net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/tcp_memcontrol.h>
  65 #include <net/busy_poll.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 #include <linux/crypto.h>
  71 #include <linux/scatterlist.h>
  72
  73 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  75                                       struct request_sock *req);
  76
  77 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  78
  79 static const struct inet_connection_sock_af_ops ipv6_mapped;
  80 static const struct inet_connection_sock_af_ops ipv6_specific;
  81 #ifdef CONFIG_TCP_MD5SIG
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  84 #else
  85 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  86                                                    const struct in6_addr *addr)
  87 {
  88         return NULL;
  89 }
  90 #endif
  91
  92 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  93 {
  94         struct dst_entry *dst = skb_dst(skb);
  95
  96         if (dst) {
  97                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99                 dst_hold(dst);
 100                 sk->sk_rx_dst = dst;
 101                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 103         }
 104 }
 105
 106 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 107 {
 108         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 109                                             ipv6_hdr(skb)->saddr.s6_addr32,
 110                                             tcp_hdr(skb)->dest,
 111                                             tcp_hdr(skb)->source);
 112 }
 113
 114 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 115                           int addr_len)
 116 {
 117         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 118         struct inet_sock *inet = inet_sk(sk);
 119         struct inet_connection_sock *icsk = inet_csk(sk);
 120         struct ipv6_pinfo *np = inet6_sk(sk);
 121         struct tcp_sock *tp = tcp_sk(sk);
 122         struct in6_addr *saddr = NULL, *final_p, final;
 123         struct flowi6 fl6;
 124         struct dst_entry *dst;
 125         int addr_type;
 126         int err;
 127
 128         if (addr_len < SIN6_LEN_RFC2133)
 129                 return -EINVAL;
 130
 131         if (usin->sin6_family != AF_INET6)
 132                 return -EAFNOSUPPORT;
 133
 134         memset(&fl6, 0, sizeof(fl6));
 135
 136         if (np->sndflow) {
 137                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 138                 IP6_ECN_flow_init(fl6.flowlabel);
 139                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 140                         struct ip6_flowlabel *flowlabel;
 141                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 142                         if (!flowlabel)
 143                                 return -EINVAL;
 144                         fl6_sock_release(flowlabel);
 145                 }
 146         }
 147
 148         /*
 149          *      connect() to INADDR_ANY means loopback (BSD'ism).
 150          */
 151
 152         if (ipv6_addr_any(&usin->sin6_addr))
 153                 usin->sin6_addr.s6_addr[15] = 0x1;
 154
 155         addr_type = ipv6_addr_type(&usin->sin6_addr);
 156
 157         if (addr_type & IPV6_ADDR_MULTICAST)
 158                 return -ENETUNREACH;
 159
 160         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 161                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 162                     usin->sin6_scope_id) {
 163                         /* If interface is set while binding, indices
 164                          * must coincide.
 165                          */
 166                         if (sk->sk_bound_dev_if &&
 167                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 168                                 return -EINVAL;
 169
 170                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 171                 }
 172
 173                 /* Connect to link-local address requires an interface */
 174                 if (!sk->sk_bound_dev_if)
 175                         return -EINVAL;
 176         }
 177
 178         if (tp->rx_opt.ts_recent_stamp &&
 179             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 180                 tp->rx_opt.ts_recent = 0;
 181                 tp->rx_opt.ts_recent_stamp = 0;
 182                 tp->write_seq = 0;
 183         }
 184
 185         sk->sk_v6_daddr = usin->sin6_addr;
 186         np->flow_label = fl6.flowlabel;
 187
 188         /*
 189          *      TCP over IPv4
 190          */
 191
 192         if (addr_type == IPV6_ADDR_MAPPED) {
 193                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 194                 struct sockaddr_in sin;
 195
 196                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 197
 198                 if (__ipv6_only_sock(sk))
 199                         return -ENETUNREACH;
 200
 201                 sin.sin_family = AF_INET;
 202                 sin.sin_port = usin->sin6_port;
 203                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 204
 205                 icsk->icsk_af_ops = &ipv6_mapped;
 206                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 207 #ifdef CONFIG_TCP_MD5SIG
 208                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 209 #endif
 210
 211                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 212
 213                 if (err) {
 214                         icsk->icsk_ext_hdr_len = exthdrlen;
 215                         icsk->icsk_af_ops = &ipv6_specific;
 216                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 217 #ifdef CONFIG_TCP_MD5SIG
 218                         tp->af_specific = &tcp_sock_ipv6_specific;
 219 #endif
 220                         goto failure;
 221                 }
 222                 np->saddr = sk->sk_v6_rcv_saddr;
 223
 224                 return err;
