Linux Audio

Check our new training course

Loading...
v4.17
   1/*
   2 *	TCP over IPv6
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *
   8 *	Based on:
   9 *	linux/net/ipv4/tcp.c
  10 *	linux/net/ipv4/tcp_input.c
  11 *	linux/net/ipv4/tcp_output.c
  12 *
  13 *	Fixes:
  14 *	Hideaki YOSHIFUJI	:	sin6_scope_id support
  15 *	YOSHIFUJI Hideaki @USAGI and:	Support IPV6_V6ONLY socket option, which
  16 *	Alexey Kuznetsov		allow both IPv4 and IPv6 sockets to bind
  17 *					a single port at the same time.
  18 *	YOSHIFUJI Hideaki @USAGI:	convert /proc/net/tcp6 to seq_file.
  19 *
  20 *	This program is free software; you can redistribute it and/or
  21 *      modify it under the terms of the GNU General Public License
  22 *      as published by the Free Software Foundation; either version
  23 *      2 of the License, or (at your option) any later version.
  24 */
  25
  26#include <linux/bottom_half.h>
  27#include <linux/module.h>
  28#include <linux/errno.h>
  29#include <linux/types.h>
  30#include <linux/socket.h>
  31#include <linux/sockios.h>
  32#include <linux/net.h>
  33#include <linux/jiffies.h>
  34#include <linux/in.h>
  35#include <linux/in6.h>
  36#include <linux/netdevice.h>
  37#include <linux/init.h>
  38#include <linux/jhash.h>
  39#include <linux/ipsec.h>
  40#include <linux/times.h>
  41#include <linux/slab.h>
  42#include <linux/uaccess.h>
  43#include <linux/ipv6.h>
  44#include <linux/icmpv6.h>
  45#include <linux/random.h>
  46
  47#include <net/tcp.h>
  48#include <net/ndisc.h>
  49#include <net/inet6_hashtables.h>
  50#include <net/inet6_connection_sock.h>
  51#include <net/ipv6.h>
  52#include <net/transp_v6.h>
  53#include <net/addrconf.h>
  54#include <net/ip6_route.h>
  55#include <net/ip6_checksum.h>
  56#include <net/inet_ecn.h>
  57#include <net/protocol.h>
  58#include <net/xfrm.h>
  59#include <net/snmp.h>
  60#include <net/dsfield.h>
  61#include <net/timewait_sock.h>
 
  62#include <net/inet_common.h>
  63#include <net/secure_seq.h>
 
  64#include <net/busy_poll.h>
  65
  66#include <linux/proc_fs.h>
  67#include <linux/seq_file.h>
  68
  69#include <crypto/hash.h>
  70#include <linux/scatterlist.h>
  71
  72#include <trace/events/tcp.h>
  73
  74static void	tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  75static void	tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  76				      struct request_sock *req);
  77
  78static int	tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80static const struct inet_connection_sock_af_ops ipv6_mapped;
  81static const struct inet_connection_sock_af_ops ipv6_specific;
  82#ifdef CONFIG_TCP_MD5SIG
  83static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  84static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  85#else
  86static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  87						   const struct in6_addr *addr)
  88{
  89	return NULL;
  90}
  91#endif
  92
  93static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  94{
  95	struct dst_entry *dst = skb_dst(skb);
 
  96
  97	if (dst && dst_hold_safe(dst)) {
  98		const struct rt6_info *rt = (const struct rt6_info *)dst;
  99
 100		sk->sk_rx_dst = dst;
 101		inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102		inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 103	}
 104}
 105
 106static u32 tcp_v6_init_seq(const struct sk_buff *skb)
 107{
 108	return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
 109				ipv6_hdr(skb)->saddr.s6_addr32,
 110				tcp_hdr(skb)->dest,
 111				tcp_hdr(skb)->source);
 112}
 113
 114static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
 115{
 116	return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
 117				   ipv6_hdr(skb)->saddr.s6_addr32);
 
 
 
 
 
 
 
 118}
 119
 120static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
 121			      int addr_len)
 122{
 123	/* This check is replicated from tcp_v6_connect() and intended to
 124	 * prevent BPF program called below from accessing bytes that are out
 125	 * of the bound specified by user in addr_len.
 126	 */
 127	if (addr_len < SIN6_LEN_RFC2133)
 128		return -EINVAL;
 129
 130	sock_owned_by_me(sk);
 131
 132	return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr);
 133}
 134
 135static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 136			  int addr_len)
 137{
 138	struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 139	struct inet_sock *inet = inet_sk(sk);
 140	struct inet_connection_sock *icsk = inet_csk(sk);
 141	struct ipv6_pinfo *np = inet6_sk(sk);
 142	struct tcp_sock *tp = tcp_sk(sk);
 143	struct in6_addr *saddr = NULL, *final_p, final;
 144	struct ipv6_txoptions *opt;
 145	struct flowi6 fl6;
 146	struct dst_entry *dst;
 147	int addr_type;
 148	int err;
 149	struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
 150
 151	if (addr_len < SIN6_LEN_RFC2133)
 152		return -EINVAL;
 153
 154	if (usin->sin6_family != AF_INET6)
 155		return -EAFNOSUPPORT;
 156
 157	memset(&fl6, 0, sizeof(fl6));
 158
 159	if (np->sndflow) {
 160		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 161		IP6_ECN_flow_init(fl6.flowlabel);
 162		if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 163			struct ip6_flowlabel *flowlabel;
 164			flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 165			if (!flowlabel)
 166				return -EINVAL;
 167			fl6_sock_release(flowlabel);
 168		}
 169	}
 170
 171	/*
 172	 *	connect() to INADDR_ANY means loopback (BSD'ism).
 173	 */
 174
 175	if (ipv6_addr_any(&usin->sin6_addr)) {
 176		if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
 177			ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
 178					       &usin->sin6_addr);
 179		else
 180			usin->sin6_addr = in6addr_loopback;
 181	}
 182
 183	addr_type = ipv6_addr_type(&usin->sin6_addr);
 184
 185	if (addr_type & IPV6_ADDR_MULTICAST)
 186		return -ENETUNREACH;
 187
 188	if (addr_type&IPV6_ADDR_LINKLOCAL) {
 189		if (addr_len >= sizeof(struct sockaddr_in6) &&
 190		    usin->sin6_scope_id) {
 191			/* If interface is set while binding, indices
 192			 * must coincide.
 193			 */
 194			if (!sk_dev_equal_l3scope(sk, usin->sin6_scope_id))
 
 195				return -EINVAL;
 196
 197			sk->sk_bound_dev_if = usin->sin6_scope_id;
 198		}
 199
 200		/* Connect to link-local address requires an interface */
 201		if (!sk->sk_bound_dev_if)
 202			return -EINVAL;
 203	}
 204
 205	if (tp->rx_opt.ts_recent_stamp &&
 206	    !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 207		tp->rx_opt.ts_recent = 0;
 208		tp->rx_opt.ts_recent_stamp = 0;
 209		tp->write_seq = 0;
 210	}
 211
 212	sk->sk_v6_daddr = usin->sin6_addr;
 213	np->flow_label = fl6.flowlabel;
 214
 215	/*
 216	 *	TCP over IPv4
 217	 */
 218
 219	if (addr_type & IPV6_ADDR_MAPPED) {
 220		u32 exthdrlen = icsk->icsk_ext_hdr_len;
 221		struct sockaddr_in sin;
 222
 223		SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 224
 225		if (__ipv6_only_sock(sk))
 226			return -ENETUNREACH;
 227
 228		sin.sin_family = AF_INET;
 229		sin.sin_port = usin->sin6_port;
 230		sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 231
 232		icsk->icsk_af_ops = &ipv6_mapped;
 233		sk->sk_backlog_rcv = tcp_v4_do_rcv;
 234#ifdef CONFIG_TCP_MD5SIG
 235		tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 236#endif
 237
 238		err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 239
 240		if (err) {
 241			icsk->icsk_ext_hdr_len = exthdrlen;
 242			icsk->icsk_af_ops = &ipv6_specific;
 243			sk->sk_backlog_rcv = tcp_v6_do_rcv;
 244#ifdef CONFIG_TCP_MD5SIG
 245			tp->af_specific = &tcp_sock_ipv6_specific;
 246#endif
 247			goto failure;
 
 
 
 
 248		}
 249		np->saddr = sk->sk_v6_rcv_saddr;
 250
 251		return err;
 252	}
 253
 254	if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 255		saddr = &sk->sk_v6_rcv_saddr;
 256
 257	fl6.flowi6_proto = IPPROTO_TCP;
 258	fl6.daddr = sk->sk_v6_daddr;
 259	fl6.saddr = saddr ? *saddr : np->saddr;
 260	fl6.flowi6_oif = sk->sk_bound_dev_if;
 261	fl6.flowi6_mark = sk->sk_mark;
 262	fl6.fl6_dport = usin->sin6_port;
 263	fl6.fl6_sport = inet->inet_sport;
 264	fl6.flowi6_uid = sk->sk_uid;
 265
 266	opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 267	final_p = fl6_update_dst(&fl6, opt, &final);
 268
 269	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 270
 271	dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 272	if (IS_ERR(dst)) {
 273		err = PTR_ERR(dst);
 274		goto failure;
 275	}
 276
 277	if (!saddr) {
 278		saddr = &fl6.saddr;
 279		sk->sk_v6_rcv_saddr = *saddr;
 280	}
 281
 282	/* set the source address */
 283	np->saddr = *saddr;
 284	inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 285
 286	sk->sk_gso_type = SKB_GSO_TCPV6;
 287	ip6_dst_store(sk, dst, NULL, NULL);
 
 
 
 
 
 
 288
 289	icsk->icsk_ext_hdr_len = 0;
 290	if (opt)
 291		icsk->icsk_ext_hdr_len = opt->opt_flen +
 292					 opt->opt_nflen;
 293
 294	tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 295
 296	inet->inet_dport = usin->sin6_port;
 297
 298	tcp_set_state(sk, TCP_SYN_SENT);
 299	err = inet6_hash_connect(tcp_death_row, sk);
 300	if (err)
 301		goto late_failure;
 302
 303	sk_set_txhash(sk);
 304
 305	if (likely(!tp->repair)) {
 306		if (!tp->write_seq)
 307			tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
 308							 sk->sk_v6_daddr.s6_addr32,
 309							 inet->inet_sport,
 310							 inet->inet_dport);
 311		tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
 312						   np->saddr.s6_addr32,
 313						   sk->sk_v6_daddr.s6_addr32);
 314	}
 315
 316	if (tcp_fastopen_defer_connect(sk, &err))
 317		return err;
 318	if (err)
 319		goto late_failure;
 320
 321	err = tcp_connect(sk);
 322	if (err)
 323		goto late_failure;
 324
 325	return 0;
 326
 327late_failure:
 328	tcp_set_state(sk, TCP_CLOSE);
 
 329failure:
 330	inet->inet_dport = 0;
 331	sk->sk_route_caps = 0;
 332	return err;
 333}
 334
 335static void tcp_v6_mtu_reduced(struct sock *sk)
 336{
 337	struct dst_entry *dst;
 338
 339	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 340		return;
 341
 342	dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 343	if (!dst)
 344		return;
 345
 346	if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 347		tcp_sync_mss(sk, dst_mtu(dst));
 348		tcp_simple_retransmit(sk);
 349	}
 350}
 351
 352static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 353		u8 type, u8 code, int offset, __be32 info)
 354{
 355	const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 356	const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 357	struct net *net = dev_net(skb->dev);
 358	struct request_sock *fastopen;
 359	struct ipv6_pinfo *np;
 360	struct tcp_sock *tp;
 361	__u32 seq, snd_una;
 362	struct sock *sk;
 363	bool fatal;
 364	int err;
 
 
 
 
 
 
 365
 366	sk = __inet6_lookup_established(net, &tcp_hashinfo,
 367					&hdr->daddr, th->dest,
 368					&hdr->saddr, ntohs(th->source),
 369					skb->dev->ifindex, inet6_sdif(skb));
 370
 371	if (!sk) {
 372		__ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 373				  ICMP6_MIB_INERRORS);
 374		return;
 375	}
 376
 377	if (sk->sk_state == TCP_TIME_WAIT) {
 378		inet_twsk_put(inet_twsk(sk));
 379		return;
 380	}
 381	seq = ntohl(th->seq);
 382	fatal = icmpv6_err_convert(type, code, &err);
 383	if (sk->sk_state == TCP_NEW_SYN_RECV)
 384		return tcp_req_err(sk, seq, fatal);
 385
 386	bh_lock_sock(sk);
 387	if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 388		__NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 389
 390	if (sk->sk_state == TCP_CLOSE)
 391		goto out;
 392
 393	if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 394		__NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 395		goto out;
 396	}
 397
 398	tp = tcp_sk(sk);
 399	/* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 400	fastopen = tp->fastopen_rsk;
 401	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 402	if (sk->sk_state != TCP_LISTEN &&
 403	    !between(seq, snd_una, tp->snd_nxt)) {
 404		__NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 405		goto out;
 406	}
 407
 408	np = inet6_sk(sk);
 409
 410	if (type == NDISC_REDIRECT) {
 411		if (!sock_owned_by_user(sk)) {
 412			struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 413
 414			if (dst)
 415				dst->ops->redirect(dst, sk, skb);
 416		}
 417		goto out;
 418	}
 419
 420	if (type == ICMPV6_PKT_TOOBIG) {
 421		/* We are not interested in TCP_LISTEN and open_requests
 422		 * (SYN-ACKs send out by Linux are always <576bytes so
 423		 * they should go through unfragmented).
 424		 */
 425		if (sk->sk_state == TCP_LISTEN)
 426			goto out;
 427
 428		if (!ip6_sk_accept_pmtu(sk))
 429			goto out;
 430
 431		tp->mtu_info = ntohl(info);
 432		if (!sock_owned_by_user(sk))
 433			tcp_v6_mtu_reduced(sk);
 434		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 435					   &sk->sk_tsq_flags))
 436			sock_hold(sk);
 437		goto out;
 438	}
 439
 
 440
 441	/* Might be for an request_sock */
 442	switch (sk->sk_state) {
 443	case TCP_SYN_SENT:
 444	case TCP_SYN_RECV:
 445		/* Only in fast or simultaneous open. If a fast open socket is
 446		 * is already accepted it is treated as a connected one below.
 
