1/*
   2 *	TCP over IPv6
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *
   8 *	Based on:
   9 *	linux/net/ipv4/tcp.c
  10 *	linux/net/ipv4/tcp_input.c
  11 *	linux/net/ipv4/tcp_output.c
  12 *
  13 *	Fixes:
  14 *	Hideaki YOSHIFUJI	:	sin6_scope_id support
  15 *	YOSHIFUJI Hideaki @USAGI and:	Support IPV6_V6ONLY socket option, which
  16 *	Alexey Kuznetsov		allow both IPv4 and IPv6 sockets to bind
  17 *					a single port at the same time.
  18 *	YOSHIFUJI Hideaki @USAGI:	convert /proc/net/tcp6 to seq_file.
  19 *
  20 *	This program is free software; you can redistribute it and/or
  21 *      modify it under the terms of the GNU General Public License
  22 *      as published by the Free Software Foundation; either version
  23 *      2 of the License, or (at your option) any later version.
  24 */
  25
  26#include <linux/bottom_half.h>
  27#include <linux/module.h>
  28#include <linux/errno.h>
  29#include <linux/types.h>
  30#include <linux/socket.h>
  31#include <linux/sockios.h>
  32#include <linux/net.h>
  33#include <linux/jiffies.h>
  34#include <linux/in.h>
  35#include <linux/in6.h>
  36#include <linux/netdevice.h>
  37#include <linux/init.h>
  38#include <linux/jhash.h>
  39#include <linux/ipsec.h>
  40#include <linux/times.h>
  41#include <linux/slab.h>
  42
  43#include <linux/ipv6.h>
  44#include <linux/icmpv6.h>
  45#include <linux/random.h>
 
  46
  47#include <net/tcp.h>
  48#include <net/ndisc.h>
  49#include <net/inet6_hashtables.h>
  50#include <net/inet6_connection_sock.h>
  51#include <net/ipv6.h>
  52#include <net/transp_v6.h>
  53#include <net/addrconf.h>
  54#include <net/ip6_route.h>
  55#include <net/ip6_checksum.h>
  56#include <net/inet_ecn.h>
  57#include <net/protocol.h>
  58#include <net/xfrm.h>
  59#include <net/snmp.h>
  60#include <net/dsfield.h>
  61#include <net/timewait_sock.h>
  62#include <net/netdma.h>
  63#include <net/inet_common.h>
  64#include <net/secure_seq.h>
  65#include <net/tcp_memcontrol.h>
  66
  67#include <asm/uaccess.h>
  68
  69#include <linux/proc_fs.h>
  70#include <linux/seq_file.h>
  71
  72#include <linux/crypto.h>
  73#include <linux/scatterlist.h>
  74
  75static void	tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 
 
  77				      struct request_sock *req);
  78
  79static int	tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  80static void	__tcp_v6_send_check(struct sk_buff *skb,
  81				    const struct in6_addr *saddr,
  82				    const struct in6_addr *daddr);
  83
  84static const struct inet_connection_sock_af_ops ipv6_mapped;
  85static const struct inet_connection_sock_af_ops ipv6_specific;
  86#ifdef CONFIG_TCP_MD5SIG
  87static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  88static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  89#else
  90static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  91						   const struct in6_addr *addr)
  92{
  93	return NULL;
  94}
  95#endif
  96
  97static void tcp_v6_hash(struct sock *sk)
 
 
 
 
 
  98{
  99	if (sk->sk_state != TCP_CLOSE) {
 100		if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 101			tcp_prot.hash(sk);
 102			return;
 103		}
 104		local_bh_disable();
 105		__inet6_hash(sk, NULL);
 106		local_bh_enable();
 
 
 
 
 
 
 
 107	}
 108}
 109
 110static __inline__ __sum16 tcp_v6_check(int len,
 111				   const struct in6_addr *saddr,
 112				   const struct in6_addr *daddr,
 113				   __wsum base)
 
 
 
 
 
 114{
 115	return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 
 116}
 117
 118static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 
 119{
 120	return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 121					    ipv6_hdr(skb)->saddr.s6_addr32,
 122					    tcp_hdr(skb)->dest,
 123					    tcp_hdr(skb)->source);
 
 
 
 
 
 
 124}
 125
 126static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 127			  int addr_len)
 128{
 129	struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 130	struct inet_sock *inet = inet_sk(sk);
 131	struct inet_connection_sock *icsk = inet_csk(sk);
 132	struct ipv6_pinfo *np = inet6_sk(sk);
 133	struct tcp_sock *tp = tcp_sk(sk);
 134	struct in6_addr *saddr = NULL, *final_p, final;
 135	struct rt6_info *rt;
 136	struct flowi6 fl6;
 137	struct dst_entry *dst;
 138	int addr_type;
 139	int err;
 
 140
 141	if (addr_len < SIN6_LEN_RFC2133)
 142		return -EINVAL;
 143
 144	if (usin->sin6_family != AF_INET6)
 145		return -EAFNOSUPPORT;
 146
 147	memset(&fl6, 0, sizeof(fl6));
 148
 149	if (np->sndflow) {
 150		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 151		IP6_ECN_flow_init(fl6.flowlabel);
 152		if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 153			struct ip6_flowlabel *flowlabel;
 154			flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 155			if (flowlabel == NULL)
 156				return -EINVAL;
 157			usin->sin6_addr = flowlabel->dst;
 158			fl6_sock_release(flowlabel);
 159		}
 160	}
 161
 162	/*
 163	 *	connect() to INADDR_ANY means loopback (BSD'ism).
 164	 */
 165
 166	if(ipv6_addr_any(&usin->sin6_addr))
 167		usin->sin6_addr.s6_addr[15] = 0x1;
 
 
 
 
 
 168
 169	addr_type = ipv6_addr_type(&usin->sin6_addr);
 170
 171	if(addr_type & IPV6_ADDR_MULTICAST)
 172		return -ENETUNREACH;
 173
 174	if (addr_type&IPV6_ADDR_LINKLOCAL) {
 175		if (addr_len >= sizeof(struct sockaddr_in6) &&
 176		    usin->sin6_scope_id) {
 177			/* If interface is set while binding, indices
 178			 * must coincide.
 179			 */
 180			if (sk->sk_bound_dev_if &&
 181			    sk->sk_bound_dev_if != usin->sin6_scope_id)
 182				return -EINVAL;
 183
 184			sk->sk_bound_dev_if = usin->sin6_scope_id;
 185		}
 186
 187		/* Connect to link-local address requires an interface */
 188		if (!sk->sk_bound_dev_if)
 189			return -EINVAL;
 190	}
 191
 192	if (tp->rx_opt.ts_recent_stamp &&
 193	    !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 194		tp->rx_opt.ts_recent = 0;
 195		tp->rx_opt.ts_recent_stamp = 0;
 196		tp->write_seq = 0;
 197	}
 198
 199	np->daddr = usin->sin6_addr;
 200	np->flow_label = fl6.flowlabel;
 201
 202	/*
 203	 *	TCP over IPv4
 204	 */
 205
 206	if (addr_type == IPV6_ADDR_MAPPED) {
 207		u32 exthdrlen = icsk->icsk_ext_hdr_len;
 208		struct sockaddr_in sin;
 209
 210		SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 211
 212		if (__ipv6_only_sock(sk))
 213			return -ENETUNREACH;
 214
 215		sin.sin_family = AF_INET;
 216		sin.sin_port = usin->sin6_port;
 217		sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 218
 219		icsk->icsk_af_ops = &ipv6_mapped;
 220		sk->sk_backlog_rcv = tcp_v4_do_rcv;
 221#ifdef CONFIG_TCP_MD5SIG
 222		tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 223#endif
 224
 225		err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 226
 227		if (err) {
 228			icsk->icsk_ext_hdr_len = exthdrlen;
 229			icsk->icsk_af_ops = &ipv6_specific;
 230			sk->sk_backlog_rcv = tcp_v6_do_rcv;
 231#ifdef CONFIG_TCP_MD5SIG
 232			tp->af_specific = &tcp_sock_ipv6_specific;
 233#endif
 234			goto failure;
 235		} else {
 236			ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 237			ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 238					       &np->rcv_saddr);
 239		}
 
 240
 241		return err;
 242	}
 243
 244	if (!ipv6_addr_any(&np->rcv_saddr))
 245		saddr = &np->rcv_saddr;
 246
 247	fl6.flowi6_proto = IPPROTO_TCP;
 248	fl6.daddr = np->daddr;
 249	fl6.saddr = saddr ? *saddr : np->saddr;
 250	fl6.flowi6_oif = sk->sk_bound_dev_if;
 251	fl6.flowi6_mark = sk->sk_mark;
 252	fl6.fl6_dport = usin->sin6_port;
 253	fl6.fl6_sport = inet->inet_sport;
 
 254
 255	final_p = fl6_update_dst(&fl6, np->opt, &final);
 
