Linux-libre 3.16.85-gnu
[librecmc/linux-libre.git] / net / dccp / ipv6.c
1 /*
2  *      DCCP over IPv6
3  *      Linux INET6 implementation
4  *
5  *      Based on net/dccp6/ipv6.c
6  *
7  *      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
8  *
9  *      This program is free software; you can redistribute it and/or
10  *      modify it under the terms of the GNU General Public License
11  *      as published by the Free Software Foundation; either version
12  *      2 of the License, or (at your option) any later version.
13  */
14
15 #include <linux/module.h>
16 #include <linux/random.h>
17 #include <linux/slab.h>
18 #include <linux/xfrm.h>
19
20 #include <net/addrconf.h>
21 #include <net/inet_common.h>
22 #include <net/inet_hashtables.h>
23 #include <net/inet_sock.h>
24 #include <net/inet6_connection_sock.h>
25 #include <net/inet6_hashtables.h>
26 #include <net/ip6_route.h>
27 #include <net/ipv6.h>
28 #include <net/protocol.h>
29 #include <net/transp_v6.h>
30 #include <net/ip6_checksum.h>
31 #include <net/xfrm.h>
32 #include <net/secure_seq.h>
33
34 #include "dccp.h"
35 #include "ipv6.h"
36 #include "feat.h"
37
38 /* The per-net dccp.v6_ctl_sk is used for sending RSTs and ACKs */
39
40 static const struct inet_connection_sock_af_ops dccp_ipv6_mapped;
41 static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops;
42
43 static void dccp_v6_hash(struct sock *sk)
44 {
45         if (sk->sk_state != DCCP_CLOSED) {
46                 if (inet_csk(sk)->icsk_af_ops == &dccp_ipv6_mapped) {
47                         inet_hash(sk);
48                         return;
49                 }
50                 local_bh_disable();
51                 __inet6_hash(sk, NULL);
52                 local_bh_enable();
53         }
54 }
55
56 /* add pseudo-header to DCCP checksum stored in skb->csum */
57 static inline __sum16 dccp_v6_csum_finish(struct sk_buff *skb,
58                                       const struct in6_addr *saddr,
59                                       const struct in6_addr *daddr)
60 {
61         return csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_DCCP, skb->csum);
62 }
63
64 static inline void dccp_v6_send_check(struct sock *sk, struct sk_buff *skb)
65 {
66         struct ipv6_pinfo *np = inet6_sk(sk);
67         struct dccp_hdr *dh = dccp_hdr(skb);
68
69         dccp_csum_outgoing(skb);
70         dh->dccph_checksum = dccp_v6_csum_finish(skb, &np->saddr, &sk->sk_v6_daddr);
71 }
72
73 static inline __u64 dccp_v6_init_sequence(struct sk_buff *skb)
74 {
75         return secure_dccpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
76                                              ipv6_hdr(skb)->saddr.s6_addr32,
77                                              dccp_hdr(skb)->dccph_dport,
78                                              dccp_hdr(skb)->dccph_sport     );
79
80 }
81
82 static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
83                         u8 type, u8 code, int offset, __be32 info)
84 {
85         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
86         const struct dccp_hdr *dh;
87         struct dccp_sock *dp;
88         struct ipv6_pinfo *np;
89         struct sock *sk;
90         int err;
91         __u64 seq;
92         struct net *net = dev_net(skb->dev);
93
94         /* Only need dccph_dport & dccph_sport which are the first
95          * 4 bytes in dccp header.
96          * Our caller (icmpv6_notify()) already pulled 8 bytes for us.
97          */
98         BUILD_BUG_ON(offsetof(struct dccp_hdr, dccph_sport) + sizeof(dh->dccph_sport) > 8);
99         BUILD_BUG_ON(offsetof(struct dccp_hdr, dccph_dport) + sizeof(dh->dccph_dport) > 8);
100         dh = (struct dccp_hdr *)(skb->data + offset);
101
102         sk = inet6_lookup(net, &dccp_hashinfo,
103                         &hdr->daddr, dh->dccph_dport,
104                         &hdr->saddr, dh->dccph_sport, inet6_iif(skb));
105
106         if (sk == NULL) {
107                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
108                                    ICMP6_MIB_INERRORS);
109                 return;
110         }
111
112         if (sk->sk_state == DCCP_TIME_WAIT) {
113                 inet_twsk_put(inet_twsk(sk));
114                 return;
115         }
116
117         bh_lock_sock(sk);
118         if (sock_owned_by_user(sk))
119                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
120
121         if (sk->sk_state == DCCP_CLOSED)
122                 goto out;
123
124         dp = dccp_sk(sk);
125         seq = dccp_hdr_seq(dh);
126         if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
127             !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
128                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
129                 goto out;
130         }
131
132         np = inet6_sk(sk);
133
134         if (type == NDISC_REDIRECT) {
135                 if (!sock_owned_by_user(sk)) {
136                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
137
138                         if (dst)
139                                 dst->ops->redirect(dst, sk, skb);
140                 }
141                 goto out;
142         }
143
144         if (type == ICMPV6_PKT_TOOBIG) {
145                 struct dst_entry *dst = NULL;
146
147                 if (!ip6_sk_accept_pmtu(sk))
148                         goto out;
149
150                 if (sock_owned_by_user(sk))
151                         goto out;
152                 if ((1 << sk->sk_state) & (DCCPF_LISTEN | DCCPF_CLOSED))
153                         goto out;
154
155                 dst = inet6_csk_update_pmtu(sk, ntohl(info));
156                 if (!dst)
157                         goto out;
158
159                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst))
160                         dccp_sync_mss(sk, dst_mtu(dst));
161                 goto out;
162         }
163
164         icmpv6_err_convert(type, code, &err);
165
166         /* Might be for an request_sock */
167         switch (sk->sk_state) {
168                 struct request_sock *req, **prev;
169         case DCCP_LISTEN:
170                 if (sock_owned_by_user(sk))
171                         goto out;
172
173                 req = inet6_csk_search_req(sk, &prev, dh->dccph_dport,
174                                            &hdr->daddr, &hdr->saddr,
175                                            inet6_iif(skb));
176                 if (req == NULL)
177                         goto out;
178
179                 /*
180                  * ICMPs are not backlogged, hence we cannot get an established
181                  * socket here.
