net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/net.h>
  34 #include <linux/jiffies.h>
  35 #include <linux/in.h>
  36 #include <linux/in6.h>
  37 #include <linux/netdevice.h>
  38 #include <linux/init.h>
  39 #include <linux/jhash.h>
  40 #include <linux/ipsec.h>
  41 #include <linux/times.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63
  64 #include <asm/uaccess.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <linux/crypto.h>
  70 #include <linux/scatterlist.h>
  71
  72 /* Socket used for sending RSTs and ACKs */
  73 static struct socket *tcp6_socket;
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
  77 static void     tcp_v6_send_check(struct sock *sk, int len,
  78                                   struct sk_buff *skb);
  79
  80 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  81
  82 static struct inet_connection_sock_af_ops ipv6_mapped;
  83 static struct inet_connection_sock_af_ops ipv6_specific;
  84 #ifdef CONFIG_TCP_MD5SIG
  85 static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  86 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  87 #endif
  88
  89 static void tcp_v6_hash(struct sock *sk)
  90 {
  91         if (sk->sk_state != TCP_CLOSE) {
  92                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  93                         tcp_prot.hash(sk);
  94                         return;
  95                 }
  96                 local_bh_disable();
  97                 __inet6_hash(sk);
  98                 local_bh_enable();
  99         }
 100 }
 101
 102 static __inline__ __sum16 tcp_v6_check(struct tcphdr *th, int len,
 103                                    struct in6_addr *saddr,
 104                                    struct in6_addr *daddr,
 105                                    __wsum base)
 106 {
 107         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 108 }
 109
 110 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 111 {
 112         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 113                                             ipv6_hdr(skb)->saddr.s6_addr32,
 114                                             tcp_hdr(skb)->dest,
 115                                             tcp_hdr(skb)->source);
 116 }
 117
 118 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 119                           int addr_len)
 120 {
 121         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 122         struct inet_sock *inet = inet_sk(sk);
 123         struct inet_connection_sock *icsk = inet_csk(sk);
 124         struct ipv6_pinfo *np = inet6_sk(sk);
 125         struct tcp_sock *tp = tcp_sk(sk);
 126         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 127         struct flowi fl;
 128         struct dst_entry *dst;
 129         int addr_type;
 130         int err;
 131
 132         if (addr_len < SIN6_LEN_RFC2133)
 133                 return -EINVAL;
 134
 135         if (usin->sin6_family != AF_INET6)
 136                 return(-EAFNOSUPPORT);
 137
 138         memset(&fl, 0, sizeof(fl));
 139
 140         if (np->sndflow) {
 141                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 142                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 143                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 144                         struct ip6_flowlabel *flowlabel;
 145                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 146                         if (flowlabel == NULL)
 147                                 return -EINVAL;
 148                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 149                         fl6_sock_release(flowlabel);
 150                 }
 151         }
 152
 153         /*
 154          *      connect() to INADDR_ANY means loopback (BSD'ism).
 155          */
 156
 157         if(ipv6_addr_any(&usin->sin6_addr))
 158                 usin->sin6_addr.s6_addr[15] = 0x1;
 159
 160         addr_type = ipv6_addr_type(&usin->sin6_addr);
 161
 162         if(addr_type & IPV6_ADDR_MULTICAST)
 163                 return -ENETUNREACH;
 164
 165         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 166                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 167                     usin->sin6_scope_id) {
 168                         /* If interface is set while binding, indices
 169                          * must coincide.
 170                          */
 171                         if (sk->sk_bound_dev_if &&
 172                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 173                                 return -EINVAL;
 174
 175                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 176                 }
 177
 178                 /* Connect to link-local address requires an interface */
 179                 if (!sk->sk_bound_dev_if)
 180                         return -EINVAL;
 181         }
 182
 183         if (tp->rx_opt.ts_recent_stamp &&
 184             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 185                 tp->rx_opt.ts_recent = 0;
 186                 tp->rx_opt.ts_recent_stamp = 0;
 187                 tp->write_seq = 0;
 188         }
 189
 190         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 191         np->flow_label = fl.fl6_flowlabel;
 192
 193         /*
 194          *      TCP over IPv4
 195          */
 196
 197         if (addr_type == IPV6_ADDR_MAPPED) {
 198                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 199                 struct sockaddr_in sin;
 200
 201                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 202
 203                 if (__ipv6_only_sock(sk))
 204                         return -ENETUNREACH;
 205
 206                 sin.sin_family = AF_INET;
 207                 sin.sin_port = usin->sin6_port;
 208                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 209
 210                 icsk->icsk_af_ops = &ipv6_mapped;
 211                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 212 #ifdef CONFIG_TCP_MD5SIG
 213                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 214 #endif
 215
 216                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 217
 218                 if (err) {
 219                         icsk->icsk_ext_hdr_len = exthdrlen;
 220                         icsk->icsk_af_ops = &ipv6_specific;
 221                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                         tp->af_specific = &tcp_sock_ipv6_specific;
 224 #endif
 225                         goto failure;
 226                 } else {
 227                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 228                                       inet->saddr);
 229                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 230                                       inet->rcv_saddr);
 231                 }
 232
 233                 return err;
 234         }
 235
 236         if (!ipv6_addr_any(&np->rcv_saddr))
 237                 saddr = &np->rcv_saddr;
 238
 239         fl.proto = IPPROTO_TCP;
 240         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 241         ipv6_addr_copy(&fl.fl6_src,
 242                        (saddr ? saddr : &np->saddr));
 243         fl.oif = sk->sk_bound_dev_if;
 244         fl.fl_ip_dport = usin->sin6_port;
 245         fl.fl_ip_sport = inet->sport;
 246
 247         if (np->opt && np->opt->srcrt) {
 248                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 249                 ipv6_addr_copy(&final, &fl.fl6_dst);
 250                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 251                 final_p = &final;
 252         }
 253
 254         security_sk_classify_flow(sk, &fl);
 255
 256         err = ip6_dst_lookup(sk, &dst, &fl);
 257         if (err)
 258                 goto failure;
 259         if (final_p)
 260                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 261
 262         if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
 263                 if (err == -EREMOTE)
 264                         err = ip6_dst_blackhole(sk, &dst, &fl);
 265                 if (err < 0)
 266                         goto failure;
 267         }
 268
 269         if (saddr == NULL) {
 270                 saddr = &fl.fl6_src;
 271                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 272         }
 273
 274         /* set the source address */
 275         ipv6_addr_copy(&np->saddr, saddr);
 276         inet->rcv_saddr = LOOPBACK4_IPV6;
 277
 278         sk->sk_gso_type = SKB_GSO_TCPV6;
 279         __ip6_dst_store(sk, dst, NULL, NULL);
 280
 281         icsk->icsk_ext_hdr_len = 0;
 282         if (np->opt)
 283                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 284                                           np->opt->opt_nflen);
 285
 286         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 287
 288         inet->dport = usin->sin6_port;
 289
 290         tcp_set_state(sk, TCP_SYN_SENT);
 291         err = inet6_hash_connect(&tcp_death_row, sk);
 292         if (err)
 293                 goto late_failure;
 294
 295         if (!tp->write_seq)
 296                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 297                                                              np->daddr.s6_addr32,
 298                                                              inet->sport,
 299                                                              inet->dport);
 300
 301         err = tcp_connect(sk);
 302         if (err)
 303                 goto late_failure;
 304
 305         return 0;
 306
 307 late_failure:
 308         tcp_set_state(sk, TCP_CLOSE);
 309         __sk_dst_reset(sk);
 310 failure:
 311         inet->dport = 0;
 312         sk->sk_route_caps = 0;
 313         return err;
 314 }
 315
 316 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 317                 int type, int code, int offset, __be32 info)
 318 {
 319         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 320         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 321         struct ipv6_pinfo *np;
 322         struct sock *sk;
 323         int err;
 324         struct tcp_sock *tp;
 325         __u32 seq;
 326
 327         sk = inet6_lookup(skb->dev->nd_net, &tcp_hashinfo, &hdr->daddr,
 328                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 329
 330         if (sk == NULL) {
 331                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 332                 return;
 333         }
 334
 335         if (sk->sk_state == TCP_TIME_WAIT) {
 336                 inet_twsk_put(inet_twsk(sk));
 337                 return;
 338         }
 339
 340         bh_lock_sock(sk);
 341         if (sock_owned_by_user(sk))
 342                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 343
 344         if (sk->sk_state == TCP_CLOSE)
 345                 goto out;
 346
 347         tp = tcp_sk(sk);
 348         seq = ntohl(th->seq);
 349         if (sk->sk_state != TCP_LISTEN &&
 350             !between(seq, tp->snd_una, tp->snd_nxt)) {
 351                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 352                 goto out;
 353         }
 354
 355         np = inet6_sk(sk);
 356
 357         if (type == ICMPV6_PKT_TOOBIG) {
 358                 struct dst_entry *dst = NULL;
 359
 360                 if (sock_owned_by_user(sk))
 361                         goto out;
 362                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 363                         goto out;
 364
 365                 /* icmp should have updated the destination cache entry */
 366                 dst = __sk_dst_check(sk, np->dst_cookie);
 367
 368                 if (dst == NULL) {
 369                         struct inet_sock *inet = inet_sk(sk);
 370                         struct flowi fl;
 371
 372                         /* BUGGG_FUTURE: Again, it is not clear how
 373                            to handle rthdr case. Ignore this complexity
 374                            for now.
