896 #ifdef CONFIG_TCP_MD5SIG
 897 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 898         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 899         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 900 };
 901 #endif
 902
 903 static void __tcp_v6_send_check(struct sk_buff *skb,
 904                                 const struct in6_addr *saddr, const struct in6_addr *daddr)
 905 {
 906         struct tcphdr *th = tcp_hdr(skb);
 907
 908         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 909                 th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
 910                 skb->csum_start = skb_transport_header(skb) - skb->head;
 911                 skb->csum_offset = offsetof(struct tcphdr, check);
 912         } else {
 913                 th->check = tcp_v6_check(skb->len, saddr, daddr,
 914                                          csum_partial(th, th->doff << 2,
 915                                                       skb->csum));
 916         }
 917 }
 918
 919 static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 920 {
 921         struct ipv6_pinfo *np = inet6_sk(sk);
 922
 923         __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
 924 }
 925
 926 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 927 {
 928         const struct ipv6hdr *ipv6h;
 929         struct tcphdr *th;
 930
 931         if (!pskb_may_pull(skb, sizeof(*th)))
 932                 return -EINVAL;
 933
 934         ipv6h = ipv6_hdr(skb);
 935         th = tcp_hdr(skb);
 936
 937         th->check = 0;
 938         skb->ip_summed = CHECKSUM_PARTIAL;
 939         __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
 940         return 0;
 941 }
 942
 943 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 944                                          struct sk_buff *skb)
 945 {
 946         const struct ipv6hdr *iph = skb_gro_network_header(skb);
 947
 948         switch (skb->ip_summed) {
 949         case CHECKSUM_COMPLETE:
 950                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
 951                                   skb->csum)) {
 952                         skb->ip_summed = CHECKSUM_UNNECESSARY;
 953                         break;
 954                 }
 955
 956                 /* fall through */
 957         case CHECKSUM_NONE:
 958                 NAPI_GRO_CB(skb)->flush = 1;
 959                 return NULL;
 960         }
 961
 962         return tcp_gro_receive(head, skb);
 963 }
 964
 965 static int tcp6_gro_complete(struct sk_buff *skb)
 966 {
 967         const struct ipv6hdr *iph = ipv6_hdr(skb);
 968         struct tcphdr *th = tcp_hdr(skb);
 969
 970         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
 971                                   &iph->saddr, &iph->daddr, 0);
 972         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
 973
 974         return tcp_gro_complete(skb);
 975 }
 976
 977 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 978                                  u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
 979 {
 980         const struct tcphdr *th = tcp_hdr(skb);
 981         struct tcphdr *t1;
 982         struct sk_buff *buff;
 983         struct flowi6 fl6;
 984         struct net *net = dev_net(skb_dst(skb)->dev);
 985         struct sock *ctl_sk = net->ipv6.tcp_sk;
 986         unsigned int tot_len = sizeof(struct tcphdr);
 987         struct dst_entry *dst;
 988         __be32 *topt;
 989
 990         if (ts)
 991                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 992 #ifdef CONFIG_TCP_MD5SIG
 993         if (key)
 994                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 995 #endif
 996
 997         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 998                          GFP_ATOMIC);
 999         if (buff == NULL)
1000                 return;
1001
1002         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1003
1004         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1005         skb_reset_transport_header(buff);
1006
1007         /* Swap the send and the receive. */
1008         memset(t1, 0, sizeof(*t1));
1009         t1->dest = th->source;
1010         t1->source = th->dest;
1011         t1->doff = tot_len / 4;
1012         t1->seq = htonl(seq);
1013         t1->ack_seq = htonl(ack);
1014         t1->ack = !rst || !th->ack;
1015         t1->rst = rst;
1016         t1->window = htons(win);
1017
1018         topt = (__be32 *)(t1 + 1);
1019
1020         if (ts) {
1021                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1022                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1023                 *topt++ = htonl(tcp_time_stamp);
1024                 *topt++ = htonl(ts);
1025         }
1026
1027 #ifdef CONFIG_TCP_MD5SIG
1028         if (key) {
1029                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1030                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1031                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
1032                                     &ipv6_hdr(skb)->saddr,
1033                                     &ipv6_hdr(skb)->daddr, t1);
1034         }
1035 #endif
1036
1037         memset(&fl6, 0, sizeof(fl6));
1038         ipv6_addr_copy(&fl6.daddr, &ipv6_hdr(skb)->saddr);
1039         ipv6_addr_copy(&fl6.saddr, &ipv6_hdr(skb)->daddr);
1040
1041         buff->ip_summed = CHECKSUM_PARTIAL;
1042         buff->csum = 0;
1043
1044         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
1045
1046         fl6.flowi6_proto = IPPROTO_TCP;
1047         if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
1048                 fl6.flowi6_oif = inet6_iif(skb);
1049         fl6.fl6_dport = t1->dest;
1050         fl6.fl6_sport = t1->source;
1051         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
1052
1053         /* Pass a socket to ip6_dst_lookup either it is for RST
1054          * Underlying function will use this to retrieve the network
1055          * namespace
1056          */
1057         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
1058         if (!IS_ERR(dst)) {
1059                 skb_dst_set(buff, dst);
1060                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
1061                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
1062                 if (rst)
1063                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
1064                 return;
1065         }
1066
1067         kfree_skb(buff);
1068 }
1069
1070 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
1071 {
1072         const struct tcphdr *th = tcp_hdr(skb);
1073         u32 seq = 0, ack_seq = 0;
1074         struct tcp_md5sig_key *key = NULL;
1075
1076         if (th->rst)
1077                 return;
1078
1079         if (!ipv6_unicast_destination(skb))
1080                 return;
1081
1082 #ifdef CONFIG_TCP_MD5SIG
1083         if (sk)
1084                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
1085 #endif
1086
1087         if (th->ack)
1088                 seq = ntohl(th->ack_seq);
1089         else
1090                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
1091                           (th->doff << 2);
1092
1093         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
1094 }
1095
1096 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
1097                             struct tcp_md5sig_key *key, u8 tclass)
1098 {
1099         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
1100 }
1101
1102 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1103 {
1104         struct inet_timewait_sock *tw = inet_twsk(sk);
1105         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1106
1107         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1108                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1109                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
1110                         tw->tw_tclass);
1111
1112         inet_twsk_put(tw);
1113 }
1114
1115 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1116                                   struct request_sock *req)
1117 {
1118         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1119                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
1120 }
1121
1122
1123 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1124 {
1125         struct request_sock *req, **prev;
1126         const struct tcphdr *th = tcp_hdr(skb);
1127         struct sock *nsk;
1128
1129         /* Find possible connection requests. */
1130         req = inet6_csk_search_req(sk, &prev, th->source,
1131                                    &ipv6_hdr(skb)->saddr,
1132                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1133         if (req)
1134                 return tcp_check_req(sk, skb, req, prev);
1135
1136         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1137                         &ipv6_hdr(skb)->saddr, th->source,
1138                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1139
1140         if (nsk) {
1141                 if (nsk->sk_state != TCP_TIME_WAIT) {
1142                         bh_lock_sock(nsk);
1143                         return nsk;
1144                 }
1145                 inet_twsk_put(inet_twsk(nsk));
1146                 return NULL;
1147         }
1148
1149 #ifdef CONFIG_SYN_COOKIES
1150         if (!th->syn)
1151                 sk = cookie_v6_check(sk, skb);
1152 #endif
1153         return sk;
1154 }
1155
1156 /* FIXME: this is substantially similar to the ipv4 code.