182                  */
183                 WARN_ON(req->sk != NULL);
184
185                 if (!between48(seq, dccp_rsk(req)->dreq_iss,
186                                     dccp_rsk(req)->dreq_gss)) {
187                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
188                         goto out;
189                 }
190
191                 inet_csk_reqsk_queue_drop(sk, req, prev);
192                 goto out;
193
194         case DCCP_REQUESTING:
195         case DCCP_RESPOND:  /* Cannot happen.
196                                It can, it SYNs are crossed. --ANK */
197                 if (!sock_owned_by_user(sk)) {
198                         DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
199                         sk->sk_err = err;
200                         /*
201                          * Wake people up to see the error
202                          * (see connect in sock.c)
203                          */
204                         sk->sk_error_report(sk);
205                         dccp_done(sk);
206                 } else
207                         sk->sk_err_soft = err;
208                 goto out;
209         }
210
211         if (!sock_owned_by_user(sk) && np->recverr) {
212                 sk->sk_err = err;
213                 sk->sk_error_report(sk);
214         } else
215                 sk->sk_err_soft = err;
216
217 out:
218         bh_unlock_sock(sk);
219         sock_put(sk);
220 }
221
222
223 static int dccp_v6_send_response(struct sock *sk, struct request_sock *req)
224 {
225         struct inet_request_sock *ireq = inet_rsk(req);
226         struct ipv6_pinfo *np = inet6_sk(sk);
227         struct sk_buff *skb;
228         struct in6_addr *final_p, final;
229         struct flowi6 fl6;
230         int err = -1;
231         struct dst_entry *dst;
232
233         memset(&fl6, 0, sizeof(fl6));
234         fl6.flowi6_proto = IPPROTO_DCCP;
235         fl6.daddr = ireq->ir_v6_rmt_addr;
236         fl6.saddr = ireq->ir_v6_loc_addr;
237         fl6.flowlabel = 0;
238         fl6.flowi6_oif = ireq->ir_iif;
239         fl6.fl6_dport = ireq->ir_rmt_port;
240         fl6.fl6_sport = htons(ireq->ir_num);
241         security_req_classify_flow(req, flowi6_to_flowi(&fl6));
242
243
244         rcu_read_lock();
245         final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final);
246         rcu_read_unlock();
247
248         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
249         if (IS_ERR(dst)) {
250                 err = PTR_ERR(dst);
251                 dst = NULL;
252                 goto done;
253         }
254
255         skb = dccp_make_response(sk, dst, req);
256         if (skb != NULL) {
257                 struct dccp_hdr *dh = dccp_hdr(skb);
258
259                 dh->dccph_checksum = dccp_v6_csum_finish(skb,
260                                                          &ireq->ir_v6_loc_addr,
261                                                          &ireq->ir_v6_rmt_addr);
262                 fl6.daddr = ireq->ir_v6_rmt_addr;
263                 rcu_read_lock();
264                 err = ip6_xmit(sk, skb, &fl6, rcu_dereference(np->opt),
265                                np->tclass);
266                 rcu_read_unlock();
267                 err = net_xmit_eval(err);
268         }
269
270 done:
271         dst_release(dst);
272         return err;
273 }
274
275 static void dccp_v6_reqsk_destructor(struct request_sock *req)
276 {
277         dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
278         kfree_skb(inet_rsk(req)->pktopts);
279 }
280
281 static void dccp_v6_ctl_send_reset(struct sock *sk, struct sk_buff *rxskb)
282 {
283         const struct ipv6hdr *rxip6h;
284         struct sk_buff *skb;
285         struct flowi6 fl6;
286         struct net *net = dev_net(skb_dst(rxskb)->dev);
287         struct sock *ctl_sk = net->dccp.v6_ctl_sk;
288         struct dst_entry *dst;
289
290         if (dccp_hdr(rxskb)->dccph_type == DCCP_PKT_RESET)
291                 return;
292
293         if (!ipv6_unicast_destination(rxskb))
294                 return;
295
296         skb = dccp_ctl_make_reset(ctl_sk, rxskb);
297         if (skb == NULL)
298                 return;
299
300         rxip6h = ipv6_hdr(rxskb);
301         dccp_hdr(skb)->dccph_checksum = dccp_v6_csum_finish(skb, &rxip6h->saddr,
302                                                             &rxip6h->daddr);
303
304         memset(&fl6, 0, sizeof(fl6));
305         fl6.daddr = rxip6h->saddr;
306         fl6.saddr = rxip6h->daddr;
307
308         fl6.flowi6_proto = IPPROTO_DCCP;
309         fl6.flowi6_oif = inet6_iif(rxskb);
310         fl6.fl6_dport = dccp_hdr(skb)->dccph_dport;
311         fl6.fl6_sport = dccp_hdr(skb)->dccph_sport;
312         security_skb_classify_flow(rxskb, flowi6_to_flowi(&fl6));
313
314         /* sk = NULL, but it is safe for now. RST socket required. */
315         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
316         if (!IS_ERR(dst)) {
317                 skb_dst_set(skb, dst);
318                 ip6_xmit(ctl_sk, skb, &fl6, NULL, 0);
319                 DCCP_INC_STATS_BH(DCCP_MIB_OUTSEGS);
320                 DCCP_INC_STATS_BH(DCCP_MIB_OUTRSTS);
321                 return;
322         }
323
324         kfree_skb(skb);
325 }
326
327 static struct request_sock_ops dccp6_request_sock_ops = {
328         .family         = AF_INET6,
329         .obj_size       = sizeof(struct dccp6_request_sock),
330         .rtx_syn_ack    = dccp_v6_send_response,
331         .send_ack       = dccp_reqsk_send_ack,
332         .destructor     = dccp_v6_reqsk_destructor,
333         .send_reset     = dccp_v6_ctl_send_reset,
334         .syn_ack_timeout = dccp_syn_ack_timeout,
335 };
336
337 static struct sock *dccp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
338 {
339         const struct dccp_hdr *dh = dccp_hdr(skb);
340         const struct ipv6hdr *iph = ipv6_hdr(skb);
341         struct sock *nsk;
342         struct request_sock **prev;
343         /* Find possible connection requests. */
344         struct request_sock *req = inet6_csk_search_req(sk, &prev,
345                                                         dh->dccph_sport,
346                                                         &iph->saddr,