 256
 257	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 258
 259	dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
 260	if (IS_ERR(dst)) {
 261		err = PTR_ERR(dst);
 262		goto failure;
 263	}
 264
 265	if (saddr == NULL) {
 266		saddr = &fl6.saddr;
 267		np->rcv_saddr = *saddr;
 268	}
 269
 270	/* set the source address */
 271	np->saddr = *saddr;
 272	inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 273
 274	sk->sk_gso_type = SKB_GSO_TCPV6;
 275	__ip6_dst_store(sk, dst, NULL, NULL);
 276
 277	rt = (struct rt6_info *) dst;
 278	if (tcp_death_row.sysctl_tw_recycle &&
 279	    !tp->rx_opt.ts_recent_stamp &&
 280	    ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
 281		struct inet_peer *peer = rt6_get_peer(rt);
 282		/*
 283		 * VJ's idea. We save last timestamp seen from
 284		 * the destination in peer table, when entering state
 285		 * TIME-WAIT * and initialize rx_opt.ts_recent from it,
 286		 * when trying new connection.
 287		 */
 288		if (peer) {
 289			inet_peer_refcheck(peer);
 290			if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
 291				tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
 292				tp->rx_opt.ts_recent = peer->tcp_ts;
 293			}
 294		}
 295	}
 296
 297	icsk->icsk_ext_hdr_len = 0;
 298	if (np->opt)
 299		icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 300					  np->opt->opt_nflen);
 301
 302	tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 303
 304	inet->inet_dport = usin->sin6_port;
 305
 306	tcp_set_state(sk, TCP_SYN_SENT);
 307	err = inet6_hash_connect(&tcp_death_row, sk);
 308	if (err)
 309		goto late_failure;
 310
 311	if (!tp->write_seq)
 312		tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 313							     np->daddr.s6_addr32,
 314							     inet->inet_sport,
 315							     inet->inet_dport);
 
 
 
 
 
 
 
 
 
 
 
 
 
 316
 317	err = tcp_connect(sk);
 318	if (err)
 319		goto late_failure;
 320
 321	return 0;
 322
 323late_failure:
 324	tcp_set_state(sk, TCP_CLOSE);
 325	__sk_dst_reset(sk);
 326failure:
 327	inet->inet_dport = 0;
 328	sk->sk_route_caps = 0;
 329	return err;
 330}
 331
 332static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 333		u8 type, u8 code, int offset, __be32 info)
 334{
 335	const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
 336	const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 
 
 337	struct ipv6_pinfo *np;
 
 
 338	struct sock *sk;
 
 339	int err;
 340	struct tcp_sock *tp;
 341	__u32 seq;
 342	struct net *net = dev_net(skb->dev);
 343
 344	sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 345			th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 346
 347	if (sk == NULL) {
 348		ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 349				   ICMP6_MIB_INERRORS);
 350		return;
 
 
 
 
 
 351	}
 352
 353	if (sk->sk_state == TCP_TIME_WAIT) {
 354		inet_twsk_put(inet_twsk(sk));
 355		return;
 
 
 
 
 
 
 356	}
 357
 358	bh_lock_sock(sk);
 359	if (sock_owned_by_user(sk))
 360		NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 361
 362	if (sk->sk_state == TCP_CLOSE)
 363		goto out;
 364
 365	if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 366		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 367		goto out;
 368	}
 369
 370	tp = tcp_sk(sk);
 371	seq = ntohl(th->seq);
 
 
 372	if (sk->sk_state != TCP_LISTEN &&
 373	    !between(seq, tp->snd_una, tp->snd_nxt)) {
 374		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 375		goto out;
 376	}
 377
 378	np = inet6_sk(sk);
 379
 380	if (type == ICMPV6_PKT_TOOBIG) {
 381		struct dst_entry *dst;
 382
 383		if (sock_owned_by_user(sk))
 384			goto out;
 385		if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 386			goto out;
 387
 388		/* icmp should have updated the destination cache entry */
 389		dst = __sk_dst_check(sk, np->dst_cookie);
 
 
 
 390
 391		if (dst == NULL) {
 392			struct inet_sock *inet = inet_sk(sk);
 393			struct flowi6 fl6;
 394
 395			/* BUGGG_FUTURE: Again, it is not clear how
 396			   to handle rthdr case. Ignore this complexity
 397			   for now.
 398			 */
 399			memset(&fl6, 0, sizeof(fl6));
 400			fl6.flowi6_proto = IPPROTO_TCP;
 401			fl6.daddr = np->daddr;
 402			fl6.saddr = np->saddr;
 403			fl6.flowi6_oif = sk->sk_bound_dev_if;
 404			fl6.flowi6_mark = sk->sk_mark;
 405			fl6.fl6_dport = inet->inet_dport;
 406			fl6.fl6_sport = inet->inet_sport;
 407			security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 408
 409			dst = ip6_dst_lookup_flow(sk, &fl6, NULL, false);
 410			if (IS_ERR(dst)) {
 411				sk->sk_err_soft = -PTR_ERR(dst);
 412				goto out;
 413			}
 414
 415		} else
 416			dst_hold(dst);
 417
 418		if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 419			tcp_sync_mss(sk, dst_mtu(dst));
 420			tcp_simple_retransmit(sk);
 421		} /* else let the usual retransmit timer handle it */
 422		dst_release(dst);
 
 423		goto out;
 424	}
 425
 426	icmpv6_err_convert(type, code, &err);
 427
 428	/* Might be for an request_sock */
 429	switch (sk->sk_state) {
 430		struct request_sock *req, **prev;
 431	case TCP_LISTEN:
 432		if (sock_owned_by_user(sk))
 433			goto out;
 434
 435		req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 436					   &hdr->saddr, inet6_iif(skb));
 437		if (!req)
 438			goto out;
 439
 440		/* ICMPs are not backlogged, hence we cannot get
 441		 * an established socket here.
 442		 */
 443		WARN_ON(req->sk != NULL);
 444
 445		if (seq != tcp_rsk(req)->snt_isn) {
 446			NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 447			goto out;
 448		}
 449
 450		inet_csk_reqsk_queue_drop(sk, req, prev);
 451		goto out;
 452
 453	case TCP_SYN_SENT:
 454	case TCP_SYN_RECV:  /* Cannot happen.
 455			       It can, it SYNs are crossed. --ANK */
 456		if (!sock_owned_by_user(sk)) {
 457			sk->sk_err = err;
 458			sk->sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */
 459
 460			tcp_done(sk);
 461		} else
 462			sk->sk_err_soft = err;
 463		goto out;
 464	}
 465
 466	if (!sock_owned_by_user(sk) && np->recverr) {
 467		sk->sk_err = err;
 468		sk->sk_error_report(sk);
 469	} else
 470		sk->sk_err_soft = err;
 471
 472out:
 473	bh_unlock_sock(sk);
 474	sock_put(sk);
 
 475}
 476
 477
 478static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 479			      struct request_values *rvp,
 480			      u16 queue_mapping)
 481{
 482	struct inet6_request_sock *treq = inet6_rsk(req);
 483	struct ipv6_pinfo *np = inet6_sk(sk);
 484	struct sk_buff * skb;
 485	struct ipv6_txoptions *opt = NULL;
 486	struct in6_addr * final_p, final;
 487	struct flowi6 fl6;
 488	struct dst_entry *dst;
 489	int err;
 490
 491	memset(&fl6, 0, sizeof(fl6));
 492	fl6.flowi6_proto = IPPROTO_TCP;
 493	fl6.daddr = treq->rmt_addr;
 494	fl6.saddr = treq->loc_addr;
 495	fl6.flowlabel = 0;
 496	fl6.flowi6_oif = treq->iif;
 497	fl6.flowi6_mark = sk->sk_mark;
 498	fl6.fl6_dport = inet_rsk(req)->rmt_port;
 499	fl6.fl6_sport = inet_rsk(req)->loc_port;
 500	security_req_classify_flow(req, flowi6_to_flowi(&fl6));
 501
 502	opt = np->opt;
 503	final_p = fl6_update_dst(&fl6, opt, &final);
 504
 505	dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
 506	if (IS_ERR(dst)) {
 507		err = PTR_ERR(dst);
 508		dst = NULL;
 509		goto done;
 510	}
 511	skb = tcp_make_synack(sk, dst, req, rvp);
 512	err = -ENOMEM;
 513	if (skb) {
 514		__tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 
 
 
 
 
 515
 516		fl6.daddr = treq->rmt_addr;
 517		skb_set_queue_mapping(skb, queue_mapping);
 518		err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
 
 
 
 
 519		err = net_xmit_eval(err);
 520	}
 521
 522done:
 523	if (opt && opt != np->opt)
 524		sock_kfree_s(sk, opt, opt->tot_len);
 525	dst_release(dst);
 526	return err;
 527}
 528
 529static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 530			     struct request_values *rvp)
 531{
 532	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 533	return tcp_v6_send_synack(sk, req, rvp, 0);
 534}
 535
 536static void tcp_v6_reqsk_destructor(struct request_sock *req)
 537{
 538	kfree_skb(inet6_rsk(req)->pktopts);
 