 225         }
 226
 227         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 228                 saddr = &sk->sk_v6_rcv_saddr;
 229
 230         fl6.flowi6_proto = IPPROTO_TCP;
 231         fl6.daddr = sk->sk_v6_daddr;
 232         fl6.saddr = saddr ? *saddr : np->saddr;
 233         fl6.flowi6_oif = sk->sk_bound_dev_if;
 234         fl6.flowi6_mark = sk->sk_mark;
 235         fl6.fl6_dport = usin->sin6_port;
 236         fl6.fl6_sport = inet->inet_sport;
 237
 238         final_p = fl6_update_dst(&fl6, np->opt, &final);
 239
 240         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 241
 242         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 243         if (IS_ERR(dst)) {
 244                 err = PTR_ERR(dst);
 245                 goto failure;
 246         }
 247
 248         if (!saddr) {
 249                 saddr = &fl6.saddr;
 250                 sk->sk_v6_rcv_saddr = *saddr;
 251         }
 252
 253         /* set the source address */
 254         np->saddr = *saddr;
 255         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 256
 257         sk->sk_gso_type = SKB_GSO_TCPV6;
 258         __ip6_dst_store(sk, dst, NULL, NULL);
 259
 260         if (tcp_death_row.sysctl_tw_recycle &&
 261             !tp->rx_opt.ts_recent_stamp &&
 262             ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
 263                 tcp_fetch_timewait_stamp(sk, dst);
 264
 265         icsk->icsk_ext_hdr_len = 0;
 266         if (np->opt)
 267                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 268                                           np->opt->opt_nflen);
 269
 270         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 271
 272         inet->inet_dport = usin->sin6_port;
 273
 274         tcp_set_state(sk, TCP_SYN_SENT);
 275         err = inet6_hash_connect(&tcp_death_row, sk);
 276         if (err)
 277                 goto late_failure;
 278
 279         sk_set_txhash(sk);
 280
 281         if (!tp->write_seq && likely(!tp->repair))
 282                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 283                                                              sk->sk_v6_daddr.s6_addr32,
 284                                                              inet->inet_sport,
 285                                                              inet->inet_dport);
 286
 287         err = tcp_connect(sk);
 288         if (err)
 289                 goto late_failure;
 290
 291         return 0;
 292
 293 late_failure:
 294         tcp_set_state(sk, TCP_CLOSE);
 295         __sk_dst_reset(sk);
 296 failure:
 297         inet->inet_dport = 0;
 298         sk->sk_route_caps = 0;
 299         return err;
 300 }
 301
 302 static void tcp_v6_mtu_reduced(struct sock *sk)
 303 {
 304         struct dst_entry *dst;
 305
 306         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 307                 return;
 308
 309         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 310         if (!dst)
 311                 return;
 312
 313         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 314                 tcp_sync_mss(sk, dst_mtu(dst));
 315                 tcp_simple_retransmit(sk);
 316         }
 317 }
 318
 319 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 320                 u8 type, u8 code, int offset, __be32 info)
 321 {
 322         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 323         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 324         struct net *net = dev_net(skb->dev);
 325         struct request_sock *fastopen;
 326         struct ipv6_pinfo *np;
 327         struct tcp_sock *tp;
 328         __u32 seq, snd_una;
 329         struct sock *sk;
 330         int err;
 331
 332         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 333                                         &hdr->daddr, th->dest,
 334                                         &hdr->saddr, ntohs(th->source),
 335                                         skb->dev->ifindex);
 336
 337         if (!sk) {
 338                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 339                                    ICMP6_MIB_INERRORS);
 340                 return;
 341         }
 342
 343         if (sk->sk_state == TCP_TIME_WAIT) {
 344                 inet_twsk_put(inet_twsk(sk));
 345                 return;
 346         }
 347         seq = ntohl(th->seq);
 348         if (sk->sk_state == TCP_NEW_SYN_RECV)
 349                 return tcp_req_err(sk, seq);
 350
 351         bh_lock_sock(sk);
 352         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 353                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 354
 355         if (sk->sk_state == TCP_CLOSE)
 356                 goto out;
 357
 358         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 359                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 360                 goto out;
 361         }
 362
 363         tp = tcp_sk(sk);
 364         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 365         fastopen = tp->fastopen_rsk;
 366         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 367         if (sk->sk_state != TCP_LISTEN &&
 368             !between(seq, snd_una, tp->snd_nxt)) {
 369                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 370                 goto out;
 371         }
 372
 373         np = inet6_sk(sk);
 374
 375         if (type == NDISC_REDIRECT) {
 376                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 377
 378                 if (dst)
 379                         dst->ops->redirect(dst, sk, skb);
 380                 goto out;
 381         }
 382
 383         if (type == ICMPV6_PKT_TOOBIG) {
 384                 /* We are not interested in TCP_LISTEN and open_requests
 385                  * (SYN-ACKs send out by Linux are always <576bytes so
 386                  * they should go through unfragmented).