347                                                         &iph->daddr,
348                                                         inet6_iif(skb));
349         if (req != NULL)
350                 return dccp_check_req(sk, skb, req, prev);
351
352         nsk = __inet6_lookup_established(sock_net(sk), &dccp_hashinfo,
353                                          &iph->saddr, dh->dccph_sport,
354                                          &iph->daddr, ntohs(dh->dccph_dport),
355                                          inet6_iif(skb));
356         if (nsk != NULL) {
357                 if (nsk->sk_state != DCCP_TIME_WAIT) {
358                         bh_lock_sock(nsk);
359                         return nsk;
360                 }
361                 inet_twsk_put(inet_twsk(nsk));
362                 return NULL;
363         }
364
365         return sk;
366 }
367
368 static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
369 {
370         struct request_sock *req;
371         struct dccp_request_sock *dreq;
372         struct inet_request_sock *ireq;
373         struct ipv6_pinfo *np = inet6_sk(sk);
374         const __be32 service = dccp_hdr_request(skb)->dccph_req_service;
375         struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
376
377         if (skb->protocol == htons(ETH_P_IP))
378                 return dccp_v4_conn_request(sk, skb);
379
380         if (!ipv6_unicast_destination(skb))
381                 return 0;       /* discard, don't send a reset here */
382
383         if (dccp_bad_service_code(sk, service)) {
384                 dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
385                 goto drop;
386         }
387         /*
388          * There are no SYN attacks on IPv6, yet...
389          */
390         dcb->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
391         if (inet_csk_reqsk_queue_is_full(sk))
392                 goto drop;
393
394         if (sk_acceptq_is_full(sk))
395                 goto drop;
396
397         req = inet6_reqsk_alloc(&dccp6_request_sock_ops);
398         if (req == NULL)
399                 goto drop;
400
401         if (dccp_reqsk_init(req, dccp_sk(sk), skb))
402                 goto drop_and_free;
403
404         dreq = dccp_rsk(req);
405         if (dccp_parse_options(sk, dreq, skb))
406                 goto drop_and_free;
407
408         if (security_inet_conn_request(sk, skb, req))
409                 goto drop_and_free;
410
411         ireq = inet_rsk(req);
412         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
413         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
414
415         if (ipv6_opt_accepted(sk, skb) ||
416             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
417             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
418                 atomic_inc(&skb->users);
419                 ireq->pktopts = skb;
420         }
421         ireq->ir_iif = sk->sk_bound_dev_if;
422
423         /* So that link locals have meaning */
424         if (!sk->sk_bound_dev_if &&
425             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
426                 ireq->ir_iif = inet6_iif(skb);
427
428         /*
429          * Step 3: Process LISTEN state
430          *
431          *   Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
432          *
433          * Setting S.SWL/S.SWH to is deferred to dccp_create_openreq_child().
434          */
435         dreq->dreq_isr     = dcb->dccpd_seq;
436         dreq->dreq_gsr     = dreq->dreq_isr;
437         dreq->dreq_iss     = dccp_v6_init_sequence(skb);
438         dreq->dreq_gss     = dreq->dreq_iss;
439         dreq->dreq_service = service;
440
441         if (dccp_v6_send_response(sk, req))
442                 goto drop_and_free;
443
444         inet6_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
445         return 0;
446
447 drop_and_free:
448         reqsk_free(req);
449 drop:
450         DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
451         return -1;
452 }
453
454 static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
455                                               struct sk_buff *skb,
456                                               struct request_sock *req,
457                                               struct dst_entry *dst)
458 {
459         struct inet_request_sock *ireq = inet_rsk(req);
460         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
461         struct ipv6_txoptions *opt;
462         struct inet_sock *newinet;
463         struct dccp6_sock *newdp6;
464         struct sock *newsk;
465
466         if (skb->protocol == htons(ETH_P_IP)) {
467                 /*
468                  *      v6 mapped
469                  */
470                 newsk = dccp_v4_request_recv_sock(sk, skb, req, dst);
471                 if (newsk == NULL)
472                         return NULL;
473
474                 newdp6 = (struct dccp6_sock *)newsk;
475                 newinet = inet_sk(newsk);
476                 newinet->pinet6 = &newdp6->inet6;
477                 newnp = inet6_sk(newsk);
478
479                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
480
481                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newsk->sk_v6_daddr);
482
483                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
484
485                 newsk->sk_v6_rcv_saddr = newnp->saddr;
486
487                 inet_csk(newsk)->icsk_af_ops = &dccp_ipv6_mapped;
488                 newsk->sk_backlog_rcv = dccp_v4_do_rcv;
489                 newnp->pktoptions  = NULL;
490                 newnp->opt         = NULL;
491                 newnp->ipv6_mc_list = NULL;
492                 newnp->ipv6_ac_list = NULL;
493                 newnp->ipv6_fl_list = NULL;
494                 newnp->mcast_oif   = inet_iif(skb);
495                 newnp->mcast_hops  = ip_hdr(skb)->ttl;
496
497                 /*
498                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
499                  * here, dccp_create_openreq_child now does this for us, see the comment in
500                  * that function for the gory details. -acme
501                  */
502
503                 /* It is tricky place. Until this moment IPv4 tcp
504                    worked with IPv6 icsk.icsk_af_ops.