 539}
 540
 541#ifdef CONFIG_TCP_MD5SIG
 542static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 543						   const struct in6_addr *addr)
 544{
 545	return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 546}
 547
 548static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 549						struct sock *addr_sk)
 550{
 551	return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 552}
 553
 554static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 555						      struct request_sock *req)
 556{
 557	return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 558}
 559
 560static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 561				  int optlen)
 562{
 563	struct tcp_md5sig cmd;
 564	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 
 565
 566	if (optlen < sizeof(cmd))
 567		return -EINVAL;
 568
 569	if (copy_from_user(&cmd, optval, sizeof(cmd)))
 570		return -EFAULT;
 571
 572	if (sin6->sin6_family != AF_INET6)
 573		return -EINVAL;
 574
 
 
 
 
 
 
 
 
 
 
 575	if (!cmd.tcpm_keylen) {
 576		if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 577			return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 578					      AF_INET);
 579		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 580				      AF_INET6);
 581	}
 582
 583	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 584		return -EINVAL;
 585
 586	if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 587		return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 588				      AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 
 589
 590	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 591			      AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 
 592}
 593
 594static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 595					const struct in6_addr *daddr,
 596					const struct in6_addr *saddr, int nbytes)
 
 597{
 598	struct tcp6_pseudohdr *bp;
 599	struct scatterlist sg;
 
 600
 601	bp = &hp->md5_blk.ip6;
 602	/* 1. TCP pseudo-header (RFC2460) */
 603	bp->saddr = *saddr;
 604	bp->daddr = *daddr;
 605	bp->protocol = cpu_to_be32(IPPROTO_TCP);
 606	bp->len = cpu_to_be32(nbytes);
 607
 608	sg_init_one(&sg, bp, sizeof(*bp));
 609	return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 
 
 
 
 
 
 610}
 611
 612static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 613			       const struct in6_addr *daddr, struct in6_addr *saddr,
 614			       const struct tcphdr *th)
 615{
 616	struct tcp_md5sig_pool *hp;
 617	struct hash_desc *desc;
 618
 619	hp = tcp_get_md5sig_pool();
 620	if (!hp)
 621		goto clear_hash_noput;
 622	desc = &hp->md5_desc;
 623
 624	if (crypto_hash_init(desc))
 625		goto clear_hash;
 626	if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 627		goto clear_hash;
 628	if (tcp_md5_hash_header(hp, th))
 629		goto clear_hash;
 630	if (tcp_md5_hash_key(hp, key))
 631		goto clear_hash;
 632	if (crypto_hash_final(desc, md5_hash))
 
 633		goto clear_hash;
 634
 635	tcp_put_md5sig_pool();
 636	return 0;
 637
 638clear_hash:
 639	tcp_put_md5sig_pool();
 640clear_hash_noput:
 641	memset(md5_hash, 0, 16);
 642	return 1;
 643}
 644
 645static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 
 646			       const struct sock *sk,
 647			       const struct request_sock *req,
 648			       const struct sk_buff *skb)
 649{
 650	const struct in6_addr *saddr, *daddr;
 651	struct tcp_md5sig_pool *hp;
 652	struct hash_desc *desc;
 653	const struct tcphdr *th = tcp_hdr(skb);
 654
 655	if (sk) {
 656		saddr = &inet6_sk(sk)->saddr;
 657		daddr = &inet6_sk(sk)->daddr;
 658	} else if (req) {
 659		saddr = &inet6_rsk(req)->loc_addr;
 660		daddr = &inet6_rsk(req)->rmt_addr;
 661	} else {
 662		const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 663		saddr = &ip6h->saddr;
 664		daddr = &ip6h->daddr;
 665	}
 666
 667	hp = tcp_get_md5sig_pool();
 668	if (!hp)
 669		goto clear_hash_noput;
 670	desc = &hp->md5_desc;
 671
 672	if (crypto_hash_init(desc))
 673		goto clear_hash;
 674
 675	if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 676		goto clear_hash;
 677	if (tcp_md5_hash_header(hp, th))
 678		goto clear_hash;
 679	if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 680		goto clear_hash;
 681	if (tcp_md5_hash_key(hp, key))
 682		goto clear_hash;
 683	if (crypto_hash_final(desc, md5_hash))
 
 684		goto clear_hash;
 685
 686	tcp_put_md5sig_pool();
 687	return 0;
 688
 689clear_hash:
 690	tcp_put_md5sig_pool();
 691clear_hash_noput:
 692	memset(md5_hash, 0, 16);
 693	return 1;
 694}
 695
 696static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 
 
 
 697{
 
 698	const __u8 *hash_location = NULL;
 699	struct tcp_md5sig_key *hash_expected;
 700	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 701	const struct tcphdr *th = tcp_hdr(skb);
 702	int genhash;
 703	u8 newhash[16];
 704
 705	hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 706	hash_location = tcp_parse_md5sig_option(th);
 707
 708	/* We've parsed the options - do we have a hash? */
 709	if (!hash_expected && !hash_location)
 710		return 0;
 711
 712	if (hash_expected && !hash_location) {
 713		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 714		return 1;
 715	}
 716
 717	if (!hash_expected && hash_location) {
 718		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 719		return 1;
 720	}
 721
 722	/* check the signature */
 723	genhash = tcp_v6_md5_hash_skb(newhash,
 724				      hash_expected,
 725				      NULL, NULL, skb);
 726
 727	if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 
 728		net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 729				     genhash ? "failed" : "mismatch",
 730				     &ip6h->saddr, ntohs(th->source),
 731				     &ip6h->daddr, ntohs(th->dest));
 732		return 1;
 733	}
 734	return 0;
 735}
 736#endif
 737
 738struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 739	.family		=	AF_INET6,
 740	.obj_size	=	sizeof(struct tcp6_request_sock),
 741	.rtx_syn_ack	=	tcp_v6_rtx_synack,
 742	.send_ack	=	tcp_v6_reqsk_send_ack,
 743	.destructor	=	tcp_v6_reqsk_destructor,
 744	.send_reset	=	tcp_v6_send_reset,
 745	.syn_ack_timeout = 	tcp_syn_ack_timeout,
 746};
 747
 748#ifdef CONFIG_TCP_MD5SIG
 749static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 750	.md5_lookup	=	tcp_v6_reqsk_md5_lookup,
 751	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
 752};
 753#endif
 754
 755static void __tcp_v6_send_check(struct sk_buff *skb,
 756				const struct in6_addr *saddr, const struct in6_addr *daddr)
 757{
 758	struct tcphdr *th = tcp_hdr(skb);
 759
 760	if (skb->ip_summed == CHECKSUM_PARTIAL) {
 761		th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
 762		skb->csum_start = skb_transport_header(skb) - skb->head;
 763		skb->csum_offset = offsetof(struct tcphdr, check);
 764	} else {
 765		th->check = tcp_v6_check(skb->len, saddr, daddr,
 766					 csum_partial(th, th->doff << 2,
 767						      skb->csum));
 768	}
 769}
 770
 771static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 772{
 773	struct ipv6_pinfo *np = inet6_sk(sk);
 774
 775	__tcp_v6_send_check(skb, &np->saddr, &np->daddr);
 776}
 777
 778static int tcp_v6_gso_send_check(struct sk_buff *skb)
 
 
 779{
 780	const struct ipv6hdr *ipv6h;
 781	struct tcphdr *th;
 782
 783	if (!pskb_may_pull(skb, sizeof(*th)))
 784		return -EINVAL;
 785
 786	ipv6h = ipv6_hdr(skb);
 787	th = tcp_hdr(skb);
 788
 789	th->check = 0;
 790	skb->ip_summed = CHECKSUM_PARTIAL;
 791	__tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
 792	return 0;
 793}
 794
 795static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 796					 struct sk_buff *skb)
 797{
 798	const struct ipv6hdr *iph = skb_gro_network_header(skb);
 799
 800	switch (skb->ip_summed) {
 801	case CHECKSUM_COMPLETE:
 802		if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
 803				  skb->csum)) {
 804			skb->ip_summed = CHECKSUM_UNNECESSARY;
 805			break;
 806		}
 807
 808		/* fall through */
 809	case CHECKSUM_NONE:
 810		NAPI_GRO_CB(skb)->flush = 1;
 811		return NULL;
 
 
 
 812	}
 813
 814	return tcp_gro_receive(head, skb);
 815}
 816
 817static int tcp6_gro_complete(struct sk_buff *skb)
 
 
 818{
 819	const struct ipv6hdr *iph = ipv6_hdr(skb);
 820	struct tcphdr *th = tcp_hdr(skb);
 821
 822	th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
 823				  &iph->saddr, &iph->daddr, 0);
 824	skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
 