 387                  */
 388                 if (sk->sk_state == TCP_LISTEN)
 389                         goto out;
 390
 391                 if (!ip6_sk_accept_pmtu(sk))
 392                         goto out;
 393
 394                 tp->mtu_info = ntohl(info);
 395                 if (!sock_owned_by_user(sk))
 396                         tcp_v6_mtu_reduced(sk);
 397                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 398                                            &tp->tsq_flags))
 399                         sock_hold(sk);
 400                 goto out;
 401         }
 402
 403         icmpv6_err_convert(type, code, &err);
 404
 405         /* Might be for an request_sock */
 406         switch (sk->sk_state) {
 407         case TCP_SYN_SENT:
 408         case TCP_SYN_RECV:
 409                 /* Only in fast or simultaneous open. If a fast open socket is
 410                  * is already accepted it is treated as a connected one below.
 411                  */
 412                 if (fastopen && !fastopen->sk)
 413                         break;
 414
 415                 if (!sock_owned_by_user(sk)) {
 416                         sk->sk_err = err;
 417                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 418
 419                         tcp_done(sk);
 420                 } else
 421                         sk->sk_err_soft = err;
 422                 goto out;
 423         }
 424
 425         if (!sock_owned_by_user(sk) && np->recverr) {
 426                 sk->sk_err = err;
 427                 sk->sk_error_report(sk);
 428         } else
 429                 sk->sk_err_soft = err;
 430
 431 out:
 432         bh_unlock_sock(sk);
 433         sock_put(sk);
 434 }
 435
 436
 437 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 438                               struct flowi *fl,
 439                               struct request_sock *req,
 440                               struct tcp_fastopen_cookie *foc,
 441                               bool attach_req)
 442 {
 443         struct inet_request_sock *ireq = inet_rsk(req);
 444         struct ipv6_pinfo *np = inet6_sk(sk);
 445         struct flowi6 *fl6 = &fl->u.ip6;
 446         struct sk_buff *skb;
 447         int err = -ENOMEM;
 448
 449         /* First, grab a route. */
 450         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 451                                                IPPROTO_TCP)) == NULL)
 452                 goto done;
 453
 454         skb = tcp_make_synack(sk, dst, req, foc, attach_req);
 455
 456         if (skb) {
 457                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 458                                     &ireq->ir_v6_rmt_addr);
 459
 460                 fl6->daddr = ireq->ir_v6_rmt_addr;
 461                 if (np->repflow && ireq->pktopts)
 462                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 463
 464                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 465                 err = net_xmit_eval(err);
 466         }
 467
 468 done:
 469         return err;
 470 }
 471
 472
 473 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 474 {
 475         kfree_skb(inet_rsk(req)->pktopts);
 476 }
 477
 478 #ifdef CONFIG_TCP_MD5SIG
 479 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 480                                                    const struct in6_addr *addr)
 481 {
 482         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 483 }
 484
 485 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 486                                                 const struct sock *addr_sk)
 487 {
 488         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 489 }
 490
 491 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 492                                  int optlen)
 493 {
 494         struct tcp_md5sig cmd;
 495         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 496
 497         if (optlen < sizeof(cmd))
 498                 return -EINVAL;
 499
 500         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 501                 return -EFAULT;
 502
 503         if (sin6->sin6_family != AF_INET6)
 504                 return -EINVAL;
 505
 506         if (!cmd.tcpm_keylen) {
 507                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 508                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 509                                               AF_INET);
 510                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 511                                       AF_INET6);
 512         }
 513
 514         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 515                 return -EINVAL;
 516
 517         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 518                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 519                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 520
 521         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 522                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 523 }
 524
 525 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 526                                         const struct in6_addr *daddr,
 527                                         const struct in6_addr *saddr, int nbytes)
 528 {
 529         struct tcp6_pseudohdr *bp;
 530         struct scatterlist sg;
 531
 532         bp = &hp->md5_blk.ip6;
 533         /* 1. TCP pseudo-header (RFC2460) */
 534         bp->saddr = *saddr;
 535         bp->daddr = *daddr;
 536         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 537         bp->len = cpu_to_be32(nbytes);
 538
 539         sg_init_one(&sg, bp, sizeof(*bp));
 540         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 541 }
 542
 543 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 544                                const struct in6_addr *daddr, struct in6_addr *saddr,
 545                                const struct tcphdr *th)
 546 {
 547         struct tcp_md5sig_pool *hp;
 548         struct hash_desc *desc;
 549