1157  * Can some kind of merge be done? -- erics
1158  */
1159 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1160 {
1161         struct tcp_extend_values tmp_ext;
1162         struct tcp_options_received tmp_opt;
1163         const u8 *hash_location;
1164         struct request_sock *req;
1165         struct inet6_request_sock *treq;
1166         struct ipv6_pinfo *np = inet6_sk(sk);
1167         struct tcp_sock *tp = tcp_sk(sk);
1168         __u32 isn = TCP_SKB_CB(skb)->when;
1169         struct dst_entry *dst = NULL;
1170         int want_cookie = 0;
1171
1172         if (skb->protocol == htons(ETH_P_IP))
1173                 return tcp_v4_conn_request(sk, skb);
1174
1175         if (!ipv6_unicast_destination(skb))
1176                 goto drop;
1177
1178         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1179                 want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
1180                 if (!want_cookie)
1181                         goto drop;
1182         }
1183
1184         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1185                 goto drop;
1186
1187         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1188         if (req == NULL)
1189                 goto drop;
1190
1191 #ifdef CONFIG_TCP_MD5SIG
1192         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1193 #endif
1194
1195         tcp_clear_options(&tmp_opt);
1196         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1197         tmp_opt.user_mss = tp->rx_opt.user_mss;
1198         tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1199
1200         if (tmp_opt.cookie_plus > 0 &&
1201             tmp_opt.saw_tstamp &&
1202             !tp->rx_opt.cookie_out_never &&
1203             (sysctl_tcp_cookie_size > 0 ||
1204              (tp->cookie_values != NULL &&
1205               tp->cookie_values->cookie_desired > 0))) {
1206                 u8 *c;
1207                 u32 *d;
1208                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1209                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1210
1211                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1212                         goto drop_and_free;
1213
1214                 /* Secret recipe starts with IP addresses */
1215                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1216                 *mess++ ^= *d++;
1217                 *mess++ ^= *d++;
1218                 *mess++ ^= *d++;
1219                 *mess++ ^= *d++;
1220                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1221                 *mess++ ^= *d++;
1222                 *mess++ ^= *d++;
1223                 *mess++ ^= *d++;
1224                 *mess++ ^= *d++;
1225
1226                 /* plus variable length Initiator Cookie */
1227                 c = (u8 *)mess;
1228                 while (l-- > 0)
1229                         *c++ ^= *hash_location++;
1230
1231                 want_cookie = 0;        /* not our kind of cookie */
1232                 tmp_ext.cookie_out_never = 0; /* false */
1233                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1234         } else if (!tp->rx_opt.cookie_in_always) {
1235                 /* redundant indications, but ensure initialization. */
1236                 tmp_ext.cookie_out_never = 1; /* true */
1237                 tmp_ext.cookie_plus = 0;
1238         } else {
1239                 goto drop_and_free;
1240         }
1241         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1242
1243         if (want_cookie && !tmp_opt.saw_tstamp)
1244                 tcp_clear_options(&tmp_opt);
1245
1246         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1247         tcp_openreq_init(req, &tmp_opt, skb);
1248
1249         treq = inet6_rsk(req);
1250         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1251         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1252         if (!want_cookie || tmp_opt.tstamp_ok)
1253                 TCP_ECN_create_request(req, skb);
1254
1255         treq->iif = sk->sk_bound_dev_if;
1256
1257         /* So that link locals have meaning */
1258         if (!sk->sk_bound_dev_if &&
1259             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1260                 treq->iif = inet6_iif(skb);
1261
1262         if (!isn) {
1263                 struct inet_peer *peer = NULL;
1264
1265                 if (ipv6_opt_accepted(sk, skb) ||
1266                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1267                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1268                         atomic_inc(&skb->users);
1269                         treq->pktopts = skb;
1270                 }
1271
1272                 if (want_cookie) {
1273                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1274                         req->cookie_ts = tmp_opt.tstamp_ok;
1275                         goto have_isn;
1276                 }
1277
1278                 /* VJ's idea. We save last timestamp seen
1279                  * from the destination in peer table, when entering
1280                  * state TIME-WAIT, and check against it before
1281                  * accepting new connection request.