 
 
 
 
 
 825
 826	return tcp_gro_complete(skb);
 827}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 828
 829static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 830				 u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
 
 
 831{
 832	const struct tcphdr *th = tcp_hdr(skb);
 833	struct tcphdr *t1;
 834	struct sk_buff *buff;
 835	struct flowi6 fl6;
 836	struct net *net = dev_net(skb_dst(skb)->dev);
 837	struct sock *ctl_sk = net->ipv6.tcp_sk;
 838	unsigned int tot_len = sizeof(struct tcphdr);
 839	struct dst_entry *dst;
 840	__be32 *topt;
 
 841
 842	if (ts)
 843		tot_len += TCPOLEN_TSTAMP_ALIGNED;
 844#ifdef CONFIG_TCP_MD5SIG
 845	if (key)
 846		tot_len += TCPOLEN_MD5SIG_ALIGNED;
 847#endif
 848
 849	buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 850			 GFP_ATOMIC);
 851	if (buff == NULL)
 852		return;
 853
 854	skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 855
 856	t1 = (struct tcphdr *) skb_push(buff, tot_len);
 857	skb_reset_transport_header(buff);
 858
 859	/* Swap the send and the receive. */
 860	memset(t1, 0, sizeof(*t1));
 861	t1->dest = th->source;
 862	t1->source = th->dest;
 863	t1->doff = tot_len / 4;
 864	t1->seq = htonl(seq);
 865	t1->ack_seq = htonl(ack);
 866	t1->ack = !rst || !th->ack;
 867	t1->rst = rst;
 868	t1->window = htons(win);
 869
 870	topt = (__be32 *)(t1 + 1);
 871
 872	if (ts) {
 873		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 874				(TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 875		*topt++ = htonl(tcp_time_stamp);
 876		*topt++ = htonl(ts);
 877	}
 878
 879#ifdef CONFIG_TCP_MD5SIG
 880	if (key) {
 881		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 882				(TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 883		tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 884				    &ipv6_hdr(skb)->saddr,
 885				    &ipv6_hdr(skb)->daddr, t1);
 886	}
 887#endif
 888
 889	memset(&fl6, 0, sizeof(fl6));
 890	fl6.daddr = ipv6_hdr(skb)->saddr;
 891	fl6.saddr = ipv6_hdr(skb)->daddr;
 
 892
 893	buff->ip_summed = CHECKSUM_PARTIAL;
 894	buff->csum = 0;
 895
 896	__tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 897
 898	fl6.flowi6_proto = IPPROTO_TCP;
 899	fl6.flowi6_oif = inet6_iif(skb);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 900	fl6.fl6_dport = t1->dest;
 901	fl6.fl6_sport = t1->source;
 
 902	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 903
 904	/* Pass a socket to ip6_dst_lookup either it is for RST
 905	 * Underlying function will use this to retrieve the network
 906	 * namespace
 907	 */
 908	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
 909	if (!IS_ERR(dst)) {
 910		skb_dst_set(buff, dst);
 911		ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 912		TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 
 913		if (rst)
 914			TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 915		return;
 916	}
 917
 918	kfree_skb(buff);
 919}
 920
 921static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 922{
 923	const struct tcphdr *th = tcp_hdr(skb);
 
 924	u32 seq = 0, ack_seq = 0;
 925	struct tcp_md5sig_key *key = NULL;
 926#ifdef CONFIG_TCP_MD5SIG
 927	const __u8 *hash_location = NULL;
 928	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 929	unsigned char newhash[16];
 930	int genhash;
 931	struct sock *sk1 = NULL;
 932#endif
 
 
 
 
 933
 934	if (th->rst)
 935		return;
 936
 937	if (!ipv6_unicast_destination(skb))
 
 
 
 938		return;
 939
 
 940#ifdef CONFIG_TCP_MD5SIG
 
 941	hash_location = tcp_parse_md5sig_option(th);
 942	if (!sk && hash_location) {
 
 
 943		/*
 944		 * active side is lost. Try to find listening socket through
 945		 * source port, and then find md5 key through listening socket.
 946		 * we are not loose security here:
 947		 * Incoming packet is checked with md5 hash with finding key,
 948		 * no RST generated if md5 hash doesn't match.
 949		 */
 950		sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 951					   &tcp_hashinfo, &ipv6h->daddr,
 952					   ntohs(th->source), inet6_iif(skb));
 
 
 
 
 953		if (!sk1)
 954			return;
 955
 956		rcu_read_lock();
 957		key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 958		if (!key)
 959			goto release_sk1;
 960
 961		genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 962		if (genhash || memcmp(hash_location, newhash, 16) != 0)
 963			goto release_sk1;
 964	} else {
 965		key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 966	}
 967#endif
 968
 969	if (th->ack)
 970		seq = ntohl(th->ack_seq);
 971	else
 972		ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 973			  (th->doff << 2);
 974
 975	tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 976
 977#ifdef CONFIG_TCP_MD5SIG
 978release_sk1:
 979	if (sk1) {
 980		rcu_read_unlock();
 981		sock_put(sk1);
 982	}
 983#endif
 984}
 985
 986static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
 987			    struct tcp_md5sig_key *key, u8 tclass)
 
 
 988{
 989	tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
 
 990}
 991
 992static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 993{
 994	struct inet_timewait_sock *tw = inet_twsk(sk);
 995	struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 996
 997	tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 998			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 999			tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
1000			tw->tw_tclass);
 
1001
1002	inet_twsk_put(tw);
1003}
1004
1005static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1006				  struct request_sock *req)
1007{
1008	tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1009			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1010}
1011
1012
1013static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1014{
1015	struct request_sock *req, **prev;
1016	const struct tcphdr *th = tcp_hdr(skb);
1017	struct sock *nsk;
1018
1019	/* Find possible connection requests. */
1020	req = inet6_csk_search_req(sk, &prev, th->source,
1021				   &ipv6_hdr(skb)->saddr,
1022				   &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1023	if (req)
1024		return tcp_check_req(sk, skb, req, prev);
1025
1026	nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1027			&ipv6_hdr(skb)->saddr, th->source,
1028			&ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1029
1030	if (nsk) {
1031		if (nsk->sk_state != TCP_TIME_WAIT) {
1032			bh_lock_sock(nsk);
1033			return nsk;
1034		}
1035		inet_twsk_put(inet_twsk(nsk));
1036		return NULL;
1037	}
1038
1039#ifdef CONFIG_SYN_COOKIES
1040	if (!th->syn)
1041		sk = cookie_v6_check(sk, skb);
1042#endif
1043	return sk;
1044}
1045
1046/* FIXME: this is substantially similar to the ipv4 code.
1047 * Can some kind of merge be done? -- erics
1048 */
1049static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1050{
1051	struct tcp_extend_values tmp_ext;
1052	struct tcp_options_received tmp_opt;
1053	const u8 *hash_location;
1054	struct request_sock *req;
1055	struct inet6_request_sock *treq;
1056	struct ipv6_pinfo *np = inet6_sk(sk);
1057	struct tcp_sock *tp = tcp_sk(sk);
1058	__u32 isn = TCP_SKB_CB(skb)->when;
1059	struct dst_entry *dst = NULL;
1060	bool want_cookie = false;
 
