net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/tcp_memcontrol.h>
  65 #include <net/busy_poll.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 #include <linux/crypto.h>
  71 #include <linux/scatterlist.h>
  72
  73 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  75                                       struct request_sock *req);
  76
  77 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  78
  79 static const struct inet_connection_sock_af_ops ipv6_mapped;
  80 static const struct inet_connection_sock_af_ops ipv6_specific;
  81 #ifdef CONFIG_TCP_MD5SIG
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  84 #else
  85 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  86                                                    const struct in6_addr *addr)
  87 {
  88         return NULL;
  89 }
  90 #endif
  91
  92 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  93 {
  94         struct dst_entry *dst = skb_dst(skb);
  95
  96         if (dst && dst_hold_safe(dst)) {
  97                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99                 sk->sk_rx_dst = dst;
 100                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 101                 if (rt->rt6i_node)
 102                         inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 103         }
 104 }
 105
 106 static void tcp_v6_hash(struct sock *sk)
 107 {
 108         if (sk->sk_state != TCP_CLOSE) {
 109                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 110                         tcp_prot.hash(sk);
 111                         return;
 112                 }
 113                 local_bh_disable();
 114                 __inet6_hash(sk, NULL);
 115                 local_bh_enable();
 116         }
 117 }
 118
 119 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 120 {
 121         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 122                                             ipv6_hdr(skb)->saddr.s6_addr32,
 123                                             tcp_hdr(skb)->dest,
 124                                             tcp_hdr(skb)->source);
 125 }
 126
 127 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 128                           int addr_len)
 129 {
 130         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 131         struct inet_sock *inet = inet_sk(sk);
 132         struct inet_connection_sock *icsk = inet_csk(sk);
 133         struct ipv6_pinfo *np = inet6_sk(sk);
 134         struct tcp_sock *tp = tcp_sk(sk);
 135         struct in6_addr *saddr = NULL, *final_p, final;
 136         struct ipv6_txoptions *opt;
 137         struct rt6_info *rt;
 138         struct flowi6 fl6;
 139         struct dst_entry *dst;
 140         int addr_type;
 141         int err;
 142
 143         if (addr_len < SIN6_LEN_RFC2133)
 144                 return -EINVAL;
 145
 146         if (usin->sin6_family != AF_INET6)
 147                 return -EAFNOSUPPORT;
 148
 149         memset(&fl6, 0, sizeof(fl6));
 150
 151         if (np->sndflow) {
 152                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 153                 IP6_ECN_flow_init(fl6.flowlabel);
 154                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 155                         struct ip6_flowlabel *flowlabel;
 156                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 157                         if (flowlabel == NULL)
 158                                 return -EINVAL;
 159                         fl6_sock_release(flowlabel);
 160                 }
 161         }
 162
 163         /*
 164          *      connect() to INADDR_ANY means loopback (BSD'ism).
 165          */
 166
 167         if (ipv6_addr_any(&usin->sin6_addr))
 168                 usin->sin6_addr.s6_addr[15] = 0x1;
 169
 170         addr_type = ipv6_addr_type(&usin->sin6_addr);
 171
 172         if (addr_type & IPV6_ADDR_MULTICAST)
 173                 return -ENETUNREACH;
 174
 175         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 176                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 177                     usin->sin6_scope_id) {
 178                         /* If interface is set while binding, indices
 179                          * must coincide.
 180                          */
 181                         if (sk->sk_bound_dev_if &&
 182                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 183                                 return -EINVAL;
 184
 185                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 186                 }
 187
 188                 /* Connect to link-local address requires an interface */
 189                 if (!sk->sk_bound_dev_if)
 190                         return -EINVAL;
 191         }
 192
 193         if (tp->rx_opt.ts_recent_stamp &&
 194             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 195                 tp->rx_opt.ts_recent = 0;
 196                 tp->rx_opt.ts_recent_stamp = 0;
 197                 tp->write_seq = 0;
 198         }
 199
 200         sk->sk_v6_daddr = usin->sin6_addr;
 201         np->flow_label = fl6.flowlabel;
 202
 203         /*
 204          *      TCP over IPv4
 205          */
 206
 207         if (addr_type == IPV6_ADDR_MAPPED) {
 208                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 209                 struct sockaddr_in sin;
 210
 211                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 212
 213                 if (__ipv6_only_sock(sk))
 214                         return -ENETUNREACH;
 215
 216                 sin.sin_family = AF_INET;
 217                 sin.sin_port = usin->sin6_port;
 218                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 219
 220                 icsk->icsk_af_ops = &ipv6_mapped;
 221                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 224 #endif
 225
 226                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 227
 228                 if (err) {
 229                         icsk->icsk_ext_hdr_len = exthdrlen;
 230                         icsk->icsk_af_ops = &ipv6_specific;
 231                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 232 #ifdef CONFIG_TCP_MD5SIG
 233                         tp->af_specific = &tcp_sock_ipv6_specific;
 234 #endif
 235                         goto failure;
 236                 } else {
 237                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 238                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 239                                                &sk->sk_v6_rcv_saddr);
 240                 }
 241
 242                 return err;
 243         }
 244
 245         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 246                 saddr = &sk->sk_v6_rcv_saddr;
 247
 248         fl6.flowi6_proto = IPPROTO_TCP;
 249         fl6.daddr = sk->sk_v6_daddr;
 250         fl6.saddr = saddr ? *saddr : np->saddr;
 251         fl6.flowi6_oif = sk->sk_bound_dev_if;
 252         fl6.flowi6_mark = sk->sk_mark;
 253         fl6.fl6_dport = usin->sin6_port;
 254         fl6.fl6_sport = inet->inet_sport;
 255
 256         opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
 257         final_p = fl6_update_dst(&fl6, opt, &final);
 258
 259         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 260
 261         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 262         if (IS_ERR(dst)) {
 263                 err = PTR_ERR(dst);
 264                 goto failure;
 265         }
 266
 267         if (saddr == NULL) {
 268                 saddr = &fl6.saddr;
 269                 sk->sk_v6_rcv_saddr = *saddr;
 270         }
 271
 272         /* set the source address */
 273         np->saddr = *saddr;
 274         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 275
 276         sk->sk_gso_type = SKB_GSO_TCPV6;
 277         __ip6_dst_store(sk, dst, NULL, NULL);
 278
 279         rt = (struct rt6_info *) dst;
 280         if (tcp_death_row.sysctl_tw_recycle &&
 281             !tp->rx_opt.ts_recent_stamp &&
 282             ipv6_addr_equal(&rt->rt6i_dst.addr, &sk->sk_v6_daddr))
 283                 tcp_fetch_timewait_stamp(sk, dst);
 284
 285         icsk->icsk_ext_hdr_len = 0;
 286         if (opt)
 287                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 288                                          opt->opt_nflen;
 289
 290         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 291
 292         inet->inet_dport = usin->sin6_port;
 293
 294         tcp_set_state(sk, TCP_SYN_SENT);
 295         err = inet6_hash_connect(&tcp_death_row, sk);
 296         if (err)
 297                 goto late_failure;
 298
 299         ip6_set_txhash(sk);
 300
 301         if (!tp->write_seq && likely(!tp->repair))
 302                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 303                                                              sk->sk_v6_daddr.s6_addr32,
 304                                                              inet->inet_sport,
 305                                                              inet->inet_dport);
 306
 307         err = tcp_connect(sk);
 308         if (err)
 309                 goto late_failure;
 310
 311         return 0;
 312
 313 late_failure:
 314         tcp_set_state(sk, TCP_CLOSE);
 315         __sk_dst_reset(sk);
 316 failure:
 317         inet->inet_dport = 0;
 318         sk->sk_route_caps = 0;
 319         return err;
 320 }
 321
 322 static void tcp_v6_mtu_reduced(struct sock *sk)
 323 {
 324         struct dst_entry *dst;
 325
 326         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 327                 return;
 328
 329         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 330         if (!dst)
 331                 return;
 332
 333         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 334                 tcp_sync_mss(sk, dst_mtu(dst));
 335                 tcp_simple_retransmit(sk);
 336         }
 337 }
 338
 339 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 340                 u8 type, u8 code, int offset, __be32 info)
 341 {
 342         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 343         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 344         struct ipv6_pinfo *np;
 345         struct sock *sk;
 346         int err;
 347         struct tcp_sock *tp;
 348         struct request_sock *fastopen;
 349         __u32 seq, snd_una;
 350         struct net *net = dev_net(skb->dev);
 351
 352         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 353                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 354
 355         if (sk == NULL) {
 356                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 357                                    ICMP6_MIB_INERRORS);
 358                 return;
 359         }
 360
 361         if (sk->sk_state == TCP_TIME_WAIT) {
 362                 inet_twsk_put(inet_twsk(sk));
 363                 return;
 364         }
 365
 366         bh_lock_sock(sk);
 367         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 368                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 369
 370         if (sk->sk_state == TCP_CLOSE)
 371                 goto out;
 372
 373         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 374                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 375                 goto out;
 376         }
 377
 378         tp = tcp_sk(sk);
 379         seq = ntohl(th->seq);
 380         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 381         fastopen = tp->fastopen_rsk;
 382         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 383         if (sk->sk_state != TCP_LISTEN &&
 384             !between(seq, snd_una, tp->snd_nxt)) {
 385                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 386                 goto out;
 387         }
 388
 389         np = inet6_sk(sk);
 390
 391         if (type == NDISC_REDIRECT) {
 392                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 393
 394                 if (dst)
 395                         dst->ops->redirect(dst, sk, skb);
 396                 goto out;
 397         }
 398
 399         if (type == ICMPV6_PKT_TOOBIG) {
 400                 /* We are not interested in TCP_LISTEN and open_requests
 401                  * (SYN-ACKs send out by Linux are always <576bytes so
 402                  * they should go through unfragmented).