 375                          */
 376                         memset(&fl, 0, sizeof(fl));
 377                         fl.proto = IPPROTO_TCP;
 378                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 379                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 380                         fl.oif = sk->sk_bound_dev_if;
 381                         fl.fl_ip_dport = inet->dport;
 382                         fl.fl_ip_sport = inet->sport;
 383                         security_skb_classify_flow(skb, &fl);
 384
 385                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 386                                 sk->sk_err_soft = -err;
 387                                 goto out;
 388                         }
 389
 390                         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 391                                 sk->sk_err_soft = -err;
 392                                 goto out;
 393                         }
 394
 395                 } else
 396                         dst_hold(dst);
 397
 398                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 399                         tcp_sync_mss(sk, dst_mtu(dst));
 400                         tcp_simple_retransmit(sk);
 401                 } /* else let the usual retransmit timer handle it */
 402                 dst_release(dst);
 403                 goto out;
 404         }
 405
 406         icmpv6_err_convert(type, code, &err);
 407
 408         /* Might be for an request_sock */
 409         switch (sk->sk_state) {
 410                 struct request_sock *req, **prev;
 411         case TCP_LISTEN:
 412                 if (sock_owned_by_user(sk))
 413                         goto out;
 414
 415                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 416                                            &hdr->saddr, inet6_iif(skb));
 417                 if (!req)
 418                         goto out;
 419
 420                 /* ICMPs are not backlogged, hence we cannot get
 421                  * an established socket here.
 422                  */
 423                 BUG_TRAP(req->sk == NULL);
 424
 425                 if (seq != tcp_rsk(req)->snt_isn) {
 426                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 427                         goto out;
 428                 }
 429
 430                 inet_csk_reqsk_queue_drop(sk, req, prev);
 431                 goto out;
 432
 433         case TCP_SYN_SENT:
 434         case TCP_SYN_RECV:  /* Cannot happen.
 435                                It can, it SYNs are crossed. --ANK */
 436                 if (!sock_owned_by_user(sk)) {
 437                         sk->sk_err = err;
 438                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 439
 440                         tcp_done(sk);
 441                 } else
 442                         sk->sk_err_soft = err;
 443                 goto out;
 444         }
 445
 446         if (!sock_owned_by_user(sk) && np->recverr) {
 447                 sk->sk_err = err;
 448                 sk->sk_error_report(sk);
 449         } else
 450                 sk->sk_err_soft = err;
 451
 452 out:
 453         bh_unlock_sock(sk);
 454         sock_put(sk);
 455 }
 456
 457
 458 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
 459 {
 460         struct inet6_request_sock *treq = inet6_rsk(req);
 461         struct ipv6_pinfo *np = inet6_sk(sk);
 462         struct sk_buff * skb;
 463         struct ipv6_txoptions *opt = NULL;
 464         struct in6_addr * final_p = NULL, final;
 465         struct flowi fl;
 466         struct dst_entry *dst;
 467         int err = -1;
 468
 469         memset(&fl, 0, sizeof(fl));
 470         fl.proto = IPPROTO_TCP;
 471         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 472         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 473         fl.fl6_flowlabel = 0;
 474         fl.oif = treq->iif;
 475         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 476         fl.fl_ip_sport = inet_sk(sk)->sport;
 477         security_req_classify_flow(req, &fl);
 478
 479         opt = np->opt;
 480         if (opt && opt->srcrt) {
 481                 struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 482                 ipv6_addr_copy(&final, &fl.fl6_dst);
 483                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 484                 final_p = &final;
 485         }
 486
 487         err = ip6_dst_lookup(sk, &dst, &fl);
 488         if (err)
 489                 goto done;
 490         if (final_p)
 491                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 492         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 493                 goto done;
 494
 495         skb = tcp_make_synack(sk, dst, req);
 496         if (skb) {
 497                 struct tcphdr *th = tcp_hdr(skb);
 498
 499                 th->check = tcp_v6_check(th, skb->len,
 500                                          &treq->loc_addr, &treq->rmt_addr,
 501                                          csum_partial((char *)th, skb->len, skb->csum));
 502
 503                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 504                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 505                 err = net_xmit_eval(err);
 506         }
 507
 508 done:
 509         if (opt && opt != np->opt)
 510                 sock_kfree_s(sk, opt, opt->tot_len);
 511         dst_release(dst);
 512         return err;
 513 }
 514
 515 static inline void syn_flood_warning(struct sk_buff *skb)
 516 {
 517 #ifdef CONFIG_SYN_COOKIES
 518         if (sysctl_tcp_syncookies)
 519                 printk(KERN_INFO
 520                        "TCPv6: Possible SYN flooding on port %d. "
 521                        "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
 522         else
 523 #endif
 524                 printk(KERN_INFO
 525                        "TCPv6: Possible SYN flooding on port %d. "
 526                        "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
 527 }
 528
 529 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 530 {
 531         if (inet6_rsk(req)->pktopts)
 532                 kfree_skb(inet6_rsk(req)->pktopts);
 533 }
 534
 535 #ifdef CONFIG_TCP_MD5SIG
 536 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 537                                                    struct in6_addr *addr)
 538 {
 539         struct tcp_sock *tp = tcp_sk(sk);
 540         int i;
 541
 542         BUG_ON(tp == NULL);
 543
 544         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 545                 return NULL;
 546
 547         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 548                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, addr) == 0)
 549                         return &tp->md5sig_info->keys6[i].base;
 550         }
 551         return NULL;
 552 }
 553
 554 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 555                                                 struct sock *addr_sk)
 556 {
 557         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 558 }
 559
 560 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 561                                                       struct request_sock *req)
 562 {
 563         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 564 }
 565
 566 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 567                              char *newkey, u8 newkeylen)
 568 {
 569         /* Add key to the list */
 570         struct tcp_md5sig_key *key;
 571         struct tcp_sock *tp = tcp_sk(sk);
 572         struct tcp6_md5sig_key *keys;
 573
 574         key = tcp_v6_md5_do_lookup(sk, peer);
 575         if (key) {
 576                 /* modify existing entry - just update that one */
 577                 kfree(key->key);
 578                 key->key = newkey;
 579                 key->keylen = newkeylen;
 580         } else {
 581                 /* reallocate new list if current one is full. */
 582                 if (!tp->md5sig_info) {
 583                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 584                         if (!tp->md5sig_info) {
 585                                 kfree(newkey);
 586                                 return -ENOMEM;
 587                         }
 588                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 589                 }
 590                 if (tcp_alloc_md5sig_pool() == NULL) {
 591                         kfree(newkey);
 592                         return -ENOMEM;
 593                 }
 594                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 595                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 596                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 597
 598                         if (!keys) {
 599                                 tcp_free_md5sig_pool();
 600                                 kfree(newkey);
 601                                 return -ENOMEM;
 602                         }
 603
 604                         if (tp->md5sig_info->entries6)
 605                                 memmove(keys, tp->md5sig_info->keys6,
 606                                         (sizeof (tp->md5sig_info->keys6[0]) *
 607                                          tp->md5sig_info->entries6));
 608
 609                         kfree(tp->md5sig_info->keys6);
 610                         tp->md5sig_info->keys6 = keys;
 611                         tp->md5sig_info->alloced6++;
 612                 }
 613
 614                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 615                                peer);
 616                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 617                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 618
 619                 tp->md5sig_info->entries6++;
 620         }
 621         return 0;
 622 }
 623
 624 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 625                                u8 *newkey, __u8 newkeylen)
 626 {
 627         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 628                                  newkey, newkeylen);
 629 }
 630
 631 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
 632 {
 633         struct tcp_sock *tp = tcp_sk(sk);
 634         int i;
 635
 636         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 637                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, peer) == 0) {
 638                         /* Free the key */
 639                         kfree(tp->md5sig_info->keys6[i].base.key);
 640                         tp->md5sig_info->entries6--;
 641
 642                         if (tp->md5sig_info->entries6 == 0) {
 643                                 kfree(tp->md5sig_info->keys6);
 644                                 tp->md5sig_info->keys6 = NULL;
 645                                 tp->md5sig_info->alloced6 = 0;
 646                         } else {
 647                                 /* shrink the database */
 648                                 if (tp->md5sig_info->entries6 != i)
 649                                         memmove(&tp->md5sig_info->keys6[i],