 
 
 
 
 
 
 
 447		 */
 448		if (fastopen && !fastopen->sk)
 449			break;
 
 
 
 
 
 
 
 
 450
 
 
 
 451		if (!sock_owned_by_user(sk)) {
 452			sk->sk_err = err;
 453			sk->sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */
 454
 455			tcp_done(sk);
 456		} else
 457			sk->sk_err_soft = err;
 458		goto out;
 459	}
 460
 461	if (!sock_owned_by_user(sk) && np->recverr) {
 462		sk->sk_err = err;
 463		sk->sk_error_report(sk);
 464	} else
 465		sk->sk_err_soft = err;
 466
 467out:
 468	bh_unlock_sock(sk);
 469	sock_put(sk);
 470}
 471
 472
 473static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 474			      struct flowi *fl,
 475			      struct request_sock *req,
 476			      struct tcp_fastopen_cookie *foc,
 477			      enum tcp_synack_type synack_type)
 478{
 479	struct inet_request_sock *ireq = inet_rsk(req);
 480	struct ipv6_pinfo *np = inet6_sk(sk);
 481	struct ipv6_txoptions *opt;
 482	struct flowi6 *fl6 = &fl->u.ip6;
 483	struct sk_buff *skb;
 484	int err = -ENOMEM;
 485
 486	/* First, grab a route. */
 487	if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 488					       IPPROTO_TCP)) == NULL)
 489		goto done;
 490
 491	skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 492
 493	if (skb) {
 494		__tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 495				    &ireq->ir_v6_rmt_addr);
 496
 497		fl6->daddr = ireq->ir_v6_rmt_addr;
 498		if (np->repflow && ireq->pktopts)
 499			fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 500
 501		rcu_read_lock();
 502		opt = ireq->ipv6_opt;
 503		if (!opt)
 504			opt = rcu_dereference(np->opt);
 505		err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
 506		rcu_read_unlock();
 507		err = net_xmit_eval(err);
 508	}
 509
 510done:
 511	return err;
 512}
 513
 
 
 
 
 
 
 
 
 
 
 
 
 514
 515static void tcp_v6_reqsk_destructor(struct request_sock *req)
 516{
 517	kfree(inet_rsk(req)->ipv6_opt);
 518	kfree_skb(inet_rsk(req)->pktopts);
 519}
 520
 521#ifdef CONFIG_TCP_MD5SIG
 522static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 523						   const struct in6_addr *addr)
 524{
 525	return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 526}
 527
 528static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 529						const struct sock *addr_sk)
 530{
 531	return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 532}
 533
 534static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
 535				 char __user *optval, int optlen)
 
 
 
 
 
 
 536{
 537	struct tcp_md5sig cmd;
 538	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 539	u8 prefixlen;
 540
 541	if (optlen < sizeof(cmd))
 542		return -EINVAL;
 543
 544	if (copy_from_user(&cmd, optval, sizeof(cmd)))
 545		return -EFAULT;
 546
 547	if (sin6->sin6_family != AF_INET6)
 548		return -EINVAL;
 549
 550	if (optname == TCP_MD5SIG_EXT &&
 551	    cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
 552		prefixlen = cmd.tcpm_prefixlen;
 553		if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
 554					prefixlen > 32))
 555			return -EINVAL;
 556	} else {
 557		prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
 558	}
 559
 560	if (!cmd.tcpm_keylen) {
 561		if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 562			return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 563					      AF_INET, prefixlen);
 564		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 565				      AF_INET6, prefixlen);
 566	}
 567
 568	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 569		return -EINVAL;
 570
 571	if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 572		return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 573				      AF_INET, prefixlen, cmd.tcpm_key,
 574				      cmd.tcpm_keylen, GFP_KERNEL);
 575
 576	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 577			      AF_INET6, prefixlen, cmd.tcpm_key,
 578			      cmd.tcpm_keylen, GFP_KERNEL);
 579}
 580
 581static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 582				   const struct in6_addr *daddr,
 583				   const struct in6_addr *saddr,
 584				   const struct tcphdr *th, int nbytes)
 585{
 586	struct tcp6_pseudohdr *bp;
 587	struct scatterlist sg;
 588	struct tcphdr *_th;
 589
 590	bp = hp->scratch;
 591	/* 1. TCP pseudo-header (RFC2460) */
 592	bp->saddr = *saddr;
 593	bp->daddr = *daddr;
 594	bp->protocol = cpu_to_be32(IPPROTO_TCP);
 595	bp->len = cpu_to_be32(nbytes);
 596
 597	_th = (struct tcphdr *)(bp + 1);
 598	memcpy(_th, th, sizeof(*th));
 599	_th->check = 0;
 600
 601	sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 602	ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 603				sizeof(*bp) + sizeof(*th));
 604	return crypto_ahash_update(hp->md5_req);
 605}
 606
 607static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 608			       const struct in6_addr *daddr, struct in6_addr *saddr,
 609			       const struct tcphdr *th)
 610{
 611	struct tcp_md5sig_pool *hp;
 612	struct ahash_request *req;
 613
 614	hp = tcp_get_md5sig_pool();
 615	if (!hp)
 616		goto clear_hash_noput;
 617	req = hp->md5_req;
 618
 619	if (crypto_ahash_init(req))
 
 
 620		goto clear_hash;
 621	if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 622		goto clear_hash;
 623	if (tcp_md5_hash_key(hp, key))
 624		goto clear_hash;
 625	ahash_request_set_crypt(req, NULL, md5_hash, 0);
 626	if (crypto_ahash_final(req))
 627		goto clear_hash;
 628
 629	tcp_put_md5sig_pool();
 630	return 0;
 631
 632clear_hash:
 633	tcp_put_md5sig_pool();
 634clear_hash_noput:
 635	memset(md5_hash, 0, 16);
 636	return 1;
 637}
 638
 639static int tcp_v6_md5_hash_skb(char *md5_hash,
 640			       const struct tcp_md5sig_key *key,
 641			       const struct sock *sk,
 
 642			       const struct sk_buff *skb)
 643{
 644	const struct in6_addr *saddr, *daddr;
 645	struct tcp_md5sig_pool *hp;
 646	struct ahash_request *req;
 647	const struct tcphdr *th = tcp_hdr(skb);
 648
 649	if (sk) { /* valid for establish/request sockets */
 650		saddr = &sk->sk_v6_rcv_saddr;
 651		daddr = &sk->sk_v6_daddr;
 
 
 
 652	} else {
 653		const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 654		saddr = &ip6h->saddr;
 655		daddr = &ip6h->daddr;
 656	}
 657
 658	hp = tcp_get_md5sig_pool();
 659	if (!hp)
 660		goto clear_hash_noput;
 661	req = hp->md5_req;
 662
 663	if (crypto_ahash_init(req))
 664		goto clear_hash;
 665
 666	if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 
 
 667		goto clear_hash;
 668	if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 669		goto clear_hash;
 670	if (tcp_md5_hash_key(hp, key))
 671		goto clear_hash;
 672	ahash_request_set_crypt(req, NULL, md5_hash, 0);
 673	if (crypto_ahash_final(req))
 674		goto clear_hash;
 675
 676	tcp_put_md5sig_pool();
 677	return 0;
 678
 679clear_hash:
 680	tcp_put_md5sig_pool();
 681clear_hash_noput:
 682	memset(md5_hash, 0, 16);
 683	return 1;
 684}
 685
 686#endif
 687
 688static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 689				    const struct sk_buff *skb)
 690{
 691#ifdef CONFIG_TCP_MD5SIG
 692	const __u8 *hash_location = NULL;
 693	struct tcp_md5sig_key *hash_expected;
 694	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 695	const struct tcphdr *th = tcp_hdr(skb);
 696	int genhash;
 697	u8 newhash[16];
 698
 699	hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 700	hash_location = tcp_parse_md5sig_option(th);
 701
 702	/* We've parsed the options - do we have a hash? */
 703	if (!hash_expected && !hash_location)
 704		return false;
 705
 706	if (hash_expected && !hash_location) {
 707		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 708		return true;
 709	}
 710
 711	if (!hash_expected && hash_location) {
 712		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 713		return true;
 714	}
 715
 716	/* check the signature */
 717	genhash = tcp_v6_md5_hash_skb(newhash,
 718				      hash_expected,
 719				      NULL, skb);
 720
 721	if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 722		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 723		net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 724				     genhash ? "failed" : "mismatch",
 725				     &ip6h->saddr, ntohs(th->source),
 726				     &ip6h->daddr, ntohs(th->dest));
 727		return true;
 728	}
 729#endif
 730	return false;
 731}
 732
 733static void tcp_v6_init_req(struct request_sock *req,
 734			    const struct sock *sk_listener,
 735			    struct sk_buff *skb)
 736{
 737	struct inet_request_sock *ireq = inet_rsk(req);
 738	const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 739
 740	ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 741	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 742
 743	/* So that link locals have meaning */
 744	if (!sk_listener->sk_bound_dev_if &&
 745	    ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 746		ireq->ir_iif = tcp_v6_iif(skb);
 747
 748	if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 749	    (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 750	     np->rxopt.bits.rxinfo ||
 751	     np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 752	     np->rxopt.bits.rxohlim || np->repflow)) {
 753		refcount_inc(&skb->users);
 754		ireq->pktopts = skb;
 755	}
 
 756}
 757
 758static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 759					  struct flowi *fl,
 760					  const struct request_sock *req)
 761{
 762	return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 763}
 764
 765struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 766	.family		=	AF_INET6,
 767	.obj_size	=	sizeof(struct tcp6_request_sock),
 768	.rtx_syn_ack	=	tcp_rtx_synack,
 769	.send_ack	=	tcp_v6_reqsk_send_ack,
 770	.destructor	=	tcp_v6_reqsk_destructor,
 771	.send_reset	=	tcp_v6_send_reset,
 772	.syn_ack_timeout =	tcp_syn_ack_timeout,
 773};
 774
 775static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 776	.mss_clamp	=	IPV6_MIN_MTU - sizeof(struct tcphdr) -
 777				sizeof(struct ipv6hdr),
 778#ifdef CONFIG_TCP_MD5SIG
 779	.req_md5_lookup	=	tcp_v6_md5_lookup,
 
 780	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
 781#endif
 782	.init_req	=	tcp_v6_init_req,
 783#ifdef CONFIG_SYN_COOKIES
 784	.cookie_init_seq =	cookie_v6_init_sequence,
 785#endif
 786	.route_req	=	tcp_v6_route_req,
 787	.init_seq	=	tcp_v6_init_seq,
 788	.init_ts_off	=	tcp_v6_init_ts_off,
 789	.send_synack	=	tcp_v6_send_synack,
 790};
 
 791
 792static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 793				 u32 ack, u32 win, u32 tsval, u32 tsecr,
 794				 int oif, struct tcp_md5sig_key *key, int rst,
 795				 u8 tclass, __be32 label)
 796{
 797	const struct tcphdr *th = tcp_hdr(skb);
 798	struct tcphdr *t1;
 799	struct sk_buff *buff;
 800	struct flowi6 fl6;
 801	struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 802	struct sock *ctl_sk = net->ipv6.tcp_sk;
 803	unsigned int tot_len = sizeof(struct tcphdr);
 804	struct dst_entry *dst;
 805	__be32 *topt;
 806
 807	if (tsecr)
 808		tot_len += TCPOLEN_TSTAMP_ALIGNED;
 809#ifdef CONFIG_TCP_MD5SIG
 810	if (key)
 811		tot_len += TCPOLEN_MD5SIG_ALIGNED;
 812#endif
 813
 814	buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 815			 GFP_ATOMIC);
 816	if (!buff)
 817		return;
 818
 819	skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 820
 821	t1 = skb_push(buff, tot_len);
 822	skb_reset_transport_header(buff);
 823
 824	/* Swap the send and the receive. */
 825	memset(t1, 0, sizeof(*t1));
 826	t1->dest = th->source;
 827	t1->source = th->dest;
 828	t1->doff = tot_len / 4;
 829	t1->seq = htonl(seq);
 830	t1->ack_seq = htonl(ack);
 831	t1->ack = !rst || !th->ack;
 832	t1->rst = rst;
 833	t1->window = htons(win);
 834
 835	topt = (__be32 *)(t1 + 1);
 836
 837	if (tsecr) {
 838		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 839				(TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 840		*topt++ = htonl(tsval);
 841		*topt++ = htonl(tsecr);
 842	}
 843
 844#ifdef CONFIG_TCP_MD5SIG
 845	if (key) {
 846		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 847				(TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 848		tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 849				    &ipv6_hdr(skb)->saddr,
 850				    &ipv6_hdr(skb)->daddr, t1);
 851	}
 852#endif
 853
 854	memset(&fl6, 0, sizeof(fl6));
 855	fl6.daddr = ipv6_hdr(skb)->saddr;
 856	fl6.saddr = ipv6_hdr(skb)->daddr;
 857	fl6.flowlabel = label;
 858
 859	buff->ip_summed = CHECKSUM_PARTIAL;
 860	buff->csum = 0;
 861
 862	__tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 863
 864	fl6.flowi6_proto = IPPROTO_TCP;
 865	if (rt6_need_strict(&fl6.daddr) && !oif)
 866		fl6.flowi6_oif = tcp_v6_iif(skb);
 867	else {
 868		if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 869			oif = skb->skb_iif;
 870
 871		fl6.flowi6_oif = oif;
 872	}
 873
 874	fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 875	fl6.fl6_dport = t1->dest;
 876	fl6.fl6_sport = t1->source;
 877	fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 878	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 879
 880	/* Pass a socket to ip6_dst_lookup either it is for RST
 881	 * Underlying function will use this to retrieve the network
 882	 * namespace
 883	 */
 884	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 885	if (!IS_ERR(dst)) {
 886		skb_dst_set(buff, dst);
 887		ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
 888		TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 889		if (rst)
 890			TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 891		return;
 892	}
 893
 894	kfree_skb(buff);
 895}
 896
 897static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 898{
 899	const struct tcphdr *th = tcp_hdr(skb);
 900	u32 seq = 0, ack_seq = 0;
 901	struct tcp_md5sig_key *key = NULL;
 902#ifdef CONFIG_TCP_MD5SIG
 903	const __u8 *hash_location = NULL;
 904	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 905	unsigned char newhash[16];
 906	int genhash;
 907	struct sock *sk1 = NULL;
 908#endif
 909	int oif = 0;
 910
 911	if (th->rst)
 912		return;
 913
 914	/* If sk not NULL, it means we did a successful lookup and incoming
 915	 * route had to be correct. prequeue might have dropped our dst.
 916	 */
 917	if (!sk && !ipv6_unicast_destination(skb))
 918		return;
 919
 920#ifdef CONFIG_TCP_MD5SIG
 921	rcu_read_lock();
 922	hash_location = tcp_parse_md5sig_option(th);
 923	if (sk && sk_fullsock(sk)) {
 924		key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 925	} else if (hash_location) {
 926		/*
 927		 * active side is lost. Try to find listening socket through
 928		 * source port, and then find md5 key through listening socket.
 929		 * we are not loose security here:
 930		 * Incoming packet is checked with md5 hash with finding key,
 931		 * no RST generated if md5 hash doesn't match.
 932		 */
 933		sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 934					   &tcp_hashinfo, NULL, 0,
 935					   &ipv6h->saddr,
 936					   th->source, &ipv6h->daddr,
 937					   ntohs(th->source), tcp_v6_iif(skb),
 938					   tcp_v6_sdif(skb));
 939		if (!sk1)
 940			goto out;
 941
 
 942		key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 943		if (!key)
 944			goto out;
 945
 946		genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 947		if (genhash || memcmp(hash_location, newhash, 16) != 0)
 948			goto out;
 
 
 949	}
 950#endif
 951
 952	if (th->ack)
 953		seq = ntohl(th->ack_seq);
 954	else
 955		ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 956			  (th->doff << 2);
 957
 958	if (sk) {
 959		oif = sk->sk_bound_dev_if;
 960		if (sk_fullsock(sk))
 961			trace_tcp_send_reset(sk, skb);
 962	}
 963
 964	tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 965
 966#ifdef CONFIG_TCP_MD5SIG
 967out:
 968	rcu_read_unlock();
 
 
 
 969#endif
 970}
 971
 972static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 973			    u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 974			    struct tcp_md5sig_key *key, u8 tclass,
 975			    __be32 label)
 976{
 977	tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 978			     tclass, label);
 979}
 980
 981static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 982{
 983	struct inet_timewait_sock *tw = inet_twsk(sk);
 984	struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 985
 986	tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 987			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 988			tcp_time_stamp_raw() + tcptw->tw_ts_offset,
 989			tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 990			tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 991
 992	inet_twsk_put(tw);
 993}
 994
 995static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 996				  struct request_sock *req)
 997{
 998	/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 999	 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
1000	 */
1001	/* RFC 7323 2.3
1002	 * The window field (SEG.WND) of every outgoing segment, with the
1003	 * exception of <SYN> segments, MUST be right-shifted by
1004	 * Rcv.Wind.Shift bits:
1005	 */
1006	tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
1007			tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
1008			tcp_rsk(req)->rcv_nxt,
1009			req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1010			tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1011			req->ts_recent, sk->sk_bound_dev_if,
1012			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
1013			0, 0);
1014}
1015
1016
1017static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
1018{
1019#ifdef CONFIG_SYN_COOKIES
1020	const struct tcphdr *th = tcp_hdr(skb);
 
1021
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1022	if (!th->syn)
1023		sk = cookie_v6_check(sk, skb);
1024#endif
1025	return sk;
1026}
1027
 
 
 
1028static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1029{
 
 
 
 
 
 
 
 
 
 
1030	if (skb->protocol == htons(ETH_P_IP))
1031		return tcp_v4_conn_request(sk, skb);
1032
1033	if (!ipv6_unicast_destination(skb))
1034		goto drop;
1035
1036	return tcp_conn_request(&tcp6_request_sock_ops,
1037				&tcp_request_sock_ipv6_ops, sk, skb);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1038
 
 
 