 550         hp = tcp_get_md5sig_pool();
 551         if (!hp)
 552                 goto clear_hash_noput;
 553         desc = &hp->md5_desc;
 554
 555         if (crypto_hash_init(desc))
 556                 goto clear_hash;
 557         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 558                 goto clear_hash;
 559         if (tcp_md5_hash_header(hp, th))
 560                 goto clear_hash;
 561         if (tcp_md5_hash_key(hp, key))
 562                 goto clear_hash;
 563         if (crypto_hash_final(desc, md5_hash))
 564                 goto clear_hash;
 565
 566         tcp_put_md5sig_pool();
 567         return 0;
 568
 569 clear_hash:
 570         tcp_put_md5sig_pool();
 571 clear_hash_noput:
 572         memset(md5_hash, 0, 16);
 573         return 1;
 574 }
 575
 576 static int tcp_v6_md5_hash_skb(char *md5_hash,
 577                                const struct tcp_md5sig_key *key,
 578                                const struct sock *sk,
 579                                const struct sk_buff *skb)
 580 {
 581         const struct in6_addr *saddr, *daddr;
 582         struct tcp_md5sig_pool *hp;
 583         struct hash_desc *desc;
 584         const struct tcphdr *th = tcp_hdr(skb);
 585
 586         if (sk) { /* valid for establish/request sockets */
 587                 saddr = &sk->sk_v6_rcv_saddr;
 588                 daddr = &sk->sk_v6_daddr;
 589         } else {
 590                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 591                 saddr = &ip6h->saddr;
 592                 daddr = &ip6h->daddr;
 593         }
 594
 595         hp = tcp_get_md5sig_pool();
 596         if (!hp)
 597                 goto clear_hash_noput;
 598         desc = &hp->md5_desc;
 599
 600         if (crypto_hash_init(desc))
 601                 goto clear_hash;
 602
 603         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 604                 goto clear_hash;
 605         if (tcp_md5_hash_header(hp, th))
 606                 goto clear_hash;
 607         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 608                 goto clear_hash;
 609         if (tcp_md5_hash_key(hp, key))
 610                 goto clear_hash;
 611         if (crypto_hash_final(desc, md5_hash))
 612                 goto clear_hash;
 613
 614         tcp_put_md5sig_pool();
 615         return 0;
 616
 617 clear_hash:
 618         tcp_put_md5sig_pool();
 619 clear_hash_noput:
 620         memset(md5_hash, 0, 16);
 621         return 1;
 622 }
 623
 624 #endif
 625
 626 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 627                                     const struct sk_buff *skb)
 628 {
 629 #ifdef CONFIG_TCP_MD5SIG
 630         const __u8 *hash_location = NULL;
 631         struct tcp_md5sig_key *hash_expected;
 632         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 633         const struct tcphdr *th = tcp_hdr(skb);
 634         int genhash;
 635         u8 newhash[16];
 636
 637         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 638         hash_location = tcp_parse_md5sig_option(th);
 639
 640         /* We've parsed the options - do we have a hash? */
 641         if (!hash_expected && !hash_location)
 642                 return false;
 643
 644         if (hash_expected && !hash_location) {
 645                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 646                 return true;
 647         }
 648
 649         if (!hash_expected && hash_location) {
 650                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 651                 return true;
 652         }
 653
 654         /* check the signature */
 655         genhash = tcp_v6_md5_hash_skb(newhash,
 656                                       hash_expected,
 657                                       NULL, skb);
 658
 659         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 660                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 661                                      genhash ? "failed" : "mismatch",
 662                                      &ip6h->saddr, ntohs(th->source),
 663                                      &ip6h->daddr, ntohs(th->dest));
 664                 return true;
 665         }
 666 #endif
 667         return false;
 668 }
 669
 670 static void tcp_v6_init_req(struct request_sock *req,
 671                             const struct sock *sk_listener,
 672                             struct sk_buff *skb)
 673 {
 674         struct inet_request_sock *ireq = inet_rsk(req);
 675         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 676
 677         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 678         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 679
 680         /* So that link locals have meaning */
 681         if (!sk_listener->sk_bound_dev_if &&
 682             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 683                 ireq->ir_iif = tcp_v6_iif(skb);
 684
 685         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 686             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 687              np->rxopt.bits.rxinfo ||
 688              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 689              np->rxopt.bits.rxohlim || np->repflow)) {
 690                 atomic_inc(&skb->users);
 691                 ireq->pktopts = skb;
 692         }
 693 }
 694
 695 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 696                                           struct flowi *fl,
 697                                           const struct request_sock *req,
 698                                           bool *strict)
 699 {
 700         if (strict)
 701                 *strict = true;
 702         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 703 }
 704
 705 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 706         .family         =       AF_INET6,
 707         .obj_size       =       sizeof(struct tcp6_request_sock),
 708         .rtx_syn_ack    =       tcp_rtx_synack,
 709         .send_ack       =       tcp_v6_reqsk_send_ack,
