net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/busy_poll.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <crypto/hash.h>
  70 #include <linux/scatterlist.h>
  71
  72 #include <trace/events/tcp.h>
  73
  74 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79
  80 static const struct inet_connection_sock_af_ops ipv6_mapped;
  81 static const struct inet_connection_sock_af_ops ipv6_specific;
  82 #ifdef CONFIG_TCP_MD5SIG
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  84 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  85 #else
  86 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  87                                                    const struct in6_addr *addr)
  88 {
  89         return NULL;
  90 }
  91 #endif
  92
  93 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  94 {
  95         struct dst_entry *dst = skb_dst(skb);
  96
  97         if (dst && dst_hold_safe(dst)) {
  98                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  99
 100                 rcu_assign_pointer(sk->sk_rx_dst, dst);
 101                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 103         }
 104 }
 105
 106 static u32 tcp_v6_init_seq(const struct sk_buff *skb)
 107 {
 108         return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
 109                                 ipv6_hdr(skb)->saddr.s6_addr32,
 110                                 tcp_hdr(skb)->dest,
 111                                 tcp_hdr(skb)->source);
 112 }
 113
 114 static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
 115 {
 116         return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
 117                                    ipv6_hdr(skb)->saddr.s6_addr32);
 118 }
 119
 120 static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
 121                               int addr_len)
 122 {
 123         /* This check is replicated from tcp_v6_connect() and intended to
 124          * prevent BPF program called below from accessing bytes that are out
 125          * of the bound specified by user in addr_len.
 126          */
 127         if (addr_len < SIN6_LEN_RFC2133)
 128                 return -EINVAL;
 129
 130         sock_owned_by_me(sk);
 131
 132         return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr);
 133 }
 134
 135 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 136                           int addr_len)
 137 {
 138         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 139         struct inet_sock *inet = inet_sk(sk);
 140         struct inet_connection_sock *icsk = inet_csk(sk);
 141         struct ipv6_pinfo *np = inet6_sk(sk);
 142         struct tcp_sock *tp = tcp_sk(sk);
 143         struct in6_addr *saddr = NULL, *final_p, final;
 144         struct ipv6_txoptions *opt;
 145         struct flowi6 fl6;
 146         struct dst_entry *dst;
 147         int addr_type;
 148         int err;
 149         struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
 150
 151         if (addr_len < SIN6_LEN_RFC2133)
 152                 return -EINVAL;
 153
 154         if (usin->sin6_family != AF_INET6)
 155                 return -EAFNOSUPPORT;
 156
 157         memset(&fl6, 0, sizeof(fl6));
 158
 159         if (np->sndflow) {
 160                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 161                 IP6_ECN_flow_init(fl6.flowlabel);
 162                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 163                         struct ip6_flowlabel *flowlabel;
 164                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 165                         if (!flowlabel)
 166                                 return -EINVAL;
 167                         fl6_sock_release(flowlabel);
 168                 }
 169         }
 170
 171         /*
 172          *      connect() to INADDR_ANY means loopback (BSD'ism).
 173          */
 174
 175         if (ipv6_addr_any(&usin->sin6_addr)) {
 176                 if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
 177                         ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
 178                                                &usin->sin6_addr);
 179                 else
 180                         usin->sin6_addr = in6addr_loopback;
 181         }
 182
 183         addr_type = ipv6_addr_type(&usin->sin6_addr);
 184
 185         if (addr_type & IPV6_ADDR_MULTICAST)
 186                 return -ENETUNREACH;
 187
 188         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 189                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 190                     usin->sin6_scope_id) {
 191                         /* If interface is set while binding, indices
 192                          * must coincide.
 193                          */
 194                         if (!sk_dev_equal_l3scope(sk, usin->sin6_scope_id))
 195                                 return -EINVAL;
 196
 197                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 198                 }
 199
 200                 /* Connect to link-local address requires an interface */
 201                 if (!sk->sk_bound_dev_if)
 202                         return -EINVAL;
 203         }
 204
 205         if (tp->rx_opt.ts_recent_stamp &&
 206             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 207                 tp->rx_opt.ts_recent = 0;
 208                 tp->rx_opt.ts_recent_stamp = 0;
 209                 WRITE_ONCE(tp->write_seq, 0);
 210         }
 211
 212         sk->sk_v6_daddr = usin->sin6_addr;
 213         np->flow_label = fl6.flowlabel;
 214
 215         /*
 216          *      TCP over IPv4
 217          */
 218
 219         if (addr_type & IPV6_ADDR_MAPPED) {
 220                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 221                 struct sockaddr_in sin;
 222
 223                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 224
 225                 if (__ipv6_only_sock(sk))
 226                         return -ENETUNREACH;
 227
 228                 sin.sin_family = AF_INET;
 229                 sin.sin_port = usin->sin6_port;
 230                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 231
 232                 icsk->icsk_af_ops = &ipv6_mapped;
 233                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 234 #ifdef CONFIG_TCP_MD5SIG
 235                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 236 #endif
 237
 238                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 239
 240                 if (err) {
 241                         icsk->icsk_ext_hdr_len = exthdrlen;
 242                         icsk->icsk_af_ops = &ipv6_specific;
 243                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 244 #ifdef CONFIG_TCP_MD5SIG
 245                         tp->af_specific = &tcp_sock_ipv6_specific;
 246 #endif
 247                         goto failure;
 248                 }
 249                 np->saddr = sk->sk_v6_rcv_saddr;
 250
 251                 return err;
 252         }
 253
 254         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 255                 saddr = &sk->sk_v6_rcv_saddr;
 256
 257         fl6.flowi6_proto = IPPROTO_TCP;
 258         fl6.daddr = sk->sk_v6_daddr;
 259         fl6.saddr = saddr ? *saddr : np->saddr;
 260         fl6.flowi6_oif = sk->sk_bound_dev_if;
 261         fl6.flowi6_mark = sk->sk_mark;
 262         fl6.fl6_dport = usin->sin6_port;
 263         fl6.fl6_sport = inet->inet_sport;
 264         fl6.flowi6_uid = sk->sk_uid;
 265
 266         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 267         final_p = fl6_update_dst(&fl6, opt, &final);
 268
 269         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 270
 271         dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
 272         if (IS_ERR(dst)) {
 273                 err = PTR_ERR(dst);
 274                 goto failure;
 275         }
 276
 277         if (!saddr) {
 278                 saddr = &fl6.saddr;
 279                 sk->sk_v6_rcv_saddr = *saddr;
 280         }
 281
 282         /* set the source address */
 283         np->saddr = *saddr;
 284         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 285
 286         sk->sk_gso_type = SKB_GSO_TCPV6;
 287         ip6_dst_store(sk, dst, NULL, NULL);
 288
 289         icsk->icsk_ext_hdr_len = 0;
 290         if (opt)
 291                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 292                                          opt->opt_nflen;
 293
 294         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 295
 296         inet->inet_dport = usin->sin6_port;
 297
 298         tcp_set_state(sk, TCP_SYN_SENT);
 299         err = inet6_hash_connect(tcp_death_row, sk);
 300         if (err)
 301                 goto late_failure;
 302
 303         sk_set_txhash(sk);
 304
 305         if (likely(!tp->repair)) {
 306                 if (!tp->write_seq)
 307                         WRITE_ONCE(tp->write_seq,
 308                                    secure_tcpv6_seq(np->saddr.s6_addr32,
 309                                                     sk->sk_v6_daddr.s6_addr32,
 310                                                     inet->inet_sport,
 311                                                     inet->inet_dport));
 312                 tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
 313                                                    np->saddr.s6_addr32,
 314                                                    sk->sk_v6_daddr.s6_addr32);
 315         }
 316
 317         if (tcp_fastopen_defer_connect(sk, &err))
 318                 return err;
 319         if (err)
 320                 goto late_failure;
 321
 322         err = tcp_connect(sk);
 323         if (err)
 324                 goto late_failure;
 325
 326         return 0;
 327
 328 late_failure:
 329         tcp_set_state(sk, TCP_CLOSE);
 330 failure:
 331         inet->inet_dport = 0;
 332         sk->sk_route_caps = 0;
 333         return err;
 334 }
 335
 336 static void tcp_v6_mtu_reduced(struct sock *sk)
 337 {
 338         struct dst_entry *dst;
 339         u32 mtu;
 340
 341         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 342                 return;
 343
 344         mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
 345
 346         /* Drop requests trying to increase our current mss.