 
1039drop:
1040	tcp_listendrop(sk);
1041	return 0; /* don't send reset */
1042}
1043
1044static void tcp_v6_restore_cb(struct sk_buff *skb)
1045{
1046	/* We need to move header back to the beginning if xfrm6_policy_check()
1047	 * and tcp_v6_fill_cb() are going to be called again.
1048	 * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1049	 */
1050	memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1051		sizeof(struct inet6_skb_parm));
1052}
1053
1054static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1055					 struct request_sock *req,
1056					 struct dst_entry *dst,
1057					 struct request_sock *req_unhash,
1058					 bool *own_req)
1059{
1060	struct inet_request_sock *ireq;
1061	struct ipv6_pinfo *newnp;
1062	const struct ipv6_pinfo *np = inet6_sk(sk);
1063	struct ipv6_txoptions *opt;
1064	struct tcp6_sock *newtcp6sk;
1065	struct inet_sock *newinet;
1066	struct tcp_sock *newtp;
1067	struct sock *newsk;
1068#ifdef CONFIG_TCP_MD5SIG
1069	struct tcp_md5sig_key *key;
1070#endif
1071	struct flowi6 fl6;
1072
1073	if (skb->protocol == htons(ETH_P_IP)) {
1074		/*
1075		 *	v6 mapped
1076		 */
1077
1078		newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1079					     req_unhash, own_req);
1080
1081		if (!newsk)
1082			return NULL;
1083
1084		newtcp6sk = (struct tcp6_sock *)newsk;
1085		inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1086
1087		newinet = inet_sk(newsk);
1088		newnp = inet6_sk(newsk);
1089		newtp = tcp_sk(newsk);
1090
1091		memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1092
1093		newnp->saddr = newsk->sk_v6_rcv_saddr;
 
 
 
 
1094
1095		inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1096		newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1097#ifdef CONFIG_TCP_MD5SIG
1098		newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1099#endif
1100
1101		newnp->ipv6_mc_list = NULL;
1102		newnp->ipv6_ac_list = NULL;
1103		newnp->ipv6_fl_list = NULL;
1104		newnp->pktoptions  = NULL;
1105		newnp->opt	   = NULL;
1106		newnp->mcast_oif   = tcp_v6_iif(skb);
1107		newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1108		newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1109		if (np->repflow)
1110			newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1111
1112		/*
1113		 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1114		 * here, tcp_create_openreq_child now does this for us, see the comment in
1115		 * that function for the gory details. -acme
1116		 */
1117
1118		/* It is tricky place. Until this moment IPv4 tcp
1119		   worked with IPv6 icsk.icsk_af_ops.
1120		   Sync it now.
1121		 */
1122		tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1123
1124		return newsk;
1125	}
1126
1127	ireq = inet_rsk(req);
1128
1129	if (sk_acceptq_is_full(sk))
1130		goto out_overflow;
1131
1132	if (!dst) {
1133		dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1134		if (!dst)
1135			goto out;
1136	}
1137
1138	newsk = tcp_create_openreq_child(sk, req, skb);
1139	if (!newsk)
1140		goto out_nonewsk;
1141
1142	/*
1143	 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1144	 * count here, tcp_create_openreq_child now does this for us, see the
1145	 * comment in that function for the gory details. -acme
1146	 */
1147
1148	newsk->sk_gso_type = SKB_GSO_TCPV6;
1149	ip6_dst_store(newsk, dst, NULL, NULL);
1150	inet6_sk_rx_dst_set(newsk, skb);
1151
1152	newtcp6sk = (struct tcp6_sock *)newsk;
1153	inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1154
1155	newtp = tcp_sk(newsk);
1156	newinet = inet_sk(newsk);
1157	newnp = inet6_sk(newsk);
1158
1159	memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1160
1161	newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1162	newnp->saddr = ireq->ir_v6_loc_addr;
1163	newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1164	newsk->sk_bound_dev_if = ireq->ir_iif;
1165
1166	/* Now IPv6 options...
1167
1168	   First: no IPv4 options.
1169	 */
1170	newinet->inet_opt = NULL;
1171	newnp->ipv6_mc_list = NULL;
1172	newnp->ipv6_ac_list = NULL;
1173	newnp->ipv6_fl_list = NULL;
1174
1175	/* Clone RX bits */
1176	newnp->rxopt.all = np->rxopt.all;
1177
 
1178	newnp->pktoptions = NULL;
 
 
 
 
 
 
 
 
1179	newnp->opt	  = NULL;
1180	newnp->mcast_oif  = tcp_v6_iif(skb);
1181	newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1182	newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1183	if (np->repflow)
1184		newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1185
1186	/* Clone native IPv6 options from listening socket (if any)
1187
1188	   Yes, keeping reference count would be much more clever,
1189	   but we make one more one thing there: reattach optmem
1190	   to newsk.
1191	 */
1192	opt = ireq->ipv6_opt;
1193	if (!opt)
1194		opt = rcu_dereference(np->opt);
1195	if (opt) {
1196		opt = ipv6_dup_options(newsk, opt);
1197		RCU_INIT_POINTER(newnp->opt, opt);
1198	}
1199	inet_csk(newsk)->icsk_ext_hdr_len = 0;
1200	if (opt)
1201		inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1202						    opt->opt_flen;
1203
1204	tcp_ca_openreq_child(newsk, dst);
 
 
 
1205
1206	tcp_sync_mss(newsk, dst_mtu(dst));
1207	newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
 
 
 
1208
1209	tcp_initialize_rcv_mss(newsk);
1210
1211	newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1212	newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1213
1214#ifdef CONFIG_TCP_MD5SIG
1215	/* Copy over the MD5 key from the original socket */
1216	key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1217	if (key) {
1218		/* We're using one, so create a matching key
1219		 * on the newsk structure. If we fail to get
1220		 * memory, then we end up not copying the key
1221		 * across. Shucks.
1222		 */
1223		tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1224			       AF_INET6, 128, key->key, key->keylen,
1225			       sk_gfp_mask(sk, GFP_ATOMIC));
1226	}
1227#endif
1228
1229	if (__inet_inherit_port(sk, newsk) < 0) {
1230		inet_csk_prepare_forced_close(newsk);
1231		tcp_done(newsk);
1232		goto out;
1233	}
1234	*own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1235	if (*own_req) {
1236		tcp_move_syn(newtp, req);
1237
1238		/* Clone pktoptions received with SYN, if we own the req */
1239		if (ireq->pktopts) {
1240			newnp->pktoptions = skb_clone(ireq->pktopts,
1241						      sk_gfp_mask(sk, GFP_ATOMIC));
1242			consume_skb(ireq->pktopts);
1243			ireq->pktopts = NULL;
1244			if (newnp->pktoptions) {
1245				tcp_v6_restore_cb(newnp->pktoptions);
1246				skb_set_owner_r(newnp->pktoptions, newsk);
1247			}
1248		}
1249	}
1250
1251	return newsk;
1252
1253out_overflow:
1254	__NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1255out_nonewsk:
1256	dst_release(dst);
1257out:
1258	tcp_listendrop(sk);
1259	return NULL;
1260}
1261
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1262/* The socket must have it's spinlock held when we get
1263 * here, unless it is a TCP_LISTEN socket.
1264 *
1265 * We have a potential double-lock case here, so even when
1266 * doing backlog processing we use the BH locking scheme.
1267 * This is because we cannot sleep with the original spinlock
1268 * held.
1269 */
1270static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1271{
1272	struct ipv6_pinfo *np = inet6_sk(sk);
1273	struct tcp_sock *tp;
1274	struct sk_buff *opt_skb = NULL;
1275
1276	/* Imagine: socket is IPv6. IPv4 packet arrives,
1277	   goes to IPv4 receive handler and backlogged.
1278	   From backlog it always goes here. Kerboom...
1279	   Fortunately, tcp_rcv_established and rcv_established
1280	   handle them correctly, but it is not case with
1281	   tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1282	 */
1283
1284	if (skb->protocol == htons(ETH_P_IP))
1285		return tcp_v4_do_rcv(sk, skb);
1286
 
 
 
 
 
 
 
 
1287	/*
1288	 *	socket locking is here for SMP purposes as backlog rcv
1289	 *	is currently called with bh processing disabled.
1290	 */
1291
1292	/* Do Stevens' IPV6_PKTOPTIONS.
1293
1294	   Yes, guys, it is the only place in our code, where we
1295	   may make it not affecting IPv4.
1296	   The rest of code is protocol independent,
1297	   and I do not like idea to uglify IPv4.
1298
1299	   Actually, all the idea behind IPV6_PKTOPTIONS
1300	   looks not very well thought. For now we latch
1301	   options, received in the last packet, enqueued
1302	   by tcp. Feel free to propose better solution.
1303					       --ANK (980728)
1304	 */
1305	if (np->rxopt.all)
1306		opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1307
1308	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1309		struct dst_entry *dst = sk->sk_rx_dst;
1310
1311		sock_rps_save_rxhash(sk, skb);
1312		sk_mark_napi_id(sk, skb);
1313		if (dst) {
1314			if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1315			    dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1316				dst_release(dst);
1317				sk->sk_rx_dst = NULL;
1318			}
1319		}
1320
1321		tcp_rcv_established(sk, skb, tcp_hdr(skb));
1322		if (opt_skb)
1323			goto ipv6_pktoptions;
1324		return 0;
1325	}
1326
1327	if (tcp_checksum_complete(skb))
1328		goto csum_err;
1329
1330	if (sk->sk_state == TCP_LISTEN) {
1331		struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1332
1333		if (!nsk)
1334			goto discard;
1335
 
 
 
 
 
1336		if (nsk != sk) {
 
1337			if (tcp_child_process(sk, nsk, skb))
1338				goto reset;
1339			if (opt_skb)
1340				__kfree_skb(opt_skb);
1341			return 0;
1342		}
1343	} else
1344		sock_rps_save_rxhash(sk, skb);
1345
1346	if (tcp_rcv_state_process(sk, skb))
1347		goto reset;
1348	if (opt_skb)
1349		goto ipv6_pktoptions;
1350	return 0;
1351
1352reset:
1353	tcp_v6_send_reset(sk, skb);
1354discard:
1355	if (opt_skb)
1356		__kfree_skb(opt_skb);
1357	kfree_skb(skb);
1358	return 0;
1359csum_err:
1360	TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1361	TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1362	goto discard;
1363
1364
1365ipv6_pktoptions:
1366	/* Do you ask, what is it?
1367
1368	   1. skb was enqueued by tcp.
1369	   2. skb is added to tail of read queue, rather than out of order.
1370	   3. socket is not in passive state.
1371	   4. Finally, it really contains options, which user wants to receive.
1372	 */
1373	tp = tcp_sk(sk);
1374	if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1375	    !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1376		if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1377			np->mcast_oif = tcp_v6_iif(opt_skb);
1378		if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1379			np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1380		if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1381			np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1382		if (np->repflow)
1383			np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1384		if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1385			skb_set_owner_r(opt_skb, sk);
1386			tcp_v6_restore_cb(opt_skb);
1387			opt_skb = xchg(&np->pktoptions, opt_skb);
1388		} else {
1389			__kfree_skb(opt_skb);
1390			opt_skb = xchg(&np->pktoptions, NULL);
1391		}
1392	}
1393
1394	kfree_skb(opt_skb);
1395	return 0;
1396}
1397
1398static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1399			   const struct tcphdr *th)
1400{
1401	/* This is tricky: we move IP6CB at its correct location into
1402	 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1403	 * _decode_session6() uses IP6CB().
1404	 * barrier() makes sure compiler won't play aliasing games.
1405	 */
1406	memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1407		sizeof(struct inet6_skb_parm));
1408	barrier();
1409
1410	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1411	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1412				    skb->len - th->doff*4);
1413	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1414	TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1415	TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1416	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1417	TCP_SKB_CB(skb)->sacked = 0;
1418	TCP_SKB_CB(skb)->has_rxtstamp =
1419			skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
1420}
1421
1422static int tcp_v6_rcv(struct sk_buff *skb)
1423{
1424	int sdif = inet6_sdif(skb);
1425	const struct tcphdr *th;
1426	const struct ipv6hdr *hdr;
1427	bool refcounted;
1428	struct sock *sk;
1429	int ret;
1430	struct net *net = dev_net(skb->dev);
1431
1432	if (skb->pkt_type != PACKET_HOST)
1433		goto discard_it;
1434
1435	/*
1436	 *	Count it even if it's bad.
1437	 */
1438	__TCP_INC_STATS(net, TCP_MIB_INSEGS);
1439
1440	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1441		goto discard_it;
1442
1443	th = (const struct tcphdr *)skb->data;
1444
1445	if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1446		goto bad_packet;
1447	if (!pskb_may_pull(skb, th->doff*4))
1448		goto discard_it;
1449
1450	if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1451		goto csum_error;
1452
1453	th = (const struct tcphdr *)skb->data;
1454	hdr = ipv6_hdr(skb);
 
 
 
 
 
 
 
1455
1456lookup:
1457	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1458				th->source, th->dest, inet6_iif(skb), sdif,
1459				&refcounted);
1460	if (!sk)
1461		goto no_tcp_socket;
1462
1463process:
1464	if (sk->sk_state == TCP_TIME_WAIT)
1465		goto do_time_wait;
1466
1467	if (sk->sk_state == TCP_NEW_SYN_RECV) {
1468		struct request_sock *req = inet_reqsk(sk);
1469		bool req_stolen = false;
1470		struct sock *nsk;
1471
1472		sk = req->rsk_listener;
1473		if (tcp_v6_inbound_md5_hash(sk, skb)) {
1474			sk_drops_add(sk, skb);
1475			reqsk_put(req);
1476			goto discard_it;
1477		}
1478		if (unlikely(sk->sk_state != TCP_LISTEN)) {
1479			inet_csk_reqsk_queue_drop_and_put(sk, req);
1480			goto lookup;
1481		}
1482		sock_hold(sk);
1483		refcounted = true;
1484		nsk = NULL;
1485		if (!tcp_filter(sk, skb)) {
1486			th = (const struct tcphdr *)skb->data;
1487			hdr = ipv6_hdr(skb);
1488			tcp_v6_fill_cb(skb, hdr, th);
1489			nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
1490		}
1491		if (!nsk) {
1492			reqsk_put(req);
1493			if (req_stolen) {
1494				/* Another cpu got exclusive access to req
1495				 * and created a full blown socket.
1496				 * Try to feed this packet to this socket
1497				 * instead of discarding it.
1498				 */
1499				tcp_v6_restore_cb(skb);
1500				sock_put(sk);
1501				goto lookup;
1502			}
1503			goto discard_and_relse;
1504		}
1505		if (nsk == sk) {
1506			reqsk_put(req);
1507			tcp_v6_restore_cb(skb);
1508		} else if (tcp_child_process(sk, nsk, skb)) {
1509			tcp_v6_send_reset(nsk, skb);
1510			goto discard_and_relse;
1511		} else {
1512			sock_put(sk);
1513			return 0;
1514		}
1515	}
1516	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1517		__NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1518		goto discard_and_relse;
1519	}
1520
1521	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1522		goto discard_and_relse;
1523
1524	if (tcp_v6_inbound_md5_hash(sk, skb))
1525		goto discard_and_relse;
1526
1527	if (tcp_filter(sk, skb))
1528		goto discard_and_relse;
1529	th = (const struct tcphdr *)skb->data;
1530	hdr = ipv6_hdr(skb);
1531	tcp_v6_fill_cb(skb, hdr, th);
1532
 
1533	skb->dev = NULL;
1534
1535	if (sk->sk_state == TCP_LISTEN) {
1536		ret = tcp_v6_do_rcv(sk, skb);
1537		goto put_and_return;
1538	}
1539
1540	sk_incoming_cpu_update(sk);
1541
1542	bh_lock_sock_nested(sk);
1543	tcp_segs_in(tcp_sk(sk), skb);
1544	ret = 0;
1545	if (!sock_owned_by_user(sk)) {
1546		ret = tcp_v6_do_rcv(sk, skb);
1547	} else if (tcp_add_backlog(sk, skb)) {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1548		goto discard_and_relse;
1549	}
1550	bh_unlock_sock(sk);
1551
1552put_and_return:
1553	if (refcounted)
1554		sock_put(sk);
1555	return ret ? -1 : 0;
1556
1557no_tcp_socket:
1558	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1559		goto discard_it;
1560
1561	tcp_v6_fill_cb(skb, hdr, th);
1562
1563	if (tcp_checksum_complete(skb)) {
1564csum_error:
1565		__TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1566bad_packet:
1567		__TCP_INC_STATS(net, TCP_MIB_INERRS);
1568	} else {
1569		tcp_v6_send_reset(NULL, skb);
1570	}
1571
1572discard_it:
1573	kfree_skb(skb);
1574	return 0;
1575
1576discard_and_relse:
1577	sk_drops_add(sk, skb);
1578	if (refcounted)
1579		sock_put(sk);
1580	goto discard_it;
1581
1582do_time_wait:
1583	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1584		inet_twsk_put(inet_twsk(sk));
1585		goto discard_it;
1586	}
1587
1588	tcp_v6_fill_cb(skb, hdr, th);
1589
 