 403                  */
 404                 if (sk->sk_state == TCP_LISTEN)
 405                         goto out;
 406
 407                 if (!ip6_sk_accept_pmtu(sk))
 408                         goto out;
 409
 410                 tp->mtu_info = ntohl(info);
 411                 if (!sock_owned_by_user(sk))
 412                         tcp_v6_mtu_reduced(sk);
 413                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 414                                            &tp->tsq_flags))
 415                         sock_hold(sk);
 416                 goto out;
 417         }
 418
 419         icmpv6_err_convert(type, code, &err);
 420
 421         /* Might be for an request_sock */
 422         switch (sk->sk_state) {
 423                 struct request_sock *req, **prev;
 424         case TCP_LISTEN:
 425                 if (sock_owned_by_user(sk))
 426                         goto out;
 427
 428                 /* Note : We use inet6_iif() here, not tcp_v6_iif() */
 429                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 430                                            &hdr->saddr, inet6_iif(skb));
 431                 if (!req)
 432                         goto out;
 433
 434                 /* ICMPs are not backlogged, hence we cannot get
 435                  * an established socket here.
 436                  */
 437                 WARN_ON(req->sk != NULL);
 438
 439                 if (seq != tcp_rsk(req)->snt_isn) {
 440                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 441                         goto out;
 442                 }
 443
 444                 inet_csk_reqsk_queue_drop(sk, req, prev);
 445                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 446                 goto out;
 447
 448         case TCP_SYN_SENT:
 449         case TCP_SYN_RECV:
 450                 /* Only in fast or simultaneous open. If a fast open socket is
 451                  * is already accepted it is treated as a connected one below.
 452                  */
 453                 if (fastopen && fastopen->sk == NULL)
 454                         break;
 455
 456                 if (!sock_owned_by_user(sk)) {
 457                         sk->sk_err = err;
 458                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 459
 460                         tcp_done(sk);
 461                 } else
 462                         sk->sk_err_soft = err;
 463                 goto out;
 464         }
 465
 466         if (!sock_owned_by_user(sk) && np->recverr) {
 467                 sk->sk_err = err;
 468                 sk->sk_error_report(sk);
 469         } else
 470                 sk->sk_err_soft = err;
 471
 472 out:
 473         bh_unlock_sock(sk);
 474         sock_put(sk);
 475 }
 476
 477
 478 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 479                               struct flowi *fl,
 480                               struct request_sock *req,
 481                               u16 queue_mapping,
 482                               struct tcp_fastopen_cookie *foc)
 483 {
 484         struct inet_request_sock *ireq = inet_rsk(req);
 485         struct ipv6_pinfo *np = inet6_sk(sk);
 486         struct flowi6 *fl6 = &fl->u.ip6;
 487         struct sk_buff *skb;
 488         int err = -ENOMEM;
 489
 490         /* First, grab a route. */
 491         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 492                 goto done;
 493
 494         skb = tcp_make_synack(sk, dst, req, foc);
 495
 496         if (skb) {
 497                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 498                                     &ireq->ir_v6_rmt_addr);
 499
 500                 fl6->daddr = ireq->ir_v6_rmt_addr;
 501                 if (np->repflow && (ireq->pktopts != NULL))
 502                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 503
 504                 skb_set_queue_mapping(skb, queue_mapping);
 505                 rcu_read_lock();
 506                 err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
 507                                np->tclass);
 508                 rcu_read_unlock();
 509                 err = net_xmit_eval(err);
 510         }
 511
 512 done:
 513         return err;
 514 }
 515
 516
 517 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 518 {
 519         kfree_skb(inet_rsk(req)->pktopts);
 520 }
 521
 522 #ifdef CONFIG_TCP_MD5SIG
 523 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 524                                                    const struct in6_addr *addr)
 525 {
 526         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 527 }
 528
 529 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 530                                                 struct sock *addr_sk)
 531 {
 532         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 533 }
 534
 535 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 536                                                       struct request_sock *req)
 537 {
 538         return tcp_v6_md5_do_lookup(sk, &inet_rsk(req)->ir_v6_rmt_addr);
 539 }
 540
 541 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 542                                  int optlen)
 543 {
 544         struct tcp_md5sig cmd;
 545         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 546
 547         if (optlen < sizeof(cmd))
 548                 return -EINVAL;
 549
 550         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 551                 return -EFAULT;
 552
 553         if (sin6->sin6_family != AF_INET6)
 554                 return -EINVAL;
 555
 556         if (!cmd.tcpm_keylen) {
 557                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 558                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 559                                               AF_INET);
 560                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 561                                       AF_INET6);
 562         }
 563
 564         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 565                 return -EINVAL;
 566
 567         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 568                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 569                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 570
 571         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 572                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 573 }
 574
 575 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 576                                         const struct in6_addr *daddr,
 577                                         const struct in6_addr *saddr, int nbytes)
 578 {
 579         struct tcp6_pseudohdr *bp;
 580         struct scatterlist sg;
 581
 582         bp = &hp->md5_blk.ip6;
 583         /* 1. TCP pseudo-header (RFC2460) */
 584         bp->saddr = *saddr;
 585         bp->daddr = *daddr;
 586         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 587         bp->len = cpu_to_be32(nbytes);
 588
 589         sg_init_one(&sg, bp, sizeof(*bp));
 590         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 591 }
 592
 593 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 594                                const struct in6_addr *daddr, struct in6_addr *saddr,
 595                                const struct tcphdr *th)
 596 {
 597         struct tcp_md5sig_pool *hp;
 598         struct hash_desc *desc;
 599
 600         hp = tcp_get_md5sig_pool();
 601         if (!hp)
 602                 goto clear_hash_noput;
 603         desc = &hp->md5_desc;
 604
 605         if (crypto_hash_init(desc))
 606                 goto clear_hash;
 607         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 608                 goto clear_hash;
 609         if (tcp_md5_hash_header(hp, th))
 610                 goto clear_hash;
 611         if (tcp_md5_hash_key(hp, key))
 612                 goto clear_hash;
 613         if (crypto_hash_final(desc, md5_hash))
 614                 goto clear_hash;
 615
 616         tcp_put_md5sig_pool();
 617         return 0;
 618
 619 clear_hash:
 620         tcp_put_md5sig_pool();
 621 clear_hash_noput:
 622         memset(md5_hash, 0, 16);
 623         return 1;
 624 }
 625
 626 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 627                                const struct sock *sk,
 628                                const struct request_sock *req,
 629                                const struct sk_buff *skb)
 630 {
 631         const struct in6_addr *saddr, *daddr;
 632         struct tcp_md5sig_pool *hp;
 633         struct hash_desc *desc;
 634         const struct tcphdr *th = tcp_hdr(skb);
 635
 636         if (sk) {
 637                 saddr = &inet6_sk(sk)->saddr;
 638                 daddr = &sk->sk_v6_daddr;
 639         } else if (req) {
 640                 saddr = &inet_rsk(req)->ir_v6_loc_addr;
 641                 daddr = &inet_rsk(req)->ir_v6_rmt_addr;
 642         } else {
 643                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 644                 saddr = &ip6h->saddr;
 645                 daddr = &ip6h->daddr;
 646         }
 647
 648         hp = tcp_get_md5sig_pool();
 649         if (!hp)