1061
 
 
1062	if (skb->protocol == htons(ETH_P_IP))
1063		return tcp_v4_conn_request(sk, skb);
1064
1065	if (!ipv6_unicast_destination(skb))
1066		goto drop;
1067
1068	if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1069		want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
1070		if (!want_cookie)
1071			goto drop;
1072	}
1073
1074	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1075		goto drop;
1076
1077	req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1078	if (req == NULL)
1079		goto drop;
1080
1081#ifdef CONFIG_TCP_MD5SIG
1082	tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1083#endif
1084
1085	tcp_clear_options(&tmp_opt);
1086	tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1087	tmp_opt.user_mss = tp->rx_opt.user_mss;
1088	tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1089
1090	if (tmp_opt.cookie_plus > 0 &&
1091	    tmp_opt.saw_tstamp &&
1092	    !tp->rx_opt.cookie_out_never &&
1093	    (sysctl_tcp_cookie_size > 0 ||
1094	     (tp->cookie_values != NULL &&
1095	      tp->cookie_values->cookie_desired > 0))) {
1096		u8 *c;
1097		u32 *d;
1098		u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1099		int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1100
1101		if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1102			goto drop_and_free;
1103
1104		/* Secret recipe starts with IP addresses */
1105		d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1106		*mess++ ^= *d++;
1107		*mess++ ^= *d++;
1108		*mess++ ^= *d++;
1109		*mess++ ^= *d++;
1110		d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1111		*mess++ ^= *d++;
1112		*mess++ ^= *d++;
1113		*mess++ ^= *d++;
1114		*mess++ ^= *d++;
1115
1116		/* plus variable length Initiator Cookie */
1117		c = (u8 *)mess;
1118		while (l-- > 0)
1119			*c++ ^= *hash_location++;
1120
1121		want_cookie = false;	/* not our kind of cookie */
1122		tmp_ext.cookie_out_never = 0; /* false */
1123		tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1124	} else if (!tp->rx_opt.cookie_in_always) {
1125		/* redundant indications, but ensure initialization. */
1126		tmp_ext.cookie_out_never = 1; /* true */
1127		tmp_ext.cookie_plus = 0;
1128	} else {
1129		goto drop_and_free;
1130	}
1131	tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1132
1133	if (want_cookie && !tmp_opt.saw_tstamp)
1134		tcp_clear_options(&tmp_opt);
1135
1136	tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1137	tcp_openreq_init(req, &tmp_opt, skb);
1138
1139	treq = inet6_rsk(req);
1140	treq->rmt_addr = ipv6_hdr(skb)->saddr;
1141	treq->loc_addr = ipv6_hdr(skb)->daddr;
1142	if (!want_cookie || tmp_opt.tstamp_ok)
1143		TCP_ECN_create_request(req, skb);
1144
1145	treq->iif = sk->sk_bound_dev_if;
1146
1147	/* So that link locals have meaning */
1148	if (!sk->sk_bound_dev_if &&
1149	    ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1150		treq->iif = inet6_iif(skb);
1151
1152	if (!isn) {
1153		struct inet_peer *peer = NULL;
1154
1155		if (ipv6_opt_accepted(sk, skb) ||
1156		    np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1157		    np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1158			atomic_inc(&skb->users);
1159			treq->pktopts = skb;
1160		}
1161
1162		if (want_cookie) {
1163			isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1164			req->cookie_ts = tmp_opt.tstamp_ok;
1165			goto have_isn;
1166		}
1167
1168		/* VJ's idea. We save last timestamp seen
1169		 * from the destination in peer table, when entering
1170		 * state TIME-WAIT, and check against it before
1171		 * accepting new connection request.
1172		 *
1173		 * If "isn" is not zero, this request hit alive
1174		 * timewait bucket, so that all the necessary checks
1175		 * are made in the function processing timewait state.
1176		 */
1177		if (tmp_opt.saw_tstamp &&
1178		    tcp_death_row.sysctl_tw_recycle &&
1179		    (dst = inet6_csk_route_req(sk, req)) != NULL &&
1180		    (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
1181		    ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
1182				    &treq->rmt_addr)) {
1183			inet_peer_refcheck(peer);
1184			if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1185			    (s32)(peer->tcp_ts - req->ts_recent) >
1186							TCP_PAWS_WINDOW) {
1187				NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1188				goto drop_and_release;
1189			}
1190		}
1191		/* Kill the following clause, if you dislike this way. */
1192		else if (!sysctl_tcp_syncookies &&
1193			 (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1194			  (sysctl_max_syn_backlog >> 2)) &&
1195			 (!peer || !peer->tcp_ts_stamp) &&
1196			 (!dst || !dst_metric(dst, RTAX_RTT))) {
1197			/* Without syncookies last quarter of
1198			 * backlog is filled with destinations,
1199			 * proven to be alive.
1200			 * It means that we continue to communicate
1201			 * to destinations, already remembered
1202			 * to the moment of synflood.
1203			 */
1204			LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1205				       &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1206			goto drop_and_release;
1207		}
1208
1209		isn = tcp_v6_init_sequence(skb);
1210	}
1211have_isn:
1212	tcp_rsk(req)->snt_isn = isn;
1213	tcp_rsk(req)->snt_synack = tcp_time_stamp;
1214
1215	if (security_inet_conn_request(sk, skb, req))
1216		goto drop_and_release;
1217
1218	if (tcp_v6_send_synack(sk, req,
1219			       (struct request_values *)&tmp_ext,
1220			       skb_get_queue_mapping(skb)) ||
1221	    want_cookie)
1222		goto drop_and_free;
1223
1224	inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1225	return 0;
1226
1227drop_and_release:
1228	dst_release(dst);
1229drop_and_free:
1230	reqsk_free(req);
1231drop:
 
1232	return 0; /* don't send reset */
1233}
1234
1235static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1236					  struct request_sock *req,
1237					  struct dst_entry *dst)
1238{
1239	struct inet6_request_sock *treq;
1240	struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1241	struct tcp6_sock *newtcp6sk;
 
 
 
 
 
 
 
 
 
 
 
 
 
1242	struct inet_sock *newinet;
1243	struct tcp_sock *newtp;
1244	struct sock *newsk;
1245	struct ipv6_txoptions *opt;
1246#ifdef CONFIG_TCP_MD5SIG
1247	struct tcp_md5sig_key *key;
1248#endif
 
1249
1250	if (skb->protocol == htons(ETH_P_IP)) {
1251		/*
1252		 *	v6 mapped
1253		 */
1254
1255		newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
 
1256
1257		if (newsk == NULL)
1258			return NULL;
1259
1260		newtcp6sk = (struct tcp6_sock *)newsk;
1261		inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1262
1263		newinet = inet_sk(newsk);
1264		newnp = inet6_sk(newsk);
1265		newtp = tcp_sk(newsk);
1266
1267		memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1268
1269		ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1270
1271		ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1272
1273		newnp->rcv_saddr = newnp->saddr;
1274
1275		inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1276		newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1277#ifdef CONFIG_TCP_MD5SIG
1278		newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1279#endif
1280
 
1281		newnp->ipv6_ac_list = NULL;
1282		newnp->ipv6_fl_list = NULL;
1283		newnp->pktoptions  = NULL;
1284		newnp->opt	   = NULL;
1285		newnp->mcast_oif   = inet6_iif(skb);
1286		newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1287		newnp->rcv_tclass  = ipv6_tclass(ipv6_hdr(skb));
 
 
1288
1289		/*
1290		 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1291		 * here, tcp_create_openreq_child now does this for us, see the comment in
1292		 * that function for the gory details. -acme
1293		 */
1294
1295		/* It is tricky place. Until this moment IPv4 tcp
1296		   worked with IPv6 icsk.icsk_af_ops.
1297		   Sync it now.
1298		 */
1299		tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1300
1301		return newsk;
1302	}
1303
1304	treq = inet6_rsk(req);
1305	opt = np->opt;
1306
1307	if (sk_acceptq_is_full(sk))
1308		goto out_overflow;
1309
1310	if (!dst) {
1311		dst = inet6_csk_route_req(sk, req);
1312		if (!dst)
1313			goto out;
1314	}
1315
1316	newsk = tcp_create_openreq_child(sk, req, skb);
1317	if (newsk == NULL)
1318		goto out_nonewsk;
1319
1320	/*
1321	 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1322	 * count here, tcp_create_openreq_child now does this for us, see the
1323	 * comment in that function for the gory details. -acme
1324	 */
1325
1326	newsk->sk_gso_type = SKB_GSO_TCPV6;
1327	__ip6_dst_store(newsk, dst, NULL, NULL);
 
1328
1329	newtcp6sk = (struct tcp6_sock *)newsk;
1330	inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1331
1332	newtp = tcp_sk(newsk);
1333	newinet = inet_sk(newsk);
1334	newnp = inet6_sk(newsk);
1335
1336	memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1337
1338	newnp->daddr = treq->rmt_addr;
1339	newnp->saddr = treq->loc_addr;
1340	newnp->rcv_saddr = treq->loc_addr;
1341	newsk->sk_bound_dev_if = treq->iif;
1342
1343	/* Now IPv6 options...
1344
1345	   First: no IPv4 options.
1346	 */
1347	newinet->inet_opt = NULL;
 
1348	newnp->ipv6_ac_list = NULL;
1349	newnp->ipv6_fl_list = NULL;
1350
1351	/* Clone RX bits */
1352	newnp->rxopt.all = np->rxopt.all;
1353
1354	/* Clone pktoptions received with SYN */
1355	newnp->pktoptions = NULL;
1356	if (treq->pktopts != NULL) {
1357		newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1358		consume_skb(treq->pktopts);
1359		treq->pktopts = NULL;
1360		if (newnp->pktoptions)
1361			skb_set_owner_r(newnp->pktoptions, newsk);
1362	}
1363	newnp->opt	  = NULL;
1364	newnp->mcast_oif  = inet6_iif(skb);
1365	newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1366	newnp->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
 
 
1367
1368	/* Clone native IPv6 options from listening socket (if any)
1369
1370	   Yes, keeping reference count would be much more clever,
1371	   but we make one more one thing there: reattach optmem
1372	   to newsk.
1373	 */
 
 
 