505                    Sync it now.
506                  */
507                 dccp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
508
509                 return newsk;
510         }
511
512
513         if (sk_acceptq_is_full(sk))
514                 goto out_overflow;
515
516         if (dst == NULL) {
517                 struct in6_addr *final_p, final;
518                 struct flowi6 fl6;
519
520                 memset(&fl6, 0, sizeof(fl6));
521                 fl6.flowi6_proto = IPPROTO_DCCP;
522                 fl6.daddr = ireq->ir_v6_rmt_addr;
523                 final_p = fl6_update_dst(&fl6, np->opt, &final);
524                 fl6.saddr = ireq->ir_v6_loc_addr;
525                 fl6.flowi6_oif = sk->sk_bound_dev_if;
526                 fl6.fl6_dport = ireq->ir_rmt_port;
527                 fl6.fl6_sport = htons(ireq->ir_num);
528                 security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
529
530                 dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
531                 if (IS_ERR(dst))
532                         goto out;
533         }
534
535         newsk = dccp_create_openreq_child(sk, req, skb);
536         if (newsk == NULL)
537                 goto out_nonewsk;
538
539         /*
540          * No need to charge this sock to the relevant IPv6 refcnt debug socks
541          * count here, dccp_create_openreq_child now does this for us, see the
542          * comment in that function for the gory details. -acme
543          */
544
545         __ip6_dst_store(newsk, dst, NULL, NULL);
546         newsk->sk_route_caps = dst->dev->features & ~(NETIF_F_IP_CSUM |
547                                                       NETIF_F_TSO);
548         newdp6 = (struct dccp6_sock *)newsk;
549         newinet = inet_sk(newsk);
550         newinet->pinet6 = &newdp6->inet6;
551         newnp = inet6_sk(newsk);
552
553         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
554
555         newsk->sk_v6_daddr      = ireq->ir_v6_rmt_addr;
556         newnp->saddr            = ireq->ir_v6_loc_addr;
557         newsk->sk_v6_rcv_saddr  = ireq->ir_v6_loc_addr;
558         newsk->sk_bound_dev_if  = ireq->ir_iif;
559
560         /* Now IPv6 options...
561
562            First: no IPv4 options.
563          */
564         newinet->inet_opt = NULL;
565
566         /* Clone RX bits */
567         newnp->rxopt.all = np->rxopt.all;
568
569         newnp->ipv6_mc_list = NULL;
570         newnp->ipv6_ac_list = NULL;
571         newnp->ipv6_fl_list = NULL;
572         /* Clone pktoptions received with SYN */
573         newnp->pktoptions = NULL;
574         if (ireq->pktopts != NULL) {
575                 newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC);
576                 consume_skb(ireq->pktopts);
577                 ireq->pktopts = NULL;
578                 if (newnp->pktoptions)
579                         skb_set_owner_r(newnp->pktoptions, newsk);
580         }
581         newnp->opt        = NULL;
582         newnp->mcast_oif  = inet6_iif(skb);
583         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
584
585         /*
586          * Clone native IPv6 options from listening socket (if any)
587          *
588          * Yes, keeping reference count would be much more clever, but we make
589          * one more one thing there: reattach optmem to newsk.
590          */
591         opt = rcu_dereference(np->opt);
592         if (opt) {
593                 opt = ipv6_dup_options(newsk, opt);
594                 RCU_INIT_POINTER(newnp->opt, opt);
595         }
596         inet_csk(newsk)->icsk_ext_hdr_len = 0;
597         if (opt)
598                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
599                                                     opt->opt_flen;
600
601         dccp_sync_mss(newsk, dst_mtu(dst));
602
603         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
604         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
605
606         if (__inet_inherit_port(sk, newsk) < 0) {
607                 inet_csk_prepare_forced_close(newsk);
608                 dccp_done(newsk);
609                 goto out;
610         }
611         __inet6_hash(newsk, NULL);
612
613         return newsk;
614
615 out_overflow:
616         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
617 out_nonewsk:
618         dst_release(dst);
619 out:
620         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
621         return NULL;
622 }
623
624 /* The socket must have it's spinlock held when we get
625  * here.
626  *
627  * We have a potential double-lock case here, so even when
628  * doing backlog processing we use the BH locking scheme.
629  * This is because we cannot sleep with the original spinlock
630  * held.
631  */
632 static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
633 {
634         struct ipv6_pinfo *np = inet6_sk(sk);
635         struct sk_buff *opt_skb = NULL;
636
637         /* Imagine: socket is IPv6. IPv4 packet arrives,
638            goes to IPv4 receive handler and backlogged.