 650                                                 &tp->md5sig_info->keys6[i+1],
 651                                                 (tp->md5sig_info->entries6 - i)
 652                                                 * sizeof (tp->md5sig_info->keys6[0]));
 653                         }
 654                         tcp_free_md5sig_pool();
 655                         return 0;
 656                 }
 657         }
 658         return -ENOENT;
 659 }
 660
 661 static void tcp_v6_clear_md5_list (struct sock *sk)
 662 {
 663         struct tcp_sock *tp = tcp_sk(sk);
 664         int i;
 665
 666         if (tp->md5sig_info->entries6) {
 667                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 668                         kfree(tp->md5sig_info->keys6[i].base.key);
 669                 tp->md5sig_info->entries6 = 0;
 670                 tcp_free_md5sig_pool();
 671         }
 672
 673         kfree(tp->md5sig_info->keys6);
 674         tp->md5sig_info->keys6 = NULL;
 675         tp->md5sig_info->alloced6 = 0;
 676
 677         if (tp->md5sig_info->entries4) {
 678                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 679                         kfree(tp->md5sig_info->keys4[i].base.key);
 680                 tp->md5sig_info->entries4 = 0;
 681                 tcp_free_md5sig_pool();
 682         }
 683
 684         kfree(tp->md5sig_info->keys4);
 685         tp->md5sig_info->keys4 = NULL;
 686         tp->md5sig_info->alloced4 = 0;
 687 }
 688
 689 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 690                                   int optlen)
 691 {
 692         struct tcp_md5sig cmd;
 693         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 694         u8 *newkey;
 695
 696         if (optlen < sizeof(cmd))
 697                 return -EINVAL;
 698
 699         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 700                 return -EFAULT;
 701
 702         if (sin6->sin6_family != AF_INET6)
 703                 return -EINVAL;
 704
 705         if (!cmd.tcpm_keylen) {
 706                 if (!tcp_sk(sk)->md5sig_info)
 707                         return -ENOENT;
 708                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 709                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 710                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 711         }
 712
 713         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 714                 return -EINVAL;
 715
 716         if (!tcp_sk(sk)->md5sig_info) {
 717                 struct tcp_sock *tp = tcp_sk(sk);
 718                 struct tcp_md5sig_info *p;
 719
 720                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 721                 if (!p)
 722                         return -ENOMEM;
 723
 724                 tp->md5sig_info = p;
 725                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 726         }
 727
 728         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 729         if (!newkey)
 730                 return -ENOMEM;
 731         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 732                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 733                                          newkey, cmd.tcpm_keylen);
 734         }
 735         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 736 }
 737
 738 static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 739                                    struct in6_addr *saddr,
 740                                    struct in6_addr *daddr,
 741                                    struct tcphdr *th, int protocol,
 742                                    unsigned int tcplen)
 743 {
 744         struct scatterlist sg[4];
 745         __u16 data_len;
 746         int block = 0;
 747         __sum16 cksum;
 748         struct tcp_md5sig_pool *hp;
 749         struct tcp6_pseudohdr *bp;
 750         struct hash_desc *desc;
 751         int err;
 752         unsigned int nbytes = 0;
 753
 754         hp = tcp_get_md5sig_pool();
 755         if (!hp) {
 756                 printk(KERN_WARNING "%s(): hash pool not found...\n", __FUNCTION__);
 757                 goto clear_hash_noput;
 758         }
 759         bp = &hp->md5_blk.ip6;
 760         desc = &hp->md5_desc;
 761
 762         /* 1. TCP pseudo-header (RFC2460) */
 763         ipv6_addr_copy(&bp->saddr, saddr);
 764         ipv6_addr_copy(&bp->daddr, daddr);
 765         bp->len = htonl(tcplen);
 766         bp->protocol = htonl(protocol);
 767
 768         sg_init_table(sg, 4);
 769
 770         sg_set_buf(&sg[block++], bp, sizeof(*bp));
 771         nbytes += sizeof(*bp);
 772
 773         /* 2. TCP header, excluding options */
 774         cksum = th->check;
 775         th->check = 0;
 776         sg_set_buf(&sg[block++], th, sizeof(*th));
 777         nbytes += sizeof(*th);
 778
 779         /* 3. TCP segment data (if any) */
 780         data_len = tcplen - (th->doff << 2);
 781         if (data_len > 0) {
 782                 u8 *data = (u8 *)th + (th->doff << 2);
 783                 sg_set_buf(&sg[block++], data, data_len);
 784                 nbytes += data_len;
 785         }
 786
 787         /* 4. shared key */
 788         sg_set_buf(&sg[block++], key->key, key->keylen);
 789         nbytes += key->keylen;
 790
 791         sg_mark_end(&sg[block - 1]);
 792
 793         /* Now store the hash into the packet */
 794         err = crypto_hash_init(desc);
 795         if (err) {
 796                 printk(KERN_WARNING "%s(): hash_init failed\n", __FUNCTION__);
 797                 goto clear_hash;
 798         }
 799         err = crypto_hash_update(desc, sg, nbytes);
 800         if (err) {
 801                 printk(KERN_WARNING "%s(): hash_update failed\n", __FUNCTION__);
 802                 goto clear_hash;
 803         }
 804         err = crypto_hash_final(desc, md5_hash);
 805         if (err) {
 806                 printk(KERN_WARNING "%s(): hash_final failed\n", __FUNCTION__);
 807                 goto clear_hash;
 808         }
 809
 810         /* Reset header, and free up the crypto */
 811         tcp_put_md5sig_pool();
 812         th->check = cksum;
 813 out:
 814         return 0;
 815 clear_hash:
 816         tcp_put_md5sig_pool();
 817 clear_hash_noput:
 818         memset(md5_hash, 0, 16);
 819         goto out;
 820 }
 821
 822 static int tcp_v6_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 823                                 struct sock *sk,
 824                                 struct dst_entry *dst,
 825                                 struct request_sock *req,
 826                                 struct tcphdr *th, int protocol,
 827                                 unsigned int tcplen)
 828 {
 829         struct in6_addr *saddr, *daddr;
 830
 831         if (sk) {
 832                 saddr = &inet6_sk(sk)->saddr;
 833                 daddr = &inet6_sk(sk)->daddr;
 834         } else {
 835                 saddr = &inet6_rsk(req)->loc_addr;
 836                 daddr = &inet6_rsk(req)->rmt_addr;
 837         }
 838         return tcp_v6_do_calc_md5_hash(md5_hash, key,
 839                                        saddr, daddr,
 840                                        th, protocol, tcplen);
 841 }
 842
 843 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 844 {
 845         __u8 *hash_location = NULL;
 846         struct tcp_md5sig_key *hash_expected;
 847         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 848         struct tcphdr *th = tcp_hdr(skb);
 849         int length = (th->doff << 2) - sizeof (*th);
 850         int genhash;
 851         u8 *ptr;
 852         u8 newhash[16];
 853
 854         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 855
 856         /* If the TCP option is too short, we can short cut */
 857         if (length < TCPOLEN_MD5SIG)
 858                 return hash_expected ? 1 : 0;
 859
 860         /* parse options */
 861         ptr = (u8*)(th + 1);
 862         while (length > 0) {
 863                 int opcode = *ptr++;
 864                 int opsize;
 865
 866                 switch(opcode) {
 867                 case TCPOPT_EOL:
 868                         goto done_opts;
 869                 case TCPOPT_NOP:
 870                         length--;
 871                         continue;
 872                 default:
 873                         opsize = *ptr++;
 874                         if (opsize < 2 || opsize > length)
 875                                 goto done_opts;
 876                         if (opcode == TCPOPT_MD5SIG) {
 877                                 hash_location = ptr;
 878                                 goto done_opts;
 879                         }
 880                 }
 881                 ptr += opsize - 2;
 882                 length -= opsize;
 883         }
 884
 885 done_opts:
 886         /* do we have a hash as expected? */
 887         if (!hash_expected) {
 888                 if (!hash_location)
 889                         return 0;
 890                 if (net_ratelimit()) {
 891                         printk(KERN_INFO "MD5 Hash NOT expected but found "
 892                                "(" NIP6_FMT ", %u)->"
 893                                "(" NIP6_FMT ", %u)\n",
 894                                NIP6(ip6h->saddr), ntohs(th->source),
 895                                NIP6(ip6h->daddr), ntohs(th->dest));
 896                 }
 897                 return 1;
 898         }
 899
 900         if (!hash_location) {
 901                 if (net_ratelimit()) {
 902                         printk(KERN_INFO "MD5 Hash expected but NOT found "
 903                                "(" NIP6_FMT ", %u)->"
 904                                "(" NIP6_FMT ", %u)\n",
 905                                NIP6(ip6h->saddr), ntohs(th->source),
 906                                NIP6(ip6h->daddr), ntohs(th->dest));
 907                 }
 908                 return 1;
 909         }
 910
 911         /* check the signature */
 912         genhash = tcp_v6_do_calc_md5_hash(newhash,
 913                                           hash_expected,
 914                                           &ip6h->saddr, &ip6h->daddr,
 915                                           th, sk->sk_protocol,
 916                                           skb->len);
 917         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 918                 if (net_ratelimit()) {
 919                         printk(KERN_INFO "MD5 Hash %s for "
 920                                "(" NIP6_FMT ", %u)->"
 921                                "(" NIP6_FMT ", %u)\n",
 922                                genhash ? "failed" : "mismatch",
 923                                NIP6(ip6h->saddr), ntohs(th->source),
 924                                NIP6(ip6h->daddr), ntohs(th->dest));
 925                 }
 926                 return 1;
 927         }
 928         return 0;
 929 }
 930 #endif
 931
 932 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 933         .family         =       AF_INET6,
 934         .obj_size       =       sizeof(struct tcp6_request_sock),
 935         .rtx_syn_ack    =       tcp_v6_send_synack,
 936         .send_ack       =       tcp_v6_reqsk_send_ack,