 347          * Check done in __ip6_rt_update_pmtu() is too late.
 348          */
 349         if (tcp_mtu_to_mss(sk, mtu) >= tcp_sk(sk)->mss_cache)
 350                 return;
 351
 352         dst = inet6_csk_update_pmtu(sk, mtu);
 353         if (!dst)
 354                 return;
 355
 356         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 357                 tcp_sync_mss(sk, dst_mtu(dst));
 358                 tcp_simple_retransmit(sk);
 359         }
 360 }
 361
 362 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 363                 u8 type, u8 code, int offset, __be32 info)
 364 {
 365         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 366         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 367         struct net *net = dev_net(skb->dev);
 368         struct request_sock *fastopen;
 369         struct ipv6_pinfo *np;
 370         struct tcp_sock *tp;
 371         __u32 seq, snd_una;
 372         struct sock *sk;
 373         bool fatal;
 374         int err;
 375
 376         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 377                                         &hdr->daddr, th->dest,
 378                                         &hdr->saddr, ntohs(th->source),
 379                                         skb->dev->ifindex, inet6_sdif(skb));
 380
 381         if (!sk) {
 382                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 383                                   ICMP6_MIB_INERRORS);
 384                 return;
 385         }
 386
 387         if (sk->sk_state == TCP_TIME_WAIT) {
 388                 inet_twsk_put(inet_twsk(sk));
 389                 return;
 390         }
 391         seq = ntohl(th->seq);
 392         fatal = icmpv6_err_convert(type, code, &err);
 393         if (sk->sk_state == TCP_NEW_SYN_RECV)
 394                 return tcp_req_err(sk, seq, fatal);
 395
 396         bh_lock_sock(sk);
 397         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 398                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 399
 400         if (sk->sk_state == TCP_CLOSE)
 401                 goto out;
 402
 403         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 404                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 405                 goto out;
 406         }
 407
 408         tp = tcp_sk(sk);
 409         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 410         fastopen = tp->fastopen_rsk;
 411         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 412         if (sk->sk_state != TCP_LISTEN &&
 413             !between(seq, snd_una, tp->snd_nxt)) {
 414                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 415                 goto out;
 416         }
 417
 418         np = inet6_sk(sk);
 419
 420         if (type == NDISC_REDIRECT) {
 421                 if (!sock_owned_by_user(sk)) {
 422                         struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 423
 424                         if (dst)
 425                                 dst->ops->redirect(dst, sk, skb);
 426                 }
 427                 goto out;
 428         }
 429
 430         if (type == ICMPV6_PKT_TOOBIG) {
 431                 u32 mtu = ntohl(info);
 432
 433                 /* We are not interested in TCP_LISTEN and open_requests
 434                  * (SYN-ACKs send out by Linux are always <576bytes so
 435                  * they should go through unfragmented).
 436                  */
 437                 if (sk->sk_state == TCP_LISTEN)
 438                         goto out;
 439
 440                 if (!ip6_sk_accept_pmtu(sk))
 441                         goto out;
 442
 443                 if (mtu < IPV6_MIN_MTU)
 444                         goto out;
 445
 446                 WRITE_ONCE(tp->mtu_info, mtu);
 447
 448                 if (!sock_owned_by_user(sk))
 449                         tcp_v6_mtu_reduced(sk);
 450                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 451                                            &sk->sk_tsq_flags))
 452                         sock_hold(sk);
 453                 goto out;
 454         }
 455
 456
 457         /* Might be for an request_sock */
 458         switch (sk->sk_state) {
 459         case TCP_SYN_SENT:
 460         case TCP_SYN_RECV:
 461                 /* Only in fast or simultaneous open. If a fast open socket is
 462                  * is already accepted it is treated as a connected one below.
 463                  */
 464                 if (fastopen && !fastopen->sk)
 465                         break;
 466
 467                 if (!sock_owned_by_user(sk)) {
 468                         sk->sk_err = err;
 469                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 470
 471                         tcp_done(sk);
 472                 } else
 473                         sk->sk_err_soft = err;
 474                 goto out;
 475         }
 476
 477         if (!sock_owned_by_user(sk) && np->recverr) {
 478                 sk->sk_err = err;
 479                 sk->sk_error_report(sk);
 480         } else
 481                 sk->sk_err_soft = err;
 482
 483 out:
 484         bh_unlock_sock(sk);
 485         sock_put(sk);
 486 }
 487
 488
 489 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 490                               struct flowi *fl,
 491                               struct request_sock *req,
 492                               struct tcp_fastopen_cookie *foc,
 493                               enum tcp_synack_type synack_type)
 494 {
 495         struct inet_request_sock *ireq = inet_rsk(req);
 496         struct ipv6_pinfo *np = inet6_sk(sk);
 497         struct ipv6_txoptions *opt;
 498         struct flowi6 *fl6 = &fl->u.ip6;
 499         struct sk_buff *skb;
 500         int err = -ENOMEM;
 501
 502         /* First, grab a route. */
 503         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 504                                                IPPROTO_TCP)) == NULL)
 505                 goto done;
 506
 507         skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 508
 509         if (skb) {
 510                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 511                                     &ireq->ir_v6_rmt_addr);
 512
 513                 fl6->daddr = ireq->ir_v6_rmt_addr;
 514                 if (np->repflow && ireq->pktopts)
 515                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 516
 517                 rcu_read_lock();
 518                 opt = ireq->ipv6_opt;
 519                 if (!opt)
 520                         opt = rcu_dereference(np->opt);
 521                 err = ip6_xmit(sk, skb, fl6, skb->mark ? : sk->sk_mark, opt,
 522                                np->tclass);
 523                 rcu_read_unlock();
 524                 err = net_xmit_eval(err);
 525         }
 526
 527 done:
 528         return err;
 529 }
 530
 531
 532 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 533 {
 534         kfree(inet_rsk(req)->ipv6_opt);
 535         kfree_skb(inet_rsk(req)->pktopts);
 536 }
 537
 538 #ifdef CONFIG_TCP_MD5SIG
 539 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 540                                                    const struct in6_addr *addr)
 541 {
 542         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 543 }
 544
 545 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 546                                                 const struct sock *addr_sk)
 547 {
 548         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 549 }
 550
 551 static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
 552                                  char __user *optval, int optlen)
 553 {
 554         struct tcp_md5sig cmd;
 555         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 556         u8 prefixlen;
 557
 558         if (optlen < sizeof(cmd))
 559                 return -EINVAL;
 560
 561         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 562                 return -EFAULT;
 563
 564         if (sin6->sin6_family != AF_INET6)
 565                 return -EINVAL;
 566
 567         if (optname == TCP_MD5SIG_EXT &&
 568             cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
 569                 prefixlen = cmd.tcpm_prefixlen;
 570                 if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
 571                                         prefixlen > 32))
 572                         return -EINVAL;
 573         } else {
 574                 prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
 575         }
 576
 577         if (!cmd.tcpm_keylen) {
 578                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 579                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 580                                               AF_INET, prefixlen);
 581                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 582                                       AF_INET6, prefixlen);
 583         }
 584
 585         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 586                 return -EINVAL;
 587
 588         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 589                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 590                                       AF_INET, prefixlen, cmd.tcpm_key,
 591                                       cmd.tcpm_keylen, GFP_KERNEL);
 592
 593         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 594                               AF_INET6, prefixlen, cmd.tcpm_key,
 595                               cmd.tcpm_keylen, GFP_KERNEL);
 596 }
 597
 598 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 599                                    const struct in6_addr *daddr,
 600                                    const struct in6_addr *saddr,
 601                                    const struct tcphdr *th, int nbytes)
 602 {
 603         struct tcp6_pseudohdr *bp;
 604         struct scatterlist sg;
 605         struct tcphdr *_th;
 606
 607         bp = hp->scratch;
 608         /* 1. TCP pseudo-header (RFC2460) */
 609         bp->saddr = *saddr;
 610         bp->daddr = *daddr;
 611         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 612         bp->len = cpu_to_be32(nbytes);
 613
 614         _th = (struct tcphdr *)(bp + 1);
 615         memcpy(_th, th, sizeof(*th));
 616         _th->check = 0;
 617
 618         sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 619         ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 620                                 sizeof(*bp) + sizeof(*th));