 650                 goto clear_hash_noput;
 651         desc = &hp->md5_desc;
 652
 653         if (crypto_hash_init(desc))
 654                 goto clear_hash;
 655
 656         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 657                 goto clear_hash;
 658         if (tcp_md5_hash_header(hp, th))
 659                 goto clear_hash;
 660         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 661                 goto clear_hash;
 662         if (tcp_md5_hash_key(hp, key))
 663                 goto clear_hash;
 664         if (crypto_hash_final(desc, md5_hash))
 665                 goto clear_hash;
 666
 667         tcp_put_md5sig_pool();
 668         return 0;
 669
 670 clear_hash:
 671         tcp_put_md5sig_pool();
 672 clear_hash_noput:
 673         memset(md5_hash, 0, 16);
 674         return 1;
 675 }
 676
 677 static int __tcp_v6_inbound_md5_hash(struct sock *sk,
 678                                      const struct sk_buff *skb)
 679 {
 680         const __u8 *hash_location = NULL;
 681         struct tcp_md5sig_key *hash_expected;
 682         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 683         const struct tcphdr *th = tcp_hdr(skb);
 684         int genhash;
 685         u8 newhash[16];
 686
 687         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 688         hash_location = tcp_parse_md5sig_option(th);
 689
 690         /* We've parsed the options - do we have a hash? */
 691         if (!hash_expected && !hash_location)
 692                 return 0;
 693
 694         if (hash_expected && !hash_location) {
 695                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 696                 return 1;
 697         }
 698
 699         if (!hash_expected && hash_location) {
 700                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 701                 return 1;
 702         }
 703
 704         /* check the signature */
 705         genhash = tcp_v6_md5_hash_skb(newhash,
 706                                       hash_expected,
 707                                       NULL, NULL, skb);
 708
 709         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 710                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 711                                      genhash ? "failed" : "mismatch",
 712                                      &ip6h->saddr, ntohs(th->source),
 713                                      &ip6h->daddr, ntohs(th->dest));
 714                 return 1;
 715         }
 716         return 0;
 717 }
 718
 719 static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 720 {
 721         int ret;
 722
 723         rcu_read_lock();
 724         ret = __tcp_v6_inbound_md5_hash(sk, skb);
 725         rcu_read_unlock();
 726
 727         return ret;
 728 }
 729
 730 #endif
 731
 732 static void tcp_v6_init_req(struct request_sock *req, struct sock *sk,
 733                             struct sk_buff *skb)
 734 {
 735         struct inet_request_sock *ireq = inet_rsk(req);
 736         struct ipv6_pinfo *np = inet6_sk(sk);
 737
 738         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 739         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 740
 741         ireq->ir_iif = sk->sk_bound_dev_if;
 742
 743         /* So that link locals have meaning */
 744         if (!sk->sk_bound_dev_if &&
 745             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 746                 ireq->ir_iif = tcp_v6_iif(skb);
 747
 748         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 749             (ipv6_opt_accepted(sk, skb, &TCP_SKB_CB(skb)->header.h6) ||
 750              np->rxopt.bits.rxinfo ||
 751              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 752              np->rxopt.bits.rxohlim || np->repflow)) {
 753                 atomic_inc(&skb->users);
 754                 ireq->pktopts = skb;
 755         }
 756 }
 757
 758 static struct dst_entry *tcp_v6_route_req(struct sock *sk, struct flowi *fl,
 759                                           const struct request_sock *req,
 760                                           bool *strict)
 761 {
 762         if (strict)
 763                 *strict = true;
 764         return inet6_csk_route_req(sk, &fl->u.ip6, req);
 765 }
 766
 767 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 768         .family         =       AF_INET6,
 769         .obj_size       =       sizeof(struct tcp6_request_sock),
 770         .rtx_syn_ack    =       tcp_rtx_synack,
 771         .send_ack       =       tcp_v6_reqsk_send_ack,
 772         .destructor     =       tcp_v6_reqsk_destructor,
 773         .send_reset     =       tcp_v6_send_reset,
 774         .syn_ack_timeout =      tcp_syn_ack_timeout,
 775 };
 776
 777 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 778         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 779                                 sizeof(struct ipv6hdr),
 780 #ifdef CONFIG_TCP_MD5SIG
 781         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 782         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 783 #endif
 784         .init_req       =       tcp_v6_init_req,
 785 #ifdef CONFIG_SYN_COOKIES
 786         .cookie_init_seq =      cookie_v6_init_sequence,
 787 #endif
 788         .route_req      =       tcp_v6_route_req,
 789         .init_seq       =       tcp_v6_init_sequence,
 790         .send_synack    =       tcp_v6_send_synack,
 791         .queue_hash_add =       inet6_csk_reqsk_queue_hash_add,
 792 };
 793
 794 static void tcp_v6_send_response(struct sock *sk, struct sk_buff *skb, u32 seq,
 795                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 796                                  int oif, struct tcp_md5sig_key *key, int rst,
 797                                  u8 tclass, u32 label)
 798 {
 799         const struct tcphdr *th = tcp_hdr(skb);
 800         struct tcphdr *t1;
 801         struct sk_buff *buff;
 802         struct flowi6 fl6;
 803         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 804         struct sock *ctl_sk = net->ipv6.tcp_sk;
 805         unsigned int tot_len = sizeof(struct tcphdr);
 806         struct dst_entry *dst;
 807         __be32 *topt;
 808
 809         if (tsecr)
 810                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 811 #ifdef CONFIG_TCP_MD5SIG
 812         if (key)
 813                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 814 #endif
 815
 816         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 817                          GFP_ATOMIC);
 818         if (buff == NULL)
 819                 return;
 820
 821         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 822
 823         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 824         skb_reset_transport_header(buff);
 825
 826         /* Swap the send and the receive. */
 827         memset(t1, 0, sizeof(*t1));
 828         t1->dest = th->source;
 829         t1->source = th->dest;
 830         t1->doff = tot_len / 4;
 831         t1->seq = htonl(seq);
 832         t1->ack_seq = htonl(ack);
 833         t1->ack = !rst || !th->ack;
 834         t1->rst = rst;
 835         t1->window = htons(win);
 836
 837         topt = (__be32 *)(t1 + 1);
 838
 839         if (tsecr) {
 840                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 841                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 842                 *topt++ = htonl(tsval);
 843                 *topt++ = htonl(tsecr);
 844         }
 845
 846 #ifdef CONFIG_TCP_MD5SIG
 847         if (key) {
 848                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 849                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 850                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 851                                     &ipv6_hdr(skb)->saddr,
 852                                     &ipv6_hdr(skb)->daddr, t1);
 853         }
 854 #endif
 855
 856         memset(&fl6, 0, sizeof(fl6));
 857         fl6.daddr = ipv6_hdr(skb)->saddr;
 858         fl6.saddr = ipv6_hdr(skb)->daddr;
 859         fl6.flowlabel = label;
 860
 861         buff->ip_summed = CHECKSUM_PARTIAL;
 862         buff->csum = 0;
 863
 864         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 865
 866         fl6.flowi6_proto = IPPROTO_TCP;
 867         if (rt6_need_strict(&fl6.daddr) && !oif)
 868                 fl6.flowi6_oif = tcp_v6_iif(skb);
 869         else
 870                 fl6.flowi6_oif = oif;
 871         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 872         fl6.fl6_dport = t1->dest;
 873         fl6.fl6_sport = t1->source;
 874         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 875
 876         /* Pass a socket to ip6_dst_lookup either it is for RST
 877          * Underlying function will use this to retrieve the network
 878          * namespace
 879          */
 880         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 881         if (!IS_ERR(dst)) {
 882                 skb_dst_set(buff, dst);
 883                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 884                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 885                 if (rst)