 937         .destructor     =       tcp_v6_reqsk_destructor,
 938         .send_reset     =       tcp_v6_send_reset
 939 };
 940
 941 #ifdef CONFIG_TCP_MD5SIG
 942 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 943         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 944 };
 945 #endif
 946
 947 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 948         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 949         .twsk_unique    = tcp_twsk_unique,
 950         .twsk_destructor= tcp_twsk_destructor,
 951 };
 952
 953 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 954 {
 955         struct ipv6_pinfo *np = inet6_sk(sk);
 956         struct tcphdr *th = tcp_hdr(skb);
 957
 958         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 959                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 960                 skb->csum_start = skb_transport_header(skb) - skb->head;
 961                 skb->csum_offset = offsetof(struct tcphdr, check);
 962         } else {
 963                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 964                                             csum_partial((char *)th, th->doff<<2,
 965                                                          skb->csum));
 966         }
 967 }
 968
 969 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 970 {
 971         struct ipv6hdr *ipv6h;
 972         struct tcphdr *th;
 973
 974         if (!pskb_may_pull(skb, sizeof(*th)))
 975                 return -EINVAL;
 976
 977         ipv6h = ipv6_hdr(skb);
 978         th = tcp_hdr(skb);
 979
 980         th->check = 0;
 981         th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
 982                                      IPPROTO_TCP, 0);
 983         skb->csum_start = skb_transport_header(skb) - skb->head;
 984         skb->csum_offset = offsetof(struct tcphdr, check);
 985         skb->ip_summed = CHECKSUM_PARTIAL;
 986         return 0;
 987 }
 988
 989 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 990 {
 991         struct tcphdr *th = tcp_hdr(skb), *t1;
 992         struct sk_buff *buff;
 993         struct flowi fl;
 994         unsigned int tot_len = sizeof(*th);
 995 #ifdef CONFIG_TCP_MD5SIG
 996         struct tcp_md5sig_key *key;
 997 #endif
 998
 999         if (th->rst)
1000                 return;
1001
1002         if (!ipv6_unicast_destination(skb))
1003                 return;
1004
1005 #ifdef CONFIG_TCP_MD5SIG
1006         if (sk)
1007                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1008         else
1009                 key = NULL;
1010
1011         if (key)
1012                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1013 #endif
1014
1015         /*
1016          * We need to grab some memory, and put together an RST,
1017          * and then put it into the queue to be sent.
1018          */
1019
1020         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1021                          GFP_ATOMIC);
1022         if (buff == NULL)
1023                 return;
1024
1025         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1026
1027         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1028
1029         /* Swap the send and the receive. */
1030         memset(t1, 0, sizeof(*t1));
1031         t1->dest = th->source;
1032         t1->source = th->dest;
1033         t1->doff = tot_len / 4;
1034         t1->rst = 1;
1035
1036         if(th->ack) {
1037                 t1->seq = th->ack_seq;
1038         } else {
1039                 t1->ack = 1;
1040                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
1041                                     + skb->len - (th->doff<<2));
1042         }
1043
1044 #ifdef CONFIG_TCP_MD5SIG
1045         if (key) {
1046                 __be32 *opt = (__be32*)(t1 + 1);
1047                 opt[0] = htonl((TCPOPT_NOP << 24) |
1048                                (TCPOPT_NOP << 16) |
1049                                (TCPOPT_MD5SIG << 8) |
1050                                TCPOLEN_MD5SIG);
1051                 tcp_v6_do_calc_md5_hash((__u8 *)&opt[1], key,
1052                                         &ipv6_hdr(skb)->daddr,
1053                                         &ipv6_hdr(skb)->saddr,
1054                                         t1, IPPROTO_TCP, tot_len);
1055         }
1056 #endif
1057
1058         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
1059
1060         memset(&fl, 0, sizeof(fl));
1061         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1062         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1063
1064         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1065                                     sizeof(*t1), IPPROTO_TCP,
1066                                     buff->csum);
1067
1068         fl.proto = IPPROTO_TCP;
1069         fl.oif = inet6_iif(skb);
1070         fl.fl_ip_dport = t1->dest;
1071         fl.fl_ip_sport = t1->source;
1072         security_skb_classify_flow(skb, &fl);
1073
1074         /* sk = NULL, but it is safe for now. RST socket required. */
1075         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1076
1077                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1078                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1079                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1080                         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
1081                         return;
1082                 }
1083         }
1084
1085         kfree_skb(buff);
1086 }
1087
1088 static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
1089                             struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
1090 {
1091         struct tcphdr *th = tcp_hdr(skb), *t1;
1092         struct sk_buff *buff;
1093         struct flowi fl;
1094         unsigned int tot_len = sizeof(struct tcphdr);
1095         __be32 *topt;
1096 #ifdef CONFIG_TCP_MD5SIG
1097         struct tcp_md5sig_key *key;
1098         struct tcp_md5sig_key tw_key;
1099 #endif
1100
1101 #ifdef CONFIG_TCP_MD5SIG
1102         if (!tw && skb->sk) {
1103                 key = tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr);
1104         } else if (tw && tw->tw_md5_keylen) {
1105                 tw_key.key = tw->tw_md5_key;
1106                 tw_key.keylen = tw->tw_md5_keylen;
1107                 key = &tw_key;
1108         } else {
1109                 key = NULL;
1110         }
1111 #endif
1112
1113         if (ts)
1114                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
1115 #ifdef CONFIG_TCP_MD5SIG
1116         if (key)
1117                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1118 #endif
1119
1120         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1121                          GFP_ATOMIC);
1122         if (buff == NULL)
1123                 return;
1124
1125         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1126
1127         t1 = (struct tcphdr *) skb_push(buff,tot_len);
1128
1129         /* Swap the send and the receive. */
1130         memset(t1, 0, sizeof(*t1));
1131         t1->dest = th->source;
1132         t1->source = th->dest;
1133         t1->doff = tot_len/4;
1134         t1->seq = htonl(seq);
1135         t1->ack_seq = htonl(ack);
1136         t1->ack = 1;
1137         t1->window = htons(win);
1138
1139         topt = (__be32 *)(t1 + 1);
1140
1141         if (ts) {
1142                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1143                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1144                 *topt++ = htonl(tcp_time_stamp);
1145                 *topt = htonl(ts);
1146         }
1147
1148 #ifdef CONFIG_TCP_MD5SIG
1149         if (key) {
1150                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1151                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1152                 tcp_v6_do_calc_md5_hash((__u8 *)topt, key,
1153                                         &ipv6_hdr(skb)->daddr,
1154                                         &ipv6_hdr(skb)->saddr,
1155                                         t1, IPPROTO_TCP, tot_len);
1156         }
1157 #endif
1158
1159         buff->csum = csum_partial((char *)t1, tot_len, 0);
1160
1161         memset(&fl, 0, sizeof(fl));
1162         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1163         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1164
1165         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1166                                     tot_len, IPPROTO_TCP,
1167                                     buff->csum);
1168
1169         fl.proto = IPPROTO_TCP;
1170         fl.oif = inet6_iif(skb);
1171         fl.fl_ip_dport = t1->dest;
1172         fl.fl_ip_sport = t1->source;
1173         security_skb_classify_flow(skb, &fl);
1174
1175         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1176                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1177                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1178                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1179                         return;
1180                 }
1181         }
1182
1183         kfree_skb(buff);
1184 }
1185
1186 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1187 {
1188         struct inet_timewait_sock *tw = inet_twsk(sk);
1189         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1190
1191         tcp_v6_send_ack(tcptw, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1192                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1193                         tcptw->tw_ts_recent);
1194
1195         inet_twsk_put(tw);
1196 }
1197
1198 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
1199 {
1200         tcp_v6_send_ack(NULL, skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
1201 }
1202
1203
1204 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1205 {
1206         struct request_sock *req, **prev;
1207         const struct tcphdr *th = tcp_hdr(skb);
1208         struct sock *nsk;
1209
1210         /* Find possible connection requests. */
1211         req = inet6_csk_search_req(sk, &prev, th->source,
1212                                    &ipv6_hdr(skb)->saddr,
1213                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1214         if (req)
1215                 return tcp_check_req(sk, skb, req, prev);
1216
1217         nsk = __inet6_lookup_established(sk->sk_net, &tcp_hashinfo,
1218                         &ipv6_hdr(skb)->saddr, th->source,
1219                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1220
1221         if (nsk) {
1222                 if (nsk->sk_state != TCP_TIME_WAIT) {
1223                         bh_lock_sock(nsk);
1224                         return nsk;
1225                 }
1226                 inet_twsk_put(inet_twsk(nsk));
1227                 return NULL;
1228         }
1229
1230 #ifdef CONFIG_SYN_COOKIES
1231         if (!th->rst && !th->syn && th->ack)
1232                 sk = cookie_v6_check(sk, skb);
1233 #endif
1234         return sk;
1235 }
1236
1237 /* FIXME: this is substantially similar to the ipv4 code.