639            From backlog it always goes here. Kerboom...
640            Fortunately, dccp_rcv_established and rcv_established
641            handle them correctly, but it is not case with
642            dccp_v6_hnd_req and dccp_v6_ctl_send_reset().   --ANK
643          */
644
645         if (skb->protocol == htons(ETH_P_IP))
646                 return dccp_v4_do_rcv(sk, skb);
647
648         if (sk_filter(sk, skb))
649                 goto discard;
650
651         /*
652          * socket locking is here for SMP purposes as backlog rcv is currently
653          * called with bh processing disabled.
654          */
655
656         /* Do Stevens' IPV6_PKTOPTIONS.
657
658            Yes, guys, it is the only place in our code, where we
659            may make it not affecting IPv4.
660            The rest of code is protocol independent,
661            and I do not like idea to uglify IPv4.
662
663            Actually, all the idea behind IPV6_PKTOPTIONS
664            looks not very well thought. For now we latch
665            options, received in the last packet, enqueued
666            by tcp. Feel free to propose better solution.
667                                                --ANK (980728)
668          */
669         if (np->rxopt.all)
670         /*
671          * FIXME: Add handling of IPV6_PKTOPTIONS skb. See the comments below
672          *        (wrt ipv6_pktopions) and net/ipv6/tcp_ipv6.c for an example.
673          */
674                 opt_skb = skb_clone(skb, GFP_ATOMIC);
675
676         if (sk->sk_state == DCCP_OPEN) { /* Fast path */
677                 if (dccp_rcv_established(sk, skb, dccp_hdr(skb), skb->len))
678                         goto reset;
679                 if (opt_skb) {
680                         /* XXX This is where we would goto ipv6_pktoptions. */
681                         __kfree_skb(opt_skb);
682                 }
683                 return 0;
684         }
685
686         /*
687          *  Step 3: Process LISTEN state
688          *     If S.state == LISTEN,
689          *       If P.type == Request or P contains a valid Init Cookie option,
690          *            (* Must scan the packet's options to check for Init
691          *               Cookies.  Only Init Cookies are processed here,
692          *               however; other options are processed in Step 8.  This
693          *               scan need only be performed if the endpoint uses Init
694          *               Cookies *)
695          *            (* Generate a new socket and switch to that socket *)
696          *            Set S := new socket for this port pair
697          *            S.state = RESPOND
698          *            Choose S.ISS (initial seqno) or set from Init Cookies
699          *            Initialize S.GAR := S.ISS
700          *            Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookies
701          *            Continue with S.state == RESPOND
702          *            (* A Response packet will be generated in Step 11 *)
703          *       Otherwise,
704          *            Generate Reset(No Connection) unless P.type == Reset
705          *            Drop packet and return
706          *
707          * NOTE: the check for the packet types is done in
708          *       dccp_rcv_state_process
709          */
710         if (sk->sk_state == DCCP_LISTEN) {
711                 struct sock *nsk = dccp_v6_hnd_req(sk, skb);
712
713                 if (nsk == NULL)
714                         goto discard;
715                 /*
716                  * Queue it on the new socket if the new socket is active,
717                  * otherwise we just shortcircuit this and continue with
718                  * the new socket..
719                  */
720                 if (nsk != sk) {
721                         if (dccp_child_process(sk, nsk, skb))
722                                 goto reset;
723                         if (opt_skb != NULL)
724                                 __kfree_skb(opt_skb);
725                         return 0;
726                 }
727         }
728
729         if (dccp_rcv_state_process(sk, skb, dccp_hdr(skb), skb->len))
730                 goto reset;
731         if (opt_skb) {
732                 /* XXX This is where we would goto ipv6_pktoptions. */
733                 __kfree_skb(opt_skb);
734         }
735         return 0;
736
737 reset:
738         dccp_v6_ctl_send_reset(sk, skb);
739 discard:
740         if (opt_skb != NULL)
741                 __kfree_skb(opt_skb);
742         kfree_skb(skb);
743         return 0;
744 }
745
746 static int dccp_v6_rcv(struct sk_buff *skb)
747 {
748         const struct dccp_hdr *dh;
749         struct sock *sk;
750         int min_cov;
751
752         /* Step 1: Check header basics */
753
754         if (dccp_invalid_packet(skb))
755                 goto discard_it;
756
757         /* Step 1: If header checksum is incorrect, drop packet and return. */
758         if (dccp_v6_csum_finish(skb, &ipv6_hdr(skb)->saddr,
759                                      &ipv6_hdr(skb)->daddr)) {
760                 DCCP_WARN("dropped packet with invalid checksum\n");
761                 goto discard_it;
762         }
763
764         dh = dccp_hdr(skb);
765
766         DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(dh);
767         DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
768
769         if (dccp_packet_without_ack(skb))
770                 DCCP_SKB_CB(skb)->dccpd_ack_seq = DCCP_PKT_WITHOUT_ACK_SEQ;
771         else
772                 DCCP_SKB_CB(skb)->dccpd_ack_seq = dccp_hdr_ack_seq(skb);
773
774         /* Step 2:
775          *      Look up flow ID in table and get corresponding socket */
776         sk = __inet6_lookup_skb(&dccp_hashinfo, skb,
777                                 dh->dccph_sport, dh->dccph_dport);
778         /*
779          * Step 2:
780          *      If no socket ...