 621         return crypto_ahash_update(hp->md5_req);
 622 }
 623
 624 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 625                                const struct in6_addr *daddr, struct in6_addr *saddr,
 626                                const struct tcphdr *th)
 627 {
 628         struct tcp_md5sig_pool *hp;
 629         struct ahash_request *req;
 630
 631         hp = tcp_get_md5sig_pool();
 632         if (!hp)
 633                 goto clear_hash_noput;
 634         req = hp->md5_req;
 635
 636         if (crypto_ahash_init(req))
 637                 goto clear_hash;
 638         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 639                 goto clear_hash;
 640         if (tcp_md5_hash_key(hp, key))
 641                 goto clear_hash;
 642         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 643         if (crypto_ahash_final(req))
 644                 goto clear_hash;
 645
 646         tcp_put_md5sig_pool();
 647         return 0;
 648
 649 clear_hash:
 650         tcp_put_md5sig_pool();
 651 clear_hash_noput:
 652         memset(md5_hash, 0, 16);
 653         return 1;
 654 }
 655
 656 static int tcp_v6_md5_hash_skb(char *md5_hash,
 657                                const struct tcp_md5sig_key *key,
 658                                const struct sock *sk,
 659                                const struct sk_buff *skb)
 660 {
 661         const struct in6_addr *saddr, *daddr;
 662         struct tcp_md5sig_pool *hp;
 663         struct ahash_request *req;
 664         const struct tcphdr *th = tcp_hdr(skb);
 665
 666         if (sk) { /* valid for establish/request sockets */
 667                 saddr = &sk->sk_v6_rcv_saddr;
 668                 daddr = &sk->sk_v6_daddr;
 669         } else {
 670                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 671                 saddr = &ip6h->saddr;
 672                 daddr = &ip6h->daddr;
 673         }
 674
 675         hp = tcp_get_md5sig_pool();
 676         if (!hp)
 677                 goto clear_hash_noput;
 678         req = hp->md5_req;
 679
 680         if (crypto_ahash_init(req))
 681                 goto clear_hash;
 682
 683         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 684                 goto clear_hash;
 685         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 686                 goto clear_hash;
 687         if (tcp_md5_hash_key(hp, key))
 688                 goto clear_hash;
 689         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 690         if (crypto_ahash_final(req))
 691                 goto clear_hash;
 692
 693         tcp_put_md5sig_pool();
 694         return 0;
 695
 696 clear_hash:
 697         tcp_put_md5sig_pool();
 698 clear_hash_noput:
 699         memset(md5_hash, 0, 16);
 700         return 1;
 701 }
 702
 703 #endif
 704
 705 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 706                                     const struct sk_buff *skb)
 707 {
 708 #ifdef CONFIG_TCP_MD5SIG
 709         const __u8 *hash_location = NULL;
 710         struct tcp_md5sig_key *hash_expected;
 711         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 712         const struct tcphdr *th = tcp_hdr(skb);
 713         int genhash;
 714         u8 newhash[16];
 715
 716         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 717         hash_location = tcp_parse_md5sig_option(th);
 718
 719         /* We've parsed the options - do we have a hash? */
 720         if (!hash_expected && !hash_location)
 721                 return false;
 722
 723         if (hash_expected && !hash_location) {
 724                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 725                 return true;
 726         }
 727
 728         if (!hash_expected && hash_location) {
 729                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 730                 return true;
 731         }
 732
 733         /* check the signature */
 734         genhash = tcp_v6_md5_hash_skb(newhash,
 735                                       hash_expected,
 736                                       NULL, skb);
 737
 738         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 739                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 740                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 741                                      genhash ? "failed" : "mismatch",
 742                                      &ip6h->saddr, ntohs(th->source),
 743                                      &ip6h->daddr, ntohs(th->dest));
 744                 return true;
 745         }
 746 #endif
 747         return false;
 748 }
 749
 750 static void tcp_v6_init_req(struct request_sock *req,
 751                             const struct sock *sk_listener,
 752                             struct sk_buff *skb)
 753 {
 754         struct inet_request_sock *ireq = inet_rsk(req);
 755         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 756
 757         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 758         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 759
 760         /* So that link locals have meaning */
 761         if (!sk_listener->sk_bound_dev_if &&
 762             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 763                 ireq->ir_iif = tcp_v6_iif(skb);
 764
 765         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 766             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 767              np->rxopt.bits.rxinfo ||
 768              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 769              np->rxopt.bits.rxohlim || np->repflow)) {
 770                 refcount_inc(&skb->users);
 771                 ireq->pktopts = skb;
 772         }
 773 }
 774
 775 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 776                                           struct flowi *fl,
 777                                           const struct request_sock *req)
 778 {
 779         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 780 }
 781
 782 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 783         .family         =       AF_INET6,
 784         .obj_size       =       sizeof(struct tcp6_request_sock),
 785         .rtx_syn_ack    =       tcp_rtx_synack,
 786         .send_ack       =       tcp_v6_reqsk_send_ack,
 787         .destructor     =       tcp_v6_reqsk_destructor,
 788         .send_reset     =       tcp_v6_send_reset,
 789         .syn_ack_timeout =      tcp_syn_ack_timeout,
 790 };
 791
 792 const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 793         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 794                                 sizeof(struct ipv6hdr),
 795 #ifdef CONFIG_TCP_MD5SIG
 796         .req_md5_lookup =       tcp_v6_md5_lookup,
 797         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 798 #endif
 799         .init_req       =       tcp_v6_init_req,
 800 #ifdef CONFIG_SYN_COOKIES
 801         .cookie_init_seq =      cookie_v6_init_sequence,
 802 #endif
 803         .route_req      =       tcp_v6_route_req,
 804         .init_seq       =       tcp_v6_init_seq,
 805         .init_ts_off    =       tcp_v6_init_ts_off,
 806         .send_synack    =       tcp_v6_send_synack,
 807 };
 808
 809 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 810                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 811                                  int oif, struct tcp_md5sig_key *key, int rst,
 812                                  u8 tclass, __be32 label)
 813 {
 814         const struct tcphdr *th = tcp_hdr(skb);
 815         struct tcphdr *t1;
 816         struct sk_buff *buff;
 817         struct flowi6 fl6;
 818         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 819         struct sock *ctl_sk = net->ipv6.tcp_sk;
 820         unsigned int tot_len = sizeof(struct tcphdr);
 821         struct dst_entry *dst;
 822         __be32 *topt;
 823         __u32 mark = 0;
 824
 825         if (tsecr)
 826                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 827 #ifdef CONFIG_TCP_MD5SIG
 828         if (key)
 829                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 830 #endif
 831
 832         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 833                          GFP_ATOMIC);
 834         if (!buff)
 835                 return;
 836
 837         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 838
 839         t1 = skb_push(buff, tot_len);
 840         skb_reset_transport_header(buff);
 841
 842         /* Swap the send and the receive. */
 843         memset(t1, 0, sizeof(*t1));
 844         t1->dest = th->source;
 845         t1->source = th->dest;
 846         t1->doff = tot_len / 4;
 847         t1->seq = htonl(seq);
 848         t1->ack_seq = htonl(ack);
 849         t1->ack = !rst || !th->ack;
 850         t1->rst = rst;
 851         t1->window = htons(win);
 852
 853         topt = (__be32 *)(t1 + 1);
 854
 855         if (tsecr) {
 856                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 857                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 858                 *topt++ = htonl(tsval);
 859                 *topt++ = htonl(tsecr);
 860         }
 861
 862 #ifdef CONFIG_TCP_MD5SIG
 863         if (key) {
 864                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 865                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 866                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 867                                     &ipv6_hdr(skb)->saddr,
 868                                     &ipv6_hdr(skb)->daddr, t1);
 869         }
 870 #endif
 871
 872         memset(&fl6, 0, sizeof(fl6));
 873         fl6.daddr = ipv6_hdr(skb)->saddr;
 874         fl6.saddr = ipv6_hdr(skb)->daddr;
 875         fl6.flowlabel = label;
 876
 877         buff->ip_summed = CHECKSUM_PARTIAL;
 878         buff->csum = 0;
 879
 880         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 881
 882         fl6.flowi6_proto = IPPROTO_TCP;
 883         if (rt6_need_strict(&fl6.daddr) && !oif)
 884                 fl6.flowi6_oif = tcp_v6_iif(skb);
 885         else {
 886                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 887                         oif = skb->skb_iif;
 888
 889                 fl6.flowi6_oif = oif;
 890         }
 891
 892         if (sk)
 893                 mark = (sk->sk_state == TCP_TIME_WAIT) ?