1238  * Can some kind of merge be done? -- erics
1239  */
1240 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1241 {
1242         struct inet6_request_sock *treq;
1243         struct ipv6_pinfo *np = inet6_sk(sk);
1244         struct tcp_options_received tmp_opt;
1245         struct tcp_sock *tp = tcp_sk(sk);
1246         struct request_sock *req = NULL;
1247         __u32 isn = TCP_SKB_CB(skb)->when;
1248 #ifdef CONFIG_SYN_COOKIES
1249         int want_cookie = 0;
1250 #else
1251 #define want_cookie 0
1252 #endif
1253
1254         if (skb->protocol == htons(ETH_P_IP))
1255                 return tcp_v4_conn_request(sk, skb);
1256
1257         if (!ipv6_unicast_destination(skb))
1258                 goto drop;
1259
1260         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1261                 if (net_ratelimit())
1262                         syn_flood_warning(skb);
1263 #ifdef CONFIG_SYN_COOKIES
1264                 if (sysctl_tcp_syncookies)
1265                         want_cookie = 1;
1266                 else
1267 #endif
1268                 goto drop;
1269         }
1270
1271         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1272                 goto drop;
1273
1274         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1275         if (req == NULL)
1276                 goto drop;
1277
1278 #ifdef CONFIG_TCP_MD5SIG
1279         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1280 #endif
1281
1282         tcp_clear_options(&tmp_opt);
1283         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1284         tmp_opt.user_mss = tp->rx_opt.user_mss;
1285
1286         tcp_parse_options(skb, &tmp_opt, 0);
1287
1288         if (want_cookie) {
1289                 tcp_clear_options(&tmp_opt);
1290                 tmp_opt.saw_tstamp = 0;
1291         }
1292
1293         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1294         tcp_openreq_init(req, &tmp_opt, skb);
1295
1296         treq = inet6_rsk(req);
1297         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1298         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1299         treq->pktopts = NULL;
1300         if (!want_cookie)
1301                 TCP_ECN_create_request(req, tcp_hdr(skb));
1302
1303         if (want_cookie) {
1304                 isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1305         } else if (!isn) {
1306                 if (ipv6_opt_accepted(sk, skb) ||
1307                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1308                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1309                         atomic_inc(&skb->users);
1310                         treq->pktopts = skb;
1311                 }
1312                 treq->iif = sk->sk_bound_dev_if;
1313
1314                 /* So that link locals have meaning */
1315                 if (!sk->sk_bound_dev_if &&
1316                     ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1317                         treq->iif = inet6_iif(skb);
1318
1319                 isn = tcp_v6_init_sequence(skb);
1320         }
1321
1322         tcp_rsk(req)->snt_isn = isn;
1323
1324         security_inet_conn_request(sk, skb, req);
1325
1326         if (tcp_v6_send_synack(sk, req))
1327                 goto drop;
1328
1329         if (!want_cookie) {
1330                 inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1331                 return 0;
1332         }
1333
1334 drop:
1335         if (req)
1336                 reqsk_free(req);
1337
1338         return 0; /* don't send reset */
1339 }
1340
1341 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1342                                           struct request_sock *req,
1343                                           struct dst_entry *dst)
1344 {
1345         struct inet6_request_sock *treq = inet6_rsk(req);
1346         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1347         struct tcp6_sock *newtcp6sk;
1348         struct inet_sock *newinet;
1349         struct tcp_sock *newtp;
1350         struct sock *newsk;
1351         struct ipv6_txoptions *opt;
1352 #ifdef CONFIG_TCP_MD5SIG
1353         struct tcp_md5sig_key *key;
1354 #endif
1355
1356         if (skb->protocol == htons(ETH_P_IP)) {
1357                 /*
1358                  *      v6 mapped
1359                  */
1360
1361                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1362
1363                 if (newsk == NULL)
1364                         return NULL;
1365
1366                 newtcp6sk = (struct tcp6_sock *)newsk;
1367                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1368
1369                 newinet = inet_sk(newsk);
1370                 newnp = inet6_sk(newsk);
1371                 newtp = tcp_sk(newsk);
1372
1373                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1374
1375                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
1376                               newinet->daddr);
1377
1378                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
1379                               newinet->saddr);
1380
1381                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1382
1383                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1384                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1385 #ifdef CONFIG_TCP_MD5SIG
1386                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1387 #endif
1388
1389                 newnp->pktoptions  = NULL;
1390                 newnp->opt         = NULL;
1391                 newnp->mcast_oif   = inet6_iif(skb);
1392                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1393
1394                 /*
1395                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1396                  * here, tcp_create_openreq_child now does this for us, see the comment in
1397                  * that function for the gory details. -acme
1398                  */
1399
1400                 /* It is tricky place. Until this moment IPv4 tcp
1401                    worked with IPv6 icsk.icsk_af_ops.
1402                    Sync it now.
1403                  */
1404                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1405
1406                 return newsk;
1407         }
1408
1409         opt = np->opt;
1410
1411         if (sk_acceptq_is_full(sk))
1412                 goto out_overflow;
1413
1414         if (dst == NULL) {
1415                 struct in6_addr *final_p = NULL, final;
1416                 struct flowi fl;
1417
1418                 memset(&fl, 0, sizeof(fl));
1419                 fl.proto = IPPROTO_TCP;
1420                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
1421                 if (opt && opt->srcrt) {
1422                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
1423                         ipv6_addr_copy(&final, &fl.fl6_dst);
1424                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1425                         final_p = &final;
1426                 }
1427                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
1428                 fl.oif = sk->sk_bound_dev_if;
1429                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
1430                 fl.fl_ip_sport = inet_sk(sk)->sport;
1431                 security_req_classify_flow(req, &fl);
1432
1433                 if (ip6_dst_lookup(sk, &dst, &fl))
1434                         goto out;
1435
1436                 if (final_p)
1437                         ipv6_addr_copy(&fl.fl6_dst, final_p);
1438
1439                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
1440                         goto out;
1441         }
1442
1443         newsk = tcp_create_openreq_child(sk, req, skb);
1444         if (newsk == NULL)
1445                 goto out;
1446
1447         /*
1448          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1449          * count here, tcp_create_openreq_child now does this for us, see the
1450          * comment in that function for the gory details. -acme
1451          */
1452
1453         newsk->sk_gso_type = SKB_GSO_TCPV6;
1454         __ip6_dst_store(newsk, dst, NULL, NULL);
1455
1456         newtcp6sk = (struct tcp6_sock *)newsk;
1457         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1458
1459         newtp = tcp_sk(newsk);
1460         newinet = inet_sk(newsk);
1461         newnp = inet6_sk(newsk);
1462
1463         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1464
1465         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1466         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1467         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1468         newsk->sk_bound_dev_if = treq->iif;
1469
1470         /* Now IPv6 options...