1374	if (opt) {
1375		newnp->opt = ipv6_dup_options(newsk, opt);
1376		if (opt != np->opt)
1377			sock_kfree_s(sk, opt, opt->tot_len);
1378	}
1379
1380	inet_csk(newsk)->icsk_ext_hdr_len = 0;
1381	if (newnp->opt)
1382		inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1383						     newnp->opt->opt_flen);
 
 
1384
1385	tcp_mtup_init(newsk);
1386	tcp_sync_mss(newsk, dst_mtu(dst));
1387	newtp->advmss = dst_metric_advmss(dst);
1388	if (tcp_sk(sk)->rx_opt.user_mss &&
1389	    tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1390		newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1391
1392	tcp_initialize_rcv_mss(newsk);
1393	if (tcp_rsk(req)->snt_synack)
1394		tcp_valid_rtt_meas(newsk,
1395		    tcp_time_stamp - tcp_rsk(req)->snt_synack);
1396	newtp->total_retrans = req->retrans;
1397
1398	newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1399	newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1400
1401#ifdef CONFIG_TCP_MD5SIG
1402	/* Copy over the MD5 key from the original socket */
1403	if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
 
1404		/* We're using one, so create a matching key
1405		 * on the newsk structure. If we fail to get
1406		 * memory, then we end up not copying the key
1407		 * across. Shucks.
1408		 */
1409		tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
1410			       AF_INET6, key->key, key->keylen, GFP_ATOMIC);
 
1411	}
1412#endif
1413
1414	if (__inet_inherit_port(sk, newsk) < 0) {
1415		sock_put(newsk);
 
1416		goto out;
1417	}
1418	__inet6_hash(newsk, NULL);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1419
1420	return newsk;
1421
1422out_overflow:
1423	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1424out_nonewsk:
1425	if (opt && opt != np->opt)
1426		sock_kfree_s(sk, opt, opt->tot_len);
1427	dst_release(dst);
1428out:
1429	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1430	return NULL;
1431}
1432
1433static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1434{
1435	if (skb->ip_summed == CHECKSUM_COMPLETE) {
1436		if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1437				  &ipv6_hdr(skb)->daddr, skb->csum)) {
1438			skb->ip_summed = CHECKSUM_UNNECESSARY;
1439			return 0;
1440		}
1441	}
1442
1443	skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1444					      &ipv6_hdr(skb)->saddr,
1445					      &ipv6_hdr(skb)->daddr, 0));
1446
1447	if (skb->len <= 76) {
1448		return __skb_checksum_complete(skb);
1449	}
1450	return 0;
1451}
1452
1453/* The socket must have it's spinlock held when we get
1454 * here.
1455 *
1456 * We have a potential double-lock case here, so even when
1457 * doing backlog processing we use the BH locking scheme.
1458 * This is because we cannot sleep with the original spinlock
1459 * held.
1460 */
1461static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1462{
1463	struct ipv6_pinfo *np = inet6_sk(sk);
1464	struct tcp_sock *tp;
1465	struct sk_buff *opt_skb = NULL;
 
1466
1467	/* Imagine: socket is IPv6. IPv4 packet arrives,
1468	   goes to IPv4 receive handler and backlogged.
1469	   From backlog it always goes here. Kerboom...
1470	   Fortunately, tcp_rcv_established and rcv_established
1471	   handle them correctly, but it is not case with
1472	   tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1473	 */
1474
1475	if (skb->protocol == htons(ETH_P_IP))
1476		return tcp_v4_do_rcv(sk, skb);
1477
1478#ifdef CONFIG_TCP_MD5SIG
1479	if (tcp_v6_inbound_md5_hash (sk, skb))
1480		goto discard;
1481#endif
1482
1483	if (sk_filter(sk, skb))
1484		goto discard;
1485
1486	/*
1487	 *	socket locking is here for SMP purposes as backlog rcv
1488	 *	is currently called with bh processing disabled.
1489	 */
1490
1491	/* Do Stevens' IPV6_PKTOPTIONS.
1492
1493	   Yes, guys, it is the only place in our code, where we
1494	   may make it not affecting IPv4.
1495	   The rest of code is protocol independent,
1496	   and I do not like idea to uglify IPv4.
1497
1498	   Actually, all the idea behind IPV6_PKTOPTIONS
1499	   looks not very well thought. For now we latch
1500	   options, received in the last packet, enqueued
1501	   by tcp. Feel free to propose better solution.
1502					       --ANK (980728)
1503	 */
1504	if (np->rxopt.all)
1505		opt_skb = skb_clone(skb, GFP_ATOMIC);
1506
1507	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
 
 
1508		sock_rps_save_rxhash(sk, skb);
1509		if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1510			goto reset;
 
 
 
 
 
 
 
 
1511		if (opt_skb)
1512			goto ipv6_pktoptions;
1513		return 0;
1514	}
1515
1516	if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1517		goto csum_err;
1518
1519	if (sk->sk_state == TCP_LISTEN) {
1520		struct sock *nsk = tcp_v6_hnd_req(sk, skb);
 
1521		if (!nsk)
1522			goto discard;
1523
1524		/*
1525		 * Queue it on the new socket if the new socket is active,
1526		 * otherwise we just shortcircuit this and continue with
1527		 * the new socket..
1528		 */
1529		if(nsk != sk) {
1530			sock_rps_save_rxhash(nsk, skb);
1531			if (tcp_child_process(sk, nsk, skb))
1532				goto reset;
1533			if (opt_skb)
1534				__kfree_skb(opt_skb);
1535			return 0;
1536		}
1537	} else
1538		sock_rps_save_rxhash(sk, skb);
1539
1540	if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1541		goto reset;
1542	if (opt_skb)
1543		goto ipv6_pktoptions;
1544	return 0;
1545
1546reset:
1547	tcp_v6_send_reset(sk, skb);
1548discard:
1549	if (opt_skb)
1550		__kfree_skb(opt_skb);
1551	kfree_skb(skb);
1552	return 0;
1553csum_err:
1554	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
 
1555	goto discard;
1556
1557
1558ipv6_pktoptions:
1559	/* Do you ask, what is it?
1560
1561	   1. skb was enqueued by tcp.
1562	   2. skb is added to tail of read queue, rather than out of order.
1563	   3. socket is not in passive state.
1564	   4. Finally, it really contains options, which user wants to receive.
1565	 */
1566	tp = tcp_sk(sk);
1567	if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1568	    !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1569		if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1570			np->mcast_oif = inet6_iif(opt_skb);
1571		if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1572			np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1573		if (np->rxopt.bits.rxtclass)
1574			np->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
1575		if (ipv6_opt_accepted(sk, opt_skb)) {
 
 
1576			skb_set_owner_r(opt_skb, sk);
 
1577			opt_skb = xchg(&np->pktoptions, opt_skb);
1578		} else {
1579			__kfree_skb(opt_skb);
1580			opt_skb = xchg(&np->pktoptions, NULL);
1581		}
1582	}
1583
1584	kfree_skb(opt_skb);
1585	return 0;
1586}
1587
1588static int tcp_v6_rcv(struct sk_buff *skb)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1589{
 
 
1590	const struct tcphdr *th;
1591	const struct ipv6hdr *hdr;
 
1592	struct sock *sk;
1593	int ret;
1594	struct net *net = dev_net(skb->dev);
1595
1596	if (skb->pkt_type != PACKET_HOST)
1597		goto discard_it;
1598
1599	/*
1600	 *	Count it even if it's bad.
1601	 */
1602	TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1603
1604	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1605		goto discard_it;
1606
1607	th = tcp_hdr(skb);
1608
1609	if (th->doff < sizeof(struct tcphdr)/4)
1610		goto bad_packet;
1611	if (!pskb_may_pull(skb, th->doff*4))
1612		goto discard_it;
1613
1614	if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1615		goto bad_packet;
1616
1617	th = tcp_hdr(skb);
1618	hdr = ipv6_hdr(skb);
1619	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1620	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1621				    skb->len - th->doff*4);
1622	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1623	TCP_SKB_CB(skb)->when = 0;
1624	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1625	TCP_SKB_CB(skb)->sacked = 0;
1626
1627	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
 
 
 
1628	if (!sk)
1629		goto no_tcp_socket;
1630
1631process:
1632	if (sk->sk_state == TCP_TIME_WAIT)
1633		goto do_time_wait;
1634
1635	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1636		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1637		goto discard_and_relse;
1638	}
1639
1640	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1641		goto discard_and_relse;
1642
1643	if (sk_filter(sk, skb))
 
 
 
1644		goto discard_and_relse;
 
 
 
1645
1646	skb->dev = NULL;
1647
 
 
 
 
 
 
 
1648	bh_lock_sock_nested(sk);
 