 894                         inet_twsk(sk)->tw_mark : sk->sk_mark;
 895         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark) ?: mark;
 896         fl6.fl6_dport = t1->dest;
 897         fl6.fl6_sport = t1->source;
 898         fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 899         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 900
 901         /* Pass a socket to ip6_dst_lookup either it is for RST
 902          * Underlying function will use this to retrieve the network
 903          * namespace
 904          */
 905         dst = ip6_dst_lookup_flow(sock_net(ctl_sk), ctl_sk, &fl6, NULL);
 906         if (!IS_ERR(dst)) {
 907                 skb_dst_set(buff, dst);
 908                 ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
 909                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 910                 if (rst)
 911                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 912                 return;
 913         }
 914
 915         kfree_skb(buff);
 916 }
 917
 918 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 919 {
 920         const struct tcphdr *th = tcp_hdr(skb);
 921         u32 seq = 0, ack_seq = 0;
 922         struct tcp_md5sig_key *key = NULL;
 923 #ifdef CONFIG_TCP_MD5SIG
 924         const __u8 *hash_location = NULL;
 925         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 926         unsigned char newhash[16];
 927         int genhash;
 928         struct sock *sk1 = NULL;
 929 #endif
 930         int oif = 0;
 931
 932         if (th->rst)
 933                 return;
 934
 935         /* If sk not NULL, it means we did a successful lookup and incoming
 936          * route had to be correct. prequeue might have dropped our dst.
 937          */
 938         if (!sk && !ipv6_unicast_destination(skb))
 939                 return;
 940
 941 #ifdef CONFIG_TCP_MD5SIG
 942         rcu_read_lock();
 943         hash_location = tcp_parse_md5sig_option(th);
 944         if (sk && sk_fullsock(sk)) {
 945                 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 946         } else if (hash_location) {
 947                 /*
 948                  * active side is lost. Try to find listening socket through
 949                  * source port, and then find md5 key through listening socket.
 950                  * we are not loose security here:
 951                  * Incoming packet is checked with md5 hash with finding key,
 952                  * no RST generated if md5 hash doesn't match.
 953                  */
 954                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 955                                            &tcp_hashinfo, NULL, 0,
 956                                            &ipv6h->saddr,
 957                                            th->source, &ipv6h->daddr,
 958                                            ntohs(th->source),
 959                                            tcp_v6_iif_l3_slave(skb),
 960                                            tcp_v6_sdif(skb));
 961                 if (!sk1)
 962                         goto out;
 963
 964                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 965                 if (!key)
 966                         goto out;
 967
 968                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 969                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 970                         goto out;
 971         }
 972 #endif
 973
 974         if (th->ack)
 975                 seq = ntohl(th->ack_seq);
 976         else
 977                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 978                           (th->doff << 2);
 979
 980         if (sk) {
 981                 oif = sk->sk_bound_dev_if;
 982                 if (sk_fullsock(sk))
 983                         trace_tcp_send_reset(sk, skb);
 984         }
 985
 986         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 987
 988 #ifdef CONFIG_TCP_MD5SIG
 989 out:
 990         rcu_read_unlock();
 991 #endif
 992 }
 993
 994 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 995                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 996                             struct tcp_md5sig_key *key, u8 tclass,
 997                             __be32 label)
 998 {
 999         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
1000                              tclass, label);
1001 }
1002
1003 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1004 {
1005         struct inet_timewait_sock *tw = inet_twsk(sk);
1006         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1007
1008         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1009                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1010                         tcp_time_stamp_raw() + tcptw->tw_ts_offset,
1011                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
1012                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
1013
1014         inet_twsk_put(tw);
1015 }
1016
1017 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
1018                                   struct request_sock *req)
1019 {
1020         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
1021          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
1022          */
1023         /* RFC 7323 2.3
1024          * The window field (SEG.WND) of every outgoing segment, with the
1025          * exception of <SYN> segments, MUST be right-shifted by
1026          * Rcv.Wind.Shift bits:
1027          */
1028         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
1029                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
1030                         tcp_rsk(req)->rcv_nxt,
1031                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1032                         tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1033                         req->ts_recent, sk->sk_bound_dev_if,
1034                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
1035                         0, 0);
1036 }
1037
1038
1039 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
1040 {
1041 #ifdef CONFIG_SYN_COOKIES
1042         const struct tcphdr *th = tcp_hdr(skb);
1043
1044         if (!th->syn)
1045                 sk = cookie_v6_check(sk, skb);
1046 #endif
1047         return sk;
1048 }
1049
1050 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1051 {
1052         if (skb->protocol == htons(ETH_P_IP))
1053                 return tcp_v4_conn_request(sk, skb);
1054
1055         if (!ipv6_unicast_destination(skb))
1056                 goto drop;
1057
1058         if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
1059                 __IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
1060                 return 0;
1061         }
1062
1063         return tcp_conn_request(&tcp6_request_sock_ops,
1064                                 &tcp_request_sock_ipv6_ops, sk, skb);
1065
1066 drop:
1067         tcp_listendrop(sk);
1068         return 0; /* don't send reset */
1069 }
1070
1071 static void tcp_v6_restore_cb(struct sk_buff *skb)
1072 {
1073         /* We need to move header back to the beginning if xfrm6_policy_check()
1074          * and tcp_v6_fill_cb() are going to be called again.
1075          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1076          */
1077         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1078                 sizeof(struct inet6_skb_parm));
1079 }
1080
1081 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1082                                          struct request_sock *req,
1083                                          struct dst_entry *dst,
1084                                          struct request_sock *req_unhash,
1085                                          bool *own_req)
1086 {
1087         struct inet_request_sock *ireq;
1088         struct ipv6_pinfo *newnp;
1089         const struct ipv6_pinfo *np = inet6_sk(sk);
1090         struct ipv6_txoptions *opt;
1091         struct tcp6_sock *newtcp6sk;
1092         struct inet_sock *newinet;
1093         bool found_dup_sk = false;
1094         struct tcp_sock *newtp;
1095         struct sock *newsk;
1096 #ifdef CONFIG_TCP_MD5SIG
1097         struct tcp_md5sig_key *key;
1098 #endif
1099         struct flowi6 fl6;
1100
1101         if (skb->protocol == htons(ETH_P_IP)) {
1102                 /*
1103                  *      v6 mapped
1104                  */
1105
1106                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1107                                              req_unhash, own_req);
1108
1109                 if (!newsk)
1110                         return NULL;
1111
1112                 newtcp6sk = (struct tcp6_sock *)newsk;
1113                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1114
1115                 newinet = inet_sk(newsk);
1116                 newnp = inet6_sk(newsk);
1117                 newtp = tcp_sk(newsk);
1118
1119                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1120
1121                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1122
1123                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1124                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1125 #ifdef CONFIG_TCP_MD5SIG
1126                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1127 #endif
1128
1129                 newnp->ipv6_mc_list = NULL;
1130                 newnp->ipv6_ac_list = NULL;
1131                 newnp->ipv6_fl_list = NULL;
1132                 newnp->pktoptions  = NULL;
1133                 newnp->opt         = NULL;
1134                 newnp->mcast_oif   = inet_iif(skb);
1135                 newnp->mcast_hops  = ip_hdr(skb)->ttl;
1136                 newnp->rcv_flowinfo = 0;
1137                 if (np->repflow)
1138                         newnp->flow_label = 0;
1139
1140                 /*
1141                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1142                  * here, tcp_create_openreq_child now does this for us, see the comment in
1143                  * that function for the gory details. -acme
1144                  */
1145
1146                 /* It is tricky place. Until this moment IPv4 tcp
1147                    worked with IPv6 icsk.icsk_af_ops.