 
1590	if (tcp_checksum_complete(skb)) {
1591		inet_twsk_put(inet_twsk(sk));
1592		goto csum_error;
1593	}
1594
1595	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1596	case TCP_TW_SYN:
1597	{
1598		struct sock *sk2;
1599
1600		sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1601					    skb, __tcp_hdrlen(th),
1602					    &ipv6_hdr(skb)->saddr, th->source,
1603					    &ipv6_hdr(skb)->daddr,
1604					    ntohs(th->dest), tcp_v6_iif(skb),
1605					    sdif);
1606		if (sk2) {
1607			struct inet_timewait_sock *tw = inet_twsk(sk);
1608			inet_twsk_deschedule_put(tw);
 
1609			sk = sk2;
1610			tcp_v6_restore_cb(skb);
1611			refcounted = false;
1612			goto process;
1613		}
 
1614	}
1615		/* to ACK */
1616		/* fall through */
1617	case TCP_TW_ACK:
1618		tcp_v6_timewait_ack(sk, skb);
1619		break;
1620	case TCP_TW_RST:
1621		tcp_v6_send_reset(sk, skb);
1622		inet_twsk_deschedule_put(inet_twsk(sk));
1623		goto discard_it;
1624	case TCP_TW_SUCCESS:
1625		;
1626	}
1627	goto discard_it;
1628}
1629
1630static void tcp_v6_early_demux(struct sk_buff *skb)
1631{
1632	const struct ipv6hdr *hdr;
1633	const struct tcphdr *th;
1634	struct sock *sk;
1635
1636	if (skb->pkt_type != PACKET_HOST)
1637		return;
1638
1639	if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1640		return;
1641
1642	hdr = ipv6_hdr(skb);
1643	th = tcp_hdr(skb);
1644
1645	if (th->doff < sizeof(struct tcphdr) / 4)
1646		return;
1647
1648	/* Note : We use inet6_iif() here, not tcp_v6_iif() */
1649	sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1650					&hdr->saddr, th->source,
1651					&hdr->daddr, ntohs(th->dest),
1652					inet6_iif(skb), inet6_sdif(skb));
1653	if (sk) {
1654		skb->sk = sk;
1655		skb->destructor = sock_edemux;
1656		if (sk_fullsock(sk)) {
1657			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1658
1659			if (dst)
1660				dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1661			if (dst &&
1662			    inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1663				skb_dst_set_noref(skb, dst);
1664		}
1665	}
1666}
1667
1668static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1669	.twsk_obj_size	= sizeof(struct tcp6_timewait_sock),
1670	.twsk_unique	= tcp_twsk_unique,
1671	.twsk_destructor = tcp_twsk_destructor,
1672};
1673
1674static const struct inet_connection_sock_af_ops ipv6_specific = {
1675	.queue_xmit	   = inet6_csk_xmit,
1676	.send_check	   = tcp_v6_send_check,
1677	.rebuild_header	   = inet6_sk_rebuild_header,
1678	.sk_rx_dst_set	   = inet6_sk_rx_dst_set,
1679	.conn_request	   = tcp_v6_conn_request,
1680	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
1681	.net_header_len	   = sizeof(struct ipv6hdr),
1682	.net_frag_header_len = sizeof(struct frag_hdr),
1683	.setsockopt	   = ipv6_setsockopt,
1684	.getsockopt	   = ipv6_getsockopt,
1685	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
1686	.sockaddr_len	   = sizeof(struct sockaddr_in6),
 
1687#ifdef CONFIG_COMPAT
1688	.compat_setsockopt = compat_ipv6_setsockopt,
1689	.compat_getsockopt = compat_ipv6_getsockopt,
1690#endif
1691	.mtu_reduced	   = tcp_v6_mtu_reduced,
1692};
1693
1694#ifdef CONFIG_TCP_MD5SIG
1695static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1696	.md5_lookup	=	tcp_v6_md5_lookup,
1697	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
1698	.md5_parse	=	tcp_v6_parse_md5_keys,
1699};
1700#endif
1701
1702/*
1703 *	TCP over IPv4 via INET6 API
1704 */
1705static const struct inet_connection_sock_af_ops ipv6_mapped = {
1706	.queue_xmit	   = ip_queue_xmit,
1707	.send_check	   = tcp_v4_send_check,
1708	.rebuild_header	   = inet_sk_rebuild_header,
1709	.sk_rx_dst_set	   = inet_sk_rx_dst_set,
1710	.conn_request	   = tcp_v6_conn_request,
1711	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
1712	.net_header_len	   = sizeof(struct iphdr),
1713	.setsockopt	   = ipv6_setsockopt,
1714	.getsockopt	   = ipv6_getsockopt,
1715	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
1716	.sockaddr_len	   = sizeof(struct sockaddr_in6),
 
1717#ifdef CONFIG_COMPAT
1718	.compat_setsockopt = compat_ipv6_setsockopt,
1719	.compat_getsockopt = compat_ipv6_getsockopt,
1720#endif
1721	.mtu_reduced	   = tcp_v4_mtu_reduced,
1722};
1723
1724#ifdef CONFIG_TCP_MD5SIG
1725static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1726	.md5_lookup	=	tcp_v4_md5_lookup,
1727	.calc_md5_hash	=	tcp_v4_md5_hash_skb,
1728	.md5_parse	=	tcp_v6_parse_md5_keys,
1729};
1730#endif
1731
1732/* NOTE: A lot of things set to zero explicitly by call to
1733 *       sk_alloc() so need not be done here.
1734 */
1735static int tcp_v6_init_sock(struct sock *sk)
1736{
1737	struct inet_connection_sock *icsk = inet_csk(sk);
1738
1739	tcp_init_sock(sk);
1740
1741	icsk->icsk_af_ops = &ipv6_specific;
1742
1743#ifdef CONFIG_TCP_MD5SIG
1744	tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1745#endif
1746
1747	return 0;
1748}
1749
1750static void tcp_v6_destroy_sock(struct sock *sk)
1751{
1752	tcp_v4_destroy_sock(sk);
1753	inet6_destroy_sock(sk);
1754}
1755
1756#ifdef CONFIG_PROC_FS
1757/* Proc filesystem TCPv6 sock list dumping. */
1758static void get_openreq6(struct seq_file *seq,
1759			 const struct request_sock *req, int i)
1760{
1761	long ttd = req->rsk_timer.expires - jiffies;
1762	const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1763	const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1764
1765	if (ttd < 0)
1766		ttd = 0;
1767
1768	seq_printf(seq,
1769		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1770		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1771		   i,
1772		   src->s6_addr32[0], src->s6_addr32[1],
1773		   src->s6_addr32[2], src->s6_addr32[3],
1774		   inet_rsk(req)->ir_num,
1775		   dest->s6_addr32[0], dest->s6_addr32[1],
1776		   dest->s6_addr32[2], dest->s6_addr32[3],
1777		   ntohs(inet_rsk(req)->ir_rmt_port),
1778		   TCP_SYN_RECV,
1779		   0, 0, /* could print option size, but that is af dependent. */
1780		   1,   /* timers active (only the expire timer) */
1781		   jiffies_to_clock_t(ttd),
1782		   req->num_timeout,
1783		   from_kuid_munged(seq_user_ns(seq),
1784				    sock_i_uid(req->rsk_listener)),
1785		   0,  /* non standard timer */
1786		   0, /* open_requests have no inode */
1787		   0, req);
1788}
1789
1790static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1791{
1792	const struct in6_addr *dest, *src;
1793	__u16 destp, srcp;
1794	int timer_active;
1795	unsigned long timer_expires;
1796	const struct inet_sock *inet = inet_sk(sp);
1797	const struct tcp_sock *tp = tcp_sk(sp);
1798	const struct inet_connection_sock *icsk = inet_csk(sp);
1799	const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1800	int rx_queue;
1801	int state;
1802
1803	dest  = &sp->sk_v6_daddr;
1804	src   = &sp->sk_v6_rcv_saddr;
1805	destp = ntohs(inet->inet_dport);
1806	srcp  = ntohs(inet->inet_sport);
1807
1808	if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1809	    icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1810	    icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1811		timer_active	= 1;
1812		timer_expires	= icsk->icsk_timeout;
1813	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1814		timer_active	= 4;
1815		timer_expires	= icsk->icsk_timeout;
1816	} else if (timer_pending(&sp->sk_timer)) {
1817		timer_active	= 2;
1818		timer_expires	= sp->sk_timer.expires;
1819	} else {
1820		timer_active	= 0;
1821		timer_expires = jiffies;
1822	}
1823
1824	state = inet_sk_state_load(sp);
1825	if (state == TCP_LISTEN)
1826		rx_queue = sp->sk_ack_backlog;
1827	else
1828		/* Because we don't lock the socket,
1829		 * we might find a transient negative value.
1830		 */
1831		rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1832
1833	seq_printf(seq,
1834		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1835		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1836		   i,
1837		   src->s6_addr32[0], src->s6_addr32[1],
1838		   src->s6_addr32[2], src->s6_addr32[3], srcp,
1839		   dest->s6_addr32[0], dest->s6_addr32[1],
1840		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1841		   state,
1842		   tp->write_seq - tp->snd_una,
1843		   rx_queue,
1844		   timer_active,
1845		   jiffies_delta_to_clock_t(timer_expires - jiffies),
1846		   icsk->icsk_retransmits,
1847		   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1848		   icsk->icsk_probes_out,
1849		   sock_i_ino(sp),
1850		   refcount_read(&sp->sk_refcnt), sp,
1851		   jiffies_to_clock_t(icsk->icsk_rto),
1852		   jiffies_to_clock_t(icsk->icsk_ack.ato),
1853		   (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1854		   tp->snd_cwnd,
1855		   state == TCP_LISTEN ?
1856			fastopenq->max_qlen :
1857			(tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1858		   );
1859}
1860
1861static void get_timewait6_sock(struct seq_file *seq,
1862			       struct inet_timewait_sock *tw, int i)
1863{
1864	long delta = tw->tw_timer.expires - jiffies;
1865	const struct in6_addr *dest, *src;
1866	__u16 destp, srcp;
 
1867
1868	dest = &tw->tw_v6_daddr;
1869	src  = &tw->tw_v6_rcv_saddr;
1870	destp = ntohs(tw->tw_dport);
1871	srcp  = ntohs(tw->tw_sport);
1872
1873	seq_printf(seq,
1874		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1875		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1876		   i,
1877		   src->s6_addr32[0], src->s6_addr32[1],
1878		   src->s6_addr32[2], src->s6_addr32[3], srcp,
1879		   dest->s6_addr32[0], dest->s6_addr32[1],
1880		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1881		   tw->tw_substate, 0, 0,
1882		   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1883		   refcount_read(&tw->tw_refcnt), tw);
1884}
1885
1886static int tcp6_seq_show(struct seq_file *seq, void *v)
1887{
1888	struct tcp_iter_state *st;
1889	struct sock *sk = v;
1890
1891	if (v == SEQ_START_TOKEN) {
1892		seq_puts(seq,
1893			 "  sl  "
1894			 "local_address                         "
1895			 "remote_address                        "
1896			 "st tx_queue rx_queue tr tm->when retrnsmt"
1897			 "   uid  timeout inode\n");
1898		goto out;
1899	}
1900	st = seq->private;
1901
1902	if (sk->sk_state == TCP_TIME_WAIT)
1903		get_timewait6_sock(seq, v, st->num);
1904	else if (sk->sk_state == TCP_NEW_SYN_RECV)
1905		get_openreq6(seq, v, st->num);
1906	else
1907		get_tcp6_sock(seq, v, st->num);
 
 
 
 
 
 
1908out:
1909	return 0;
1910}
1911
1912static const struct file_operations tcp6_afinfo_seq_fops = {
 
1913	.open    = tcp_seq_open,
1914	.read    = seq_read,
1915	.llseek  = seq_lseek,
1916	.release = seq_release_net
1917};
1918
1919static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1920	.name		= "tcp6",
1921	.family		= AF_INET6,
1922	.seq_fops	= &tcp6_afinfo_seq_fops,
1923	.seq_ops	= {
1924		.show		= tcp6_seq_show,
1925	},
1926};
1927
1928int __net_init tcp6_proc_init(struct net *net)
1929{
1930	return tcp_proc_register(net, &tcp6_seq_afinfo);
1931}
1932
1933void tcp6_proc_exit(struct net *net)
1934{
1935	tcp_proc_unregister(net, &tcp6_seq_afinfo);
1936}
1937#endif
1938
 
 
 
 
 
 
 
 
 
 
 
1939struct proto tcpv6_prot = {
1940	.name			= "TCPv6",
1941	.owner			= THIS_MODULE,
1942	.close			= tcp_close,
1943	.pre_connect		= tcp_v6_pre_connect,
1944	.connect		= tcp_v6_connect,
1945	.disconnect		= tcp_disconnect,
1946	.accept			= inet_csk_accept,
1947	.ioctl			= tcp_ioctl,
1948	.init			= tcp_v6_init_sock,
1949	.destroy		= tcp_v6_destroy_sock,
1950	.shutdown		= tcp_shutdown,
1951	.setsockopt		= tcp_setsockopt,
1952	.getsockopt		= tcp_getsockopt,
1953	.keepalive		= tcp_set_keepalive,
1954	.recvmsg		= tcp_recvmsg,
1955	.sendmsg		= tcp_sendmsg,
1956	.sendpage		= tcp_sendpage,
1957	.backlog_rcv		= tcp_v6_do_rcv,
1958	.release_cb		= tcp_release_cb,
1959	.hash			= inet6_hash,
 
1960	.unhash			= inet_unhash,
1961	.get_port		= inet_csk_get_port,
1962	.enter_memory_pressure	= tcp_enter_memory_pressure,
1963	.leave_memory_pressure	= tcp_leave_memory_pressure,
1964	.stream_memory_free	= tcp_stream_memory_free,
1965	.sockets_allocated	= &tcp_sockets_allocated,
1966	.memory_allocated	= &tcp_memory_allocated,
1967	.memory_pressure	= &tcp_memory_pressure,
1968	.orphan_count		= &tcp_orphan_count,
1969	.sysctl_mem		= sysctl_tcp_mem,
1970	.sysctl_wmem_offset	= offsetof(struct net, ipv4.sysctl_tcp_wmem),
1971	.sysctl_rmem_offset	= offsetof(struct net, ipv4.sysctl_tcp_rmem),
1972	.max_header		= MAX_TCP_HEADER,
1973	.obj_size		= sizeof(struct tcp6_sock),
1974	.slab_flags		= SLAB_TYPESAFE_BY_RCU,
1975	.twsk_prot		= &tcp6_timewait_sock_ops,
1976	.rsk_prot		= &tcp6_request_sock_ops,
1977	.h.hashinfo		= &tcp_hashinfo,
1978	.no_autobind		= true,
1979#ifdef CONFIG_COMPAT
1980	.compat_setsockopt	= compat_tcp_setsockopt,
1981	.compat_getsockopt	= compat_tcp_getsockopt,
1982#endif
1983	.diag_destroy		= tcp_abort,
 
 
 
1984};
1985
1986/* thinking of making this const? Don't.
1987 * early_demux can change based on sysctl.
1988 */
1989static struct inet6_protocol tcpv6_protocol = {
1990	.early_demux	=	tcp_v6_early_demux,
1991	.early_demux_handler =  tcp_v6_early_demux,
1992	.handler	=	tcp_v6_rcv,
1993	.err_handler	=	tcp_v6_err,
1994	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1995};
1996
1997static struct inet_protosw tcpv6_protosw = {
1998	.type		=	SOCK_STREAM,
1999	.protocol	=	IPPROTO_TCP,
2000	.prot		=	&tcpv6_prot,
2001	.ops		=	&inet6_stream_ops,
 