1649	ret = 0;
1650	if (!sock_owned_by_user(sk)) {
1651#ifdef CONFIG_NET_DMA
1652		struct tcp_sock *tp = tcp_sk(sk);
1653		if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1654			tp->ucopy.dma_chan = net_dma_find_channel();
1655		if (tp->ucopy.dma_chan)
1656			ret = tcp_v6_do_rcv(sk, skb);
1657		else
1658#endif
1659		{
1660			if (!tcp_prequeue(sk, skb))
1661				ret = tcp_v6_do_rcv(sk, skb);
1662		}
1663	} else if (unlikely(sk_add_backlog(sk, skb,
1664					   sk->sk_rcvbuf + sk->sk_sndbuf))) {
1665		bh_unlock_sock(sk);
1666		NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1667		goto discard_and_relse;
1668	}
1669	bh_unlock_sock(sk);
1670
1671	sock_put(sk);
 
 
 
1672	return ret ? -1 : 0;
1673
1674no_tcp_socket:
1675	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1676		goto discard_it;
1677
1678	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 
 
 
 
1679bad_packet:
1680		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1681	} else {
1682		tcp_v6_send_reset(NULL, skb);
1683	}
1684
1685discard_it:
1686
1687	/*
1688	 *	Discard frame
1689	 */
1690
1691	kfree_skb(skb);
1692	return 0;
1693
1694discard_and_relse:
1695	sock_put(sk);
 
 
1696	goto discard_it;
1697
1698do_time_wait:
1699	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1700		inet_twsk_put(inet_twsk(sk));
1701		goto discard_it;
1702	}
1703
1704	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1705		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
 
1706		inet_twsk_put(inet_twsk(sk));
1707		goto discard_it;
1708	}
1709
1710	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1711	case TCP_TW_SYN:
1712	{
1713		struct sock *sk2;
1714
1715		sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
 
 
1716					    &ipv6_hdr(skb)->daddr,
1717					    ntohs(th->dest), inet6_iif(skb));
1718		if (sk2 != NULL) {
 
 
1719			struct inet_timewait_sock *tw = inet_twsk(sk);
1720			inet_twsk_deschedule(tw, &tcp_death_row);
1721			inet_twsk_put(tw);
1722			sk = sk2;
 
 
1723			goto process;
1724		}
1725		/* Fall through to ACK */
1726	}
 
 
1727	case TCP_TW_ACK:
1728		tcp_v6_timewait_ack(sk, skb);
1729		break;
1730	case TCP_TW_RST:
1731		goto no_tcp_socket;
1732	case TCP_TW_SUCCESS:;
 
 
 
1733	}
1734	goto discard_it;
1735}
1736
1737static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
1738{
1739	struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
1740	struct ipv6_pinfo *np = inet6_sk(sk);
1741	struct inet_peer *peer;
1742
1743	if (!rt ||
1744	    !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
1745		peer = inet_getpeer_v6(&np->daddr, 1);
1746		*release_it = true;
1747	} else {
1748		if (!rt->rt6i_peer)
1749			rt6_bind_peer(rt, 1);
1750		peer = rt->rt6i_peer;
1751		*release_it = false;
1752	}
1753
1754	return peer;
1755}
1756
1757static void *tcp_v6_tw_get_peer(struct sock *sk)
1758{
1759	const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
1760	const struct inet_timewait_sock *tw = inet_twsk(sk);
1761
1762	if (tw->tw_family == AF_INET)
1763		return tcp_v4_tw_get_peer(sk);
 
 
 
1764
1765	return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1766}
1767
1768static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1769	.twsk_obj_size	= sizeof(struct tcp6_timewait_sock),
1770	.twsk_unique	= tcp_twsk_unique,
1771	.twsk_destructor= tcp_twsk_destructor,
1772	.twsk_getpeer	= tcp_v6_tw_get_peer,
1773};
1774
1775static const struct inet_connection_sock_af_ops ipv6_specific = {
1776	.queue_xmit	   = inet6_csk_xmit,
1777	.send_check	   = tcp_v6_send_check,
1778	.rebuild_header	   = inet6_sk_rebuild_header,
 
1779	.conn_request	   = tcp_v6_conn_request,
1780	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
1781	.get_peer	   = tcp_v6_get_peer,
1782	.net_header_len	   = sizeof(struct ipv6hdr),
1783	.net_frag_header_len = sizeof(struct frag_hdr),
1784	.setsockopt	   = ipv6_setsockopt,
1785	.getsockopt	   = ipv6_getsockopt,
1786	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
1787	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1788	.bind_conflict	   = inet6_csk_bind_conflict,
1789#ifdef CONFIG_COMPAT
1790	.compat_setsockopt = compat_ipv6_setsockopt,
1791	.compat_getsockopt = compat_ipv6_getsockopt,
1792#endif
 
1793};
1794
1795#ifdef CONFIG_TCP_MD5SIG
1796static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1797	.md5_lookup	=	tcp_v6_md5_lookup,
1798	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
1799	.md5_parse	=	tcp_v6_parse_md5_keys,
1800};
1801#endif
1802
1803/*
1804 *	TCP over IPv4 via INET6 API
1805 */
1806
1807static const struct inet_connection_sock_af_ops ipv6_mapped = {
1808	.queue_xmit	   = ip_queue_xmit,
1809	.send_check	   = tcp_v4_send_check,
1810	.rebuild_header	   = inet_sk_rebuild_header,
 
1811	.conn_request	   = tcp_v6_conn_request,
1812	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
1813	.get_peer	   = tcp_v4_get_peer,
1814	.net_header_len	   = sizeof(struct iphdr),
1815	.setsockopt	   = ipv6_setsockopt,
1816	.getsockopt	   = ipv6_getsockopt,
1817	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
1818	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1819	.bind_conflict	   = inet6_csk_bind_conflict,
1820#ifdef CONFIG_COMPAT
1821	.compat_setsockopt = compat_ipv6_setsockopt,
1822	.compat_getsockopt = compat_ipv6_getsockopt,
1823#endif
 
1824};
1825
1826#ifdef CONFIG_TCP_MD5SIG
1827static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1828	.md5_lookup	=	tcp_v4_md5_lookup,
1829	.calc_md5_hash	=	tcp_v4_md5_hash_skb,
1830	.md5_parse	=	tcp_v6_parse_md5_keys,
1831};
1832#endif
1833
1834/* NOTE: A lot of things set to zero explicitly by call to
1835 *       sk_alloc() so need not be done here.
1836 */
1837static int tcp_v6_init_sock(struct sock *sk)
1838{
1839	struct inet_connection_sock *icsk = inet_csk(sk);
1840
1841	tcp_init_sock(sk);
1842
1843	icsk->icsk_af_ops = &ipv6_specific;
1844
1845#ifdef CONFIG_TCP_MD5SIG
1846	tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1847#endif
1848
1849	return 0;
1850}
1851
1852static void tcp_v6_destroy_sock(struct sock *sk)
1853{
1854	tcp_v4_destroy_sock(sk);
1855	inet6_destroy_sock(sk);
1856}
1857
1858#ifdef CONFIG_PROC_FS
1859/* Proc filesystem TCPv6 sock list dumping. */
1860static void get_openreq6(struct seq_file *seq,
1861			 const struct sock *sk, struct request_sock *req, int i, int uid)
1862{
1863	int ttd = req->expires - jiffies;
1864	const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1865	const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1866
1867	if (ttd < 0)
1868		ttd = 0;
1869
1870	seq_printf(seq,
1871		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1872		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1873		   i,
1874		   src->s6_addr32[0], src->s6_addr32[1],
1875		   src->s6_addr32[2], src->s6_addr32[3],
1876		   ntohs(inet_rsk(req)->loc_port),
1877		   dest->s6_addr32[0], dest->s6_addr32[1],
1878		   dest->s6_addr32[2], dest->s6_addr32[3],
1879		   ntohs(inet_rsk(req)->rmt_port),
1880		   TCP_SYN_RECV,
1881		   0,0, /* could print option size, but that is af dependent. */
1882		   1,   /* timers active (only the expire timer) */
1883		   jiffies_to_clock_t(ttd),
1884		   req->retrans,
1885		   uid,
 
1886		   0,  /* non standard timer */
1887		   0, /* open_requests have no inode */
1888		   0, req);
1889}
1890
1891static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1892{
1893	const struct in6_addr *dest, *src;
1894	__u16 destp, srcp;
1895	int timer_active;
1896	unsigned long timer_expires;
1897	const struct inet_sock *inet = inet_sk(sp);
1898	const struct tcp_sock *tp = tcp_sk(sp);
1899	const struct inet_connection_sock *icsk = inet_csk(sp);
1900	const struct ipv6_pinfo *np = inet6_sk(sp);
 
 
1901
1902	dest  = &np->daddr;
1903	src   = &np->rcv_saddr;
1904	destp = ntohs(inet->inet_dport);
1905	srcp  = ntohs(inet->inet_sport);
1906
1907	if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
 