781          */
782         if (sk == NULL) {
783                 dccp_pr_debug("failed to look up flow ID in table and "
784                               "get corresponding socket\n");
785                 goto no_dccp_socket;
786         }
787
788         /*
789          * Step 2:
790          *      ... or S.state == TIMEWAIT,
791          *              Generate Reset(No Connection) unless P.type == Reset
792          *              Drop packet and return
793          */
794         if (sk->sk_state == DCCP_TIME_WAIT) {
795                 dccp_pr_debug("sk->sk_state == DCCP_TIME_WAIT: do_time_wait\n");
796                 inet_twsk_put(inet_twsk(sk));
797                 goto no_dccp_socket;
798         }
799
800         /*
801          * RFC 4340, sec. 9.2.1: Minimum Checksum Coverage
802          *      o if MinCsCov = 0, only packets with CsCov = 0 are accepted
803          *      o if MinCsCov > 0, also accept packets with CsCov >= MinCsCov
804          */
805         min_cov = dccp_sk(sk)->dccps_pcrlen;
806         if (dh->dccph_cscov  &&  (min_cov == 0 || dh->dccph_cscov < min_cov))  {
807                 dccp_pr_debug("Packet CsCov %d does not satisfy MinCsCov %d\n",
808                               dh->dccph_cscov, min_cov);
809                 /* FIXME: send Data Dropped option (see also dccp_v4_rcv) */
810                 goto discard_and_relse;
811         }
812
813         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
814                 goto discard_and_relse;
815
816         return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4) ? -1 : 0;
817
818 no_dccp_socket:
819         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
820                 goto discard_it;
821         /*
822          * Step 2:
823          *      If no socket ...
824          *              Generate Reset(No Connection) unless P.type == Reset
825          *              Drop packet and return
826          */
827         if (dh->dccph_type != DCCP_PKT_RESET) {
828                 DCCP_SKB_CB(skb)->dccpd_reset_code =
829                                         DCCP_RESET_CODE_NO_CONNECTION;
830                 dccp_v6_ctl_send_reset(sk, skb);
831         }
832
833 discard_it:
834         kfree_skb(skb);
835         return 0;
836
837 discard_and_relse:
838         sock_put(sk);
839         goto discard_it;
840 }
841
842 static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
843                            int addr_len)
844 {
845         struct sockaddr_in6 *usin = (struct sockaddr_in6 *)uaddr;
846         struct inet_connection_sock *icsk = inet_csk(sk);
847         struct inet_sock *inet = inet_sk(sk);
848         struct ipv6_pinfo *np = inet6_sk(sk);
849         struct dccp_sock *dp = dccp_sk(sk);
850         struct in6_addr *saddr = NULL, *final_p, final;
851         struct ipv6_txoptions *opt;
852         struct flowi6 fl6;
853         struct dst_entry *dst;
854         int addr_type;
855         int err;
856
857         dp->dccps_role = DCCP_ROLE_CLIENT;
858
859         if (addr_len < SIN6_LEN_RFC2133)
860                 return -EINVAL;
861
862         if (usin->sin6_family != AF_INET6)
863                 return -EAFNOSUPPORT;
864
865         memset(&fl6, 0, sizeof(fl6));
866
867         if (np->sndflow) {
868                 fl6.flowlabel = usin->sin6_flowinfo & IPV6_FLOWINFO_MASK;
869                 IP6_ECN_flow_init(fl6.flowlabel);
870                 if (fl6.flowlabel & IPV6_FLOWLABEL_MASK) {
871                         struct ip6_flowlabel *flowlabel;
872                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
873                         if (flowlabel == NULL)
874                                 return -EINVAL;
875                         fl6_sock_release(flowlabel);
876                 }
877         }
878         /*
879          * connect() to INADDR_ANY means loopback (BSD'ism).
880          */
881         if (ipv6_addr_any(&usin->sin6_addr))
882                 usin->sin6_addr.s6_addr[15] = 1;
883
884         addr_type = ipv6_addr_type(&usin->sin6_addr);
885
886         if (addr_type & IPV6_ADDR_MULTICAST)
887                 return -ENETUNREACH;
888
889         if (addr_type & IPV6_ADDR_LINKLOCAL) {
890                 if (addr_len >= sizeof(struct sockaddr_in6) &&
891                     usin->sin6_scope_id) {
892                         /* If interface is set while binding, indices
893                          * must coincide.