1148                    Sync it now.
1149                  */
1150                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1151
1152                 return newsk;
1153         }
1154
1155         ireq = inet_rsk(req);
1156
1157         if (sk_acceptq_is_full(sk))
1158                 goto out_overflow;
1159
1160         if (!dst) {
1161                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1162                 if (!dst)
1163                         goto out;
1164         }
1165
1166         newsk = tcp_create_openreq_child(sk, req, skb);
1167         if (!newsk)
1168                 goto out_nonewsk;
1169
1170         /*
1171          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1172          * count here, tcp_create_openreq_child now does this for us, see the
1173          * comment in that function for the gory details. -acme
1174          */
1175
1176         newsk->sk_gso_type = SKB_GSO_TCPV6;
1177         ip6_dst_store(newsk, dst, NULL, NULL);
1178         inet6_sk_rx_dst_set(newsk, skb);
1179
1180         newtcp6sk = (struct tcp6_sock *)newsk;
1181         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1182
1183         newtp = tcp_sk(newsk);
1184         newinet = inet_sk(newsk);
1185         newnp = inet6_sk(newsk);
1186
1187         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1188
1189         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1190         newnp->saddr = ireq->ir_v6_loc_addr;
1191         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1192         newsk->sk_bound_dev_if = ireq->ir_iif;
1193
1194         /* Now IPv6 options...
1195
1196            First: no IPv4 options.
1197          */
1198         newinet->inet_opt = NULL;
1199         newnp->ipv6_mc_list = NULL;
1200         newnp->ipv6_ac_list = NULL;
1201         newnp->ipv6_fl_list = NULL;
1202
1203         /* Clone RX bits */
1204         newnp->rxopt.all = np->rxopt.all;
1205
1206         newnp->pktoptions = NULL;
1207         newnp->opt        = NULL;
1208         newnp->mcast_oif  = tcp_v6_iif(skb);
1209         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1210         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1211         if (np->repflow)
1212                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1213
1214         /* Clone native IPv6 options from listening socket (if any)
1215
1216            Yes, keeping reference count would be much more clever,
1217            but we make one more one thing there: reattach optmem
1218            to newsk.
1219          */
1220         opt = ireq->ipv6_opt;
1221         if (!opt)
1222                 opt = rcu_dereference(np->opt);
1223         if (opt) {
1224                 opt = ipv6_dup_options(newsk, opt);
1225                 RCU_INIT_POINTER(newnp->opt, opt);
1226         }
1227         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1228         if (opt)
1229                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1230                                                     opt->opt_flen;
1231
1232         tcp_ca_openreq_child(newsk, dst);
1233
1234         tcp_sync_mss(newsk, dst_mtu(dst));
1235         newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
1236
1237         tcp_initialize_rcv_mss(newsk);
1238
1239         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1240         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1241
1242 #ifdef CONFIG_TCP_MD5SIG
1243         /* Copy over the MD5 key from the original socket */
1244         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1245         if (key) {
1246                 /* We're using one, so create a matching key
1247                  * on the newsk structure. If we fail to get
1248                  * memory, then we end up not copying the key
1249                  * across. Shucks.
1250                  */
1251                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1252                                AF_INET6, 128, key->key, key->keylen,
1253                                sk_gfp_mask(sk, GFP_ATOMIC));
1254         }
1255 #endif
1256
1257         if (__inet_inherit_port(sk, newsk) < 0) {
1258                 inet_csk_prepare_forced_close(newsk);
1259                 tcp_done(newsk);
1260                 goto out;
1261         }
1262         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash),
1263                                        &found_dup_sk);
1264         if (*own_req) {
1265                 tcp_move_syn(newtp, req);
1266
1267                 /* Clone pktoptions received with SYN, if we own the req */
1268                 if (ireq->pktopts) {
1269                         newnp->pktoptions = skb_clone(ireq->pktopts,
1270                                                       sk_gfp_mask(sk, GFP_ATOMIC));
1271                         consume_skb(ireq->pktopts);
1272                         ireq->pktopts = NULL;
1273                         if (newnp->pktoptions) {
1274                                 tcp_v6_restore_cb(newnp->pktoptions);
1275                                 skb_set_owner_r(newnp->pktoptions, newsk);
1276                         }
1277                 }
1278         } else {
1279                 if (!req_unhash && found_dup_sk) {
1280                         /* This code path should only be executed in the
1281                          * syncookie case only
1282                          */
1283                         bh_unlock_sock(newsk);
1284                         sock_put(newsk);
1285                         newsk = NULL;
1286                 }
1287         }
1288
1289         return newsk;
1290
1291 out_overflow:
1292         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1293 out_nonewsk:
1294         dst_release(dst);
1295 out:
1296         tcp_listendrop(sk);
1297         return NULL;
1298 }
1299
1300 /* The socket must have it's spinlock held when we get
1301  * here, unless it is a TCP_LISTEN socket.
1302  *
1303  * We have a potential double-lock case here, so even when
1304  * doing backlog processing we use the BH locking scheme.
1305  * This is because we cannot sleep with the original spinlock
1306  * held.
1307  */
1308 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1309 {
1310         struct ipv6_pinfo *np = inet6_sk(sk);
1311         struct tcp_sock *tp;
1312         struct sk_buff *opt_skb = NULL;
1313
1314         /* Imagine: socket is IPv6. IPv4 packet arrives,
1315            goes to IPv4 receive handler and backlogged.
1316            From backlog it always goes here. Kerboom...
1317            Fortunately, tcp_rcv_established and rcv_established
1318            handle them correctly, but it is not case with
1319            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1320          */
1321
1322         if (skb->protocol == htons(ETH_P_IP))
1323                 return tcp_v4_do_rcv(sk, skb);
1324
1325         /*
1326          *      socket locking is here for SMP purposes as backlog rcv
1327          *      is currently called with bh processing disabled.
1328          */
1329
1330         /* Do Stevens' IPV6_PKTOPTIONS.
1331
1332            Yes, guys, it is the only place in our code, where we
1333            may make it not affecting IPv4.
1334            The rest of code is protocol independent,
1335            and I do not like idea to uglify IPv4.
1336
1337            Actually, all the idea behind IPV6_PKTOPTIONS
1338            looks not very well thought. For now we latch
1339            options, received in the last packet, enqueued
1340            by tcp. Feel free to propose better solution.
1341                                                --ANK (980728)
1342          */
1343         if (np->rxopt.all)
1344                 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1345
1346         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1347                 struct dst_entry *dst;
1348
1349                 dst = rcu_dereference_protected(sk->sk_rx_dst,
1350                                                 lockdep_sock_is_held(sk));
1351
1352                 sock_rps_save_rxhash(sk, skb);
1353                 sk_mark_napi_id(sk, skb);
1354                 if (dst) {
1355                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1356                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1357                                 RCU_INIT_POINTER(sk->sk_rx_dst, NULL);
1358                                 dst_release(dst);
1359                         }
1360                 }
1361
1362                 tcp_rcv_established(sk, skb);
1363                 if (opt_skb)
1364                         goto ipv6_pktoptions;
1365                 return 0;
1366         }
1367
1368         if (tcp_checksum_complete(skb))
1369                 goto csum_err;
1370
1371         if (sk->sk_state == TCP_LISTEN) {
1372                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1373
1374                 if (!nsk)
1375                         goto discard;
1376
1377                 if (nsk != sk) {
1378                         if (tcp_child_process(sk, nsk, skb))
1379                                 goto reset;
1380                         if (opt_skb)
1381                                 __kfree_skb(opt_skb);
1382                         return 0;
1383                 }
1384         } else
1385                 sock_rps_save_rxhash(sk, skb);
1386
1387         if (tcp_rcv_state_process(sk, skb))
1388                 goto reset;
1389         if (opt_skb)
1390                 goto ipv6_pktoptions;
1391         return 0;
1392
1393 reset:
1394         tcp_v6_send_reset(sk, skb);
1395 discard:
1396         if (opt_skb)
1397                 __kfree_skb(opt_skb);
1398         kfree_skb(skb);
1399         return 0;
1400 csum_err:
1401         TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1402         TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1403         goto discard;
1404
1405
1406 ipv6_pktoptions:
1407         /* Do you ask, what is it?