 710         .destructor     =       tcp_v6_reqsk_destructor,
 711         .send_reset     =       tcp_v6_send_reset,
 712         .syn_ack_timeout =      tcp_syn_ack_timeout,
 713 };
 714
 715 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 716         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 717                                 sizeof(struct ipv6hdr),
 718 #ifdef CONFIG_TCP_MD5SIG
 719         .req_md5_lookup =       tcp_v6_md5_lookup,
 720         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 721 #endif
 722         .init_req       =       tcp_v6_init_req,
 723 #ifdef CONFIG_SYN_COOKIES
 724         .cookie_init_seq =      cookie_v6_init_sequence,
 725 #endif
 726         .route_req      =       tcp_v6_route_req,
 727         .init_seq       =       tcp_v6_init_sequence,
 728         .send_synack    =       tcp_v6_send_synack,
 729 };
 730
 731 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 732                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 733                                  int oif, struct tcp_md5sig_key *key, int rst,
 734                                  u8 tclass, u32 label)
 735 {
 736         const struct tcphdr *th = tcp_hdr(skb);
 737         struct tcphdr *t1;
 738         struct sk_buff *buff;
 739         struct flowi6 fl6;
 740         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 741         struct sock *ctl_sk = net->ipv6.tcp_sk;
 742         unsigned int tot_len = sizeof(struct tcphdr);
 743         struct dst_entry *dst;
 744         __be32 *topt;
 745
 746         if (tsecr)
 747                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 748 #ifdef CONFIG_TCP_MD5SIG
 749         if (key)
 750                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 751 #endif
 752
 753         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 754                          GFP_ATOMIC);
 755         if (!buff)
 756                 return;
 757
 758         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 759
 760         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 761         skb_reset_transport_header(buff);
 762
 763         /* Swap the send and the receive. */
 764         memset(t1, 0, sizeof(*t1));
 765         t1->dest = th->source;
 766         t1->source = th->dest;
 767         t1->doff = tot_len / 4;
 768         t1->seq = htonl(seq);
 769         t1->ack_seq = htonl(ack);
 770         t1->ack = !rst || !th->ack;
 771         t1->rst = rst;
 772         t1->window = htons(win);
 773
 774         topt = (__be32 *)(t1 + 1);
 775
 776         if (tsecr) {
 777                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 778                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 779                 *topt++ = htonl(tsval);
 780                 *topt++ = htonl(tsecr);
 781         }
 782
 783 #ifdef CONFIG_TCP_MD5SIG
 784         if (key) {
 785                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 786                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 787                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 788                                     &ipv6_hdr(skb)->saddr,
 789                                     &ipv6_hdr(skb)->daddr, t1);
 790         }
 791 #endif
 792
 793         memset(&fl6, 0, sizeof(fl6));
 794         fl6.daddr = ipv6_hdr(skb)->saddr;
 795         fl6.saddr = ipv6_hdr(skb)->daddr;
 796         fl6.flowlabel = label;
 797
 798         buff->ip_summed = CHECKSUM_PARTIAL;
 799         buff->csum = 0;
 800
 801         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 802
 803         fl6.flowi6_proto = IPPROTO_TCP;
 804         if (rt6_need_strict(&fl6.daddr) && !oif)
 805                 fl6.flowi6_oif = tcp_v6_iif(skb);
 806         else
 807                 fl6.flowi6_oif = oif;
 808         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 809         fl6.fl6_dport = t1->dest;
 810         fl6.fl6_sport = t1->source;
 811         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 812
 813         /* Pass a socket to ip6_dst_lookup either it is for RST
 814          * Underlying function will use this to retrieve the network
 815          * namespace
 816          */
 817         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 818         if (!IS_ERR(dst)) {
 819                 skb_dst_set(buff, dst);
 820                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 821                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 822                 if (rst)
 823                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 824                 return;
 825         }
 826
 827         kfree_skb(buff);
 828 }
 829
 830 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 831 {
 832         const struct tcphdr *th = tcp_hdr(skb);
 833         u32 seq = 0, ack_seq = 0;
 834         struct tcp_md5sig_key *key = NULL;
 835 #ifdef CONFIG_TCP_MD5SIG
 836         const __u8 *hash_location = NULL;
 837         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 838         unsigned char newhash[16];
 839         int genhash;
 840         struct sock *sk1 = NULL;
 841 #endif
 842         int oif;
 843
 844         if (th->rst)
 845                 return;
 846
 847         /* If sk not NULL, it means we did a successful lookup and incoming
 848          * route had to be correct. prequeue might have dropped our dst.
 849          */
 850         if (!sk && !ipv6_unicast_destination(skb))
 851                 return;
 852
 853 #ifdef CONFIG_TCP_MD5SIG
 854         hash_location = tcp_parse_md5sig_option(th);
 855         if (!sk && hash_location) {
 856                 /*
 857                  * active side is lost. Try to find listening socket through
 858                  * source port, and then find md5 key through listening socket.
 859                  * we are not loose security here:
 860                  * Incoming packet is checked with md5 hash with finding key,
 861                  * no RST generated if md5 hash doesn't match.