894                          */
895                         if (sk->sk_bound_dev_if &&
896                             sk->sk_bound_dev_if != usin->sin6_scope_id)
897                                 return -EINVAL;
898
899                         sk->sk_bound_dev_if = usin->sin6_scope_id;
900                 }
901
902                 /* Connect to link-local address requires an interface */
903                 if (!sk->sk_bound_dev_if)
904                         return -EINVAL;
905         }
906
907         sk->sk_v6_daddr = usin->sin6_addr;
908         np->flow_label = fl6.flowlabel;
909
910         /*
911          * DCCP over IPv4
912          */
913         if (addr_type == IPV6_ADDR_MAPPED) {
914                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
915                 struct sockaddr_in sin;
916
917                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
918
919                 if (__ipv6_only_sock(sk))
920                         return -ENETUNREACH;
921
922                 sin.sin_family = AF_INET;
923                 sin.sin_port = usin->sin6_port;
924                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
925
926                 icsk->icsk_af_ops = &dccp_ipv6_mapped;
927                 sk->sk_backlog_rcv = dccp_v4_do_rcv;
928
929                 err = dccp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
930                 if (err) {
931                         icsk->icsk_ext_hdr_len = exthdrlen;
932                         icsk->icsk_af_ops = &dccp_ipv6_af_ops;
933                         sk->sk_backlog_rcv = dccp_v6_do_rcv;
934                         goto failure;
935                 }
936                 ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
937                 ipv6_addr_set_v4mapped(inet->inet_rcv_saddr, &sk->sk_v6_rcv_saddr);
938
939                 return err;
940         }
941
942         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
943                 saddr = &sk->sk_v6_rcv_saddr;
944
945         fl6.flowi6_proto = IPPROTO_DCCP;
946         fl6.daddr = sk->sk_v6_daddr;
947         fl6.saddr = saddr ? *saddr : np->saddr;
948         fl6.flowi6_oif = sk->sk_bound_dev_if;
949         fl6.fl6_dport = usin->sin6_port;
950         fl6.fl6_sport = inet->inet_sport;
951         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
952
953         opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
954         final_p = fl6_update_dst(&fl6, opt, &final);
955
956         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
957         if (IS_ERR(dst)) {
958                 err = PTR_ERR(dst);
959                 goto failure;
960         }
961
962         if (saddr == NULL) {
963                 saddr = &fl6.saddr;
964                 sk->sk_v6_rcv_saddr = *saddr;
965         }
966
967         /* set the source address */
968         np->saddr = *saddr;
969         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
970
971         __ip6_dst_store(sk, dst, NULL, NULL);
972
973         icsk->icsk_ext_hdr_len = 0;
974         if (opt)
975                 icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
976
977         inet->inet_dport = usin->sin6_port;
978
979         dccp_set_state(sk, DCCP_REQUESTING);
980         err = inet6_hash_connect(&dccp_death_row, sk);
981         if (err)
982                 goto late_failure;
983
984         dp->dccps_iss = secure_dccpv6_sequence_number(np->saddr.s6_addr32,
985                                                       sk->sk_v6_daddr.s6_addr32,
986                                                       inet->inet_sport,
987                                                       inet->inet_dport);
988         err = dccp_connect(sk);
989         if (err)
990                 goto late_failure;
991
992         return 0;
993
994 late_failure:
995         dccp_set_state(sk, DCCP_CLOSED);
996         __sk_dst_reset(sk);
997 failure:
998         inet->inet_dport = 0;
999         sk->sk_route_caps = 0;
1000         return err;
1001 }
1002
1003 static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops = {
1004         .queue_xmit        = inet6_csk_xmit,
1005         .send_check        = dccp_v6_send_check,
1006         .rebuild_header    = inet6_sk_rebuild_header,
1007         .conn_request      = dccp_v6_conn_request,
1008         .syn_recv_sock     = dccp_v6_request_recv_sock,
1009         .net_header_len    = sizeof(struct ipv6hdr),
1010         .setsockopt        = ipv6_setsockopt,
1011         .getsockopt        = ipv6_getsockopt,
1012         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1013         .sockaddr_len      = sizeof(struct sockaddr_in6),
1014         .bind_conflict     = inet6_csk_bind_conflict,
1015 #ifdef CONFIG_COMPAT
1016         .compat_setsockopt = compat_ipv6_setsockopt,
1017         .compat_getsockopt = compat_ipv6_getsockopt,
1018 #endif
1019 };
1020
1021 /*
1022  *      DCCP over IPv4 via INET6 API
1023  */
1024 static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
1025         .queue_xmit        = ip_queue_xmit,
1026         .send_check        = dccp_v4_send_check,
1027         .rebuild_header    = inet_sk_rebuild_header,
1028         .conn_request      = dccp_v6_conn_request,
1029         .syn_recv_sock     = dccp_v6_request_recv_sock,
1030         .net_header_len    = sizeof(struct iphdr),
1031         .setsockopt        = ipv6_setsockopt,
1032         .getsockopt        = ipv6_getsockopt,
1033         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1034         .sockaddr_len      = sizeof(struct sockaddr_in6),
1035         .bind_conflict     = inet6_csk_bind_conflict,
1036 #ifdef CONFIG_COMPAT
1037         .compat_setsockopt = compat_ipv6_setsockopt,
1038         .compat_getsockopt = compat_ipv6_getsockopt,
1039 #endif
1040 };
1041
1042 /* NOTE: A lot of things set to zero explicitly by call to
1043  *       sk_alloc() so need not be done here.