 886                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 887                 return;
 888         }
 889
 890         kfree_skb(buff);
 891 }
 892
 893 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 894 {
 895         const struct tcphdr *th = tcp_hdr(skb);
 896         u32 seq = 0, ack_seq = 0;
 897         struct tcp_md5sig_key *key = NULL;
 898 #ifdef CONFIG_TCP_MD5SIG
 899         const __u8 *hash_location = NULL;
 900         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 901         unsigned char newhash[16];
 902         int genhash;
 903         struct sock *sk1 = NULL;
 904 #endif
 905         int oif;
 906
 907         if (th->rst)
 908                 return;
 909
 910         /* If sk not NULL, it means we did a successful lookup and incoming
 911          * route had to be correct. prequeue might have dropped our dst.
 912          */
 913         if (!sk && !ipv6_unicast_destination(skb))
 914                 return;
 915
 916 #ifdef CONFIG_TCP_MD5SIG
 917         hash_location = tcp_parse_md5sig_option(th);
 918         if (!sk && hash_location) {
 919                 /*
 920                  * active side is lost. Try to find listening socket through
 921                  * source port, and then find md5 key through listening socket.
 922                  * we are not loose security here:
 923                  * Incoming packet is checked with md5 hash with finding key,
 924                  * no RST generated if md5 hash doesn't match.
 925                  */
 926                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 927                                            &tcp_hashinfo, &ipv6h->saddr,
 928                                            th->source, &ipv6h->daddr,
 929                                            ntohs(th->source), tcp_v6_iif(skb));
 930                 if (!sk1)
 931                         return;
 932
 933                 rcu_read_lock();
 934                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 935                 if (!key)
 936                         goto release_sk1;
 937
 938                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 939                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 940                         goto release_sk1;
 941         } else {
 942                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 943         }
 944 #endif
 945
 946         if (th->ack)
 947                 seq = ntohl(th->ack_seq);
 948         else
 949                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 950                           (th->doff << 2);
 951
 952         oif = sk ? sk->sk_bound_dev_if : 0;
 953         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 954
 955 #ifdef CONFIG_TCP_MD5SIG
 956 release_sk1:
 957         if (sk1) {
 958                 rcu_read_unlock();
 959                 sock_put(sk1);
 960         }
 961 #endif
 962 }
 963
 964 static void tcp_v6_send_ack(struct sock *sk, struct sk_buff *skb, u32 seq,
 965                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 966                             struct tcp_md5sig_key *key, u8 tclass,
 967                             u32 label)
 968 {
 969         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 970                              tclass, label);
 971 }
 972
 973 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 974 {
 975         struct inet_timewait_sock *tw = inet_twsk(sk);
 976         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 977
 978         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 979                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 980                         tcp_time_stamp + tcptw->tw_ts_offset,
 981                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 982                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 983
 984         inet_twsk_put(tw);
 985 }
 986
 987 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 988                                   struct request_sock *req)
 989 {
 990         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 991          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 992          */
 993         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 994                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
 995                         tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
 996                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 997                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 998                         0, 0);
 999 }
1000
1001
1002 static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
1003 {
1004         struct request_sock *req, **prev;
1005         const struct tcphdr *th = tcp_hdr(skb);
1006         struct sock *nsk;
1007
1008         /* Find possible connection requests. */
1009         req = inet6_csk_search_req(sk, &prev, th->source,
1010                                    &ipv6_hdr(skb)->saddr,
1011                                    &ipv6_hdr(skb)->daddr, tcp_v6_iif(skb));
1012         if (req)
1013                 return tcp_check_req(sk, skb, req, prev, false);
1014
1015         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1016                                          &ipv6_hdr(skb)->saddr, th->source,
1017                                          &ipv6_hdr(skb)->daddr, ntohs(th->dest),
1018                                          tcp_v6_iif(skb));
1019
1020         if (nsk) {
1021                 if (nsk->sk_state != TCP_TIME_WAIT) {
1022                         bh_lock_sock(nsk);
1023                         return nsk;
1024                 }
1025                 inet_twsk_put(inet_twsk(nsk));
1026                 return NULL;
1027         }
1028
1029 #ifdef CONFIG_SYN_COOKIES
1030         if (!th->syn)
1031                 sk = cookie_v6_check(sk, skb);
1032 #endif
1033         return sk;
1034 }
1035
1036 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1037 {
1038         if (skb->protocol == htons(ETH_P_IP))
1039                 return tcp_v4_conn_request(sk, skb);
1040
1041         if (!ipv6_unicast_destination(skb))
1042                 goto drop;
1043
1044         return tcp_conn_request(&tcp6_request_sock_ops,
1045                                 &tcp_request_sock_ipv6_ops, sk, skb);
1046
1047 drop:
1048         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1049         return 0; /* don't send reset */
1050 }
1051
1052 static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1053                                          struct request_sock *req,
1054                                          struct dst_entry *dst)
1055 {
1056         struct inet_request_sock *ireq;
1057         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1058         struct tcp6_sock *newtcp6sk;
1059         struct ipv6_txoptions *opt;
1060         struct inet_sock *newinet;
1061         struct tcp_sock *newtp;
1062         struct sock *newsk;
1063 #ifdef CONFIG_TCP_MD5SIG
1064         struct tcp_md5sig_key *key;
1065 #endif
1066         struct flowi6 fl6;
1067
1068         if (skb->protocol == htons(ETH_P_IP)) {
1069                 /*
1070                  *      v6 mapped
1071                  */
1072
1073                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1074
1075                 if (newsk == NULL)
1076                         return NULL;
1077
1078                 newtcp6sk = (struct tcp6_sock *)newsk;
1079                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1080
1081                 newinet = inet_sk(newsk);
1082                 newnp = inet6_sk(newsk);
1083                 newtp = tcp_sk(newsk);
1084
1085                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1086
1087                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newsk->sk_v6_daddr);
1088
1089                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1090
1091                 newsk->sk_v6_rcv_saddr = newnp->saddr;
1092
1093                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1094                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1095 #ifdef CONFIG_TCP_MD5SIG
1096                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1097 #endif
1098
1099                 newnp->ipv6_ac_list = NULL;
1100                 newnp->ipv6_fl_list = NULL;
1101                 newnp->pktoptions  = NULL;
1102                 newnp->opt         = NULL;
1103                 newnp->mcast_oif   = tcp_v6_iif(skb);
1104                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1105                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1106                 if (np->repflow)
1107                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1108
1109                 /*
1110                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1111                  * here, tcp_create_openreq_child now does this for us, see the comment in
1112                  * that function for the gory details. -acme
1113                  */
1114
1115                 /* It is tricky place. Until this moment IPv4 tcp
1116                    worked with IPv6 icsk.icsk_af_ops.