1408
1409            1. skb was enqueued by tcp.
1410            2. skb is added to tail of read queue, rather than out of order.
1411            3. socket is not in passive state.
1412            4. Finally, it really contains options, which user wants to receive.
1413          */
1414         tp = tcp_sk(sk);
1415         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1416             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1417                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1418                         np->mcast_oif = tcp_v6_iif(opt_skb);
1419                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1420                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1421                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1422                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1423                 if (np->repflow)
1424                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1425                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1426                         skb_set_owner_r(opt_skb, sk);
1427                         tcp_v6_restore_cb(opt_skb);
1428                         opt_skb = xchg(&np->pktoptions, opt_skb);
1429                 } else {
1430                         __kfree_skb(opt_skb);
1431                         opt_skb = xchg(&np->pktoptions, NULL);
1432                 }
1433         }
1434
1435         kfree_skb(opt_skb);
1436         return 0;
1437 }
1438
1439 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1440                            const struct tcphdr *th)
1441 {
1442         /* This is tricky: we move IP6CB at its correct location into
1443          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1444          * _decode_session6() uses IP6CB().
1445          * barrier() makes sure compiler won't play aliasing games.
1446          */
1447         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1448                 sizeof(struct inet6_skb_parm));
1449         barrier();
1450
1451         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1452         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1453                                     skb->len - th->doff*4);
1454         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1455         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1456         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1457         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1458         TCP_SKB_CB(skb)->sacked = 0;
1459         TCP_SKB_CB(skb)->has_rxtstamp =
1460                         skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
1461 }
1462
1463 static int tcp_v6_rcv(struct sk_buff *skb)
1464 {
1465         int sdif = inet6_sdif(skb);
1466         const struct tcphdr *th;
1467         const struct ipv6hdr *hdr;
1468         bool refcounted;
1469         struct sock *sk;
1470         int ret;
1471         struct net *net = dev_net(skb->dev);
1472
1473         if (skb->pkt_type != PACKET_HOST)
1474                 goto discard_it;
1475
1476         /*
1477          *      Count it even if it's bad.
1478          */
1479         __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1480
1481         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1482                 goto discard_it;
1483
1484         th = (const struct tcphdr *)skb->data;
1485
1486         if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1487                 goto bad_packet;
1488         if (!pskb_may_pull(skb, th->doff*4))
1489                 goto discard_it;
1490
1491         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1492                 goto csum_error;
1493
1494         th = (const struct tcphdr *)skb->data;
1495         hdr = ipv6_hdr(skb);
1496
1497 lookup:
1498         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1499                                 th->source, th->dest, inet6_iif(skb), sdif,
1500                                 &refcounted);
1501         if (!sk)
1502                 goto no_tcp_socket;
1503
1504 process:
1505         if (sk->sk_state == TCP_TIME_WAIT)
1506                 goto do_time_wait;
1507
1508         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1509                 struct request_sock *req = inet_reqsk(sk);
1510                 bool req_stolen = false;
1511                 struct sock *nsk;
1512
1513                 sk = req->rsk_listener;
1514                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1515                         sk_drops_add(sk, skb);
1516                         reqsk_put(req);
1517                         goto discard_it;
1518                 }
1519                 if (tcp_checksum_complete(skb)) {
1520                         reqsk_put(req);
1521                         goto csum_error;
1522                 }
1523                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1524                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1525                         goto lookup;
1526                 }
1527                 sock_hold(sk);
1528                 refcounted = true;
1529                 nsk = NULL;
1530                 if (!tcp_filter(sk, skb)) {
1531                         th = (const struct tcphdr *)skb->data;
1532                         hdr = ipv6_hdr(skb);
1533                         tcp_v6_fill_cb(skb, hdr, th);
1534                         nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
1535                 }
1536                 if (!nsk) {
1537                         reqsk_put(req);
1538                         if (req_stolen) {
1539                                 /* Another cpu got exclusive access to req
1540                                  * and created a full blown socket.
1541                                  * Try to feed this packet to this socket
1542                                  * instead of discarding it.
1543                                  */
1544                                 tcp_v6_restore_cb(skb);
1545                                 sock_put(sk);
1546                                 goto lookup;
1547                         }
1548                         goto discard_and_relse;
1549                 }
1550                 if (nsk == sk) {
1551                         reqsk_put(req);
1552                         tcp_v6_restore_cb(skb);
1553                 } else if (tcp_child_process(sk, nsk, skb)) {
1554                         tcp_v6_send_reset(nsk, skb);
1555                         goto discard_and_relse;
1556                 } else {
1557                         sock_put(sk);
1558                         return 0;
1559                 }
1560         }
1561         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1562                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1563                 goto discard_and_relse;
1564         }
1565
1566         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1567                 goto discard_and_relse;
1568
1569         if (tcp_v6_inbound_md5_hash(sk, skb))
1570                 goto discard_and_relse;
1571
1572         if (tcp_filter(sk, skb))
1573                 goto discard_and_relse;
1574         th = (const struct tcphdr *)skb->data;
1575         hdr = ipv6_hdr(skb);
1576         tcp_v6_fill_cb(skb, hdr, th);
1577
1578         skb->dev = NULL;
1579
1580         if (sk->sk_state == TCP_LISTEN) {
1581                 ret = tcp_v6_do_rcv(sk, skb);
1582                 goto put_and_return;
1583         }
1584
1585         sk_incoming_cpu_update(sk);
1586
1587         bh_lock_sock_nested(sk);
1588         tcp_segs_in(tcp_sk(sk), skb);
1589         ret = 0;
1590         if (!sock_owned_by_user(sk)) {
1591                 ret = tcp_v6_do_rcv(sk, skb);
1592         } else if (tcp_add_backlog(sk, skb)) {
1593                 goto discard_and_relse;
1594         }
1595         bh_unlock_sock(sk);
1596
1597 put_and_return:
1598         if (refcounted)
1599                 sock_put(sk);
1600         return ret ? -1 : 0;
1601
1602 no_tcp_socket:
1603         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1604                 goto discard_it;
1605
1606         tcp_v6_fill_cb(skb, hdr, th);
1607
1608         if (tcp_checksum_complete(skb)) {
1609 csum_error:
1610                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1611 bad_packet:
1612                 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1613         } else {
1614                 tcp_v6_send_reset(NULL, skb);
1615         }
1616
1617 discard_it:
1618         kfree_skb(skb);
1619         return 0;
1620
1621 discard_and_relse:
1622         sk_drops_add(sk, skb);
1623         if (refcounted)
1624                 sock_put(sk);
1625         goto discard_it;
1626
1627 do_time_wait:
1628         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1629                 inet_twsk_put(inet_twsk(sk));
1630                 goto discard_it;
1631         }
1632
1633         tcp_v6_fill_cb(skb, hdr, th);
1634
1635         if (tcp_checksum_complete(skb)) {
1636                 inet_twsk_put(inet_twsk(sk));
1637                 goto csum_error;
1638         }
1639
1640         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1641         case TCP_TW_SYN:
1642         {
1643                 struct sock *sk2;
1644
1645                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1646                                             skb, __tcp_hdrlen(th),