1471
1472            First: no IPv4 options.
1473          */
1474         newinet->opt = NULL;
1475         newnp->ipv6_fl_list = NULL;
1476
1477         /* Clone RX bits */
1478         newnp->rxopt.all = np->rxopt.all;
1479
1480         /* Clone pktoptions received with SYN */
1481         newnp->pktoptions = NULL;
1482         if (treq->pktopts != NULL) {
1483                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1484                 kfree_skb(treq->pktopts);
1485                 treq->pktopts = NULL;
1486                 if (newnp->pktoptions)
1487                         skb_set_owner_r(newnp->pktoptions, newsk);
1488         }
1489         newnp->opt        = NULL;
1490         newnp->mcast_oif  = inet6_iif(skb);
1491         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1492
1493         /* Clone native IPv6 options from listening socket (if any)
1494
1495            Yes, keeping reference count would be much more clever,
1496            but we make one more one thing there: reattach optmem
1497            to newsk.
1498          */
1499         if (opt) {
1500                 newnp->opt = ipv6_dup_options(newsk, opt);
1501                 if (opt != np->opt)
1502                         sock_kfree_s(sk, opt, opt->tot_len);
1503         }
1504
1505         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1506         if (newnp->opt)
1507                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1508                                                      newnp->opt->opt_flen);
1509
1510         tcp_mtup_init(newsk);
1511         tcp_sync_mss(newsk, dst_mtu(dst));
1512         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
1513         tcp_initialize_rcv_mss(newsk);
1514
1515         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
1516
1517 #ifdef CONFIG_TCP_MD5SIG
1518         /* Copy over the MD5 key from the original socket */
1519         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1520                 /* We're using one, so create a matching key
1521                  * on the newsk structure. If we fail to get
1522                  * memory, then we end up not copying the key
1523                  * across. Shucks.
1524                  */
1525                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1526                 if (newkey != NULL)
1527                         tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
1528                                           newkey, key->keylen);
1529         }
1530 #endif
1531
1532         __inet6_hash(newsk);
1533         inet_inherit_port(sk, newsk);
1534
1535         return newsk;
1536
1537 out_overflow:
1538         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
1539 out:
1540         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
1541         if (opt && opt != np->opt)
1542                 sock_kfree_s(sk, opt, opt->tot_len);
1543         dst_release(dst);
1544         return NULL;
1545 }
1546
1547 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1548 {
1549         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1550                 if (!tcp_v6_check(tcp_hdr(skb), skb->len, &ipv6_hdr(skb)->saddr,
1551                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1552                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1553                         return 0;
1554                 }
1555         }
1556
1557         skb->csum = ~csum_unfold(tcp_v6_check(tcp_hdr(skb), skb->len,
1558                                               &ipv6_hdr(skb)->saddr,
1559                                               &ipv6_hdr(skb)->daddr, 0));
1560
1561         if (skb->len <= 76) {
1562                 return __skb_checksum_complete(skb);
1563         }
1564         return 0;
1565 }
1566
1567 /* The socket must have it's spinlock held when we get
1568  * here.
1569  *
1570  * We have a potential double-lock case here, so even when
1571  * doing backlog processing we use the BH locking scheme.
1572  * This is because we cannot sleep with the original spinlock
1573  * held.
1574  */
1575 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1576 {
1577         struct ipv6_pinfo *np = inet6_sk(sk);
1578         struct tcp_sock *tp;
1579         struct sk_buff *opt_skb = NULL;
1580
1581         /* Imagine: socket is IPv6. IPv4 packet arrives,
1582            goes to IPv4 receive handler and backlogged.
1583            From backlog it always goes here. Kerboom...
1584            Fortunately, tcp_rcv_established and rcv_established
1585            handle them correctly, but it is not case with
1586            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1587          */
1588
1589         if (skb->protocol == htons(ETH_P_IP))
1590                 return tcp_v4_do_rcv(sk, skb);
1591
1592 #ifdef CONFIG_TCP_MD5SIG
1593         if (tcp_v6_inbound_md5_hash (sk, skb))
1594                 goto discard;
1595 #endif
1596
1597         if (sk_filter(sk, skb))
1598                 goto discard;
1599
1600         /*
1601          *      socket locking is here for SMP purposes as backlog rcv
1602          *      is currently called with bh processing disabled.
1603          */
1604
1605         /* Do Stevens' IPV6_PKTOPTIONS.
1606
1607            Yes, guys, it is the only place in our code, where we
1608            may make it not affecting IPv4.
1609            The rest of code is protocol independent,
1610            and I do not like idea to uglify IPv4.
1611
1612            Actually, all the idea behind IPV6_PKTOPTIONS
1613            looks not very well thought. For now we latch
1614            options, received in the last packet, enqueued
1615            by tcp. Feel free to propose better solution.
1616                                                --ANK (980728)
1617          */
1618         if (np->rxopt.all)
1619                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1620
1621         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1622                 TCP_CHECK_TIMER(sk);
1623                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1624                         goto reset;
1625                 TCP_CHECK_TIMER(sk);
1626                 if (opt_skb)
1627                         goto ipv6_pktoptions;
1628                 return 0;
1629         }
1630
1631         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1632                 goto csum_err;
1633
1634         if (sk->sk_state == TCP_LISTEN) {
1635                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1636                 if (!nsk)
1637                         goto discard;
1638
1639                 /*
1640                  * Queue it on the new socket if the new socket is active,
1641                  * otherwise we just shortcircuit this and continue with
1642                  * the new socket..
1643                  */
1644                 if(nsk != sk) {
1645                         if (tcp_child_process(sk, nsk, skb))
1646                                 goto reset;
1647                         if (opt_skb)
1648                                 __kfree_skb(opt_skb);
1649                         return 0;
1650                 }
1651         }
1652
1653         TCP_CHECK_TIMER(sk);
1654         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1655                 goto reset;
1656         TCP_CHECK_TIMER(sk);
1657         if (opt_skb)
1658                 goto ipv6_pktoptions;
1659         return 0;
1660
1661 reset:
1662         tcp_v6_send_reset(sk, skb);
1663 discard:
1664         if (opt_skb)
1665                 __kfree_skb(opt_skb);
1666         kfree_skb(skb);
1667         return 0;
1668 csum_err:
1669         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1670         goto discard;
1671
1672
1673 ipv6_pktoptions:
1674         /* Do you ask, what is it?
1675
1676            1. skb was enqueued by tcp.
1677            2. skb is added to tail of read queue, rather than out of order.
1678            3. socket is not in passive state.
1679            4. Finally, it really contains options, which user wants to receive.
1680          */
1681         tp = tcp_sk(sk);
1682         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1683             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1684                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1685                         np->mcast_oif = inet6_iif(opt_skb);
1686                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1687                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1688                 if (ipv6_opt_accepted(sk, opt_skb)) {
1689                         skb_set_owner_r(opt_skb, sk);
1690                         opt_skb = xchg(&np->pktoptions, opt_skb);
1691                 } else {
1692                         __kfree_skb(opt_skb);
1693                         opt_skb = xchg(&np->pktoptions, NULL);
1694                 }
1695         }
1696
1697         if (opt_skb)
1698                 kfree_skb(opt_skb);
1699         return 0;
1700 }
1701
1702 static int tcp_v6_rcv(struct sk_buff *skb)
1703 {
1704         struct tcphdr *th;
1705         struct sock *sk;
1706         int ret;
1707
1708         if (skb->pkt_type != PACKET_HOST)
1709                 goto discard_it;
1710
1711         /*
1712          *      Count it even if it's bad.