1117                    Sync it now.
1118                  */
1119                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1120
1121                 return newsk;
1122         }
1123
1124         ireq = inet_rsk(req);
1125
1126         if (sk_acceptq_is_full(sk))
1127                 goto out_overflow;
1128
1129         if (!dst) {
1130                 dst = inet6_csk_route_req(sk, &fl6, req);
1131                 if (!dst)
1132                         goto out;
1133         }
1134
1135         newsk = tcp_create_openreq_child(sk, req, skb);
1136         if (newsk == NULL)
1137                 goto out_nonewsk;
1138
1139         /*
1140          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1141          * count here, tcp_create_openreq_child now does this for us, see the
1142          * comment in that function for the gory details. -acme
1143          */
1144
1145         newsk->sk_gso_type = SKB_GSO_TCPV6;
1146         __ip6_dst_store(newsk, dst, NULL, NULL);
1147         inet6_sk_rx_dst_set(newsk, skb);
1148
1149         newtcp6sk = (struct tcp6_sock *)newsk;
1150         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1151
1152         newtp = tcp_sk(newsk);
1153         newinet = inet_sk(newsk);
1154         newnp = inet6_sk(newsk);
1155
1156         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1157
1158         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1159         newnp->saddr = ireq->ir_v6_loc_addr;
1160         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1161         newsk->sk_bound_dev_if = ireq->ir_iif;
1162
1163         ip6_set_txhash(newsk);
1164
1165         /* Now IPv6 options...
1166
1167            First: no IPv4 options.
1168          */
1169         newinet->inet_opt = NULL;
1170         newnp->ipv6_ac_list = NULL;
1171         newnp->ipv6_fl_list = NULL;
1172
1173         /* Clone RX bits */
1174         newnp->rxopt.all = np->rxopt.all;
1175
1176         /* Clone pktoptions received with SYN */
1177         newnp->pktoptions = NULL;
1178         if (ireq->pktopts != NULL) {
1179                 newnp->pktoptions = skb_clone(ireq->pktopts,
1180                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1181                 consume_skb(ireq->pktopts);
1182                 ireq->pktopts = NULL;
1183                 if (newnp->pktoptions)
1184                         skb_set_owner_r(newnp->pktoptions, newsk);
1185         }
1186         newnp->opt        = NULL;
1187         newnp->mcast_oif  = tcp_v6_iif(skb);
1188         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1189         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1190         if (np->repflow)
1191                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1192
1193         /* Clone native IPv6 options from listening socket (if any)
1194
1195            Yes, keeping reference count would be much more clever,
1196            but we make one more one thing there: reattach optmem
1197            to newsk.
1198          */
1199         opt = rcu_dereference(np->opt);
1200         if (opt) {
1201                 opt = ipv6_dup_options(newsk, opt);
1202                 RCU_INIT_POINTER(newnp->opt, opt);
1203         }
1204         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1205         if (opt)
1206                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1207                                                     opt->opt_flen;
1208
1209         tcp_sync_mss(newsk, dst_mtu(dst));
1210         newtp->advmss = dst_metric_advmss(dst);
1211         if (tcp_sk(sk)->rx_opt.user_mss &&
1212             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1213                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1214
1215         tcp_initialize_rcv_mss(newsk);
1216
1217         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1218         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1219
1220 #ifdef CONFIG_TCP_MD5SIG
1221         /* Copy over the MD5 key from the original socket */
1222         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1223         if (key != NULL) {
1224                 /* We're using one, so create a matching key
1225                  * on the newsk structure. If we fail to get
1226                  * memory, then we end up not copying the key
1227                  * across. Shucks.
1228                  */
1229                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1230                                AF_INET6, key->key, key->keylen,
1231                                sk_gfp_atomic(sk, GFP_ATOMIC));
1232         }
1233 #endif
1234
1235         if (__inet_inherit_port(sk, newsk) < 0) {
1236                 inet_csk_prepare_forced_close(newsk);
1237                 tcp_done(newsk);
1238                 goto out;
1239         }
1240         __inet6_hash(newsk, NULL);
1241
1242         return newsk;
1243
1244 out_overflow:
1245         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1246 out_nonewsk:
1247         dst_release(dst);
1248 out:
1249         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1250         return NULL;
1251 }
1252
1253 /* The socket must have it's spinlock held when we get
1254  * here.
1255  *
1256  * We have a potential double-lock case here, so even when
1257  * doing backlog processing we use the BH locking scheme.
1258  * This is because we cannot sleep with the original spinlock
1259  * held.
1260  */
1261 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1262 {
1263         struct ipv6_pinfo *np = inet6_sk(sk);
1264         struct tcp_sock *tp;
1265         struct sk_buff *opt_skb = NULL;
1266
1267         /* Imagine: socket is IPv6. IPv4 packet arrives,
1268            goes to IPv4 receive handler and backlogged.
1269            From backlog it always goes here. Kerboom...
1270            Fortunately, tcp_rcv_established and rcv_established
1271            handle them correctly, but it is not case with
1272            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1273          */
1274
1275         if (skb->protocol == htons(ETH_P_IP))
1276                 return tcp_v4_do_rcv(sk, skb);
1277
1278         if (sk_filter(sk, skb))
1279                 goto discard;
1280
1281         /*
1282          *      socket locking is here for SMP purposes as backlog rcv
1283          *      is currently called with bh processing disabled.
1284          */
1285
1286         /* Do Stevens' IPV6_PKTOPTIONS.
1287
1288            Yes, guys, it is the only place in our code, where we
1289            may make it not affecting IPv4.
1290            The rest of code is protocol independent,
1291            and I do not like idea to uglify IPv4.
1292
1293            Actually, all the idea behind IPV6_PKTOPTIONS
1294            looks not very well thought. For now we latch
1295            options, received in the last packet, enqueued
1296            by tcp. Feel free to propose better solution.
1297                                                --ANK (980728)
1298          */
1299         if (np->rxopt.all)
1300                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1301
1302         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1303                 struct dst_entry *dst = sk->sk_rx_dst;
1304
1305                 sock_rps_save_rxhash(sk, skb);
1306                 if (dst) {
1307                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1308                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1309                                 dst_release(dst);
1310                                 sk->sk_rx_dst = NULL;
1311                         }
1312                 }
1313
1314                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1315                 if (opt_skb)
1316                         goto ipv6_pktoptions;
1317                 return 0;
1318         }
1319
1320         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1321                 goto csum_err;
1322
1323         if (sk->sk_state == TCP_LISTEN) {
1324                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1325                 if (!nsk)
1326                         goto discard;
1327
1328                 /*
1329                  * Queue it on the new socket if the new socket is active,
1330                  * otherwise we just shortcircuit this and continue with
1331                  * the new socket..