1282                  *
1283                  * If "isn" is not zero, this request hit alive
1284                  * timewait bucket, so that all the necessary checks
1285                  * are made in the function processing timewait state.
1286                  */
1287                 if (tmp_opt.saw_tstamp &&
1288                     tcp_death_row.sysctl_tw_recycle &&
1289                     (dst = inet6_csk_route_req(sk, req)) != NULL &&
1290                     (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
1291                     ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
1292                                     &treq->rmt_addr)) {
1293                         inet_peer_refcheck(peer);
1294                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1295                             (s32)(peer->tcp_ts - req->ts_recent) >
1296                                                         TCP_PAWS_WINDOW) {
1297                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1298                                 goto drop_and_release;
1299                         }
1300                 }
1301                 /* Kill the following clause, if you dislike this way. */
1302                 else if (!sysctl_tcp_syncookies &&
1303                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1304                           (sysctl_max_syn_backlog >> 2)) &&
1305                          (!peer || !peer->tcp_ts_stamp) &&
1306                          (!dst || !dst_metric(dst, RTAX_RTT))) {
1307                         /* Without syncookies last quarter of
1308                          * backlog is filled with destinations,
1309                          * proven to be alive.
1310                          * It means that we continue to communicate
1311                          * to destinations, already remembered
1312                          * to the moment of synflood.
1313                          */
1314                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1315                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1316                         goto drop_and_release;
1317                 }
1318
1319                 isn = tcp_v6_init_sequence(skb);
1320         }
1321 have_isn:
1322         tcp_rsk(req)->snt_isn = isn;
1323         tcp_rsk(req)->snt_synack = tcp_time_stamp;
1324
1325         security_inet_conn_request(sk, skb, req);
1326
1327         if (tcp_v6_send_synack(sk, req,
1328                                (struct request_values *)&tmp_ext) ||
1329             want_cookie)
1330                 goto drop_and_free;
1331
1332         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1333         return 0;
1334
1335 drop_and_release:
1336         dst_release(dst);
1337 drop_and_free:
1338         reqsk_free(req);
1339 drop:
1340         return 0; /* don't send reset */
1341 }
1342
1343 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1344                                           struct request_sock *req,
1345                                           struct dst_entry *dst)
1346 {
1347         struct inet6_request_sock *treq;
1348         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1349         struct tcp6_sock *newtcp6sk;
1350         struct inet_sock *newinet;
1351         struct tcp_sock *newtp;
1352         struct sock *newsk;
1353         struct ipv6_txoptions *opt;
1354 #ifdef CONFIG_TCP_MD5SIG
1355         struct tcp_md5sig_key *key;
1356 #endif
1357
1358         if (skb->protocol == htons(ETH_P_IP)) {
1359                 /*
1360                  *      v6 mapped
1361                  */
1362
1363                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1364
1365                 if (newsk == NULL)
1366                         return NULL;
1367
1368                 newtcp6sk = (struct tcp6_sock *)newsk;
1369                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1370
1371                 newinet = inet_sk(newsk);
1372                 newnp = inet6_sk(newsk);
1373                 newtp = tcp_sk(newsk);
1374
1375                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1376
1377                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1378
1379                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1380
1381                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1382
1383                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1384                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1385 #ifdef CONFIG_TCP_MD5SIG
1386                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1387 #endif
1388
1389                 newnp->ipv6_mc_list = NULL;
1390                 newnp->ipv6_ac_list = NULL;
1391                 newnp->ipv6_fl_list = NULL;
1392                 newnp->pktoptions  = NULL;
1393                 newnp->opt         = NULL;
1394                 newnp->mcast_oif   = inet6_iif(skb);
1395                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1396
1397                 /*
1398                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1399                  * here, tcp_create_openreq_child now does this for us, see the comment in
1400                  * that function for the gory details. -acme
1401                  */
1402
1403                 /* It is tricky place. Until this moment IPv4 tcp
1404                    worked with IPv6 icsk.icsk_af_ops.
1405                    Sync it now.
1406                  */
1407                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1408
1409                 return newsk;
1410         }
1411
1412         treq = inet6_rsk(req);
1413
1414         if (sk_acceptq_is_full(sk))
1415                 goto out_overflow;
1416
1417         if (!dst) {
1418                 dst = inet6_csk_route_req(sk, req);
1419                 if (!dst)
1420                         goto out;
1421         }
1422
1423         newsk = tcp_create_openreq_child(sk, req, skb);
1424         if (newsk == NULL)
1425                 goto out_nonewsk;
1426
1427         /*
1428          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1429          * count here, tcp_create_openreq_child now does this for us, see the
1430          * comment in that function for the gory details. -acme
1431          */
1432
1433         newsk->sk_gso_type = SKB_GSO_TCPV6;
1434         __ip6_dst_store(newsk, dst, NULL, NULL);
1435
1436         newtcp6sk = (struct tcp6_sock *)newsk;
1437         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1438
1439         newtp = tcp_sk(newsk);
1440         newinet = inet_sk(newsk);
1441         newnp = inet6_sk(newsk);
1442
1443         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1444
1445         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1446         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1447         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1448         newsk->sk_bound_dev_if = treq->iif;
1449
1450         /* Now IPv6 options...
1451
1452            First: no IPv4 options.
1453          */
1454         newinet->inet_opt = NULL;
1455         newnp->ipv6_mc_list = NULL;
1456         newnp->ipv6_ac_list = NULL;
1457         newnp->ipv6_fl_list = NULL;
1458
1459         /* Clone RX bits */
1460         newnp->rxopt.all = np->rxopt.all;
1461
1462         /* Clone pktoptions received with SYN */
1463         newnp->pktoptions = NULL;
1464         if (treq->pktopts != NULL) {
1465                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1466                 kfree_skb(treq->pktopts);
1467                 treq->pktopts = NULL;
1468                 if (newnp->pktoptions)
1469                         skb_set_owner_r(newnp->pktoptions, newsk);
1470         }
1471         newnp->opt        = NULL;
1472         newnp->mcast_oif  = inet6_iif(skb);
1473         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1474
1475         /* Clone native IPv6 options from listening socket (if any)
1476
1477            Yes, keeping reference count would be much more clever,
1478            but we make one more one thing there: reattach optmem
1479            to newsk.