1647                                             &ipv6_hdr(skb)->saddr, th->source,
1648                                             &ipv6_hdr(skb)->daddr,
1649                                             ntohs(th->dest),
1650                                             tcp_v6_iif_l3_slave(skb),
1651                                             sdif);
1652                 if (sk2) {
1653                         struct inet_timewait_sock *tw = inet_twsk(sk);
1654                         inet_twsk_deschedule_put(tw);
1655                         sk = sk2;
1656                         tcp_v6_restore_cb(skb);
1657                         refcounted = false;
1658                         goto process;
1659                 }
1660         }
1661                 /* to ACK */
1662                 /* fall through */
1663         case TCP_TW_ACK:
1664                 tcp_v6_timewait_ack(sk, skb);
1665                 break;
1666         case TCP_TW_RST:
1667                 tcp_v6_send_reset(sk, skb);
1668                 inet_twsk_deschedule_put(inet_twsk(sk));
1669                 goto discard_it;
1670         case TCP_TW_SUCCESS:
1671                 ;
1672         }
1673         goto discard_it;
1674 }
1675
1676 static void tcp_v6_early_demux(struct sk_buff *skb)
1677 {
1678         const struct ipv6hdr *hdr;
1679         const struct tcphdr *th;
1680         struct sock *sk;
1681
1682         if (skb->pkt_type != PACKET_HOST)
1683                 return;
1684
1685         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1686                 return;
1687
1688         hdr = ipv6_hdr(skb);
1689         th = tcp_hdr(skb);
1690
1691         if (th->doff < sizeof(struct tcphdr) / 4)
1692                 return;
1693
1694         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1695         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1696                                         &hdr->saddr, th->source,
1697                                         &hdr->daddr, ntohs(th->dest),
1698                                         inet6_iif(skb), inet6_sdif(skb));
1699         if (sk) {
1700                 skb->sk = sk;
1701                 skb->destructor = sock_edemux;
1702                 if (sk_fullsock(sk)) {
1703                         struct dst_entry *dst = rcu_dereference(sk->sk_rx_dst);
1704
1705                         if (dst)
1706                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1707                         if (dst &&
1708                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1709                                 skb_dst_set_noref(skb, dst);
1710                 }
1711         }
1712 }
1713
1714 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1715         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1716         .twsk_unique    = tcp_twsk_unique,
1717         .twsk_destructor = tcp_twsk_destructor,
1718 };
1719
1720 static const struct inet_connection_sock_af_ops ipv6_specific = {
1721         .queue_xmit        = inet6_csk_xmit,
1722         .send_check        = tcp_v6_send_check,
1723         .rebuild_header    = inet6_sk_rebuild_header,
1724         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1725         .conn_request      = tcp_v6_conn_request,
1726         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1727         .net_header_len    = sizeof(struct ipv6hdr),
1728         .net_frag_header_len = sizeof(struct frag_hdr),
1729         .setsockopt        = ipv6_setsockopt,
1730         .getsockopt        = ipv6_getsockopt,
1731         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1732         .sockaddr_len      = sizeof(struct sockaddr_in6),
1733 #ifdef CONFIG_COMPAT
1734         .compat_setsockopt = compat_ipv6_setsockopt,
1735         .compat_getsockopt = compat_ipv6_getsockopt,
1736 #endif
1737         .mtu_reduced       = tcp_v6_mtu_reduced,
1738 };
1739
1740 #ifdef CONFIG_TCP_MD5SIG
1741 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1742         .md5_lookup     =       tcp_v6_md5_lookup,
1743         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1744         .md5_parse      =       tcp_v6_parse_md5_keys,
1745 };
1746 #endif
1747
1748 /*
1749  *      TCP over IPv4 via INET6 API
1750  */
1751 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1752         .queue_xmit        = ip_queue_xmit,
1753         .send_check        = tcp_v4_send_check,
1754         .rebuild_header    = inet_sk_rebuild_header,
1755         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1756         .conn_request      = tcp_v6_conn_request,
1757         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1758         .net_header_len    = sizeof(struct iphdr),
1759         .setsockopt        = ipv6_setsockopt,
1760         .getsockopt        = ipv6_getsockopt,
1761         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1762         .sockaddr_len      = sizeof(struct sockaddr_in6),
1763 #ifdef CONFIG_COMPAT
1764         .compat_setsockopt = compat_ipv6_setsockopt,
1765         .compat_getsockopt = compat_ipv6_getsockopt,
1766 #endif
1767         .mtu_reduced       = tcp_v4_mtu_reduced,
1768 };
1769
1770 #ifdef CONFIG_TCP_MD5SIG
1771 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1772         .md5_lookup     =       tcp_v4_md5_lookup,
1773         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1774         .md5_parse      =       tcp_v6_parse_md5_keys,
1775 };
1776 #endif
1777
1778 /* NOTE: A lot of things set to zero explicitly by call to
1779  *       sk_alloc() so need not be done here.
1780  */
1781 static int tcp_v6_init_sock(struct sock *sk)
1782 {
1783         struct inet_connection_sock *icsk = inet_csk(sk);
1784
1785         tcp_init_sock(sk);
1786
1787         icsk->icsk_af_ops = &ipv6_specific;
1788
1789 #ifdef CONFIG_TCP_MD5SIG
1790         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1791 #endif
1792
1793         return 0;
1794 }
1795
1796 static void tcp_v6_destroy_sock(struct sock *sk)
1797 {
1798         tcp_v4_destroy_sock(sk);
1799         inet6_destroy_sock(sk);
1800 }
1801
1802 #ifdef CONFIG_PROC_FS
1803 /* Proc filesystem TCPv6 sock list dumping. */
1804 static void get_openreq6(struct seq_file *seq,
1805                          const struct request_sock *req, int i)
1806 {
1807         long ttd = req->rsk_timer.expires - jiffies;
1808         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1809         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1810
1811         if (ttd < 0)
1812                 ttd = 0;
1813
1814         seq_printf(seq,
1815                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1816                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1817                    i,
1818                    src->s6_addr32[0], src->s6_addr32[1],
1819                    src->s6_addr32[2], src->s6_addr32[3],
1820                    inet_rsk(req)->ir_num,
1821                    dest->s6_addr32[0], dest->s6_addr32[1],
1822                    dest->s6_addr32[2], dest->s6_addr32[3],
1823                    ntohs(inet_rsk(req)->ir_rmt_port),
1824                    TCP_SYN_RECV,
1825                    0, 0, /* could print option size, but that is af dependent. */
1826                    1,   /* timers active (only the expire timer) */
1827                    jiffies_to_clock_t(ttd),
1828                    req->num_timeout,
1829                    from_kuid_munged(seq_user_ns(seq),
1830                                     sock_i_uid(req->rsk_listener)),
1831                    0,  /* non standard timer */
1832                    0, /* open_requests have no inode */
1833                    0, req);
1834 }
1835
1836 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1837 {
1838         const struct in6_addr *dest, *src;
1839         __u16 destp, srcp;
1840         int timer_active;
1841         unsigned long timer_expires;
1842         const struct inet_sock *inet = inet_sk(sp);
1843         const struct tcp_sock *tp = tcp_sk(sp);
1844         const struct inet_connection_sock *icsk = inet_csk(sp);
1845         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1846         int rx_queue;
1847         int state;
1848
1849         dest  = &sp->sk_v6_daddr;
1850         src   = &sp->sk_v6_rcv_saddr;
1851         destp = ntohs(inet->inet_dport);
1852         srcp  = ntohs(inet->inet_sport);
1853
1854         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1855             icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1856             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1857                 timer_active    = 1;
1858                 timer_expires   = icsk->icsk_timeout;
1859         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1860                 timer_active    = 4;
1861                 timer_expires   = icsk->icsk_timeout;
1862         } else if (timer_pending(&sp->sk_timer)) {
1863                 timer_active    = 2;
1864                 timer_expires   = sp->sk_timer.expires;
1865         } else {
1866                 timer_active    = 0;
1867                 timer_expires = jiffies;
1868         }
1869
1870         state = inet_sk_state_load(sp);
1871         if (state == TCP_LISTEN)
1872                 rx_queue = sp->sk_ack_backlog;
1873         else
1874                 /* Because we don't lock the socket,
1875                  * we might find a transient negative value.