 862                  */
 863                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 864                                            &tcp_hashinfo, &ipv6h->saddr,
 865                                            th->source, &ipv6h->daddr,
 866                                            ntohs(th->source), tcp_v6_iif(skb));
 867                 if (!sk1)
 868                         return;
 869
 870                 rcu_read_lock();
 871                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 872                 if (!key)
 873                         goto release_sk1;
 874
 875                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 876                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 877                         goto release_sk1;
 878         } else {
 879                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 880         }
 881 #endif
 882
 883         if (th->ack)
 884                 seq = ntohl(th->ack_seq);
 885         else
 886                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 887                           (th->doff << 2);
 888
 889         oif = sk ? sk->sk_bound_dev_if : 0;
 890         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 891
 892 #ifdef CONFIG_TCP_MD5SIG
 893 release_sk1:
 894         if (sk1) {
 895                 rcu_read_unlock();
 896                 sock_put(sk1);
 897         }
 898 #endif
 899 }
 900
 901 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 902                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 903                             struct tcp_md5sig_key *key, u8 tclass,
 904                             u32 label)
 905 {
 906         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 907                              tclass, label);
 908 }
 909
 910 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 911 {
 912         struct inet_timewait_sock *tw = inet_twsk(sk);
 913         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 914
 915         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 916                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 917                         tcp_time_stamp + tcptw->tw_ts_offset,
 918                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 919                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 920
 921         inet_twsk_put(tw);
 922 }
 923
 924 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 925                                   struct request_sock *req)
 926 {
 927         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 928          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 929          */
 930         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 931                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
 932                         tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
 933                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 934                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 935                         0, 0);
 936 }
 937
 938
 939 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
 940 {
 941 #ifdef CONFIG_SYN_COOKIES
 942         const struct tcphdr *th = tcp_hdr(skb);
 943
 944         if (!th->syn)
 945                 sk = cookie_v6_check(sk, skb);
 946 #endif
 947         return sk;
 948 }
 949
 950 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 951 {
 952         if (skb->protocol == htons(ETH_P_IP))
 953                 return tcp_v4_conn_request(sk, skb);
 954
 955         if (!ipv6_unicast_destination(skb))
 956                 goto drop;
 957
 958         return tcp_conn_request(&tcp6_request_sock_ops,
 959                                 &tcp_request_sock_ipv6_ops, sk, skb);
 960
 961 drop:
 962         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 963         return 0; /* don't send reset */
 964 }
 965
 966 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
 967                                          struct request_sock *req,
 968                                          struct dst_entry *dst,
 969                                          struct request_sock *req_unhash,
 970                                          bool *own_req)
 971 {
 972         struct inet_request_sock *ireq;
 973         struct ipv6_pinfo *newnp;
 974         const struct ipv6_pinfo *np = inet6_sk(sk);
 975         struct tcp6_sock *newtcp6sk;
 976         struct inet_sock *newinet;
 977         struct tcp_sock *newtp;
 978         struct sock *newsk;
 979 #ifdef CONFIG_TCP_MD5SIG
 980         struct tcp_md5sig_key *key;
 981 #endif
 982         struct flowi6 fl6;
 983
 984         if (skb->protocol == htons(ETH_P_IP)) {
 985                 /*
 986                  *      v6 mapped
 987                  */
 988
 989                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
 990                                              req_unhash, own_req);
 991
 992                 if (!newsk)
 993                         return NULL;
 994
 995                 newtcp6sk = (struct tcp6_sock *)newsk;
 996                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
 997
 998                 newinet = inet_sk(newsk);
 999                 newnp = inet6_sk(newsk);
1000                 newtp = tcp_sk(newsk);
1001
1002                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1003
1004                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1005
1006                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1007                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1008 #ifdef CONFIG_TCP_MD5SIG
1009                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1010 #endif
1011
1012                 newnp->ipv6_ac_list = NULL;
1013                 newnp->ipv6_fl_list = NULL;
1014                 newnp->pktoptions  = NULL;
1015                 newnp->opt         = NULL;
1016                 newnp->mcast_oif   = tcp_v6_iif(skb);
1017                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1018                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1019                 if (np->repflow)
1020                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1021
1022                 /*
1023                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1024                  * here, tcp_create_openreq_child now does this for us, see the comment in
1025                  * that function for the gory details. -acme
1026                  */
1027
1028                 /* It is tricky place. Until this moment IPv4 tcp
1029                    worked with IPv6 icsk.icsk_af_ops.
1030                    Sync it now.
1031                  */
1032                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1033
1034                 return newsk;
1035         }
1036
1037         ireq = inet_rsk(req);
1038
1039         if (sk_acceptq_is_full(sk))
1040                 goto out_overflow;
1041
1042         if (!dst) {
1043                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1044                 if (!dst)
1045                         goto out;
1046         }
1047
1048         newsk = tcp_create_openreq_child(sk, req, skb);
1049         if (!newsk)
1050                 goto out_nonewsk;
1051
1052         /*
1053          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1054          * count here, tcp_create_openreq_child now does this for us, see the
1055          * comment in that function for the gory details. -acme
1056          */
1057
1058         newsk->sk_gso_type = SKB_GSO_TCPV6;
1059         __ip6_dst_store(newsk, dst, NULL, NULL);
1060         inet6_sk_rx_dst_set(newsk, skb);
1061
1062         newtcp6sk = (struct tcp6_sock *)newsk;
1063         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1064
1065         newtp = tcp_sk(newsk);
1066         newinet = inet_sk(newsk);
1067         newnp = inet6_sk(newsk);
1068
1069         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1070
1071         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1072         newnp->saddr = ireq->ir_v6_loc_addr;
1073         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1074         newsk->sk_bound_dev_if = ireq->ir_iif;
1075
1076         /* Now IPv6 options...