1480          */
1481         opt = rcu_dereference(np->opt);
1482         if (opt) {
1483                 opt = ipv6_dup_options(newsk, opt);
1484                 RCU_INIT_POINTER(newnp->opt, opt);
1485         }
1486         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1487         if (opt)
1488                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1489                                                     opt->opt_flen;
1490
1491         tcp_mtup_init(newsk);
1492         tcp_sync_mss(newsk, dst_mtu(dst));
1493         newtp->advmss = dst_metric_advmss(dst);
1494         if (tcp_sk(sk)->rx_opt.user_mss &&
1495             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1496                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1497
1498         tcp_initialize_rcv_mss(newsk);
1499         if (tcp_rsk(req)->snt_synack)
1500                 tcp_valid_rtt_meas(newsk,
1501                     tcp_time_stamp - tcp_rsk(req)->snt_synack);
1502         newtp->total_retrans = req->retrans;
1503
1504         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1505         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1506
1507 #ifdef CONFIG_TCP_MD5SIG
1508         /* Copy over the MD5 key from the original socket */
1509         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1510                 /* We're using one, so create a matching key
1511                  * on the newsk structure. If we fail to get
1512                  * memory, then we end up not copying the key
1513                  * across. Shucks.
1514                  */
1515                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1516                 if (newkey != NULL)
1517                         tcp_v6_md5_do_add(newsk, &newnp->daddr,
1518                                           newkey, key->keylen);
1519         }
1520 #endif
1521
1522         if (__inet_inherit_port(sk, newsk) < 0) {
1523                 inet_csk_prepare_forced_close(newsk);
1524                 tcp_done(newsk);
1525                 goto out;
1526         }
1527         __inet6_hash(newsk, NULL);
1528
1529         return newsk;
1530
1531 out_overflow:
1532         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1533 out_nonewsk:
1534         dst_release(dst);
1535 out:
1536         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1537         return NULL;
1538 }
1539
1540 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1541 {
1542         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1543                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1544                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1545                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1546                         return 0;
1547                 }
1548         }
1549
1550         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1551                                               &ipv6_hdr(skb)->saddr,
1552                                               &ipv6_hdr(skb)->daddr, 0));
1553
1554         if (skb->len <= 76) {
1555                 return __skb_checksum_complete(skb);
1556         }
1557         return 0;
1558 }
1559
1560 /* The socket must have it's spinlock held when we get
1561  * here.
1562  *
1563  * We have a potential double-lock case here, so even when
1564  * doing backlog processing we use the BH locking scheme.
1565  * This is because we cannot sleep with the original spinlock
1566  * held.
1567  */
1568 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1569 {
1570         struct ipv6_pinfo *np = inet6_sk(sk);
1571         struct tcp_sock *tp;
1572         struct sk_buff *opt_skb = NULL;
1573
1574         /* Imagine: socket is IPv6. IPv4 packet arrives,
1575            goes to IPv4 receive handler and backlogged.
1576            From backlog it always goes here. Kerboom...
1577            Fortunately, tcp_rcv_established and rcv_established
1578            handle them correctly, but it is not case with
1579            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1580          */
1581
1582         if (skb->protocol == htons(ETH_P_IP))
1583                 return tcp_v4_do_rcv(sk, skb);
1584
1585 #ifdef CONFIG_TCP_MD5SIG
1586         if (tcp_v6_inbound_md5_hash (sk, skb))
1587                 goto discard;
1588 #endif
1589
1590         if (tcp_filter(sk, skb))
1591                 goto discard;
1592
1593         /*
1594          *      socket locking is here for SMP purposes as backlog rcv
1595          *      is currently called with bh processing disabled.
1596          */
1597
1598         /* Do Stevens' IPV6_PKTOPTIONS.
1599
1600            Yes, guys, it is the only place in our code, where we
1601            may make it not affecting IPv4.
1602            The rest of code is protocol independent,
1603            and I do not like idea to uglify IPv4.
1604
1605            Actually, all the idea behind IPV6_PKTOPTIONS
1606            looks not very well thought. For now we latch
1607            options, received in the last packet, enqueued
1608            by tcp. Feel free to propose better solution.
1609                                                --ANK (980728)
1610          */
1611         if (np->rxopt.all)
1612                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1613
1614         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1615                 sock_rps_save_rxhash(sk, skb);
1616                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1617                         goto reset;
1618                 if (opt_skb)
1619                         goto ipv6_pktoptions;
1620                 return 0;
1621         }
1622
1623         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1624                 goto csum_err;
1625
1626         if (sk->sk_state == TCP_LISTEN) {
1627                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1628                 if (!nsk)
1629                         goto discard;
1630
1631                 /*
1632                  * Queue it on the new socket if the new socket is active,
1633                  * otherwise we just shortcircuit this and continue with
1634                  * the new socket..
1635                  */
1636                 if(nsk != sk) {
1637                         sock_rps_save_rxhash(nsk, skb);
1638                         if (tcp_child_process(sk, nsk, skb))
1639                                 goto reset;
1640                         if (opt_skb)
1641                                 __kfree_skb(opt_skb);
1642                         return 0;
1643                 }
1644         } else
1645                 sock_rps_save_rxhash(sk, skb);
1646
1647         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1648                 goto reset;
1649         if (opt_skb)
1650                 goto ipv6_pktoptions;
1651         return 0;
1652
1653 reset:
1654         tcp_v6_send_reset(sk, skb);
1655 discard:
1656         if (opt_skb)
1657                 __kfree_skb(opt_skb);
1658         kfree_skb(skb);
1659         return 0;
1660 csum_err:
1661         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1662         goto discard;
1663
1664
1665 ipv6_pktoptions:
1666         /* Do you ask, what is it?