2002	.flags		=	INET_PROTOSW_PERMANENT |
2003				INET_PROTOSW_ICSK,
2004};
2005
2006static int __net_init tcpv6_net_init(struct net *net)
2007{
2008	return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2009				    SOCK_RAW, IPPROTO_TCP, net);
2010}
2011
2012static void __net_exit tcpv6_net_exit(struct net *net)
2013{
2014	inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2015}
2016
2017static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2018{
2019	inet_twsk_purge(&tcp_hashinfo, AF_INET6);
2020}
2021
2022static struct pernet_operations tcpv6_net_ops = {
2023	.init	    = tcpv6_net_init,
2024	.exit	    = tcpv6_net_exit,
2025	.exit_batch = tcpv6_net_exit_batch,
2026};
2027
2028int __init tcpv6_init(void)
2029{
2030	int ret;
2031
2032	ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2033	if (ret)
2034		goto out;
2035
2036	/* register inet6 protocol */
2037	ret = inet6_register_protosw(&tcpv6_protosw);
2038	if (ret)
2039		goto out_tcpv6_protocol;
2040
2041	ret = register_pernet_subsys(&tcpv6_net_ops);
2042	if (ret)
2043		goto out_tcpv6_protosw;
2044out:
2045	return ret;
2046
2047out_tcpv6_protosw:
2048	inet6_unregister_protosw(&tcpv6_protosw);
2049out_tcpv6_protocol:
2050	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2051	goto out;
2052}
2053
2054void tcpv6_exit(void)
2055{
2056	unregister_pernet_subsys(&tcpv6_net_ops);
2057	inet6_unregister_protosw(&tcpv6_protosw);
2058	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2059}
v3.15
   1/*
   2 *	TCP over IPv6
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *
   8 *	Based on:
   9 *	linux/net/ipv4/tcp.c
  10 *	linux/net/ipv4/tcp_input.c
  11 *	linux/net/ipv4/tcp_output.c
  12 *
  13 *	Fixes:
  14 *	Hideaki YOSHIFUJI	:	sin6_scope_id support
  15 *	YOSHIFUJI Hideaki @USAGI and:	Support IPV6_V6ONLY socket option, which
  16 *	Alexey Kuznetsov		allow both IPv4 and IPv6 sockets to bind
  17 *					a single port at the same time.
  18 *	YOSHIFUJI Hideaki @USAGI:	convert /proc/net/tcp6 to seq_file.
  19 *
  20 *	This program is free software; you can redistribute it and/or
  21 *      modify it under the terms of the GNU General Public License
  22 *      as published by the Free Software Foundation; either version
  23 *      2 of the License, or (at your option) any later version.
  24 */
  25
  26#include <linux/bottom_half.h>
  27#include <linux/module.h>
  28#include <linux/errno.h>
  29#include <linux/types.h>
  30#include <linux/socket.h>
  31#include <linux/sockios.h>
  32#include <linux/net.h>
  33#include <linux/jiffies.h>
  34#include <linux/in.h>
  35#include <linux/in6.h>
  36#include <linux/netdevice.h>
  37#include <linux/init.h>
  38#include <linux/jhash.h>
  39#include <linux/ipsec.h>
  40#include <linux/times.h>
  41#include <linux/slab.h>
  42#include <linux/uaccess.h>
  43#include <linux/ipv6.h>
  44#include <linux/icmpv6.h>
  45#include <linux/random.h>
  46
  47#include <net/tcp.h>
  48#include <net/ndisc.h>
  49#include <net/inet6_hashtables.h>
  50#include <net/inet6_connection_sock.h>
  51#include <net/ipv6.h>
  52#include <net/transp_v6.h>
  53#include <net/addrconf.h>
  54#include <net/ip6_route.h>
  55#include <net/ip6_checksum.h>
  56#include <net/inet_ecn.h>
  57#include <net/protocol.h>
  58#include <net/xfrm.h>
  59#include <net/snmp.h>
  60#include <net/dsfield.h>
  61#include <net/timewait_sock.h>
  62#include <net/netdma.h>
  63#include <net/inet_common.h>
  64#include <net/secure_seq.h>
  65#include <net/tcp_memcontrol.h>
  66#include <net/busy_poll.h>
  67
  68#include <linux/proc_fs.h>
  69#include <linux/seq_file.h>
  70
  71#include <linux/crypto.h>
  72#include <linux/scatterlist.h>
  73
  74static void	tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  75static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 
 
  76				      struct request_sock *req);
  77
  78static int	tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80static const struct inet_connection_sock_af_ops ipv6_mapped;
  81static const struct inet_connection_sock_af_ops ipv6_specific;
  82#ifdef CONFIG_TCP_MD5SIG
  83static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  84static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  85#else
  86static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  87						   const struct in6_addr *addr)
  88{
  89	return NULL;
  90}
  91#endif
  92
  93static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  94{
  95	struct dst_entry *dst = skb_dst(skb);
  96	const struct rt6_info *rt = (const struct rt6_info *)dst;
  97
  98	dst_hold(dst);
  99	sk->sk_rx_dst = dst;
 100	inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 101	if (rt->rt6i_node)
 102		inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
 
 
 
 
 
 
 
 
 
 
 103}
 104
 105static void tcp_v6_hash(struct sock *sk)
 106{
 107	if (sk->sk_state != TCP_CLOSE) {
 108		if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 109			tcp_prot.hash(sk);
 110			return;
 111		}
 112		local_bh_disable();
 113		__inet6_hash(sk, NULL);
 114		local_bh_enable();
 115	}
 116}
 117
 118static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 
 119{
 120	return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 121					    ipv6_hdr(skb)->saddr.s6_addr32,
 122					    tcp_hdr(skb)->dest,
 123					    tcp_hdr(skb)->source);
 
 
 
 
 
 
 124}
 125
 126static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 127			  int addr_len)
 128{
 129	struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 130	struct inet_sock *inet = inet_sk(sk);
 131	struct inet_connection_sock *icsk = inet_csk(sk);
 132	struct ipv6_pinfo *np = inet6_sk(sk);
 133	struct tcp_sock *tp = tcp_sk(sk);
 134	struct in6_addr *saddr = NULL, *final_p, final;
 135	struct rt6_info *rt;
 136	struct flowi6 fl6;
 137	struct dst_entry *dst;
 138	int addr_type;
 139	int err;
 
 140
 141	if (addr_len < SIN6_LEN_RFC2133)
 142		return -EINVAL;
 143
 144	if (usin->sin6_family != AF_INET6)
 145		return -EAFNOSUPPORT;
 146
 147	memset(&fl6, 0, sizeof(fl6));
 148
 149	if (np->sndflow) {
 150		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 151		IP6_ECN_flow_init(fl6.flowlabel);
 152		if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 153			struct ip6_flowlabel *flowlabel;
 154			flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 155			if (flowlabel == NULL)
 156				return -EINVAL;
 157			fl6_sock_release(flowlabel);
 158		}
 159	}
 160
 161	/*
 162	 *	connect() to INADDR_ANY means loopback (BSD'ism).
 163	 */
 164
 165	if (ipv6_addr_any(&usin->sin6_addr))
 166		usin->sin6_addr.s6_addr[15] = 0x1;
 
 
 
 
 
 167
 168	addr_type = ipv6_addr_type(&usin->sin6_addr);
 169
 170	if (addr_type & IPV6_ADDR_MULTICAST)
 171		return -ENETUNREACH;
 172
 173	if (addr_type&IPV6_ADDR_LINKLOCAL) {
 174		if (addr_len >= sizeof(struct sockaddr_in6) &&
 175		    usin->sin6_scope_id) {
 176			/* If interface is set while binding, indices
 177			 * must coincide.
 178			 */
 179			if (sk->sk_bound_dev_if &&
 180			    sk->sk_bound_dev_if != usin->sin6_scope_id)
 181				return -EINVAL;
 182
 183			sk->sk_bound_dev_if = usin->sin6_scope_id;
 184		}
 185
 186		/* Connect to link-local address requires an interface */
 187		if (!sk->sk_bound_dev_if)
 188			return -EINVAL;
 189	}
 190
 191	if (tp->rx_opt.ts_recent_stamp &&
 192	    !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 193		tp->rx_opt.ts_recent = 0;
 194		tp->rx_opt.ts_recent_stamp = 0;
 195		tp->write_seq = 0;
 196	}
 197
 198	sk->sk_v6_daddr = usin->sin6_addr;
 199	np->flow_label = fl6.flowlabel;
 200
 201	/*
 202	 *	TCP over IPv4
 203	 */
 204
 205	if (addr_type == IPV6_ADDR_MAPPED) {
 206		u32 exthdrlen = icsk->icsk_ext_hdr_len;
 207		struct sockaddr_in sin;
 208
 209		SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 210
 211		if (__ipv6_only_sock(sk))
 212			return -ENETUNREACH;
 213
 214		sin.sin_family = AF_INET;
 215		sin.sin_port = usin->sin6_port;
 216		sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 217
 218		icsk->icsk_af_ops = &ipv6_mapped;
 219		sk->sk_backlog_rcv = tcp_v4_do_rcv;
 220#ifdef CONFIG_TCP_MD5SIG
 221		tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 222#endif
 223
 224		err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 225
 226		if (err) {
 227			icsk->icsk_ext_hdr_len = exthdrlen;
 228			icsk->icsk_af_ops = &ipv6_specific;
 229			sk->sk_backlog_rcv = tcp_v6_do_rcv;
 230#ifdef CONFIG_TCP_MD5SIG
 231			tp->af_specific = &tcp_sock_ipv6_specific;
 232#endif
 233			goto failure;
 234		} else {
 235			ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 236			ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 237					       &sk->sk_v6_rcv_saddr);
 238		}
 
 239
 240		return err;
 241	}
 242
 243	if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 244		saddr = &sk->sk_v6_rcv_saddr;
 245
 246	fl6.flowi6_proto = IPPROTO_TCP;
 247	fl6.daddr = sk->sk_v6_daddr;
 248	fl6.saddr = saddr ? *saddr : np->saddr;
 249	fl6.flowi6_oif = sk->sk_bound_dev_if;
 250	fl6.flowi6_mark = sk->sk_mark;
 251	fl6.fl6_dport = usin->sin6_port;
 252	fl6.fl6_sport = inet->inet_sport;
 
 253
 254	final_p = fl6_update_dst(&fl6, np->opt, &final);
 
 255
 256	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 257
 258	dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 259	if (IS_ERR(dst)) {
 260		err = PTR_ERR(dst);
 261		goto failure;
 262	}
 263
 264	if (saddr == NULL) {
 265		saddr = &fl6.saddr;
 266		sk->sk_v6_rcv_saddr = *saddr;
 267	}
 268
 269	/* set the source address */
 270	np->saddr = *saddr;
 271	inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 272
 273	sk->sk_gso_type = SKB_GSO_TCPV6;
 274	__ip6_dst_store(sk, dst, NULL, NULL);
 275
 276	rt = (struct rt6_info *) dst;
 277	if (tcp_death_row.sysctl_tw_recycle &&
 278	    !tp->rx_opt.ts_recent_stamp &&
 279	    ipv6_addr_equal(&rt->rt6i_dst.addr, &sk->sk_v6_daddr))
 280		tcp_fetch_timewait_stamp(sk, dst);
 281
 282	icsk->icsk_ext_hdr_len = 0;
 283	if (np->opt)
 284		icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 285					  np->opt->opt_nflen);
 286
 287	tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 288
 289	inet->inet_dport = usin->sin6_port;
 290
 291	tcp_set_state(sk, TCP_SYN_SENT);
 292	err = inet6_hash_connect(&tcp_death_row, sk);
 293	if (err)
 294		goto late_failure;
 295
 296	if (!tp->write_seq && likely(!tp->repair))
 297		tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 298							     sk->sk_v6_daddr.s6_addr32,
 299							     inet->inet_sport,
 300							     inet->inet_dport);
 
 
 
 
 
 
 
 
 
 
 
 
 301
 302	err = tcp_connect(sk);
 303	if (err)
 304		goto late_failure;
 305
 306	return 0;
 307
 308late_failure:
 309	tcp_set_state(sk, TCP_CLOSE);
 310	__sk_dst_reset(sk);
 311failure:
 312	inet->inet_dport = 0;
 313	sk->sk_route_caps = 0;
 314	return err;
 315}
 316
 317static void tcp_v6_mtu_reduced(struct sock *sk)
 318{
 319	struct dst_entry *dst;
 320
 321	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 322		return;
 323
 324	dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 325	if (!dst)
 326		return;
 327
 328	if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 329		tcp_sync_mss(sk, dst_mtu(dst));
 330		tcp_simple_retransmit(sk);
 331	}
 332}
 333
 334static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 335		u8 type, u8 code, int offset, __be32 info)
 336{
 337	const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 338	const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 
 
 339	struct ipv6_pinfo *np;
 
 
 340	struct sock *sk;
 
 341	int err;
 342	struct tcp_sock *tp;
 343	__u32 seq;
 344	struct net *net = dev_net(skb->dev);
 345
 346	sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 347			th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 348
 349	if (sk == NULL) {
 350		ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 351				   ICMP6_MIB_INERRORS);
 
 
 
 
 
 352		return;
 353	}
 354
 355	if (sk->sk_state == TCP_TIME_WAIT) {
 356		inet_twsk_put(inet_twsk(sk));
 357		return;
 358	}
 
 
 
 
 359
 360	bh_lock_sock(sk);
 361	if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 362		NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 363
 364	if (sk->sk_state == TCP_CLOSE)
 365		goto out;
 366
 367	if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 368		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 369		goto out;
 370	}
 371
 372	tp = tcp_sk(sk);
 373	seq = ntohl(th->seq);
 
 
 374	if (sk->sk_state != TCP_LISTEN &&
 375	    !between(seq, tp->snd_una, tp->snd_nxt)) {
 376		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 377		goto out;
 378	}
 379
 380	np = inet6_sk(sk);
 381
 382	if (type == NDISC_REDIRECT) {
 383		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 
 384
 385		if (dst)
 386			dst->ops->redirect(dst, sk, skb);
 
 387		goto out;
 388	}
 389
 390	if (type == ICMPV6_PKT_TOOBIG) {
 391		/* We are not interested in TCP_LISTEN and open_requests
 392		 * (SYN-ACKs send out by Linux are always <576bytes so
 393		 * they should go through unfragmented).
 394		 */
 395		if (sk->sk_state == TCP_LISTEN)
 396			goto out;
 397
 398		if (!ip6_sk_accept_pmtu(sk))
 399			goto out;
 400
 401		tp->mtu_info = ntohl(info);
 402		if (!sock_owned_by_user(sk))
 403			tcp_v6_mtu_reduced(sk);
 404		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 405					   &tp->tsq_flags))
 406			sock_hold(sk);
 407		goto out;
 408	}
 409
 410	icmpv6_err_convert(type, code, &err);
 411
 412	/* Might be for an request_sock */
 413	switch (sk->sk_state) {
 414		struct request_sock *req, **prev;
 415	case TCP_LISTEN:
 416		if (sock_owned_by_user(sk))
 417			goto out;
 418
 419		req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 420					   &hdr->saddr, inet6_iif(skb));
 421		if (!req)
 422			goto out;
 423
 424		/* ICMPs are not backlogged, hence we cannot get
 425		 * an established socket here.
 426		 */
 427		WARN_ON(req->sk != NULL);
 428
 429		if (seq != tcp_rsk(req)->snt_isn) {
 430			NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 431			goto out;
 432		}
 433
 434		inet_csk_reqsk_queue_drop(sk, req, prev);
 435		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 436		goto out;
 437
 438	case TCP_SYN_SENT:
 439	case TCP_SYN_RECV:  /* Cannot happen.
 440			       It can, it SYNs are crossed. --ANK */
 441		if (!sock_owned_by_user(sk)) {
 442			sk->sk_err = err;
 443			sk->sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */
 444
 445			tcp_done(sk);
 446		} else
 447			sk->sk_err_soft = err;
 448		goto out;
 449	}
 450
 451	if (!sock_owned_by_user(sk) && np->recverr) {
 452		sk->sk_err = err;
 453		sk->sk_error_report(sk);
 454	} else
 455		sk->sk_err_soft = err;
 456
 457out:
 458	bh_unlock_sock(sk);
 459	sock_put(sk);
 460}
 461
 462
 463static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 464			      struct flowi6 *fl6,
 465			      struct request_sock *req,
 466			      u16 queue_mapping)
 
 467{
 468	struct inet_request_sock *ireq = inet_rsk(req);
 469	struct ipv6_pinfo *np = inet6_sk(sk);
 
 
 470	struct sk_buff *skb;
 471	int err = -ENOMEM;
 472
 473	/* First, grab a route. */
 474	if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
 
 475		goto done;
 476
 477	skb = tcp_make_synack(sk, dst, req, NULL);
 478
 479	if (skb) {
 480		__tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 481				    &ireq->ir_v6_rmt_addr);
 482
 483		fl6->daddr = ireq->ir_v6_rmt_addr;
 484		if (np->repflow && (ireq->pktopts != NULL))
 485			fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 486
 487		skb_set_queue_mapping(skb, queue_mapping);
 488		err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 
 
 
 
 489		err = net_xmit_eval(err);
 490	}
 491
 492done:
 493	return err;
 494}
 495
 496static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
 497{
 498	struct flowi6 fl6;
 499	int res;
 500
 501	res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
 502	if (!res) {
 503		TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 504		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
 505	}
 506	return res;
 507}
 508
 509static void tcp_v6_reqsk_destructor(struct request_sock *req)
 510{
 