1044  */
1045 static int dccp_v6_init_sock(struct sock *sk)
1046 {
1047         static __u8 dccp_v6_ctl_sock_initialized;
1048         int err = dccp_init_sock(sk, dccp_v6_ctl_sock_initialized);
1049
1050         if (err == 0) {
1051                 if (unlikely(!dccp_v6_ctl_sock_initialized))
1052                         dccp_v6_ctl_sock_initialized = 1;
1053                 inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops;
1054         }
1055
1056         return err;
1057 }
1058
1059 static void dccp_v6_destroy_sock(struct sock *sk)
1060 {
1061         dccp_destroy_sock(sk);
1062         inet6_destroy_sock(sk);
1063 }
1064
1065 static struct timewait_sock_ops dccp6_timewait_sock_ops = {
1066         .twsk_obj_size  = sizeof(struct dccp6_timewait_sock),
1067 };
1068
1069 static struct proto dccp_v6_prot = {
1070         .name              = "DCCPv6",
1071         .owner             = THIS_MODULE,
1072         .close             = dccp_close,
1073         .connect           = dccp_v6_connect,
1074         .disconnect        = dccp_disconnect,
1075         .ioctl             = dccp_ioctl,
1076         .init              = dccp_v6_init_sock,
1077         .setsockopt        = dccp_setsockopt,
1078         .getsockopt        = dccp_getsockopt,
1079         .sendmsg           = dccp_sendmsg,
1080         .recvmsg           = dccp_recvmsg,
1081         .backlog_rcv       = dccp_v6_do_rcv,
1082         .hash              = dccp_v6_hash,
1083         .unhash            = inet_unhash,
1084         .accept            = inet_csk_accept,
1085         .get_port          = inet_csk_get_port,
1086         .shutdown          = dccp_shutdown,
1087         .destroy           = dccp_v6_destroy_sock,
1088         .orphan_count      = &dccp_orphan_count,
1089         .max_header        = MAX_DCCP_HEADER,
1090         .obj_size          = sizeof(struct dccp6_sock),
1091         .slab_flags        = SLAB_DESTROY_BY_RCU,
1092         .rsk_prot          = &dccp6_request_sock_ops,
1093         .twsk_prot         = &dccp6_timewait_sock_ops,
1094         .h.hashinfo        = &dccp_hashinfo,
1095 #ifdef CONFIG_COMPAT
1096         .compat_setsockopt = compat_dccp_setsockopt,
1097         .compat_getsockopt = compat_dccp_getsockopt,
1098 #endif
1099 };
1100
1101 static const struct inet6_protocol dccp_v6_protocol = {
1102         .handler        = dccp_v6_rcv,
1103         .err_handler    = dccp_v6_err,
1104         .flags          = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
1105 };
1106
1107 static const struct proto_ops inet6_dccp_ops = {
1108         .family            = PF_INET6,
1109         .owner             = THIS_MODULE,
1110         .release           = inet6_release,
1111         .bind              = inet6_bind,
1112         .connect           = inet_stream_connect,
1113         .socketpair        = sock_no_socketpair,
1114         .accept            = inet_accept,
1115         .getname           = inet6_getname,
1116         .poll              = dccp_poll,
1117         .ioctl             = inet6_ioctl,
1118         .listen            = inet_dccp_listen,
1119         .shutdown          = inet_shutdown,
1120         .setsockopt        = sock_common_setsockopt,
1121         .getsockopt        = sock_common_getsockopt,
1122         .sendmsg           = inet_sendmsg,
1123         .recvmsg           = sock_common_recvmsg,
1124         .mmap              = sock_no_mmap,
1125         .sendpage          = sock_no_sendpage,
1126 #ifdef CONFIG_COMPAT
1127         .compat_setsockopt = compat_sock_common_setsockopt,
1128         .compat_getsockopt = compat_sock_common_getsockopt,
1129 #endif
1130 };
1131
1132 static struct inet_protosw dccp_v6_protosw = {
1133         .type           = SOCK_DCCP,
1134         .protocol       = IPPROTO_DCCP,
1135         .prot           = &dccp_v6_prot,
1136         .ops            = &inet6_dccp_ops,
1137         .flags          = INET_PROTOSW_ICSK,
1138 };
1139
1140 static int __net_init dccp_v6_init_net(struct net *net)
1141 {
1142         if (dccp_hashinfo.bhash == NULL)
1143                 return -ESOCKTNOSUPPORT;
1144
1145         return inet_ctl_sock_create(&net->dccp.v6_ctl_sk, PF_INET6,
1146                                     SOCK_DCCP, IPPROTO_DCCP, net);
1147 }
1148
1149 static void __net_exit dccp_v6_exit_net(struct net *net)
1150 {
1151         inet_ctl_sock_destroy(net->dccp.v6_ctl_sk);
1152 }
1153
1154 static void __net_exit dccp_v6_exit_batch(struct list_head *net_exit_list)
1155 {
1156         inet_twsk_purge(&dccp_hashinfo, &dccp_death_row, AF_INET6);
1157 }
1158
1159 static struct pernet_operations dccp_v6_ops = {
1160         .init   = dccp_v6_init_net,
1161         .exit   = dccp_v6_exit_net,
1162         .exit_batch = dccp_v6_exit_batch,
1163 };
1164
1165 static int __init dccp_v6_init(void)
1166 {
1167         int err = proto_register(&dccp_v6_prot, 1);
1168
1169         if (err != 0)
1170                 goto out;
1171
1172         err = inet6_add_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1173         if (err != 0)
1174                 goto out_unregister_proto;
1175
1176         inet6_register_protosw(&dccp_v6_protosw);
1177
1178         err = register_pernet_subsys(&dccp_v6_ops);
1179         if (err != 0)
1180                 goto out_destroy_ctl_sock;
1181 out:
1182         return err;
1183
1184 out_destroy_ctl_sock:
1185         inet6_del_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1186         inet6_unregister_protosw(&dccp_v6_protosw);
1187 out_unregister_proto:
1188         proto_unregister(&dccp_v6_prot);
1189         goto out;
1190 }
1191
1192 static void __exit dccp_v6_exit(void)
1193 {
1194         unregister_pernet_subsys(&dccp_v6_ops);
1195         inet6_del_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1196         inet6_unregister_protosw(&dccp_v6_protosw);
1197         proto_unregister(&dccp_v6_prot);
1198 }
1199
1200 module_init(dccp_v6_init);
1201 module_exit(dccp_v6_exit);
1202
1203 /*
1204  * __stringify doesn't likes enums, so use SOCK_DCCP (6) and IPPROTO_DCCP (33)
1205  * values directly, Also cover the case where the protocol is not specified,
1206  * i.e. net-pf-PF_INET6-proto-0-type-SOCK_DCCP
1207  */
1208 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 33, 6);
1209 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 0, 6);
1210 MODULE_LICENSE("GPL");
1211 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
1212 MODULE_DESCRIPTION("DCCPv6 - Datagram Congestion Controlled Protocol");