1667
1668            1. skb was enqueued by tcp.
1669            2. skb is added to tail of read queue, rather than out of order.
1670            3. socket is not in passive state.
1671            4. Finally, it really contains options, which user wants to receive.
1672          */
1673         tp = tcp_sk(sk);
1674         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1675             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1676                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1677                         np->mcast_oif = inet6_iif(opt_skb);
1678                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1679                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1680                 if (ipv6_opt_accepted(sk, opt_skb)) {
1681                         skb_set_owner_r(opt_skb, sk);
1682                         opt_skb = xchg(&np->pktoptions, opt_skb);
1683                 } else {
1684                         __kfree_skb(opt_skb);
1685                         opt_skb = xchg(&np->pktoptions, NULL);
1686                 }
1687         }
1688
1689         kfree_skb(opt_skb);
1690         return 0;
1691 }
1692
1693 static int tcp_v6_rcv(struct sk_buff *skb)
1694 {
1695         const struct tcphdr *th;
1696         const struct ipv6hdr *hdr;
1697         struct sock *sk;
1698         int ret;
1699         struct net *net = dev_net(skb->dev);
1700
1701         if (skb->pkt_type != PACKET_HOST)
1702                 goto discard_it;
1703
1704         /*
1705          *      Count it even if it's bad.
1706          */
1707         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1708
1709         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1710                 goto discard_it;
1711
1712         th = tcp_hdr(skb);
1713
1714         if (th->doff < sizeof(struct tcphdr)/4)
1715                 goto bad_packet;
1716         if (!pskb_may_pull(skb, th->doff*4))
1717                 goto discard_it;
1718
1719         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1720                 goto bad_packet;
1721
1722         th = tcp_hdr(skb);
1723         hdr = ipv6_hdr(skb);
1724         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1725         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1726                                     skb->len - th->doff*4);
1727         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1728         TCP_SKB_CB(skb)->when = 0;
1729         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1730         TCP_SKB_CB(skb)->sacked = 0;
1731
1732         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1733         if (!sk)
1734                 goto no_tcp_socket;
1735
1736 process:
1737         if (sk->sk_state == TCP_TIME_WAIT)
1738                 goto do_time_wait;
1739
1740         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1741                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1742                 goto discard_and_relse;
1743         }
1744
1745         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1746                 goto discard_and_relse;
1747
1748         if (tcp_filter(sk, skb))
1749                 goto discard_and_relse;
1750         th = (const struct tcphdr *)skb->data;
1751         hdr = ipv6_hdr(skb);
1752
1753         skb->dev = NULL;
1754
1755         bh_lock_sock_nested(sk);
1756         ret = 0;
1757         if (!sock_owned_by_user(sk)) {
1758 #ifdef CONFIG_NET_DMA
1759                 struct tcp_sock *tp = tcp_sk(sk);
1760                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1761                         tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
1762                 if (tp->ucopy.dma_chan)
1763                         ret = tcp_v6_do_rcv(sk, skb);
1764                 else
1765 #endif
1766                 {
1767                         if (!tcp_prequeue(sk, skb))
1768                                 ret = tcp_v6_do_rcv(sk, skb);
1769                 }
1770         } else if (unlikely(sk_add_backlog(sk, skb))) {
1771                 bh_unlock_sock(sk);
1772                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1773                 goto discard_and_relse;
1774         }
1775         bh_unlock_sock(sk);
1776
1777         sock_put(sk);
1778         return ret ? -1 : 0;
1779
1780 no_tcp_socket:
1781         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1782                 goto discard_it;
1783
1784         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1785 bad_packet:
1786                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1787         } else {
1788                 tcp_v6_send_reset(NULL, skb);
1789         }
1790
1791 discard_it:
1792
1793         /*
1794          *      Discard frame
1795          */
1796
1797         kfree_skb(skb);
1798         return 0;
1799
1800 discard_and_relse:
1801         sock_put(sk);
1802         goto discard_it;
1803
1804 do_time_wait:
1805         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1806                 inet_twsk_put(inet_twsk(sk));
1807                 goto discard_it;
1808         }
1809
1810         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1811                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1812                 inet_twsk_put(inet_twsk(sk));
1813                 goto discard_it;
1814         }
1815
1816         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1817         case TCP_TW_SYN:
1818         {
1819                 struct sock *sk2;
1820
1821                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1822                                             &ipv6_hdr(skb)->daddr,