 511	kfree_skb(inet_rsk(req)->pktopts);
 512}
 513
 514#ifdef CONFIG_TCP_MD5SIG
 515static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 516						   const struct in6_addr *addr)
 517{
 518	return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 519}
 520
 521static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 522						struct sock *addr_sk)
 523{
 524	return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 525}
 526
 527static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 528						      struct request_sock *req)
 529{
 530	return tcp_v6_md5_do_lookup(sk, &inet_rsk(req)->ir_v6_rmt_addr);
 531}
 532
 533static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 534				 int optlen)
 535{
 536	struct tcp_md5sig cmd;
 537	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 
 538
 539	if (optlen < sizeof(cmd))
 540		return -EINVAL;
 541
 542	if (copy_from_user(&cmd, optval, sizeof(cmd)))
 543		return -EFAULT;
 544
 545	if (sin6->sin6_family != AF_INET6)
 546		return -EINVAL;
 547
 
 
 
 
 
 
 
 
 
 
 548	if (!cmd.tcpm_keylen) {
 549		if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 550			return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 551					      AF_INET);
 552		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 553				      AF_INET6);
 554	}
 555
 556	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 557		return -EINVAL;
 558
 559	if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 560		return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 561				      AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 
 562
 563	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 564			      AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 
 565}
 566
 567static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 568					const struct in6_addr *daddr,
 569					const struct in6_addr *saddr, int nbytes)
 
 570{
 571	struct tcp6_pseudohdr *bp;
 572	struct scatterlist sg;
 
 573
 574	bp = &hp->md5_blk.ip6;
 575	/* 1. TCP pseudo-header (RFC2460) */
 576	bp->saddr = *saddr;
 577	bp->daddr = *daddr;
 578	bp->protocol = cpu_to_be32(IPPROTO_TCP);
 579	bp->len = cpu_to_be32(nbytes);
 580
 581	sg_init_one(&sg, bp, sizeof(*bp));
 582	return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 
 
 
 
 
 
 583}
 584
 585static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 586			       const struct in6_addr *daddr, struct in6_addr *saddr,
 587			       const struct tcphdr *th)
 588{
 589	struct tcp_md5sig_pool *hp;
 590	struct hash_desc *desc;
 591
 592	hp = tcp_get_md5sig_pool();
 593	if (!hp)
 594		goto clear_hash_noput;
 595	desc = &hp->md5_desc;
 596
 597	if (crypto_hash_init(desc))
 598		goto clear_hash;
 599	if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 600		goto clear_hash;
 601	if (tcp_md5_hash_header(hp, th))
 602		goto clear_hash;
 603	if (tcp_md5_hash_key(hp, key))
 604		goto clear_hash;
 605	if (crypto_hash_final(desc, md5_hash))
 
 606		goto clear_hash;
 607
 608	tcp_put_md5sig_pool();
 609	return 0;
 610
 611clear_hash:
 612	tcp_put_md5sig_pool();
 613clear_hash_noput:
 614	memset(md5_hash, 0, 16);
 615	return 1;
 616}
 617
 618static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 
 619			       const struct sock *sk,
 620			       const struct request_sock *req,
 621			       const struct sk_buff *skb)
 622{
 623	const struct in6_addr *saddr, *daddr;
 624	struct tcp_md5sig_pool *hp;
 625	struct hash_desc *desc;
 626	const struct tcphdr *th = tcp_hdr(skb);
 627
 628	if (sk) {
 629		saddr = &inet6_sk(sk)->saddr;
 630		daddr = &sk->sk_v6_daddr;
 631	} else if (req) {
 632		saddr = &inet_rsk(req)->ir_v6_loc_addr;
 633		daddr = &inet_rsk(req)->ir_v6_rmt_addr;
 634	} else {
 635		const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 636		saddr = &ip6h->saddr;
 637		daddr = &ip6h->daddr;
 638	}
 639
 640	hp = tcp_get_md5sig_pool();
 641	if (!hp)
 642		goto clear_hash_noput;
 643	desc = &hp->md5_desc;
 644
 645	if (crypto_hash_init(desc))
 646		goto clear_hash;
 647
 648	if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 649		goto clear_hash;
 650	if (tcp_md5_hash_header(hp, th))
 651		goto clear_hash;
 652	if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 653		goto clear_hash;
 654	if (tcp_md5_hash_key(hp, key))
 655		goto clear_hash;
 656	if (crypto_hash_final(desc, md5_hash))
 
 657		goto clear_hash;
 658
 659	tcp_put_md5sig_pool();
 660	return 0;
 661
 662clear_hash:
 663	tcp_put_md5sig_pool();
 664clear_hash_noput:
 665	memset(md5_hash, 0, 16);
 666	return 1;
 667}
 668
 669static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
 
 
 
 670{
 
 671	const __u8 *hash_location = NULL;
 672	struct tcp_md5sig_key *hash_expected;
 673	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 674	const struct tcphdr *th = tcp_hdr(skb);
 675	int genhash;
 676	u8 newhash[16];
 677
 678	hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 679	hash_location = tcp_parse_md5sig_option(th);
 680
 681	/* We've parsed the options - do we have a hash? */
 682	if (!hash_expected && !hash_location)
 683		return 0;
 684
 685	if (hash_expected && !hash_location) {
 686		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 687		return 1;
 688	}
 689
 690	if (!hash_expected && hash_location) {
 691		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 692		return 1;
 693	}
 694
 695	/* check the signature */
 696	genhash = tcp_v6_md5_hash_skb(newhash,
 697				      hash_expected,
 698				      NULL, NULL, skb);
 699
 700	if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 
 701		net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 702				     genhash ? "failed" : "mismatch",
 703				     &ip6h->saddr, ntohs(th->source),
 704				     &ip6h->daddr, ntohs(th->dest));
 705		return 1;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 706	}
 707	return 0;
 708}
 709#endif
 
 
 
 
 
 
 710
 711struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 712	.family		=	AF_INET6,
 713	.obj_size	=	sizeof(struct tcp6_request_sock),
 714	.rtx_syn_ack	=	tcp_v6_rtx_synack,
 715	.send_ack	=	tcp_v6_reqsk_send_ack,
 716	.destructor	=	tcp_v6_reqsk_destructor,
 717	.send_reset	=	tcp_v6_send_reset,
 718	.syn_ack_timeout =	tcp_syn_ack_timeout,
 719};
 720
 
 
 
 721#ifdef CONFIG_TCP_MD5SIG
 722static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 723	.md5_lookup	=	tcp_v6_reqsk_md5_lookup,
 724	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
 
 
 
 
 
 
 
 
 
 725};
 726#endif
 727
 728static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 729				 u32 tsval, u32 tsecr, int oif,
 730				 struct tcp_md5sig_key *key, int rst, u8 tclass,
 731				 u32 label)
 732{
 733	const struct tcphdr *th = tcp_hdr(skb);
 734	struct tcphdr *t1;
 735	struct sk_buff *buff;
 736	struct flowi6 fl6;
 737	struct net *net = dev_net(skb_dst(skb)->dev);
 738	struct sock *ctl_sk = net->ipv6.tcp_sk;
 739	unsigned int tot_len = sizeof(struct tcphdr);
 740	struct dst_entry *dst;
 741	__be32 *topt;
 742
 743	if (tsecr)
 744		tot_len += TCPOLEN_TSTAMP_ALIGNED;
 745#ifdef CONFIG_TCP_MD5SIG
 746	if (key)
 747		tot_len += TCPOLEN_MD5SIG_ALIGNED;
 748#endif
 749
 750	buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 751			 GFP_ATOMIC);
 752	if (buff == NULL)
 753		return;
 754
 755	skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 756
 757	t1 = (struct tcphdr *) skb_push(buff, tot_len);
 758	skb_reset_transport_header(buff);
 759
 760	/* Swap the send and the receive. */
 761	memset(t1, 0, sizeof(*t1));
 762	t1->dest = th->source;
 763	t1->source = th->dest;
 764	t1->doff = tot_len / 4;
 765	t1->seq = htonl(seq);
 766	t1->ack_seq = htonl(ack);
 767	t1->ack = !rst || !th->ack;
 768	t1->rst = rst;
 769	t1->window = htons(win);
 770
 771	topt = (__be32 *)(t1 + 1);
 772
 773	if (tsecr) {
 774		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 775				(TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 776		*topt++ = htonl(tsval);
 777		*topt++ = htonl(tsecr);
 778	}
 779
 780#ifdef CONFIG_TCP_MD5SIG
 781	if (key) {
 782		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 783				(TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 784		tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 785				    &ipv6_hdr(skb)->saddr,
 786				    &ipv6_hdr(skb)->daddr, t1);
 787	}
 788#endif
 789
 790	memset(&fl6, 0, sizeof(fl6));
 791	fl6.daddr = ipv6_hdr(skb)->saddr;
 792	fl6.saddr = ipv6_hdr(skb)->daddr;
 793	fl6.flowlabel = label;
 794
 795	buff->ip_summed = CHECKSUM_PARTIAL;
 796	buff->csum = 0;
 797
 798	__tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 799
 800	fl6.flowi6_proto = IPPROTO_TCP;
 801	if (rt6_need_strict(&fl6.daddr) && !oif)
 802		fl6.flowi6_oif = inet6_iif(skb);
 803	else
 
 
 
 804		fl6.flowi6_oif = oif;
 
 
 
 805	fl6.fl6_dport = t1->dest;
 806	fl6.fl6_sport = t1->source;
 
 807	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 808
 809	/* Pass a socket to ip6_dst_lookup either it is for RST
 810	 * Underlying function will use this to retrieve the network
 811	 * namespace
 812	 */
 813	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 814	if (!IS_ERR(dst)) {
 815		skb_dst_set(buff, dst);
 816		ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 817		TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 818		if (rst)
 819			TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 820		return;
 821	}
 822
 823	kfree_skb(buff);
 824}
 825
 826static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 827{
 828	const struct tcphdr *th = tcp_hdr(skb);
 829	u32 seq = 0, ack_seq = 0;
 830	struct tcp_md5sig_key *key = NULL;
 831#ifdef CONFIG_TCP_MD5SIG
 832	const __u8 *hash_location = NULL;
 833	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 834	unsigned char newhash[16];
 835	int genhash;
 836	struct sock *sk1 = NULL;
 837#endif
 838	int oif;
 839
 840	if (th->rst)
 841		return;
 842
 843	if (!ipv6_unicast_destination(skb))
 
 
 
 844		return;
 845
 846#ifdef CONFIG_TCP_MD5SIG
 
 847	hash_location = tcp_parse_md5sig_option(th);
 848	if (!sk && hash_location) {
 
 
 849		/*
 850		 * active side is lost. Try to find listening socket through
 851		 * source port, and then find md5 key through listening socket.
 852		 * we are not loose security here:
 853		 * Incoming packet is checked with md5 hash with finding key,
 854		 * no RST generated if md5 hash doesn't match.
 855		 */
 856		sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 857					   &tcp_hashinfo, &ipv6h->saddr,
 
 858					   th->source, &ipv6h->daddr,
 859					   ntohs(th->source), inet6_iif(skb));
 
 860		if (!sk1)
 861			return;
 862
 863		rcu_read_lock();
 864		key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 865		if (!key)
 866			goto release_sk1;
 867
 868		genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
 869		if (genhash || memcmp(hash_location, newhash, 16) != 0)
 870			goto release_sk1;
 871	} else {
 872		key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 873	}
 874#endif
 875
 876	if (th->ack)
 877		seq = ntohl(th->ack_seq);
 878	else
 879		ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 880			  (th->doff << 2);
 881
 882	oif = sk ? sk->sk_bound_dev_if : 0;
 883	tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 
 
 
 
 
 884
 885#ifdef CONFIG_TCP_MD5SIG
 886release_sk1:
 887	if (sk1) {
 888		rcu_read_unlock();
 889		sock_put(sk1);
 890	}
 891#endif
 892}
 893
 894static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
 895			    u32 win, u32 tsval, u32 tsecr, int oif,
 896			    struct tcp_md5sig_key *key, u8 tclass,
 897			    u32 label)
 898{
 899	tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, oif, key, 0, tclass,
 900			     label);
 901}
 902
 903static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 904{
 905	struct inet_timewait_sock *tw = inet_twsk(sk);
 906	struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 907
 908	tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 909			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 910			tcp_time_stamp + tcptw->tw_ts_offset,
 911			tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 912			tw->tw_tclass, (tw->tw_flowlabel << 12));
 913
 914	inet_twsk_put(tw);
 915}
 916
 917static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 918				  struct request_sock *req)
 919{
 920	tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
 921			req->rcv_wnd, tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 922			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 
 
 
 
 
 
 
 
 
 
 
 
 923			0, 0);
 924}
 925
 926
 927static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
 928{
 929	struct request_sock *req, **prev;
 930	const struct tcphdr *th = tcp_hdr(skb);
 931	struct sock *nsk;
 932
 933	/* Find possible connection requests. */
 934	req = inet6_csk_search_req(sk, &prev, th->source,
 935				   &ipv6_hdr(skb)->saddr,
 936				   &ipv6_hdr(skb)->daddr, inet6_iif(skb));
 937	if (req)
 938		return tcp_check_req(sk, skb, req, prev, false);
 939
 940	nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
 941			&ipv6_hdr(skb)->saddr, th->source,
 942			&ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 943
 944	if (nsk) {
 945		if (nsk->sk_state != TCP_TIME_WAIT) {
 946			bh_lock_sock(nsk);
 947			return nsk;
 948		}
 949		inet_twsk_put(inet_twsk(nsk));
 950		return NULL;
 951	}
 952
 953#ifdef CONFIG_SYN_COOKIES
 954	if (!th->syn)
 955		sk = cookie_v6_check(sk, skb);
 956#endif
 957	return sk;
 958}
 959
 960/* FIXME: this is substantially similar to the ipv4 code.
 961 * Can some kind of merge be done? -- erics
 962 */
 963static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 964{
 965	struct tcp_options_received tmp_opt;
 966	struct request_sock *req;
 967	struct inet_request_sock *ireq;
 968	struct ipv6_pinfo *np = inet6_sk(sk);
 969	struct tcp_sock *tp = tcp_sk(sk);
 970	__u32 isn = TCP_SKB_CB(skb)->when;
 971	struct dst_entry *dst = NULL;
 972	struct flowi6 fl6;
 973	bool want_cookie = false;
 974
 975	if (skb->protocol == htons(ETH_P_IP))
 976		return tcp_v4_conn_request(sk, skb);
 977
 978	if (!ipv6_unicast_destination(skb))
 979		goto drop;
 980
 981	if ((sysctl_tcp_syncookies == 2 ||
 982	     inet_csk_reqsk_queue_is_full(sk)) && !isn) {
 983		want_cookie = tcp_syn_flood_action(sk, skb, "TCPv6");
 984		if (!want_cookie)
 985			goto drop;
 986	}
 987
 988	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
 989		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 990		goto drop;
 991	}
 992
 993	req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
 994	if (req == NULL)
 995		goto drop;
 996
 997#ifdef CONFIG_TCP_MD5SIG
 998	tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
 999#endif
1000
1001	tcp_clear_options(&tmp_opt);
1002	tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1003	tmp_opt.user_mss = tp->rx_opt.user_mss;
1004	tcp_parse_options(skb, &tmp_opt, 0, NULL);
1005
1006	if (want_cookie && !tmp_opt.saw_tstamp)
1007		tcp_clear_options(&tmp_opt);
1008
1009	tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1010	tcp_openreq_init(req, &tmp_opt, skb);
1011
1012	ireq = inet_rsk(req);
1013	ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
1014	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
1015	if (!want_cookie || tmp_opt.tstamp_ok)
1016		TCP_ECN_create_request(req, skb, sock_net(sk));
1017
1018	ireq->ir_iif = sk->sk_bound_dev_if;
1019
1020	/* So that link locals have meaning */
1021	if (!sk->sk_bound_dev_if &&
1022	    ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
1023		ireq->ir_iif = inet6_iif(skb);
1024
1025	if (!isn) {
1026		if (ipv6_opt_accepted(sk, skb) ||
1027		    np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1028		    np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim ||
1029		    np->repflow) {
1030			atomic_inc(&skb->users);
1031			ireq->pktopts = skb;
1032		}
1033
1034		if (want_cookie) {
1035			isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1036			req->cookie_ts = tmp_opt.tstamp_ok;
1037			goto have_isn;
1038		}
1039
1040		/* VJ's idea. We save last timestamp seen
1041		 * from the destination in peer table, when entering
1042		 * state TIME-WAIT, and check against it before
1043		 * accepting new connection request.
1044		 *
1045		 * If "isn" is not zero, this request hit alive
1046		 * timewait bucket, so that all the necessary checks
1047		 * are made in the function processing timewait state.
1048		 */
1049		if (tmp_opt.saw_tstamp &&
1050		    tcp_death_row.sysctl_tw_recycle &&
1051		    (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
1052			if (!tcp_peer_is_proven(req, dst, true)) {
1053				NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1054				goto drop_and_release;
1055			}
1056		}
1057		/* Kill the following clause, if you dislike this way. */
1058		else if (!sysctl_tcp_syncookies &&
1059			 (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1060			  (sysctl_max_syn_backlog >> 2)) &&
1061			 !tcp_peer_is_proven(req, dst, false)) {
1062			/* Without syncookies last quarter of
1063			 * backlog is filled with destinations,
1064			 * proven to be alive.
1065			 * It means that we continue to communicate
1066			 * to destinations, already remembered
1067			 * to the moment of synflood.
1068			 */
1069			LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1070				       &ireq->ir_v6_rmt_addr, ntohs(tcp_hdr(skb)->source));
1071			goto drop_and_release;
1072		}
1073
1074		isn = tcp_v6_init_sequence(skb);
1075	}
1076have_isn:
1077	tcp_rsk(req)->snt_isn = isn;
1078
1079	if (security_inet_conn_request(sk, skb, req))
1080		goto drop_and_release;
1081
1082	if (tcp_v6_send_synack(sk, dst, &fl6, req,
1083			       skb_get_queue_mapping(skb)) ||
1084	    want_cookie)
1085		goto drop_and_free;
1086
1087	tcp_rsk(req)->snt_synack = tcp_time_stamp;
1088	tcp_rsk(req)->listener = NULL;
1089	inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1090	return 0;
1091
1092drop_and_release:
1093	dst_release(dst);
1094drop_and_free:
1095	reqsk_free(req);
1096drop:
1097	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1098	return 0; /* don't send reset */
1099}
1100
1101static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
 