 
1908		timer_active	= 1;
1909		timer_expires	= icsk->icsk_timeout;
1910	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1911		timer_active	= 4;
1912		timer_expires	= icsk->icsk_timeout;
1913	} else if (timer_pending(&sp->sk_timer)) {
1914		timer_active	= 2;
1915		timer_expires	= sp->sk_timer.expires;
1916	} else {
1917		timer_active	= 0;
1918		timer_expires = jiffies;
1919	}
1920
 
 
 
 
 
 
 
 
 
 
1921	seq_printf(seq,
1922		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1923		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
1924		   i,
1925		   src->s6_addr32[0], src->s6_addr32[1],
1926		   src->s6_addr32[2], src->s6_addr32[3], srcp,
1927		   dest->s6_addr32[0], dest->s6_addr32[1],
1928		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1929		   sp->sk_state,
1930		   tp->write_seq-tp->snd_una,
1931		   (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1932		   timer_active,
1933		   jiffies_to_clock_t(timer_expires - jiffies),
1934		   icsk->icsk_retransmits,
1935		   sock_i_uid(sp),
1936		   icsk->icsk_probes_out,
1937		   sock_i_ino(sp),
1938		   atomic_read(&sp->sk_refcnt), sp,
1939		   jiffies_to_clock_t(icsk->icsk_rto),
1940		   jiffies_to_clock_t(icsk->icsk_ack.ato),
1941		   (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1942		   tp->snd_cwnd,
1943		   tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
 
 
1944		   );
1945}
1946
1947static void get_timewait6_sock(struct seq_file *seq,
1948			       struct inet_timewait_sock *tw, int i)
1949{
 
1950	const struct in6_addr *dest, *src;
1951	__u16 destp, srcp;
1952	const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1953	int ttd = tw->tw_ttd - jiffies;
1954
1955	if (ttd < 0)
1956		ttd = 0;
1957
1958	dest = &tw6->tw_v6_daddr;
1959	src  = &tw6->tw_v6_rcv_saddr;
1960	destp = ntohs(tw->tw_dport);
1961	srcp  = ntohs(tw->tw_sport);
1962
1963	seq_printf(seq,
1964		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1965		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1966		   i,
1967		   src->s6_addr32[0], src->s6_addr32[1],
1968		   src->s6_addr32[2], src->s6_addr32[3], srcp,
1969		   dest->s6_addr32[0], dest->s6_addr32[1],
1970		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1971		   tw->tw_substate, 0, 0,
1972		   3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
1973		   atomic_read(&tw->tw_refcnt), tw);
1974}
1975
1976static int tcp6_seq_show(struct seq_file *seq, void *v)
1977{
1978	struct tcp_iter_state *st;
 
1979
1980	if (v == SEQ_START_TOKEN) {
1981		seq_puts(seq,
1982			 "  sl  "
1983			 "local_address                         "
1984			 "remote_address                        "
1985			 "st tx_queue rx_queue tr tm->when retrnsmt"
1986			 "   uid  timeout inode\n");
1987		goto out;
1988	}
1989	st = seq->private;
1990
1991	switch (st->state) {
1992	case TCP_SEQ_STATE_LISTENING:
1993	case TCP_SEQ_STATE_ESTABLISHED:
1994		get_tcp6_sock(seq, v, st->num);
1995		break;
1996	case TCP_SEQ_STATE_OPENREQ:
1997		get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1998		break;
1999	case TCP_SEQ_STATE_TIME_WAIT:
2000		get_timewait6_sock(seq, v, st->num);
2001		break;
2002	}
 
 
2003out:
2004	return 0;
2005}
2006
2007static const struct file_operations tcp6_afinfo_seq_fops = {
2008	.owner   = THIS_MODULE,
2009	.open    = tcp_seq_open,
2010	.read    = seq_read,
2011	.llseek  = seq_lseek,
2012	.release = seq_release_net
2013};
2014
2015static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2016	.name		= "tcp6",
2017	.family		= AF_INET6,
2018	.seq_fops	= &tcp6_afinfo_seq_fops,
2019	.seq_ops	= {
2020		.show		= tcp6_seq_show,
2021	},
2022};
2023
2024int __net_init tcp6_proc_init(struct net *net)
2025{
2026	return tcp_proc_register(net, &tcp6_seq_afinfo);
 
 
 
2027}
2028
2029void tcp6_proc_exit(struct net *net)
2030{
2031	tcp_proc_unregister(net, &tcp6_seq_afinfo);
2032}
2033#endif
2034
2035struct proto tcpv6_prot = {
2036	.name			= "TCPv6",
2037	.owner			= THIS_MODULE,
2038	.close			= tcp_close,
 
2039	.connect		= tcp_v6_connect,
2040	.disconnect		= tcp_disconnect,
2041	.accept			= inet_csk_accept,
2042	.ioctl			= tcp_ioctl,
2043	.init			= tcp_v6_init_sock,
2044	.destroy		= tcp_v6_destroy_sock,
2045	.shutdown		= tcp_shutdown,
2046	.setsockopt		= tcp_setsockopt,
2047	.getsockopt		= tcp_getsockopt,
 
2048	.recvmsg		= tcp_recvmsg,
2049	.sendmsg		= tcp_sendmsg,
2050	.sendpage		= tcp_sendpage,
2051	.backlog_rcv		= tcp_v6_do_rcv,
2052	.hash			= tcp_v6_hash,
 
2053	.unhash			= inet_unhash,
2054	.get_port		= inet_csk_get_port,
2055	.enter_memory_pressure	= tcp_enter_memory_pressure,
 
 
2056	.sockets_allocated	= &tcp_sockets_allocated,
2057	.memory_allocated	= &tcp_memory_allocated,
2058	.memory_pressure	= &tcp_memory_pressure,
2059	.orphan_count		= &tcp_orphan_count,
2060	.sysctl_wmem		= sysctl_tcp_wmem,
2061	.sysctl_rmem		= sysctl_tcp_rmem,
 
2062	.max_header		= MAX_TCP_HEADER,
2063	.obj_size		= sizeof(struct tcp6_sock),
2064	.slab_flags		= SLAB_DESTROY_BY_RCU,
2065	.twsk_prot		= &tcp6_timewait_sock_ops,
2066	.rsk_prot		= &tcp6_request_sock_ops,
2067	.h.hashinfo		= &tcp_hashinfo,
2068	.no_autobind		= true,
2069#ifdef CONFIG_COMPAT
2070	.compat_setsockopt	= compat_tcp_setsockopt,
2071	.compat_getsockopt	= compat_tcp_getsockopt,
2072#endif
2073#ifdef CONFIG_CGROUP_MEM_RES_CTLR_KMEM
2074	.proto_cgroup		= tcp_proto_cgroup,
2075#endif
2076};
2077
2078static const struct inet6_protocol tcpv6_protocol = {
 
 
 
 
 
2079	.handler	=	tcp_v6_rcv,
2080	.err_handler	=	tcp_v6_err,
2081	.gso_send_check	=	tcp_v6_gso_send_check,
2082	.gso_segment	=	tcp_tso_segment,
2083	.gro_receive	=	tcp6_gro_receive,
2084	.gro_complete	=	tcp6_gro_complete,
2085	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2086};
2087
2088static struct inet_protosw tcpv6_protosw = {
2089	.type		=	SOCK_STREAM,
2090	.protocol	=	IPPROTO_TCP,
2091	.prot		=	&tcpv6_prot,
2092	.ops		=	&inet6_stream_ops,
2093	.no_check	=	0,
2094	.flags		=	INET_PROTOSW_PERMANENT |
2095				INET_PROTOSW_ICSK,
2096};
2097
2098static int __net_init tcpv6_net_init(struct net *net)
2099{
2100	return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2101				    SOCK_RAW, IPPROTO_TCP, net);
2102}
2103
2104static void __net_exit tcpv6_net_exit(struct net *net)
2105{
2106	inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2107}
2108
2109static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2110{
2111	inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2112}
2113
2114static struct pernet_operations tcpv6_net_ops = {
2115	.init	    = tcpv6_net_init,
2116	.exit	    = tcpv6_net_exit,
2117	.exit_batch = tcpv6_net_exit_batch,
2118};
2119
2120int __init tcpv6_init(void)
2121{
2122	int ret;
2123
2124	ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2125	if (ret)
2126		goto out;
2127
2128	/* register inet6 protocol */
2129	ret = inet6_register_protosw(&tcpv6_protosw);
2130	if (ret)
2131		goto out_tcpv6_protocol;
2132
2133	ret = register_pernet_subsys(&tcpv6_net_ops);
2134	if (ret)
2135		goto out_tcpv6_protosw;
2136out:
2137	return ret;
2138
2139out_tcpv6_protocol:
2140	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2141out_tcpv6_protosw:
2142	inet6_unregister_protosw(&tcpv6_protosw);
 
 
2143	goto out;
2144}
2145
2146void tcpv6_exit(void)
2147{
2148	unregister_pernet_subsys(&tcpv6_net_ops);
2149	inet6_unregister_protosw(&tcpv6_protosw);
2150	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2151}