1823                                             ntohs(th->dest), inet6_iif(skb));
1824                 if (sk2 != NULL) {
1825                         struct inet_timewait_sock *tw = inet_twsk(sk);
1826                         inet_twsk_deschedule(tw, &tcp_death_row);
1827                         inet_twsk_put(tw);
1828                         sk = sk2;
1829                         goto process;
1830                 }
1831                 /* Fall through to ACK */
1832         }
1833         case TCP_TW_ACK:
1834                 tcp_v6_timewait_ack(sk, skb);
1835                 break;
1836         case TCP_TW_RST:
1837                 goto no_tcp_socket;
1838         case TCP_TW_SUCCESS:;
1839         }
1840         goto discard_it;
1841 }
1842
1843 static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
1844 {
1845         struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
1846         struct ipv6_pinfo *np = inet6_sk(sk);
1847         struct inet_peer *peer;
1848
1849         if (!rt ||
1850             !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
1851                 peer = inet_getpeer_v6(&np->daddr, 1);
1852                 *release_it = true;
1853         } else {
1854                 if (!rt->rt6i_peer)
1855                         rt6_bind_peer(rt, 1);
1856                 peer = rt->rt6i_peer;
1857                 *release_it = false;
1858         }
1859
1860         return peer;
1861 }
1862
1863 static void *tcp_v6_tw_get_peer(struct sock *sk)
1864 {
1865         const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
1866         const struct inet_timewait_sock *tw = inet_twsk(sk);
1867
1868         if (tw->tw_family == AF_INET)
1869                 return tcp_v4_tw_get_peer(sk);
1870
1871         return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
1872 }
1873
1874 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1875         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1876         .twsk_unique    = tcp_twsk_unique,
1877         .twsk_destructor= tcp_twsk_destructor,
1878         .twsk_getpeer   = tcp_v6_tw_get_peer,
1879 };
1880
1881 static const struct inet_connection_sock_af_ops ipv6_specific = {
1882         .queue_xmit        = inet6_csk_xmit,
1883         .send_check        = tcp_v6_send_check,
1884         .rebuild_header    = inet6_sk_rebuild_header,
1885         .conn_request      = tcp_v6_conn_request,
1886         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1887         .get_peer          = tcp_v6_get_peer,
1888         .net_header_len    = sizeof(struct ipv6hdr),
1889         .setsockopt        = ipv6_setsockopt,
1890         .getsockopt        = ipv6_getsockopt,
1891         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1892         .sockaddr_len      = sizeof(struct sockaddr_in6),
1893         .bind_conflict     = inet6_csk_bind_conflict,
1894 #ifdef CONFIG_COMPAT
1895         .compat_setsockopt = compat_ipv6_setsockopt,
1896         .compat_getsockopt = compat_ipv6_getsockopt,
1897 #endif
1898 };
1899
1900 #ifdef CONFIG_TCP_MD5SIG
1901 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1902         .md5_lookup     =       tcp_v6_md5_lookup,
1903         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1904         .md5_add        =       tcp_v6_md5_add_func,
1905         .md5_parse      =       tcp_v6_parse_md5_keys,
1906 };
1907 #endif
1908
1909 /*
1910  *      TCP over IPv4 via INET6 API
1911  */
1912
1913 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1914         .queue_xmit        = ip_queue_xmit,
1915         .send_check        = tcp_v4_send_check,
1916         .rebuild_header    = inet_sk_rebuild_header,
1917         .conn_request      = tcp_v6_conn_request,
1918         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1919         .get_peer          = tcp_v4_get_peer,
1920         .net_header_len    = sizeof(struct iphdr),
1921         .setsockopt        = ipv6_setsockopt,
1922         .getsockopt        = ipv6_getsockopt,
1923         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1924         .sockaddr_len      = sizeof(struct sockaddr_in6),
1925         .bind_conflict     = inet6_csk_bind_conflict,
1926 #ifdef CONFIG_COMPAT
1927         .compat_setsockopt = compat_ipv6_setsockopt,
1928         .compat_getsockopt = compat_ipv6_getsockopt,
1929 #endif
1930 };
1931
1932 #ifdef CONFIG_TCP_MD5SIG
1933 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1934         .md5_lookup     =       tcp_v4_md5_lookup,
1935         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1936         .md5_add        =       tcp_v6_md5_add_func,
1937         .md5_parse      =       tcp_v6_parse_md5_keys,
1938 };
1939 #endif
1940
1941 /* NOTE: A lot of things set to zero explicitly by call to
1942  *       sk_alloc() so need not be done here.
1943  */
1944 static int tcp_v6_init_sock(struct sock *sk)
1945 {
1946         struct inet_connection_sock *icsk = inet_csk(sk);
1947         struct tcp_sock *tp = tcp_sk(sk);
1948
1949         skb_queue_head_init(&tp->out_of_order_queue);
1950         tcp_init_xmit_timers(sk);
1951         tcp_prequeue_init(tp);
1952
1953         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1954         tp->mdev = TCP_TIMEOUT_INIT;
1955
1956         /* So many TCP implementations out there (incorrectly) count the
1957          * initial SYN frame in their delayed-ACK and congestion control
1958          * algorithms that we must have the following bandaid to talk
1959          * efficiently to them.  -DaveM
1960          */
1961         tp->snd_cwnd = 2;
1962
1963         /* See draft-stevens-tcpca-spec-01 for discussion of the
1964          * initialization of these values.