 
 
 
 
 
 
 
 
1102					 struct request_sock *req,
1103					 struct dst_entry *dst)
 
 
1104{
1105	struct inet_request_sock *ireq;
1106	struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
 
 
1107	struct tcp6_sock *newtcp6sk;
1108	struct inet_sock *newinet;
1109	struct tcp_sock *newtp;
1110	struct sock *newsk;
1111#ifdef CONFIG_TCP_MD5SIG
1112	struct tcp_md5sig_key *key;
1113#endif
1114	struct flowi6 fl6;
1115
1116	if (skb->protocol == htons(ETH_P_IP)) {
1117		/*
1118		 *	v6 mapped
1119		 */
1120
1121		newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
 
1122
1123		if (newsk == NULL)
1124			return NULL;
1125
1126		newtcp6sk = (struct tcp6_sock *)newsk;
1127		inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1128
1129		newinet = inet_sk(newsk);
1130		newnp = inet6_sk(newsk);
1131		newtp = tcp_sk(newsk);
1132
1133		memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1134
1135		ipv6_addr_set_v4mapped(newinet->inet_daddr, &newsk->sk_v6_daddr);
1136
1137		ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1138
1139		newsk->sk_v6_rcv_saddr = newnp->saddr;
1140
1141		inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1142		newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1143#ifdef CONFIG_TCP_MD5SIG
1144		newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1145#endif
1146
 
1147		newnp->ipv6_ac_list = NULL;
1148		newnp->ipv6_fl_list = NULL;
1149		newnp->pktoptions  = NULL;
1150		newnp->opt	   = NULL;
1151		newnp->mcast_oif   = inet6_iif(skb);
1152		newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1153		newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1154		if (np->repflow)
1155			newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1156
1157		/*
1158		 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1159		 * here, tcp_create_openreq_child now does this for us, see the comment in
1160		 * that function for the gory details. -acme
1161		 */
1162
1163		/* It is tricky place. Until this moment IPv4 tcp
1164		   worked with IPv6 icsk.icsk_af_ops.
1165		   Sync it now.
1166		 */
1167		tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1168
1169		return newsk;
1170	}
1171
1172	ireq = inet_rsk(req);
1173
1174	if (sk_acceptq_is_full(sk))
1175		goto out_overflow;
1176
1177	if (!dst) {
1178		dst = inet6_csk_route_req(sk, &fl6, req);
1179		if (!dst)
1180			goto out;
1181	}
1182
1183	newsk = tcp_create_openreq_child(sk, req, skb);
1184	if (newsk == NULL)
1185		goto out_nonewsk;
1186
1187	/*
1188	 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1189	 * count here, tcp_create_openreq_child now does this for us, see the
1190	 * comment in that function for the gory details. -acme
1191	 */
1192
1193	newsk->sk_gso_type = SKB_GSO_TCPV6;
1194	__ip6_dst_store(newsk, dst, NULL, NULL);
1195	inet6_sk_rx_dst_set(newsk, skb);
1196
1197	newtcp6sk = (struct tcp6_sock *)newsk;
1198	inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1199
1200	newtp = tcp_sk(newsk);
1201	newinet = inet_sk(newsk);
1202	newnp = inet6_sk(newsk);
1203
1204	memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1205
1206	newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1207	newnp->saddr = ireq->ir_v6_loc_addr;
1208	newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1209	newsk->sk_bound_dev_if = ireq->ir_iif;
1210
1211	/* Now IPv6 options...
1212
1213	   First: no IPv4 options.
1214	 */
1215	newinet->inet_opt = NULL;
 
1216	newnp->ipv6_ac_list = NULL;
1217	newnp->ipv6_fl_list = NULL;
1218
1219	/* Clone RX bits */
1220	newnp->rxopt.all = np->rxopt.all;
1221
1222	/* Clone pktoptions received with SYN */
1223	newnp->pktoptions = NULL;
1224	if (ireq->pktopts != NULL) {
1225		newnp->pktoptions = skb_clone(ireq->pktopts,
1226					      sk_gfp_atomic(sk, GFP_ATOMIC));
1227		consume_skb(ireq->pktopts);
1228		ireq->pktopts = NULL;
1229		if (newnp->pktoptions)
1230			skb_set_owner_r(newnp->pktoptions, newsk);
1231	}
1232	newnp->opt	  = NULL;
1233	newnp->mcast_oif  = inet6_iif(skb);
1234	newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1235	newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1236	if (np->repflow)
1237		newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1238
1239	/* Clone native IPv6 options from listening socket (if any)
1240
1241	   Yes, keeping reference count would be much more clever,
1242	   but we make one more one thing there: reattach optmem
1243	   to newsk.
1244	 */
1245	if (np->opt)
1246		newnp->opt = ipv6_dup_options(newsk, np->opt);
 
 
 
 
 
 
 
 
 
1247
1248	inet_csk(newsk)->icsk_ext_hdr_len = 0;
1249	if (newnp->opt)
1250		inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1251						     newnp->opt->opt_flen);
1252
1253	tcp_sync_mss(newsk, dst_mtu(dst));
1254	newtp->advmss = dst_metric_advmss(dst);
1255	if (tcp_sk(sk)->rx_opt.user_mss &&
1256	    tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1257		newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1258
1259	tcp_initialize_rcv_mss(newsk);
1260
1261	newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1262	newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1263
1264#ifdef CONFIG_TCP_MD5SIG
1265	/* Copy over the MD5 key from the original socket */
1266	key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1267	if (key != NULL) {
1268		/* We're using one, so create a matching key
1269		 * on the newsk structure. If we fail to get
1270		 * memory, then we end up not copying the key
1271		 * across. Shucks.
1272		 */
1273		tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1274			       AF_INET6, key->key, key->keylen,
1275			       sk_gfp_atomic(sk, GFP_ATOMIC));
1276	}
1277#endif
1278
1279	if (__inet_inherit_port(sk, newsk) < 0) {
1280		inet_csk_prepare_forced_close(newsk);
1281		tcp_done(newsk);
1282		goto out;
1283	}
1284	__inet6_hash(newsk, NULL);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1285
1286	return newsk;
1287
1288out_overflow:
1289	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1290out_nonewsk:
1291	dst_release(dst);
1292out:
1293	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1294	return NULL;
1295}
1296
1297static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1298{
1299	if (skb->ip_summed == CHECKSUM_COMPLETE) {
1300		if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1301				  &ipv6_hdr(skb)->daddr, skb->csum)) {
1302			skb->ip_summed = CHECKSUM_UNNECESSARY;
1303			return 0;
1304		}
1305	}
1306
1307	skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1308					      &ipv6_hdr(skb)->saddr,
1309					      &ipv6_hdr(skb)->daddr, 0));
1310
1311	if (skb->len <= 76)
1312		return __skb_checksum_complete(skb);
1313	return 0;
1314}
1315
1316/* The socket must have it's spinlock held when we get
1317 * here.
1318 *
1319 * We have a potential double-lock case here, so even when
1320 * doing backlog processing we use the BH locking scheme.
1321 * This is because we cannot sleep with the original spinlock
1322 * held.
1323 */
1324static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1325{
1326	struct ipv6_pinfo *np = inet6_sk(sk);
1327	struct tcp_sock *tp;
1328	struct sk_buff *opt_skb = NULL;
1329
1330	/* Imagine: socket is IPv6. IPv4 packet arrives,
1331	   goes to IPv4 receive handler and backlogged.
1332	   From backlog it always goes here. Kerboom...
1333	   Fortunately, tcp_rcv_established and rcv_established
1334	   handle them correctly, but it is not case with
1335	   tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1336	 */
1337
1338	if (skb->protocol == htons(ETH_P_IP))
1339		return tcp_v4_do_rcv(sk, skb);
1340
1341#ifdef CONFIG_TCP_MD5SIG
1342	if (tcp_v6_inbound_md5_hash(sk, skb))
1343		goto discard;
1344#endif
1345
1346	if (sk_filter(sk, skb))
1347		goto discard;
1348
1349	/*
1350	 *	socket locking is here for SMP purposes as backlog rcv
1351	 *	is currently called with bh processing disabled.
1352	 */
1353
1354	/* Do Stevens' IPV6_PKTOPTIONS.
1355
1356	   Yes, guys, it is the only place in our code, where we
1357	   may make it not affecting IPv4.
1358	   The rest of code is protocol independent,
1359	   and I do not like idea to uglify IPv4.
1360
1361	   Actually, all the idea behind IPV6_PKTOPTIONS
1362	   looks not very well thought. For now we latch
1363	   options, received in the last packet, enqueued
1364	   by tcp. Feel free to propose better solution.
1365					       --ANK (980728)
1366	 */
1367	if (np->rxopt.all)
1368		opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1369
1370	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1371		struct dst_entry *dst = sk->sk_rx_dst;
1372
1373		sock_rps_save_rxhash(sk, skb);
 
1374		if (dst) {
1375			if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1376			    dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1377				dst_release(dst);
1378				sk->sk_rx_dst = NULL;
1379			}
1380		}
1381
1382		tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1383		if (opt_skb)
1384			goto ipv6_pktoptions;
1385		return 0;
1386	}
1387
1388	if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1389		goto csum_err;
1390
1391	if (sk->sk_state == TCP_LISTEN) {
1392		struct sock *nsk = tcp_v6_hnd_req(sk, skb);
 
1393		if (!nsk)
1394			goto discard;
1395
1396		/*
1397		 * Queue it on the new socket if the new socket is active,
1398		 * otherwise we just shortcircuit this and continue with
1399		 * the new socket..
1400		 */
1401		if (nsk != sk) {
1402			sock_rps_save_rxhash(nsk, skb);
1403			if (tcp_child_process(sk, nsk, skb))
1404				goto reset;
1405			if (opt_skb)
1406				__kfree_skb(opt_skb);
1407			return 0;
1408		}
1409	} else
1410		sock_rps_save_rxhash(sk, skb);
1411
1412	if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1413		goto reset;
1414	if (opt_skb)
1415		goto ipv6_pktoptions;
1416	return 0;
1417
1418reset:
1419	tcp_v6_send_reset(sk, skb);
1420discard:
1421	if (opt_skb)
1422		__kfree_skb(opt_skb);
1423	kfree_skb(skb);
1424	return 0;
1425csum_err:
1426	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1427	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1428	goto discard;
1429
1430
1431ipv6_pktoptions:
1432	/* Do you ask, what is it?
1433
1434	   1. skb was enqueued by tcp.
1435	   2. skb is added to tail of read queue, rather than out of order.
1436	   3. socket is not in passive state.
1437	   4. Finally, it really contains options, which user wants to receive.
1438	 */
1439	tp = tcp_sk(sk);
1440	if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1441	    !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1442		if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1443			np->mcast_oif = inet6_iif(opt_skb);
1444		if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1445			np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1446		if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1447			np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1448		if (np->repflow)
1449			np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1450		if (ipv6_opt_accepted(sk, opt_skb)) {
1451			skb_set_owner_r(opt_skb, sk);
 
1452			opt_skb = xchg(&np->pktoptions, opt_skb);
1453		} else {
1454			__kfree_skb(opt_skb);
1455			opt_skb = xchg(&np->pktoptions, NULL);
1456		}
1457	}
1458
1459	kfree_skb(opt_skb);
1460	return 0;
1461}
1462
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1463static int tcp_v6_rcv(struct sk_buff *skb)
1464{
 
1465	const struct tcphdr *th;
1466	const struct ipv6hdr *hdr;
 
1467	struct sock *sk;
1468	int ret;
1469	struct net *net = dev_net(skb->dev);
1470
1471	if (skb->pkt_type != PACKET_HOST)
1472		goto discard_it;
1473
1474	/*
1475	 *	Count it even if it's bad.
1476	 */
1477	TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1478
1479	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1480		goto discard_it;
1481
1482	th = tcp_hdr(skb);
1483
1484	if (th->doff < sizeof(struct tcphdr)/4)
1485		goto bad_packet;
1486	if (!pskb_may_pull(skb, th->doff*4))
1487		goto discard_it;
1488
1489	if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1490		goto csum_error;
1491
1492	th = tcp_hdr(skb);
1493	hdr = ipv6_hdr(skb);
1494	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1495	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1496				    skb->len - th->doff*4);
1497	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1498	TCP_SKB_CB(skb)->when = 0;
1499	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1500	TCP_SKB_CB(skb)->sacked = 0;
1501
1502	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
 
 
 
1503	if (!sk)
1504		goto no_tcp_socket;
1505
1506process:
1507	if (sk->sk_state == TCP_TIME_WAIT)
1508		goto do_time_wait;
1509
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1510	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1511		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1512		goto discard_and_relse;
1513	}
1514
1515	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1516		goto discard_and_relse;
1517
1518	if (sk_filter(sk, skb))
 
 
 
1519		goto discard_and_relse;
 
 
 
1520
1521	sk_mark_napi_id(sk, skb);
1522	skb->dev = NULL;
1523
 
 
 
 
 
 
 
1524	bh_lock_sock_nested(sk);
 
1525	ret = 0;
1526	if (!sock_owned_by_user(sk)) {
1527#ifdef CONFIG_NET_DMA
1528		struct tcp_sock *tp = tcp_sk(sk);
1529		if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1530			tp->ucopy.dma_chan = net_dma_find_channel();
1531		if (tp->ucopy.dma_chan)
1532			ret = tcp_v6_do_rcv(sk, skb);
1533		else
1534#endif
1535		{
1536			if (!tcp_prequeue(sk, skb))
1537				ret = tcp_v6_do_rcv(sk, skb);
1538		}
1539	} else if (unlikely(sk_add_backlog(sk, skb,
1540					   sk->sk_rcvbuf + sk->sk_sndbuf))) {
1541		bh_unlock_sock(sk);
1542		NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1543		goto discard_and_relse;
1544	}
1545	bh_unlock_sock(sk);
1546
1547	sock_put(sk);
 
 
1548	return ret ? -1 : 0;
1549
1550no_tcp_socket:
1551	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1552		goto discard_it;
1553
1554	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 
 
1555csum_error:
1556		TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1557bad_packet:
1558		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1559	} else {
1560		tcp_v6_send_reset(NULL, skb);
1561	}
1562
1563discard_it:
1564	kfree_skb(skb);
1565	return 0;
1566
1567discard_and_relse:
1568	sock_put(sk);
 
 
1569	goto discard_it;
1570
1571do_time_wait:
1572	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1573		inet_twsk_put(inet_twsk(sk));
1574		goto discard_it;
1575	}
1576
1577	if (skb->len < (th->doff<<2)) {
1578		inet_twsk_put(inet_twsk(sk));
1579		goto bad_packet;
1580	}
1581	if (tcp_checksum_complete(skb)) {
1582		inet_twsk_put(inet_twsk(sk));
1583		goto csum_error;
1584	}
1585
1586	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1587	case TCP_TW_SYN:
1588	{
1589		struct sock *sk2;
1590
1591		sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
 