1332                  */
1333                 if (nsk != sk) {
1334                         sock_rps_save_rxhash(nsk, skb);
1335                         if (tcp_child_process(sk, nsk, skb))
1336                                 goto reset;
1337                         if (opt_skb)
1338                                 __kfree_skb(opt_skb);
1339                         return 0;
1340                 }
1341         } else
1342                 sock_rps_save_rxhash(sk, skb);
1343
1344         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1345                 goto reset;
1346         if (opt_skb)
1347                 goto ipv6_pktoptions;
1348         return 0;
1349
1350 reset:
1351         tcp_v6_send_reset(sk, skb);
1352 discard:
1353         if (opt_skb)
1354                 __kfree_skb(opt_skb);
1355         kfree_skb(skb);
1356         return 0;
1357 csum_err:
1358         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1359         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1360         goto discard;
1361
1362
1363 ipv6_pktoptions:
1364         /* Do you ask, what is it?
1365
1366            1. skb was enqueued by tcp.
1367            2. skb is added to tail of read queue, rather than out of order.
1368            3. socket is not in passive state.
1369            4. Finally, it really contains options, which user wants to receive.
1370          */
1371         tp = tcp_sk(sk);
1372         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1373             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1374                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1375                         np->mcast_oif = tcp_v6_iif(opt_skb);
1376                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1377                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1378                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1379                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1380                 if (np->repflow)
1381                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1382                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1383                         skb_set_owner_r(opt_skb, sk);
1384                         opt_skb = xchg(&np->pktoptions, opt_skb);
1385                 } else {
1386                         __kfree_skb(opt_skb);
1387                         opt_skb = xchg(&np->pktoptions, NULL);
1388                 }
1389         }
1390
1391         kfree_skb(opt_skb);
1392         return 0;
1393 }
1394
1395 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1396                            const struct tcphdr *th)
1397 {
1398         /* This is tricky: we move IP6CB at its correct location into
1399          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1400          * _decode_session6() uses IP6CB().
1401          * barrier() makes sure compiler won't play aliasing games.
1402          */
1403         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1404                 sizeof(struct inet6_skb_parm));
1405         barrier();
1406
1407         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1408         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1409                                     skb->len - th->doff*4);
1410         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1411         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1412         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1413         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1414         TCP_SKB_CB(skb)->sacked = 0;
1415 }
1416
1417 static void tcp_v6_restore_cb(struct sk_buff *skb)
1418 {
1419         /* We need to move header back to the beginning if xfrm6_policy_check()
1420          * and tcp_v6_fill_cb() are going to be called again.
1421          */
1422         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1423                 sizeof(struct inet6_skb_parm));
1424 }
1425
1426 static int tcp_v6_rcv(struct sk_buff *skb)
1427 {
1428         const struct tcphdr *th;
1429         const struct ipv6hdr *hdr;
1430         struct sock *sk;
1431         int ret;
1432         struct net *net = dev_net(skb->dev);
1433
1434         if (skb->pkt_type != PACKET_HOST)
1435                 goto discard_it;
1436
1437         /*
1438          *      Count it even if it's bad.
1439          */
1440         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1441
1442         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1443                 goto discard_it;
1444
1445         th = tcp_hdr(skb);
1446
1447         if (th->doff < sizeof(struct tcphdr)/4)
1448                 goto bad_packet;
1449         if (!pskb_may_pull(skb, th->doff*4))
1450                 goto discard_it;
1451
1452         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1453                 goto csum_error;
1454
1455         th = tcp_hdr(skb);
1456         hdr = ipv6_hdr(skb);
1457
1458         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1459                                 inet6_iif(skb));
1460         if (!sk)
1461                 goto no_tcp_socket;
1462
1463 process:
1464         if (sk->sk_state == TCP_TIME_WAIT)
1465                 goto do_time_wait;
1466
1467         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1468                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1469                 goto discard_and_relse;
1470         }
1471
1472         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1473                 goto discard_and_relse;
1474
1475         tcp_v6_fill_cb(skb, hdr, th);
1476
1477 #ifdef CONFIG_TCP_MD5SIG
1478         if (tcp_v6_inbound_md5_hash(sk, skb))
1479                 goto discard_and_relse;
1480 #endif
1481
1482         if (sk_filter(sk, skb))
1483                 goto discard_and_relse;
1484
1485         sk_mark_napi_id(sk, skb);
1486         skb->dev = NULL;
1487
1488         bh_lock_sock_nested(sk);
1489         ret = 0;
1490         if (!sock_owned_by_user(sk)) {
1491                 if (!tcp_prequeue(sk, skb))
1492                         ret = tcp_v6_do_rcv(sk, skb);
1493         } else if (unlikely(sk_add_backlog(sk, skb,
1494                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1495                 bh_unlock_sock(sk);
1496                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1497                 goto discard_and_relse;
1498         }
1499         bh_unlock_sock(sk);
1500
1501         sock_put(sk);
1502         return ret ? -1 : 0;
1503
1504 no_tcp_socket:
1505         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1506                 goto discard_it;
1507
1508         tcp_v6_fill_cb(skb, hdr, th);
1509
1510         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1511 csum_error:
1512                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1513 bad_packet:
1514                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1515         } else {
1516                 tcp_v6_send_reset(NULL, skb);
1517         }
1518
1519 discard_it:
1520         kfree_skb(skb);
1521         return 0;
1522
1523 discard_and_relse:
1524         sock_put(sk);
1525         goto discard_it;
1526
1527 do_time_wait:
1528         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1529                 inet_twsk_put(inet_twsk(sk));
1530                 goto discard_it;
1531         }
1532
1533         tcp_v6_fill_cb(skb, hdr, th);
1534
1535         if (skb->len < (th->doff<<2)) {
1536                 inet_twsk_put(inet_twsk(sk));
1537                 goto bad_packet;
1538         }
1539         if (tcp_checksum_complete(skb)) {
1540                 inet_twsk_put(inet_twsk(sk));
1541                 goto csum_error;
1542         }
1543
1544         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1545         case TCP_TW_SYN:
1546         {
1547                 struct sock *sk2;
1548
1549                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1550                                             &ipv6_hdr(skb)->saddr, th->source,
1551                                             &ipv6_hdr(skb)->daddr,
1552                                             ntohs(th->dest), tcp_v6_iif(skb));
1553                 if (sk2 != NULL) {
1554                         struct inet_timewait_sock *tw = inet_twsk(sk);
1555                         inet_twsk_deschedule(tw, &tcp_death_row);
1556                         inet_twsk_put(tw);
1557                         sk = sk2;
1558                         tcp_v6_restore_cb(skb);
1559                         goto process;
1560                 }
1561                 /* Fall through to ACK */
1562         }
1563         case TCP_TW_ACK:
1564                 tcp_v6_timewait_ack(sk, skb);
1565                 break;
1566         case TCP_TW_RST:
1567                 tcp_v6_restore_cb(skb);
1568                 goto no_tcp_socket;
1569         case TCP_TW_SUCCESS:
1570                 ;
1571         }
1572         goto discard_it;
1573 }
1574
1575 static void tcp_v6_early_demux(struct sk_buff *skb)
1576 {
1577         const struct ipv6hdr *hdr;