1965          */
1966         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
1967         tp->snd_cwnd_clamp = ~0;
1968         tp->mss_cache = TCP_MSS_DEFAULT;
1969
1970         tp->reordering = sysctl_tcp_reordering;
1971
1972         sk->sk_state = TCP_CLOSE;
1973
1974         icsk->icsk_af_ops = &ipv6_specific;
1975         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1976         icsk->icsk_sync_mss = tcp_sync_mss;
1977         sk->sk_write_space = sk_stream_write_space;
1978         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1979
1980 #ifdef CONFIG_TCP_MD5SIG
1981         tp->af_specific = &tcp_sock_ipv6_specific;
1982 #endif
1983
1984         /* TCP Cookie Transactions */
1985         if (sysctl_tcp_cookie_size > 0) {
1986                 /* Default, cookies without s_data_payload. */
1987                 tp->cookie_values =
1988                         kzalloc(sizeof(*tp->cookie_values),
1989                                 sk->sk_allocation);
1990                 if (tp->cookie_values != NULL)
1991                         kref_init(&tp->cookie_values->kref);
1992         }
1993         /* Presumed zeroed, in order of appearance:
1994          *      cookie_in_always, cookie_out_never,
1995          *      s_data_constant, s_data_in, s_data_out
1996          */
1997         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1998         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1999
2000         local_bh_disable();
2001         percpu_counter_inc(&tcp_sockets_allocated);
2002         local_bh_enable();
2003
2004         return 0;
2005 }
2006
2007 static void tcp_v6_destroy_sock(struct sock *sk)
2008 {
2009 #ifdef CONFIG_TCP_MD5SIG
2010         /* Clean up the MD5 key list */
2011         if (tcp_sk(sk)->md5sig_info)
2012                 tcp_v6_clear_md5_list(sk);
2013 #endif
2014         tcp_v4_destroy_sock(sk);
2015         inet6_destroy_sock(sk);
2016 }
2017
2018 #ifdef CONFIG_PROC_FS
2019 /* Proc filesystem TCPv6 sock list dumping. */
2020 static void get_openreq6(struct seq_file *seq,
2021                          const struct sock *sk, struct request_sock *req, int i, int uid)
2022 {
2023         int ttd = req->expires - jiffies;
2024         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
2025         const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
2026
2027         if (ttd < 0)
2028                 ttd = 0;
2029
2030         seq_printf(seq,
2031                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2032                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2033                    i,
2034                    src->s6_addr32[0], src->s6_addr32[1],
2035                    src->s6_addr32[2], src->s6_addr32[3],
2036                    ntohs(inet_rsk(req)->loc_port),
2037                    dest->s6_addr32[0], dest->s6_addr32[1],
2038                    dest->s6_addr32[2], dest->s6_addr32[3],
2039                    ntohs(inet_rsk(req)->rmt_port),
2040                    TCP_SYN_RECV,
2041                    0,0, /* could print option size, but that is af dependent. */
2042                    1,   /* timers active (only the expire timer) */
2043                    jiffies_to_clock_t(ttd),
2044                    req->retrans,
2045                    uid,
2046                    0,  /* non standard timer */
2047                    0, /* open_requests have no inode */
2048                    0, req);
2049 }
2050
2051 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
2052 {
2053         const struct in6_addr *dest, *src;
2054         __u16 destp, srcp;
2055         int timer_active;
2056         unsigned long timer_expires;
2057         const struct inet_sock *inet = inet_sk(sp);
2058         const struct tcp_sock *tp = tcp_sk(sp);
2059         const struct inet_connection_sock *icsk = inet_csk(sp);
2060         const struct ipv6_pinfo *np = inet6_sk(sp);
2061
2062         dest  = &np->daddr;
2063         src   = &np->rcv_saddr;
2064         destp = ntohs(inet->inet_dport);
2065         srcp  = ntohs(inet->inet_sport);
2066
2067         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2068                 timer_active    = 1;
2069                 timer_expires   = icsk->icsk_timeout;
2070         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2071                 timer_active    = 4;
2072                 timer_expires   = icsk->icsk_timeout;
2073         } else if (timer_pending(&sp->sk_timer)) {
2074                 timer_active    = 2;
2075                 timer_expires   = sp->sk_timer.expires;
2076         } else {
2077                 timer_active    = 0;
2078                 timer_expires = jiffies;
2079         }
2080
2081         seq_printf(seq,
2082                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2083                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
2084                    i,
2085                    src->s6_addr32[0], src->s6_addr32[1],
2086                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2087                    dest->s6_addr32[0], dest->s6_addr32[1],
2088                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2089                    sp->sk_state,
2090                    tp->write_seq-tp->snd_una,
2091                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2092                    timer_active,
2093                    jiffies_to_clock_t(timer_expires - jiffies),
2094                    icsk->icsk_retransmits,
2095                    sock_i_uid(sp),
2096                    icsk->icsk_probes_out,
2097                    sock_i_ino(sp),
2098                    atomic_read(&sp->sk_refcnt), sp,
2099                    jiffies_to_clock_t(icsk->icsk_rto),
2100                    jiffies_to_clock_t(icsk->icsk_ack.ato),
2101                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2102                    tp->snd_cwnd,
2103                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
2104                    );
2105 }
2106
2107 static void get_timewait6_sock(struct seq_file *seq,
2108                                struct inet_timewait_sock *tw, int i)
2109 {
2110         const struct in6_addr *dest, *src;
2111         __u16 destp, srcp;
2112         const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2113         int ttd = tw->tw_ttd - jiffies;
2114
2115         if (ttd < 0)
2116                 ttd = 0;
2117
2118         dest = &tw6->tw_v6_daddr;
2119         src  = &tw6->tw_v6_rcv_saddr;
2120         destp = ntohs(tw->tw_dport);
2121         srcp  = ntohs(tw->tw_sport);
2122
2123         seq_printf(seq,
2124                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2125                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2126                    i,
2127                    src->s6_addr32[0], src->s6_addr32[1],
2128                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2129                    dest->s6_addr32[0], dest->s6_addr32[1],
2130                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2131                    tw->tw_substate, 0, 0,