1592					    &ipv6_hdr(skb)->saddr, th->source,
1593					    &ipv6_hdr(skb)->daddr,
1594					    ntohs(th->dest), inet6_iif(skb));
1595		if (sk2 != NULL) {
 
1596			struct inet_timewait_sock *tw = inet_twsk(sk);
1597			inet_twsk_deschedule(tw, &tcp_death_row);
1598			inet_twsk_put(tw);
1599			sk = sk2;
 
 
1600			goto process;
1601		}
1602		/* Fall through to ACK */
1603	}
 
 
1604	case TCP_TW_ACK:
1605		tcp_v6_timewait_ack(sk, skb);
1606		break;
1607	case TCP_TW_RST:
1608		goto no_tcp_socket;
 
 
1609	case TCP_TW_SUCCESS:
1610		;
1611	}
1612	goto discard_it;
1613}
1614
1615static void tcp_v6_early_demux(struct sk_buff *skb)
1616{
1617	const struct ipv6hdr *hdr;
1618	const struct tcphdr *th;
1619	struct sock *sk;
1620
1621	if (skb->pkt_type != PACKET_HOST)
1622		return;
1623
1624	if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1625		return;
1626
1627	hdr = ipv6_hdr(skb);
1628	th = tcp_hdr(skb);
1629
1630	if (th->doff < sizeof(struct tcphdr) / 4)
1631		return;
1632
 
1633	sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1634					&hdr->saddr, th->source,
1635					&hdr->daddr, ntohs(th->dest),
1636					inet6_iif(skb));
1637	if (sk) {
1638		skb->sk = sk;
1639		skb->destructor = sock_edemux;
1640		if (sk->sk_state != TCP_TIME_WAIT) {
1641			struct dst_entry *dst = sk->sk_rx_dst;
1642
1643			if (dst)
1644				dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1645			if (dst &&
1646			    inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1647				skb_dst_set_noref(skb, dst);
1648		}
1649	}
1650}
1651
1652static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1653	.twsk_obj_size	= sizeof(struct tcp6_timewait_sock),
1654	.twsk_unique	= tcp_twsk_unique,
1655	.twsk_destructor = tcp_twsk_destructor,
1656};
1657
1658static const struct inet_connection_sock_af_ops ipv6_specific = {
1659	.queue_xmit	   = inet6_csk_xmit,
1660	.send_check	   = tcp_v6_send_check,
1661	.rebuild_header	   = inet6_sk_rebuild_header,
1662	.sk_rx_dst_set	   = inet6_sk_rx_dst_set,
1663	.conn_request	   = tcp_v6_conn_request,
1664	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
1665	.net_header_len	   = sizeof(struct ipv6hdr),
1666	.net_frag_header_len = sizeof(struct frag_hdr),
1667	.setsockopt	   = ipv6_setsockopt,
1668	.getsockopt	   = ipv6_getsockopt,
1669	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
1670	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1671	.bind_conflict	   = inet6_csk_bind_conflict,
1672#ifdef CONFIG_COMPAT
1673	.compat_setsockopt = compat_ipv6_setsockopt,
1674	.compat_getsockopt = compat_ipv6_getsockopt,
1675#endif
 
1676};
1677
1678#ifdef CONFIG_TCP_MD5SIG
1679static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1680	.md5_lookup	=	tcp_v6_md5_lookup,
1681	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
1682	.md5_parse	=	tcp_v6_parse_md5_keys,
1683};
1684#endif
1685
1686/*
1687 *	TCP over IPv4 via INET6 API
1688 */
1689static const struct inet_connection_sock_af_ops ipv6_mapped = {
1690	.queue_xmit	   = ip_queue_xmit,
1691	.send_check	   = tcp_v4_send_check,
1692	.rebuild_header	   = inet_sk_rebuild_header,
1693	.sk_rx_dst_set	   = inet_sk_rx_dst_set,
1694	.conn_request	   = tcp_v6_conn_request,
1695	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
1696	.net_header_len	   = sizeof(struct iphdr),
1697	.setsockopt	   = ipv6_setsockopt,
1698	.getsockopt	   = ipv6_getsockopt,
1699	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
1700	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1701	.bind_conflict	   = inet6_csk_bind_conflict,
1702#ifdef CONFIG_COMPAT
1703	.compat_setsockopt = compat_ipv6_setsockopt,
1704	.compat_getsockopt = compat_ipv6_getsockopt,
1705#endif
 
1706};
1707
1708#ifdef CONFIG_TCP_MD5SIG
1709static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1710	.md5_lookup	=	tcp_v4_md5_lookup,
1711	.calc_md5_hash	=	tcp_v4_md5_hash_skb,
1712	.md5_parse	=	tcp_v6_parse_md5_keys,
1713};
1714#endif
1715
1716/* NOTE: A lot of things set to zero explicitly by call to
1717 *       sk_alloc() so need not be done here.
1718 */
1719static int tcp_v6_init_sock(struct sock *sk)
1720{
1721	struct inet_connection_sock *icsk = inet_csk(sk);
1722
1723	tcp_init_sock(sk);
1724
1725	icsk->icsk_af_ops = &ipv6_specific;
1726
1727#ifdef CONFIG_TCP_MD5SIG
1728	tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1729#endif
1730
1731	return 0;
1732}
1733
1734static void tcp_v6_destroy_sock(struct sock *sk)
1735{
1736	tcp_v4_destroy_sock(sk);
1737	inet6_destroy_sock(sk);
1738}
1739
1740#ifdef CONFIG_PROC_FS
1741/* Proc filesystem TCPv6 sock list dumping. */
1742static void get_openreq6(struct seq_file *seq,
1743			 const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
1744{
1745	int ttd = req->expires - jiffies;
1746	const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1747	const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1748
1749	if (ttd < 0)
1750		ttd = 0;
1751
1752	seq_printf(seq,
1753		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1754		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1755		   i,
1756		   src->s6_addr32[0], src->s6_addr32[1],
1757		   src->s6_addr32[2], src->s6_addr32[3],
1758		   inet_rsk(req)->ir_num,
1759		   dest->s6_addr32[0], dest->s6_addr32[1],
1760		   dest->s6_addr32[2], dest->s6_addr32[3],
1761		   ntohs(inet_rsk(req)->ir_rmt_port),
1762		   TCP_SYN_RECV,
1763		   0, 0, /* could print option size, but that is af dependent. */
1764		   1,   /* timers active (only the expire timer) */
1765		   jiffies_to_clock_t(ttd),
1766		   req->num_timeout,
1767		   from_kuid_munged(seq_user_ns(seq), uid),
 
1768		   0,  /* non standard timer */
1769		   0, /* open_requests have no inode */
1770		   0, req);
1771}
1772
1773static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1774{
1775	const struct in6_addr *dest, *src;
1776	__u16 destp, srcp;
1777	int timer_active;
1778	unsigned long timer_expires;
1779	const struct inet_sock *inet = inet_sk(sp);
1780	const struct tcp_sock *tp = tcp_sk(sp);
1781	const struct inet_connection_sock *icsk = inet_csk(sp);
 
 
 
1782
1783	dest  = &sp->sk_v6_daddr;
1784	src   = &sp->sk_v6_rcv_saddr;
1785	destp = ntohs(inet->inet_dport);
1786	srcp  = ntohs(inet->inet_sport);
1787
1788	if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
 
 
1789		timer_active	= 1;
1790		timer_expires	= icsk->icsk_timeout;
1791	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1792		timer_active	= 4;
1793		timer_expires	= icsk->icsk_timeout;
1794	} else if (timer_pending(&sp->sk_timer)) {
1795		timer_active	= 2;
1796		timer_expires	= sp->sk_timer.expires;
1797	} else {
1798		timer_active	= 0;
1799		timer_expires = jiffies;
1800	}
1801
 
 
 
 
 
 
 
 
 
1802	seq_printf(seq,
1803		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1804		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1805		   i,
1806		   src->s6_addr32[0], src->s6_addr32[1],
1807		   src->s6_addr32[2], src->s6_addr32[3], srcp,
1808		   dest->s6_addr32[0], dest->s6_addr32[1],
1809		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1810		   sp->sk_state,
1811		   tp->write_seq-tp->snd_una,
1812		   (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1813		   timer_active,
1814		   jiffies_delta_to_clock_t(timer_expires - jiffies),
1815		   icsk->icsk_retransmits,
1816		   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1817		   icsk->icsk_probes_out,
1818		   sock_i_ino(sp),
1819		   atomic_read(&sp->sk_refcnt), sp,
1820		   jiffies_to_clock_t(icsk->icsk_rto),
1821		   jiffies_to_clock_t(icsk->icsk_ack.ato),
1822		   (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1823		   tp->snd_cwnd,
1824		   tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
 
 
1825		   );
1826}
1827
1828static void get_timewait6_sock(struct seq_file *seq,
1829			       struct inet_timewait_sock *tw, int i)
1830{
 
1831	const struct in6_addr *dest, *src;
1832	__u16 destp, srcp;
1833	s32 delta = tw->tw_ttd - inet_tw_time_stamp();
1834
1835	dest = &tw->tw_v6_daddr;
1836	src  = &tw->tw_v6_rcv_saddr;
1837	destp = ntohs(tw->tw_dport);
1838	srcp  = ntohs(tw->tw_sport);
1839
1840	seq_printf(seq,
1841		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1842		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1843		   i,
1844		   src->s6_addr32[0], src->s6_addr32[1],
1845		   src->s6_addr32[2], src->s6_addr32[3], srcp,
1846		   dest->s6_addr32[0], dest->s6_addr32[1],
1847		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1848		   tw->tw_substate, 0, 0,
1849		   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1850		   atomic_read(&tw->tw_refcnt), tw);
1851}
1852
1853static int tcp6_seq_show(struct seq_file *seq, void *v)
1854{
1855	struct tcp_iter_state *st;
1856	struct sock *sk = v;
1857
1858	if (v == SEQ_START_TOKEN) {
1859		seq_puts(seq,
1860			 "  sl  "
1861			 "local_address                         "
1862			 "remote_address                        "
1863			 "st tx_queue rx_queue tr tm->when retrnsmt"
1864			 "   uid  timeout inode\n");
1865		goto out;
1866	}
1867	st = seq->private;
1868
1869	switch (st->state) {
1870	case TCP_SEQ_STATE_LISTENING:
1871	case TCP_SEQ_STATE_ESTABLISHED:
1872		if (sk->sk_state == TCP_TIME_WAIT)
1873			get_timewait6_sock(seq, v, st->num);
1874		else
1875			get_tcp6_sock(seq, v, st->num);
1876		break;
1877	case TCP_SEQ_STATE_OPENREQ:
1878		get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1879		break;
1880	}
1881out:
1882	return 0;
1883}
1884
1885static const struct file_operations tcp6_afinfo_seq_fops = {
1886	.owner   = THIS_MODULE,
1887	.open    = tcp_seq_open,
1888	.read    = seq_read,
1889	.llseek  = seq_lseek,
1890	.release = seq_release_net
1891};
1892
1893static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1894	.name		= "tcp6",
1895	.family		= AF_INET6,
1896	.seq_fops	= &tcp6_afinfo_seq_fops,
1897	.seq_ops	= {
1898		.show		= tcp6_seq_show,
1899	},
1900};
1901
1902int __net_init tcp6_proc_init(struct net *net)
1903{
1904	return tcp_proc_register(net, &tcp6_seq_afinfo);
1905}
1906
1907void tcp6_proc_exit(struct net *net)
1908{
1909	tcp_proc_unregister(net, &tcp6_seq_afinfo);
1910}
1911#endif
1912
1913static void tcp_v6_clear_sk(struct sock *sk, int size)
1914{
1915	struct inet_sock *inet = inet_sk(sk);
1916
1917	/* we do not want to clear pinet6 field, because of RCU lookups */
1918	sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1919
1920	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1921	memset(&inet->pinet6 + 1, 0, size);
1922}
1923
1924struct proto tcpv6_prot = {
1925	.name			= "TCPv6",
1926	.owner			= THIS_MODULE,
1927	.close			= tcp_close,
 
1928	.connect		= tcp_v6_connect,
1929	.disconnect		= tcp_disconnect,
1930	.accept			= inet_csk_accept,
1931	.ioctl			= tcp_ioctl,
1932	.init			= tcp_v6_init_sock,
1933	.destroy		= tcp_v6_destroy_sock,
1934	.shutdown		= tcp_shutdown,
1935	.setsockopt		= tcp_setsockopt,
1936	.getsockopt		= tcp_getsockopt,
 
1937	.recvmsg		= tcp_recvmsg,
1938	.sendmsg		= tcp_sendmsg,
1939	.sendpage		= tcp_sendpage,
1940	.backlog_rcv		= tcp_v6_do_rcv,
1941	.release_cb		= tcp_release_cb,
1942	.mtu_reduced		= tcp_v6_mtu_reduced,
1943	.hash			= tcp_v6_hash,
1944	.unhash			= inet_unhash,
1945	.get_port		= inet_csk_get_port,
1946	.enter_memory_pressure	= tcp_enter_memory_pressure,
 
1947	.stream_memory_free	= tcp_stream_memory_free,
1948	.sockets_allocated	= &tcp_sockets_allocated,
1949	.memory_allocated	= &tcp_memory_allocated,
1950	.memory_pressure	= &tcp_memory_pressure,
1951	.orphan_count		= &tcp_orphan_count,
1952	.sysctl_mem		= sysctl_tcp_mem,
1953	.sysctl_wmem		= sysctl_tcp_wmem,
1954	.sysctl_rmem		= sysctl_tcp_rmem,
1955	.max_header		= MAX_TCP_HEADER,
1956	.obj_size		= sizeof(struct tcp6_sock),
1957	.slab_flags		= SLAB_DESTROY_BY_RCU,
1958	.twsk_prot		= &tcp6_timewait_sock_ops,
1959	.rsk_prot		= &tcp6_request_sock_ops,
1960	.h.hashinfo		= &tcp_hashinfo,
1961	.no_autobind		= true,
1962#ifdef CONFIG_COMPAT
1963	.compat_setsockopt	= compat_tcp_setsockopt,
1964	.compat_getsockopt	= compat_tcp_getsockopt,
1965#endif
1966#ifdef CONFIG_MEMCG_KMEM
1967	.proto_cgroup		= tcp_proto_cgroup,
1968#endif
1969	.clear_sk		= tcp_v6_clear_sk,
1970};
1971
1972static const struct inet6_protocol tcpv6_protocol = {
 
 
 
1973	.early_demux	=	tcp_v6_early_demux,
 
1974	.handler	=	tcp_v6_rcv,
1975	.err_handler	=	tcp_v6_err,
1976	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1977};
1978
1979static struct inet_protosw tcpv6_protosw = {
1980	.type		=	SOCK_STREAM,
1981	.protocol	=	IPPROTO_TCP,
1982	.prot		=	&tcpv6_prot,
1983	.ops		=	&inet6_stream_ops,
1984	.no_check	=	0,
1985	.flags		=	INET_PROTOSW_PERMANENT |
1986				INET_PROTOSW_ICSK,
1987};
1988
1989static int __net_init tcpv6_net_init(struct net *net)
1990{
1991	return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1992				    SOCK_RAW, IPPROTO_TCP, net);
1993}
1994
1995static void __net_exit tcpv6_net_exit(struct net *net)
1996{
1997	inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1998}
1999
2000static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2001{
2002	inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2003}
2004
2005static struct pernet_operations tcpv6_net_ops = {
2006	.init	    = tcpv6_net_init,
2007	.exit	    = tcpv6_net_exit,
2008	.exit_batch = tcpv6_net_exit_batch,
2009};
2010
2011int __init tcpv6_init(void)
2012{
2013	int ret;
2014
2015	ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2016	if (ret)
2017		goto out;
2018
2019	/* register inet6 protocol */
2020	ret = inet6_register_protosw(&tcpv6_protosw);
2021	if (ret)
2022		goto out_tcpv6_protocol;
2023
2024	ret = register_pernet_subsys(&tcpv6_net_ops);
2025	if (ret)
2026		goto out_tcpv6_protosw;
2027out:
2028	return ret;
2029
2030out_tcpv6_protosw:
2031	inet6_unregister_protosw(&tcpv6_protosw);
2032out_tcpv6_protocol:
2033	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2034	goto out;
2035}
2036
2037void tcpv6_exit(void)
2038{
2039	unregister_pernet_subsys(&tcpv6_net_ops);
2040	inet6_unregister_protosw(&tcpv6_protosw);
2041	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2042}