1077
1078            First: no IPv4 options.
1079          */
1080         newinet->inet_opt = NULL;
1081         newnp->ipv6_ac_list = NULL;
1082         newnp->ipv6_fl_list = NULL;
1083
1084         /* Clone RX bits */
1085         newnp->rxopt.all = np->rxopt.all;
1086
1087         newnp->pktoptions = NULL;
1088         newnp->opt        = NULL;
1089         newnp->mcast_oif  = tcp_v6_iif(skb);
1090         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1091         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1092         if (np->repflow)
1093                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1094
1095         /* Clone native IPv6 options from listening socket (if any)
1096
1097            Yes, keeping reference count would be much more clever,
1098            but we make one more one thing there: reattach optmem
1099            to newsk.
1100          */
1101         if (np->opt)
1102                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1103
1104         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1105         if (newnp->opt)
1106                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1107                                                      newnp->opt->opt_flen);
1108
1109         tcp_ca_openreq_child(newsk, dst);
1110
1111         tcp_sync_mss(newsk, dst_mtu(dst));
1112         newtp->advmss = dst_metric_advmss(dst);
1113         if (tcp_sk(sk)->rx_opt.user_mss &&
1114             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1115                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1116
1117         tcp_initialize_rcv_mss(newsk);
1118
1119         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1120         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1121
1122 #ifdef CONFIG_TCP_MD5SIG
1123         /* Copy over the MD5 key from the original socket */
1124         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1125         if (key) {
1126                 /* We're using one, so create a matching key
1127                  * on the newsk structure. If we fail to get
1128                  * memory, then we end up not copying the key
1129                  * across. Shucks.
1130                  */
1131                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1132                                AF_INET6, key->key, key->keylen,
1133                                sk_gfp_atomic(sk, GFP_ATOMIC));
1134         }
1135 #endif
1136
1137         if (__inet_inherit_port(sk, newsk) < 0) {
1138                 inet_csk_prepare_forced_close(newsk);
1139                 tcp_done(newsk);
1140                 goto out;
1141         }
1142         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1143         /* Clone pktoptions received with SYN, if we own the req */
1144         if (*own_req && ireq->pktopts) {
1145                 newnp->pktoptions = skb_clone(ireq->pktopts,
1146                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1147                 consume_skb(ireq->pktopts);
1148                 ireq->pktopts = NULL;
1149                 if (newnp->pktoptions)
1150                         skb_set_owner_r(newnp->pktoptions, newsk);
1151         }
1152
1153         return newsk;
1154
1155 out_overflow:
1156         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1157 out_nonewsk:
1158         dst_release(dst);
1159 out:
1160         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1161         return NULL;
1162 }
1163
1164 /* The socket must have it's spinlock held when we get
1165  * here, unless it is a TCP_LISTEN socket.
1166  *
1167  * We have a potential double-lock case here, so even when
1168  * doing backlog processing we use the BH locking scheme.
1169  * This is because we cannot sleep with the original spinlock
1170  * held.
1171  */
1172 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1173 {
1174         struct ipv6_pinfo *np = inet6_sk(sk);
1175         struct tcp_sock *tp;
1176         struct sk_buff *opt_skb = NULL;
1177
1178         /* Imagine: socket is IPv6. IPv4 packet arrives,
1179            goes to IPv4 receive handler and backlogged.
1180            From backlog it always goes here. Kerboom...
1181            Fortunately, tcp_rcv_established and rcv_established
1182            handle them correctly, but it is not case with
1183            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1184          */
1185
1186         if (skb->protocol == htons(ETH_P_IP))
1187                 return tcp_v4_do_rcv(sk, skb);
1188
1189         if (sk_filter(sk, skb))
1190                 goto discard;
1191
1192         /*
1193          *      socket locking is here for SMP purposes as backlog rcv
1194          *      is currently called with bh processing disabled.
1195          */
1196
1197         /* Do Stevens' IPV6_PKTOPTIONS.
1198
1199            Yes, guys, it is the only place in our code, where we
1200            may make it not affecting IPv4.
1201            The rest of code is protocol independent,
1202            and I do not like idea to uglify IPv4.
1203
1204            Actually, all the idea behind IPV6_PKTOPTIONS
1205            looks not very well thought. For now we latch
1206            options, received in the last packet, enqueued
1207            by tcp. Feel free to propose better solution.