1713          */
1714         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1715
1716         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1717                 goto discard_it;
1718
1719         th = tcp_hdr(skb);
1720
1721         if (th->doff < sizeof(struct tcphdr)/4)
1722                 goto bad_packet;
1723         if (!pskb_may_pull(skb, th->doff*4))
1724                 goto discard_it;
1725
1726         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1727                 goto bad_packet;
1728
1729         th = tcp_hdr(skb);
1730         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1731         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1732                                     skb->len - th->doff*4);
1733         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1734         TCP_SKB_CB(skb)->when = 0;
1735         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
1736         TCP_SKB_CB(skb)->sacked = 0;
1737
1738         sk = __inet6_lookup(skb->dev->nd_net, &tcp_hashinfo,
1739                         &ipv6_hdr(skb)->saddr, th->source,
1740                         &ipv6_hdr(skb)->daddr, ntohs(th->dest),
1741                         inet6_iif(skb));
1742
1743         if (!sk)
1744                 goto no_tcp_socket;
1745
1746 process:
1747         if (sk->sk_state == TCP_TIME_WAIT)
1748                 goto do_time_wait;
1749
1750         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1751                 goto discard_and_relse;
1752
1753         if (sk_filter(sk, skb))
1754                 goto discard_and_relse;
1755
1756         skb->dev = NULL;
1757
1758         bh_lock_sock_nested(sk);
1759         ret = 0;
1760         if (!sock_owned_by_user(sk)) {
1761 #ifdef CONFIG_NET_DMA
1762                 struct tcp_sock *tp = tcp_sk(sk);
1763                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1764                         tp->ucopy.dma_chan = get_softnet_dma();
1765                 if (tp->ucopy.dma_chan)
1766                         ret = tcp_v6_do_rcv(sk, skb);
1767                 else
1768 #endif
1769                 {
1770                         if (!tcp_prequeue(sk, skb))
1771                                 ret = tcp_v6_do_rcv(sk, skb);
1772                 }
1773         } else
1774                 sk_add_backlog(sk, skb);
1775         bh_unlock_sock(sk);
1776
1777         sock_put(sk);
1778         return ret ? -1 : 0;
1779
1780 no_tcp_socket:
1781         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1782                 goto discard_it;
1783
1784         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1785 bad_packet:
1786                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1787         } else {
1788                 tcp_v6_send_reset(NULL, skb);
1789         }
1790
1791 discard_it:
1792
1793         /*
1794          *      Discard frame
1795          */
1796
1797         kfree_skb(skb);
1798         return 0;
1799
1800 discard_and_relse:
1801         sock_put(sk);
1802         goto discard_it;
1803
1804 do_time_wait:
1805         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1806                 inet_twsk_put(inet_twsk(sk));
1807                 goto discard_it;
1808         }
1809
1810         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1811                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1812                 inet_twsk_put(inet_twsk(sk));
1813                 goto discard_it;
1814         }
1815
1816         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1817         case TCP_TW_SYN:
1818         {
1819                 struct sock *sk2;
1820
1821                 sk2 = inet6_lookup_listener(skb->dev->nd_net, &tcp_hashinfo,
1822                                             &ipv6_hdr(skb)->daddr,
1823                                             ntohs(th->dest), inet6_iif(skb));
1824                 if (sk2 != NULL) {
1825                         struct inet_timewait_sock *tw = inet_twsk(sk);
1826                         inet_twsk_deschedule(tw, &tcp_death_row);
1827                         inet_twsk_put(tw);
1828                         sk = sk2;
1829                         goto process;
1830                 }
1831                 /* Fall through to ACK */
1832         }
1833         case TCP_TW_ACK:
1834                 tcp_v6_timewait_ack(sk, skb);
1835                 break;
1836         case TCP_TW_RST:
1837                 goto no_tcp_socket;
1838         case TCP_TW_SUCCESS:;
1839         }
1840         goto discard_it;
1841 }
1842
1843 static int tcp_v6_remember_stamp(struct sock *sk)
1844 {
1845         /* Alas, not yet... */
1846         return 0;
1847 }
1848
1849 static struct inet_connection_sock_af_ops ipv6_specific = {
1850         .queue_xmit        = inet6_csk_xmit,
1851         .send_check        = tcp_v6_send_check,
1852         .rebuild_header    = inet6_sk_rebuild_header,
1853         .conn_request      = tcp_v6_conn_request,
1854         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1855         .remember_stamp    = tcp_v6_remember_stamp,
1856         .net_header_len    = sizeof(struct ipv6hdr),
1857         .setsockopt        = ipv6_setsockopt,
1858         .getsockopt        = ipv6_getsockopt,
1859         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1860         .sockaddr_len      = sizeof(struct sockaddr_in6),
1861         .bind_conflict     = inet6_csk_bind_conflict,
1862 #ifdef CONFIG_COMPAT
1863         .compat_setsockopt = compat_ipv6_setsockopt,
1864         .compat_getsockopt = compat_ipv6_getsockopt,
1865 #endif
1866 };
1867
1868 #ifdef CONFIG_TCP_MD5SIG
1869 static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1870         .md5_lookup     =       tcp_v6_md5_lookup,
1871         .calc_md5_hash  =       tcp_v6_calc_md5_hash,
1872         .md5_add        =       tcp_v6_md5_add_func,
1873         .md5_parse      =       tcp_v6_parse_md5_keys,
1874 };
1875 #endif
1876
1877 /*
1878  *      TCP over IPv4 via INET6 API
1879  */
1880
1881 static struct inet_connection_sock_af_ops ipv6_mapped = {
1882         .queue_xmit        = ip_queue_xmit,
1883         .send_check        = tcp_v4_send_check,
1884         .rebuild_header    = inet_sk_rebuild_header,
1885         .conn_request      = tcp_v6_conn_request,
1886         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1887         .remember_stamp    = tcp_v4_remember_stamp,
1888         .net_header_len    = sizeof(struct iphdr),
1889         .setsockopt        = ipv6_setsockopt,
1890         .getsockopt        = ipv6_getsockopt,
1891         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1892         .sockaddr_len      = sizeof(struct sockaddr_in6),
1893         .bind_conflict     = inet6_csk_bind_conflict,
1894 #ifdef CONFIG_COMPAT
1895         .compat_setsockopt = compat_ipv6_setsockopt,
1896         .compat_getsockopt = compat_ipv6_getsockopt,
1897 #endif
1898 };
1899
1900 #ifdef CONFIG_TCP_MD5SIG
1901 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1902         .md5_lookup     =       tcp_v4_md5_lookup,
1903         .calc_md5_hash  =       tcp_v4_calc_md5_hash,
1904         .md5_add        =       tcp_v6_md5_add_func,
1905         .md5_parse      =       tcp_v6_parse_md5_keys,
1906 };
1907 #endif
1908
1909 /* NOTE: A lot of things set to zero explicitly by call to
1910  *       sk_alloc() so need not be done here.
1911  */
1912 static int tcp_v6_init_sock(struct sock *sk)
1913 {
1914         struct inet_connection_sock *icsk = inet_csk(sk);
1915         struct tcp_sock *tp = tcp_sk(sk);
1916
1917         skb_queue_head_init(&tp->out_of_order_queue);
1918         tcp_init_xmit_timers(sk);
1919         tcp_prequeue_init(tp);
1920
1921         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1922         tp->mdev = TCP_TIMEOUT_INIT;
1923
1924         /* So many TCP implementations out there (incorrectly) count the
1925          * initial SYN frame in their delayed-ACK and congestion control
1926          * algorithms that we must have the following bandaid to talk
1927          * efficiently to them.  -DaveM
1928          */
1929         tp->snd_cwnd = 2;
1930
1931         /* See draft-stevens-tcpca-spec-01 for discussion of the
1932          * initialization of these values.