1876                  */
1877                 rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
1878                                       READ_ONCE(tp->copied_seq), 0);
1879
1880         seq_printf(seq,
1881                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1882                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1883                    i,
1884                    src->s6_addr32[0], src->s6_addr32[1],
1885                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1886                    dest->s6_addr32[0], dest->s6_addr32[1],
1887                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1888                    state,
1889                    READ_ONCE(tp->write_seq) - tp->snd_una,
1890                    rx_queue,
1891                    timer_active,
1892                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1893                    icsk->icsk_retransmits,
1894                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1895                    icsk->icsk_probes_out,
1896                    sock_i_ino(sp),
1897                    refcount_read(&sp->sk_refcnt), sp,
1898                    jiffies_to_clock_t(icsk->icsk_rto),
1899                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1900                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1901                    tp->snd_cwnd,
1902                    state == TCP_LISTEN ?
1903                         fastopenq->max_qlen :
1904                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1905                    );
1906 }
1907
1908 static void get_timewait6_sock(struct seq_file *seq,
1909                                struct inet_timewait_sock *tw, int i)
1910 {
1911         long delta = tw->tw_timer.expires - jiffies;
1912         const struct in6_addr *dest, *src;
1913         __u16 destp, srcp;
1914
1915         dest = &tw->tw_v6_daddr;
1916         src  = &tw->tw_v6_rcv_saddr;
1917         destp = ntohs(tw->tw_dport);
1918         srcp  = ntohs(tw->tw_sport);
1919
1920         seq_printf(seq,
1921                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1922                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1923                    i,
1924                    src->s6_addr32[0], src->s6_addr32[1],
1925                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1926                    dest->s6_addr32[0], dest->s6_addr32[1],
1927                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1928                    tw->tw_substate, 0, 0,
1929                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1930                    refcount_read(&tw->tw_refcnt), tw);
1931 }
1932
1933 static int tcp6_seq_show(struct seq_file *seq, void *v)
1934 {
1935         struct tcp_iter_state *st;
1936         struct sock *sk = v;
1937
1938         if (v == SEQ_START_TOKEN) {
1939                 seq_puts(seq,
1940                          "  sl  "
1941                          "local_address                         "
1942                          "remote_address                        "
1943                          "st tx_queue rx_queue tr tm->when retrnsmt"
1944                          "   uid  timeout inode\n");
1945                 goto out;
1946         }
1947         st = seq->private;
1948
1949         if (sk->sk_state == TCP_TIME_WAIT)
1950                 get_timewait6_sock(seq, v, st->num);
1951         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1952                 get_openreq6(seq, v, st->num);
1953         else
1954                 get_tcp6_sock(seq, v, st->num);
1955 out:
1956         return 0;
1957 }
1958
1959 static const struct seq_operations tcp6_seq_ops = {
1960         .show           = tcp6_seq_show,
1961         .start          = tcp_seq_start,
1962         .next           = tcp_seq_next,
1963         .stop           = tcp_seq_stop,
1964 };
1965
1966 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1967         .family         = AF_INET6,
1968 };
1969
1970 int __net_init tcp6_proc_init(struct net *net)
1971 {
1972         if (!proc_create_net_data("tcp6", 0444, net->proc_net, &tcp6_seq_ops,
1973                         sizeof(struct tcp_iter_state), &tcp6_seq_afinfo))
1974                 return -ENOMEM;
1975         return 0;
1976 }
1977
1978 void tcp6_proc_exit(struct net *net)
1979 {
1980         remove_proc_entry("tcp6", net->proc_net);
1981 }
1982 #endif
1983
1984 struct proto tcpv6_prot = {
1985         .name                   = "TCPv6",
1986         .owner                  = THIS_MODULE,
1987         .close                  = tcp_close,
1988         .pre_connect            = tcp_v6_pre_connect,
1989         .connect                = tcp_v6_connect,
1990         .disconnect             = tcp_disconnect,
1991         .accept                 = inet_csk_accept,
1992         .ioctl                  = tcp_ioctl,
1993         .init                   = tcp_v6_init_sock,
1994         .destroy                = tcp_v6_destroy_sock,
1995         .shutdown               = tcp_shutdown,
1996         .setsockopt             = tcp_setsockopt,
1997         .getsockopt             = tcp_getsockopt,
1998         .keepalive              = tcp_set_keepalive,
1999         .recvmsg                = tcp_recvmsg,
2000         .sendmsg                = tcp_sendmsg,
2001         .sendpage               = tcp_sendpage,
2002         .backlog_rcv            = tcp_v6_do_rcv,
2003         .release_cb             = tcp_release_cb,
2004         .hash                   = inet6_hash,
2005         .unhash                 = inet_unhash,
2006         .get_port               = inet_csk_get_port,
2007         .enter_memory_pressure  = tcp_enter_memory_pressure,
2008         .leave_memory_pressure  = tcp_leave_memory_pressure,
2009         .stream_memory_free     = tcp_stream_memory_free,
2010         .sockets_allocated      = &tcp_sockets_allocated,
2011         .memory_allocated       = &tcp_memory_allocated,
2012         .memory_pressure        = &tcp_memory_pressure,
2013         .orphan_count           = &tcp_orphan_count,
2014         .sysctl_mem             = sysctl_tcp_mem,
2015         .sysctl_wmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_wmem),
2016         .sysctl_rmem_offset     = offsetof(struct net, ipv4.sysctl_tcp_rmem),
2017         .max_header             = MAX_TCP_HEADER,
2018         .obj_size               = sizeof(struct tcp6_sock),
2019         .slab_flags             = SLAB_TYPESAFE_BY_RCU,
2020         .twsk_prot              = &tcp6_timewait_sock_ops,
2021         .rsk_prot               = &tcp6_request_sock_ops,
2022         .h.hashinfo             = &tcp_hashinfo,
2023         .no_autobind            = true,
2024 #ifdef CONFIG_COMPAT
2025         .compat_setsockopt      = compat_tcp_setsockopt,
2026         .compat_getsockopt      = compat_tcp_getsockopt,
2027 #endif
2028         .diag_destroy           = tcp_abort,
2029 };
2030
2031 /* thinking of making this const? Don't.
2032  * early_demux can change based on sysctl.
2033  */
2034 static struct inet6_protocol tcpv6_protocol = {
2035         .early_demux    =       tcp_v6_early_demux,
2036         .early_demux_handler =  tcp_v6_early_demux,
2037         .handler        =       tcp_v6_rcv,
2038         .err_handler    =       tcp_v6_err,
2039         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2040 };
2041
2042 static struct inet_protosw tcpv6_protosw = {
2043         .type           =       SOCK_STREAM,
2044         .protocol       =       IPPROTO_TCP,
2045         .prot           =       &tcpv6_prot,
2046         .ops            =       &inet6_stream_ops,
2047         .flags          =       INET_PROTOSW_PERMANENT |
2048                                 INET_PROTOSW_ICSK,
2049 };
2050
2051 static int __net_init tcpv6_net_init(struct net *net)
2052 {
2053         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2054                                     SOCK_RAW, IPPROTO_TCP, net);
2055 }
2056
2057 static void __net_exit tcpv6_net_exit(struct net *net)
2058 {
2059         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2060 }
2061
2062 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2063 {
2064         inet_twsk_purge(&tcp_hashinfo, AF_INET6);
2065 }
2066
2067 static struct pernet_operations tcpv6_net_ops = {
2068         .init       = tcpv6_net_init,
2069         .exit       = tcpv6_net_exit,
2070         .exit_batch = tcpv6_net_exit_batch,
2071 };
2072
2073 int __init tcpv6_init(void)
2074 {
2075         int ret;
2076
2077         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2078         if (ret)
2079                 goto out;
2080
2081         /* register inet6 protocol */
2082         ret = inet6_register_protosw(&tcpv6_protosw);
2083         if (ret)
2084                 goto out_tcpv6_protocol;
2085
2086         ret = register_pernet_subsys(&tcpv6_net_ops);
2087         if (ret)
2088                 goto out_tcpv6_protosw;
2089 out:
2090         return ret;
2091
2092 out_tcpv6_protosw:
2093         inet6_unregister_protosw(&tcpv6_protosw);
2094 out_tcpv6_protocol:
2095         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2096         goto out;
2097 }
2098
2099 void tcpv6_exit(void)
2100 {
2101         unregister_pernet_subsys(&tcpv6_net_ops);
2102         inet6_unregister_protosw(&tcpv6_protosw);
2103         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2104 }