2132                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2133                    atomic_read(&tw->tw_refcnt), tw);
2134 }
2135
2136 static int tcp6_seq_show(struct seq_file *seq, void *v)
2137 {
2138         struct tcp_iter_state *st;
2139
2140         if (v == SEQ_START_TOKEN) {
2141                 seq_puts(seq,
2142                          "  sl  "
2143                          "local_address                         "
2144                          "remote_address                        "
2145                          "st tx_queue rx_queue tr tm->when retrnsmt"
2146                          "   uid  timeout inode\n");
2147                 goto out;
2148         }
2149         st = seq->private;
2150
2151         switch (st->state) {
2152         case TCP_SEQ_STATE_LISTENING:
2153         case TCP_SEQ_STATE_ESTABLISHED:
2154                 get_tcp6_sock(seq, v, st->num);
2155                 break;
2156         case TCP_SEQ_STATE_OPENREQ:
2157                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2158                 break;
2159         case TCP_SEQ_STATE_TIME_WAIT:
2160                 get_timewait6_sock(seq, v, st->num);
2161                 break;
2162         }
2163 out:
2164         return 0;
2165 }
2166
2167 static const struct file_operations tcp6_afinfo_seq_fops = {
2168         .owner   = THIS_MODULE,
2169         .open    = tcp_seq_open,
2170         .read    = seq_read,
2171         .llseek  = seq_lseek,
2172         .release = seq_release_net
2173 };
2174
2175 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2176         .name           = "tcp6",
2177         .family         = AF_INET6,
2178         .seq_fops       = &tcp6_afinfo_seq_fops,
2179         .seq_ops        = {
2180                 .show           = tcp6_seq_show,
2181         },
2182 };
2183
2184 int __net_init tcp6_proc_init(struct net *net)
2185 {
2186         return tcp_proc_register(net, &tcp6_seq_afinfo);
2187 }
2188
2189 void tcp6_proc_exit(struct net *net)
2190 {
2191         tcp_proc_unregister(net, &tcp6_seq_afinfo);
2192 }
2193 #endif
2194
2195 static void tcp_v6_clear_sk(struct sock *sk, int size)
2196 {
2197         struct inet_sock *inet = inet_sk(sk);
2198
2199         /* we do not want to clear pinet6 field, because of RCU lookups */
2200         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
2201
2202         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
2203         memset(&inet->pinet6 + 1, 0, size);
2204 }
2205
2206 struct proto tcpv6_prot = {
2207         .name                   = "TCPv6",
2208         .owner                  = THIS_MODULE,
2209         .close                  = tcp_close,
2210         .connect                = tcp_v6_connect,
2211         .disconnect             = tcp_disconnect,
2212         .accept                 = inet_csk_accept,
2213         .ioctl                  = tcp_ioctl,
2214         .init                   = tcp_v6_init_sock,
2215         .destroy                = tcp_v6_destroy_sock,
2216         .shutdown               = tcp_shutdown,
2217         .setsockopt             = tcp_setsockopt,
2218         .getsockopt             = tcp_getsockopt,
2219         .recvmsg                = tcp_recvmsg,
2220         .sendmsg                = tcp_sendmsg,
2221         .sendpage               = tcp_sendpage,
2222         .backlog_rcv            = tcp_v6_do_rcv,
2223         .hash                   = tcp_v6_hash,
2224         .unhash                 = inet_unhash,
2225         .get_port               = inet_csk_get_port,
2226         .enter_memory_pressure  = tcp_enter_memory_pressure,
2227         .sockets_allocated      = &tcp_sockets_allocated,
2228         .memory_allocated       = &tcp_memory_allocated,
2229         .memory_pressure        = &tcp_memory_pressure,
2230         .orphan_count           = &tcp_orphan_count,
2231         .sysctl_mem             = sysctl_tcp_mem,
2232         .sysctl_wmem            = sysctl_tcp_wmem,
2233         .sysctl_rmem            = sysctl_tcp_rmem,
2234         .max_header             = MAX_TCP_HEADER,
2235         .obj_size               = sizeof(struct tcp6_sock),
2236         .slab_flags             = SLAB_DESTROY_BY_RCU,
2237         .twsk_prot              = &tcp6_timewait_sock_ops,
2238         .rsk_prot               = &tcp6_request_sock_ops,
2239         .h.hashinfo             = &tcp_hashinfo,
2240         .no_autobind            = true,
2241 #ifdef CONFIG_COMPAT
2242         .compat_setsockopt      = compat_tcp_setsockopt,
2243         .compat_getsockopt      = compat_tcp_getsockopt,
2244 #endif
2245         .clear_sk               = tcp_v6_clear_sk,
2246 };
2247
2248 static const struct inet6_protocol tcpv6_protocol = {
2249         .handler        =       tcp_v6_rcv,
2250         .err_handler    =       tcp_v6_err,
2251         .gso_send_check =       tcp_v6_gso_send_check,
2252         .gso_segment    =       tcp_tso_segment,
2253         .gro_receive    =       tcp6_gro_receive,
2254         .gro_complete   =       tcp6_gro_complete,
2255         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2256 };
2257
2258 static struct inet_protosw tcpv6_protosw = {
2259         .type           =       SOCK_STREAM,
2260         .protocol       =       IPPROTO_TCP,
2261         .prot           =       &tcpv6_prot,
2262         .ops            =       &inet6_stream_ops,
2263         .no_check       =       0,
2264         .flags          =       INET_PROTOSW_PERMANENT |
2265                                 INET_PROTOSW_ICSK,
2266 };
2267
2268 static int __net_init tcpv6_net_init(struct net *net)
2269 {
2270         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2271                                     SOCK_RAW, IPPROTO_TCP, net);
2272 }
2273
2274 static void __net_exit tcpv6_net_exit(struct net *net)
2275 {
2276         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2277 }
2278
2279 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2280 {
2281         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2282 }
2283
2284 static struct pernet_operations tcpv6_net_ops = {
2285         .init       = tcpv6_net_init,
2286         .exit       = tcpv6_net_exit,
2287         .exit_batch = tcpv6_net_exit_batch,
2288 };
2289
2290 int __init tcpv6_init(void)
2291 {
2292         int ret;
2293
2294         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2295         if (ret)
2296                 goto out;
2297
2298         /* register inet6 protocol */
2299         ret = inet6_register_protosw(&tcpv6_protosw);
2300         if (ret)
2301                 goto out_tcpv6_protocol;
2302
2303         ret = register_pernet_subsys(&tcpv6_net_ops);
2304         if (ret)
2305                 goto out_tcpv6_protosw;
2306 out:
2307         return ret;
2308
2309 out_tcpv6_protocol:
2310         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2311 out_tcpv6_protosw:
2312         inet6_unregister_protosw(&tcpv6_protosw);
2313         goto out;
2314 }
2315
2316 void tcpv6_exit(void)
2317 {
2318         unregister_pernet_subsys(&tcpv6_net_ops);
2319         inet6_unregister_protosw(&tcpv6_protosw);
2320         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2321 }