1933          */
1934         tp->snd_ssthresh = 0x7fffffff;
1935         tp->snd_cwnd_clamp = ~0;
1936         tp->mss_cache = 536;
1937
1938         tp->reordering = sysctl_tcp_reordering;
1939
1940         sk->sk_state = TCP_CLOSE;
1941
1942         icsk->icsk_af_ops = &ipv6_specific;
1943         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1944         icsk->icsk_sync_mss = tcp_sync_mss;
1945         sk->sk_write_space = sk_stream_write_space;
1946         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1947
1948 #ifdef CONFIG_TCP_MD5SIG
1949         tp->af_specific = &tcp_sock_ipv6_specific;
1950 #endif
1951
1952         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1953         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1954
1955         atomic_inc(&tcp_sockets_allocated);
1956
1957         return 0;
1958 }
1959
1960 static int tcp_v6_destroy_sock(struct sock *sk)
1961 {
1962 #ifdef CONFIG_TCP_MD5SIG
1963         /* Clean up the MD5 key list */
1964         if (tcp_sk(sk)->md5sig_info)
1965                 tcp_v6_clear_md5_list(sk);
1966 #endif
1967         tcp_v4_destroy_sock(sk);
1968         return inet6_destroy_sock(sk);
1969 }
1970
1971 #ifdef CONFIG_PROC_FS
1972 /* Proc filesystem TCPv6 sock list dumping. */
1973 static void get_openreq6(struct seq_file *seq,
1974                          struct sock *sk, struct request_sock *req, int i, int uid)
1975 {
1976         int ttd = req->expires - jiffies;
1977         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1978         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1979
1980         if (ttd < 0)
1981                 ttd = 0;
1982
1983         seq_printf(seq,
1984                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1985                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1986                    i,
1987                    src->s6_addr32[0], src->s6_addr32[1],
1988                    src->s6_addr32[2], src->s6_addr32[3],
1989                    ntohs(inet_sk(sk)->sport),
1990                    dest->s6_addr32[0], dest->s6_addr32[1],
1991                    dest->s6_addr32[2], dest->s6_addr32[3],
1992                    ntohs(inet_rsk(req)->rmt_port),
1993                    TCP_SYN_RECV,
1994                    0,0, /* could print option size, but that is af dependent. */
1995                    1,   /* timers active (only the expire timer) */
1996                    jiffies_to_clock_t(ttd),
1997                    req->retrans,
1998                    uid,
1999                    0,  /* non standard timer */
2000                    0, /* open_requests have no inode */
2001                    0, req);
2002 }
2003
2004 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
2005 {
2006         struct in6_addr *dest, *src;
2007         __u16 destp, srcp;
2008         int timer_active;
2009         unsigned long timer_expires;
2010         struct inet_sock *inet = inet_sk(sp);
2011         struct tcp_sock *tp = tcp_sk(sp);
2012         const struct inet_connection_sock *icsk = inet_csk(sp);
2013         struct ipv6_pinfo *np = inet6_sk(sp);
2014
2015         dest  = &np->daddr;
2016         src   = &np->rcv_saddr;
2017         destp = ntohs(inet->dport);
2018         srcp  = ntohs(inet->sport);
2019
2020         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2021                 timer_active    = 1;
2022                 timer_expires   = icsk->icsk_timeout;
2023         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2024                 timer_active    = 4;
2025                 timer_expires   = icsk->icsk_timeout;
2026         } else if (timer_pending(&sp->sk_timer)) {
2027                 timer_active    = 2;
2028                 timer_expires   = sp->sk_timer.expires;
2029         } else {
2030                 timer_active    = 0;
2031                 timer_expires = jiffies;
2032         }
2033
2034         seq_printf(seq,
2035                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2036                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
2037                    i,
2038                    src->s6_addr32[0], src->s6_addr32[1],
2039                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2040                    dest->s6_addr32[0], dest->s6_addr32[1],
2041                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2042                    sp->sk_state,
2043                    tp->write_seq-tp->snd_una,
2044                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2045                    timer_active,
2046                    jiffies_to_clock_t(timer_expires - jiffies),
2047                    icsk->icsk_retransmits,
2048                    sock_i_uid(sp),
2049                    icsk->icsk_probes_out,
2050                    sock_i_ino(sp),
2051                    atomic_read(&sp->sk_refcnt), sp,
2052                    icsk->icsk_rto,
2053                    icsk->icsk_ack.ato,
2054                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2055                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
2056                    );
2057 }
2058
2059 static void get_timewait6_sock(struct seq_file *seq,
2060                                struct inet_timewait_sock *tw, int i)
2061 {
2062         struct in6_addr *dest, *src;
2063         __u16 destp, srcp;
2064         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2065         int ttd = tw->tw_ttd - jiffies;
2066
2067         if (ttd < 0)
2068                 ttd = 0;
2069
2070         dest = &tw6->tw_v6_daddr;
2071         src  = &tw6->tw_v6_rcv_saddr;
2072         destp = ntohs(tw->tw_dport);
2073         srcp  = ntohs(tw->tw_sport);
2074
2075         seq_printf(seq,
2076                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2077                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2078                    i,
2079                    src->s6_addr32[0], src->s6_addr32[1],
2080                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2081                    dest->s6_addr32[0], dest->s6_addr32[1],
2082                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2083                    tw->tw_substate, 0, 0,
2084                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2085                    atomic_read(&tw->tw_refcnt), tw);
2086 }
2087
2088 static int tcp6_seq_show(struct seq_file *seq, void *v)
2089 {
2090         struct tcp_iter_state *st;
2091
2092         if (v == SEQ_START_TOKEN) {
2093                 seq_puts(seq,
2094                          "  sl  "
2095                          "local_address                         "
2096                          "remote_address                        "
2097                          "st tx_queue rx_queue tr tm->when retrnsmt"
2098                          "   uid  timeout inode\n");
2099                 goto out;
2100         }
2101         st = seq->private;
2102
2103         switch (st->state) {
2104         case TCP_SEQ_STATE_LISTENING:
2105         case TCP_SEQ_STATE_ESTABLISHED:
2106                 get_tcp6_sock(seq, v, st->num);
2107                 break;
2108         case TCP_SEQ_STATE_OPENREQ:
2109                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2110                 break;
2111         case TCP_SEQ_STATE_TIME_WAIT:
2112                 get_timewait6_sock(seq, v, st->num);
2113                 break;
2114         }
2115 out:
2116         return 0;
2117 }
2118
2119 static struct file_operations tcp6_seq_fops;
2120 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2121         .owner          = THIS_MODULE,
2122         .name           = "tcp6",
2123         .family         = AF_INET6,
2124         .seq_show       = tcp6_seq_show,
2125         .seq_fops       = &tcp6_seq_fops,
2126 };
2127
2128 int __init tcp6_proc_init(void)
2129 {
2130         return tcp_proc_register(&tcp6_seq_afinfo);
2131 }
2132
2133 void tcp6_proc_exit(void)
2134 {
2135         tcp_proc_unregister(&tcp6_seq_afinfo);
2136 }
2137 #endif
2138
2139 DEFINE_PROTO_INUSE(tcpv6)
2140
2141 struct proto tcpv6_prot = {
2142         .name                   = "TCPv6",
2143         .owner                  = THIS_MODULE,
2144         .close                  = tcp_close,
2145         .connect                = tcp_v6_connect,
2146         .disconnect             = tcp_disconnect,
2147         .accept                 = inet_csk_accept,
2148         .ioctl                  = tcp_ioctl,
2149         .init                   = tcp_v6_init_sock,
2150         .destroy                = tcp_v6_destroy_sock,
2151         .shutdown               = tcp_shutdown,
2152         .setsockopt             = tcp_setsockopt,
2153         .getsockopt             = tcp_getsockopt,
2154         .recvmsg                = tcp_recvmsg,
2155         .backlog_rcv            = tcp_v6_do_rcv,
2156         .hash                   = tcp_v6_hash,
2157         .unhash                 = inet_unhash,
2158         .get_port               = inet_csk_get_port,
2159         .enter_memory_pressure  = tcp_enter_memory_pressure,
2160         .sockets_allocated      = &tcp_sockets_allocated,
2161         .memory_allocated       = &tcp_memory_allocated,
2162         .memory_pressure        = &tcp_memory_pressure,
2163         .orphan_count           = &tcp_orphan_count,
2164         .sysctl_mem             = sysctl_tcp_mem,
2165         .sysctl_wmem            = sysctl_tcp_wmem,
2166         .sysctl_rmem            = sysctl_tcp_rmem,
2167         .max_header             = MAX_TCP_HEADER,
2168         .obj_size               = sizeof(struct tcp6_sock),
2169         .twsk_prot              = &tcp6_timewait_sock_ops,
2170         .rsk_prot               = &tcp6_request_sock_ops,
2171         .hashinfo               = &tcp_hashinfo,
2172 #ifdef CONFIG_COMPAT
2173         .compat_setsockopt      = compat_tcp_setsockopt,
2174         .compat_getsockopt      = compat_tcp_getsockopt,
2175 #endif
2176         REF_PROTO_INUSE(tcpv6)
2177 };
2178
2179 static struct inet6_protocol tcpv6_protocol = {
2180         .handler        =       tcp_v6_rcv,
2181         .err_handler    =       tcp_v6_err,
2182         .gso_send_check =       tcp_v6_gso_send_check,
2183         .gso_segment    =       tcp_tso_segment,
2184         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2185 };
2186
2187 static struct inet_protosw tcpv6_protosw = {
2188         .type           =       SOCK_STREAM,
2189         .protocol       =       IPPROTO_TCP,
2190         .prot           =       &tcpv6_prot,
2191         .ops            =       &inet6_stream_ops,
2192         .capability     =       -1,
2193         .no_check       =       0,
2194         .flags          =       INET_PROTOSW_PERMANENT |
2195                                 INET_PROTOSW_ICSK,
2196 };
2197
2198 int __init tcpv6_init(void)
2199 {
2200         int ret;
2201
2202         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2203         if (ret)
2204                 goto out;
2205
2206         /* register inet6 protocol */
2207         ret = inet6_register_protosw(&tcpv6_protosw);
2208         if (ret)
2209                 goto out_tcpv6_protocol;
2210
2211         ret = inet_csk_ctl_sock_create(&tcp6_socket, PF_INET6,
2212                                        SOCK_RAW, IPPROTO_TCP);
2213         if (ret)
2214                 goto out_tcpv6_protosw;
2215 out:
2216         return ret;
2217
2218 out_tcpv6_protocol:
2219         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2220 out_tcpv6_protosw:
2221         inet6_unregister_protosw(&tcpv6_protosw);
2222         goto out;
2223 }
2224
2225 void tcpv6_exit(void)
2226 {
2227         sock_release(tcp6_socket);
2228         inet6_unregister_protosw(&tcpv6_protosw);
2229         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2230 }