1578         const struct tcphdr *th;
1579         struct sock *sk;
1580
1581         if (skb->pkt_type != PACKET_HOST)
1582                 return;
1583
1584         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1585                 return;
1586
1587         hdr = ipv6_hdr(skb);
1588         th = tcp_hdr(skb);
1589
1590         if (th->doff < sizeof(struct tcphdr) / 4)
1591                 return;
1592
1593         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1594         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1595                                         &hdr->saddr, th->source,
1596                                         &hdr->daddr, ntohs(th->dest),
1597                                         inet6_iif(skb));
1598         if (sk) {
1599                 skb->sk = sk;
1600                 skb->destructor = sock_edemux;
1601                 if (sk->sk_state != TCP_TIME_WAIT) {
1602                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1603
1604                         if (dst)
1605                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1606                         if (dst &&
1607                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1608                                 skb_dst_set_noref(skb, dst);
1609                 }
1610         }
1611 }
1612
1613 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1614         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1615         .twsk_unique    = tcp_twsk_unique,
1616         .twsk_destructor = tcp_twsk_destructor,
1617 };
1618
1619 static const struct inet_connection_sock_af_ops ipv6_specific = {
1620         .queue_xmit        = inet6_csk_xmit,
1621         .send_check        = tcp_v6_send_check,
1622         .rebuild_header    = inet6_sk_rebuild_header,
1623         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1624         .conn_request      = tcp_v6_conn_request,
1625         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1626         .net_header_len    = sizeof(struct ipv6hdr),
1627         .net_frag_header_len = sizeof(struct frag_hdr),
1628         .setsockopt        = ipv6_setsockopt,
1629         .getsockopt        = ipv6_getsockopt,
1630         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1631         .sockaddr_len      = sizeof(struct sockaddr_in6),
1632         .bind_conflict     = inet6_csk_bind_conflict,
1633 #ifdef CONFIG_COMPAT
1634         .compat_setsockopt = compat_ipv6_setsockopt,
1635         .compat_getsockopt = compat_ipv6_getsockopt,
1636 #endif
1637         .mtu_reduced       = tcp_v6_mtu_reduced,
1638 };
1639
1640 #ifdef CONFIG_TCP_MD5SIG
1641 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1642         .md5_lookup     =       tcp_v6_md5_lookup,
1643         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1644         .md5_parse      =       tcp_v6_parse_md5_keys,
1645 };
1646 #endif
1647
1648 /*
1649  *      TCP over IPv4 via INET6 API
1650  */
1651 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1652         .queue_xmit        = ip_queue_xmit,
1653         .send_check        = tcp_v4_send_check,
1654         .rebuild_header    = inet_sk_rebuild_header,
1655         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1656         .conn_request      = tcp_v6_conn_request,
1657         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1658         .net_header_len    = sizeof(struct iphdr),
1659         .setsockopt        = ipv6_setsockopt,
1660         .getsockopt        = ipv6_getsockopt,
1661         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1662         .sockaddr_len      = sizeof(struct sockaddr_in6),
1663         .bind_conflict     = inet6_csk_bind_conflict,
1664 #ifdef CONFIG_COMPAT
1665         .compat_setsockopt = compat_ipv6_setsockopt,
1666         .compat_getsockopt = compat_ipv6_getsockopt,
1667 #endif
1668         .mtu_reduced       = tcp_v4_mtu_reduced,
1669 };
1670
1671 #ifdef CONFIG_TCP_MD5SIG
1672 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1673         .md5_lookup     =       tcp_v4_md5_lookup,
1674         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1675         .md5_parse      =       tcp_v6_parse_md5_keys,
1676 };
1677 #endif
1678
1679 /* NOTE: A lot of things set to zero explicitly by call to
1680  *       sk_alloc() so need not be done here.
1681  */
1682 static int tcp_v6_init_sock(struct sock *sk)
1683 {
1684         struct inet_connection_sock *icsk = inet_csk(sk);
1685
1686         tcp_init_sock(sk);
1687
1688         icsk->icsk_af_ops = &ipv6_specific;
1689
1690 #ifdef CONFIG_TCP_MD5SIG
1691         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1692 #endif
1693
1694         return 0;
1695 }
1696
1697 static void tcp_v6_destroy_sock(struct sock *sk)
1698 {
1699         tcp_v4_destroy_sock(sk);
1700         inet6_destroy_sock(sk);
1701 }
1702
1703 #ifdef CONFIG_PROC_FS
1704 /* Proc filesystem TCPv6 sock list dumping. */
1705 static void get_openreq6(struct seq_file *seq,
1706                          const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1707 {
1708         int ttd = req->expires - jiffies;
1709         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1710         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1711
1712         if (ttd < 0)
1713                 ttd = 0;
1714
1715         seq_printf(seq,
1716                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1717                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1718                    i,
1719                    src->s6_addr32[0], src->s6_addr32[1],
1720                    src->s6_addr32[2], src->s6_addr32[3],
1721                    inet_rsk(req)->ir_num,
1722                    dest->s6_addr32[0], dest->s6_addr32[1],
1723                    dest->s6_addr32[2], dest->s6_addr32[3],
1724                    ntohs(inet_rsk(req)->ir_rmt_port),
1725                    TCP_SYN_RECV,
1726                    0, 0, /* could print option size, but that is af dependent. */
1727                    1,   /* timers active (only the expire timer) */
1728                    jiffies_to_clock_t(ttd),
1729                    req->num_timeout,
1730                    from_kuid_munged(seq_user_ns(seq), uid),
1731                    0,  /* non standard timer */
1732                    0, /* open_requests have no inode */
1733                    0, req);
1734 }
1735
1736 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1737 {
1738         const struct in6_addr *dest, *src;
1739         __u16 destp, srcp;
1740         int timer_active;
1741         unsigned long timer_expires;
1742         const struct inet_sock *inet = inet_sk(sp);
1743         const struct tcp_sock *tp = tcp_sk(sp);
1744         const struct inet_connection_sock *icsk = inet_csk(sp);
1745         struct fastopen_queue *fastopenq = icsk->icsk_accept_queue.fastopenq;
1746
1747         dest  = &sp->sk_v6_daddr;
1748         src   = &sp->sk_v6_rcv_saddr;
1749         destp = ntohs(inet->inet_dport);
1750         srcp  = ntohs(inet->inet_sport);
1751
1752         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1753             icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
1754             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1755                 timer_active    = 1;
1756                 timer_expires   = icsk->icsk_timeout;
1757         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1758                 timer_active    = 4;
1759                 timer_expires   = icsk->icsk_timeout;
1760         } else if (timer_pending(&sp->sk_timer)) {
1761                 timer_active    = 2;
1762                 timer_expires   = sp->sk_timer.expires;
1763         } else {
1764                 timer_active    = 0;
1765                 timer_expires = jiffies;
1766         }
1767
1768         seq_printf(seq,
1769                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1770                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1771                    i,
1772                    src->s6_addr32[0], src->s6_addr32[1],
1773                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1774                    dest->s6_addr32[0], dest->s6_addr32[1],
1775                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1776                    sp->sk_state,
1777                    tp->write_seq-tp->snd_una,
1778                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1779                    timer_active,
1780                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1781                    icsk->icsk_retransmits,
1782                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1783                    icsk->icsk_probes_out,
1784                    sock_i_ino(sp),
1785                    atomic_read(&sp->sk_refcnt), sp,
1786                    jiffies_to_clock_t(icsk->icsk_rto),
1787                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1788                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1789                    tp->snd_cwnd,
1790                    sp->sk_state == TCP_LISTEN ?
1791                         (fastopenq ? fastopenq->max_qlen : 0) :
1792                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1793                    );
1794 }
1795
1796 static void get_timewait6_sock(struct seq_file *seq,
1797                                struct inet_timewait_sock *tw, int i)
1798 {
1799         const struct in6_addr *dest, *src;
1800         __u16 destp, srcp;
1801         s32 delta = tw->tw_ttd - inet_tw_time_stamp();
1802
1803         dest = &tw->tw_v6_daddr;
1804         src  = &tw->tw_v6_rcv_saddr;
1805         destp = ntohs(tw->tw_dport);
1806         srcp  = ntohs(tw->tw_sport);
1807
1808         seq_printf(seq,
1809                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1810                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1811                    i,
1812                    src->s6_addr32[0], src->s6_addr32[1],
1813                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1814                    dest->s6_addr32[0], dest->s6_addr32[1],
1815                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1816                    tw->tw_substate, 0, 0,
1817                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1818                    atomic_read(&tw->tw_refcnt), tw);
1819 }
1820
1821 static int tcp6_seq_show(struct seq_file *seq, void *v)
1822 {
1823         struct tcp_iter_state *st;
1824         struct sock *sk = v;
1825
1826         if (v == SEQ_START_TOKEN) {
1827                 seq_puts(seq,
1828                          "  sl  "
1829                          "local_address                         "
1830                          "remote_address                        "
1831                          "st tx_queue rx_queue tr tm->when retrnsmt"
1832                          "   uid  timeout inode\n");
1833                 goto out;
1834         }
1835         st = seq->private;
1836
1837         switch (st->state) {
1838         case TCP_SEQ_STATE_LISTENING:
1839         case TCP_SEQ_STATE_ESTABLISHED:
1840                 if (sk->sk_state == TCP_TIME_WAIT)
1841                         get_timewait6_sock(seq, v, st->num);
1842                 else
1843                         get_tcp6_sock(seq, v, st->num);
1844                 break;
1845         case TCP_SEQ_STATE_OPENREQ:
1846                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1847                 break;
1848         }
1849 out:
1850         return 0;
1851 }
1852
1853 static const struct file_operations tcp6_afinfo_seq_fops = {
1854         .owner   = THIS_MODULE,
1855         .open    = tcp_seq_open,
1856         .read    = seq_read,
1857         .llseek  = seq_lseek,
1858         .release = seq_release_net
1859 };
1860
1861 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1862         .name           = "tcp6",
1863         .family         = AF_INET6,
1864         .seq_fops       = &tcp6_afinfo_seq_fops,
1865         .seq_ops        = {
1866                 .show           = tcp6_seq_show,
1867         },
1868 };
1869
1870 int __net_init tcp6_proc_init(struct net *net)
1871 {
1872         return tcp_proc_register(net, &tcp6_seq_afinfo);
1873 }
1874
1875 void tcp6_proc_exit(struct net *net)
1876 {
1877         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1878 }
1879 #endif
1880
1881 static void tcp_v6_clear_sk(struct sock *sk, int size)
1882 {
1883         struct inet_sock *inet = inet_sk(sk);
1884
1885         /* we do not want to clear pinet6 field, because of RCU lookups */
1886         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1887
1888         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1889         memset(&inet->pinet6 + 1, 0, size);
1890 }
1891
1892 struct proto tcpv6_prot = {
1893         .name                   = "TCPv6",
1894         .owner                  = THIS_MODULE,
1895         .close                  = tcp_close,
1896         .connect                = tcp_v6_connect,
1897         .disconnect             = tcp_disconnect,
1898         .accept                 = inet_csk_accept,
1899         .ioctl                  = tcp_ioctl,
1900         .init                   = tcp_v6_init_sock,
1901         .destroy                = tcp_v6_destroy_sock,
1902         .shutdown               = tcp_shutdown,
1903         .setsockopt             = tcp_setsockopt,
1904         .getsockopt             = tcp_getsockopt,
1905         .recvmsg                = tcp_recvmsg,
1906         .sendmsg                = tcp_sendmsg,
1907         .sendpage               = tcp_sendpage,
1908         .backlog_rcv            = tcp_v6_do_rcv,
1909         .release_cb             = tcp_release_cb,
1910         .hash                   = tcp_v6_hash,
1911         .unhash                 = inet_unhash,
1912         .get_port               = inet_csk_get_port,
1913         .enter_memory_pressure  = tcp_enter_memory_pressure,
1914         .stream_memory_free     = tcp_stream_memory_free,
1915         .sockets_allocated      = &tcp_sockets_allocated,
1916         .memory_allocated       = &tcp_memory_allocated,
1917         .memory_pressure        = &tcp_memory_pressure,
1918         .orphan_count           = &tcp_orphan_count,
1919         .sysctl_mem             = sysctl_tcp_mem,
1920         .sysctl_wmem            = sysctl_tcp_wmem,
1921         .sysctl_rmem            = sysctl_tcp_rmem,
1922         .max_header             = MAX_TCP_HEADER,
1923         .obj_size               = sizeof(struct tcp6_sock),
1924         .slab_flags             = SLAB_DESTROY_BY_RCU,
1925         .twsk_prot              = &tcp6_timewait_sock_ops,
1926         .rsk_prot               = &tcp6_request_sock_ops,
1927         .h.hashinfo             = &tcp_hashinfo,
1928         .no_autobind            = true,
1929 #ifdef CONFIG_COMPAT
1930         .compat_setsockopt      = compat_tcp_setsockopt,
1931         .compat_getsockopt      = compat_tcp_getsockopt,
1932 #endif
1933 #ifdef CONFIG_MEMCG_KMEM
1934         .proto_cgroup           = tcp_proto_cgroup,
1935 #endif
1936         .clear_sk               = tcp_v6_clear_sk,
1937 };
1938
1939 static const struct inet6_protocol tcpv6_protocol = {
1940         .early_demux    =       tcp_v6_early_demux,
1941         .handler        =       tcp_v6_rcv,
1942         .err_handler    =       tcp_v6_err,
1943         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1944 };
1945
1946 static struct inet_protosw tcpv6_protosw = {
1947         .type           =       SOCK_STREAM,
1948         .protocol       =       IPPROTO_TCP,
1949         .prot           =       &tcpv6_prot,
1950         .ops            =       &inet6_stream_ops,
1951         .flags          =       INET_PROTOSW_PERMANENT |
1952                                 INET_PROTOSW_ICSK,
1953 };
1954
1955 static int __net_init tcpv6_net_init(struct net *net)
1956 {
1957         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1958                                     SOCK_RAW, IPPROTO_TCP, net);
1959 }
1960
1961 static void __net_exit tcpv6_net_exit(struct net *net)
1962 {
1963         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1964 }
1965
1966 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1967 {
1968         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1969 }
1970
1971 static struct pernet_operations tcpv6_net_ops = {
1972         .init       = tcpv6_net_init,
1973         .exit       = tcpv6_net_exit,
1974         .exit_batch = tcpv6_net_exit_batch,
1975 };
1976
1977 int __init tcpv6_init(void)
1978 {
1979         int ret;
1980
1981         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1982         if (ret)
1983                 goto out;
1984
1985         /* register inet6 protocol */
1986         ret = inet6_register_protosw(&tcpv6_protosw);
1987         if (ret)
1988                 goto out_tcpv6_protocol;
1989
1990         ret = register_pernet_subsys(&tcpv6_net_ops);
1991         if (ret)
1992                 goto out_tcpv6_protosw;
1993 out:
1994         return ret;
1995
1996 out_tcpv6_protosw:
1997         inet6_unregister_protosw(&tcpv6_protosw);
1998 out_tcpv6_protocol:
1999         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2000         goto out;
2001 }
2002
2003 void tcpv6_exit(void)
2004 {
2005         unregister_pernet_subsys(&tcpv6_net_ops);
2006         inet6_unregister_protosw(&tcpv6_protosw);
2007         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2008 }