1208                                                --ANK (980728)
1209          */
1210         if (np->rxopt.all)
1211                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1212
1213         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1214                 struct dst_entry *dst = sk->sk_rx_dst;
1215
1216                 sock_rps_save_rxhash(sk, skb);
1217                 sk_mark_napi_id(sk, skb);
1218                 if (dst) {
1219                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1220                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1221                                 dst_release(dst);
1222                                 sk->sk_rx_dst = NULL;
1223                         }
1224                 }
1225
1226                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1227                 if (opt_skb)
1228                         goto ipv6_pktoptions;
1229                 return 0;
1230         }
1231
1232         if (tcp_checksum_complete(skb))
1233                 goto csum_err;
1234
1235         if (sk->sk_state == TCP_LISTEN) {
1236                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1237
1238                 if (!nsk)
1239                         goto discard;
1240
1241                 if (nsk != sk) {
1242                         sock_rps_save_rxhash(nsk, skb);
1243                         sk_mark_napi_id(nsk, skb);
1244                         if (tcp_child_process(sk, nsk, skb))
1245                                 goto reset;
1246                         if (opt_skb)
1247                                 __kfree_skb(opt_skb);
1248                         return 0;
1249                 }
1250         } else
1251                 sock_rps_save_rxhash(sk, skb);
1252
1253         if (tcp_rcv_state_process(sk, skb))
1254                 goto reset;
1255         if (opt_skb)
1256                 goto ipv6_pktoptions;
1257         return 0;
1258
1259 reset:
1260         tcp_v6_send_reset(sk, skb);
1261 discard:
1262         if (opt_skb)
1263                 __kfree_skb(opt_skb);
1264         kfree_skb(skb);
1265         return 0;
1266 csum_err:
1267         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1268         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1269         goto discard;
1270
1271
1272 ipv6_pktoptions:
1273         /* Do you ask, what is it?
1274
1275            1. skb was enqueued by tcp.
1276            2. skb is added to tail of read queue, rather than out of order.
1277            3. socket is not in passive state.
1278            4. Finally, it really contains options, which user wants to receive.
1279          */
1280         tp = tcp_sk(sk);
1281         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1282             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1283                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1284                         np->mcast_oif = tcp_v6_iif(opt_skb);
1285                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1286                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1287                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1288                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1289                 if (np->repflow)
1290                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1291                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1292                         skb_set_owner_r(opt_skb, sk);
1293                         opt_skb = xchg(&np->pktoptions, opt_skb);
1294                 } else {
1295                         __kfree_skb(opt_skb);
1296                         opt_skb = xchg(&np->pktoptions, NULL);
1297                 }
1298         }
1299
1300         kfree_skb(opt_skb);
1301         return 0;
1302 }
1303
1304 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1305                            const struct tcphdr *th)
1306 {
1307         /* This is tricky: we move IP6CB at its correct location into
1308          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1309          * _decode_session6() uses IP6CB().
1310          * barrier() makes sure compiler won't play aliasing games.
1311          */
1312         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1313                 sizeof(struct inet6_skb_parm));
1314         barrier();
1315
1316         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1317         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1318                                     skb->len - th->doff*4);
1319         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1320         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1321         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1322         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1323         TCP_SKB_CB(skb)->sacked = 0;
1324 }
1325
1326 static void tcp_v6_restore_cb(struct sk_buff *skb)
1327 {
1328         /* We need to move header back to the beginning if xfrm6_policy_check()
1329          * and tcp_v6_fill_cb() are going to be called again.
1330          */
1331         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1332                 sizeof(struct inet6_skb_parm));
1333 }
1334
1335 static int tcp_v6_rcv(struct sk_buff *skb)
1336 {
1337         const struct tcphdr *th;
1338         const struct ipv6hdr *hdr;
1339         struct sock *sk;
1340         int ret;
1341         struct net *net = dev_net(skb->dev);
1342
1343         if (skb->pkt_type != PACKET_HOST)
1344                 goto discard_it;
1345
1346         /*
1347          *      Count it even if it's bad.
1348          */
1349         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1350
1351         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1352                 goto discard_it;
1353
1354         th = tcp_hdr(skb);
1355
1356         if (th->doff < sizeof(struct tcphdr)/4)
1357                 goto bad_packet;
1358         if (!pskb_may_pull(skb, th->doff*4))
1359                 goto discard_it;
1360
1361         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1362                 goto csum_error;
1363
1364         th = tcp_hdr(skb);
1365         hdr = ipv6_hdr(skb);
1366
1367 lookup:
1368         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1369                                 inet6_iif(skb));
1370         if (!sk)
1371                 goto no_tcp_socket;
1372
1373 process:
1374         if (sk->sk_state == TCP_TIME_WAIT)
1375                 goto do_time_wait;
1376
1377         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1378                 struct request_sock *req = inet_reqsk(sk);
1379                 struct sock *nsk = NULL;
1380
1381                 sk = req->rsk_listener;
1382                 tcp_v6_fill_cb(skb, hdr, th);
1383                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1384                         reqsk_put(req);
1385                         goto discard_it;
1386                 }
1387                 if (likely(sk->sk_state == TCP_LISTEN)) {
1388                         nsk = tcp_check_req(sk, skb, req, false);
1389                 } else {
1390                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1391                         goto lookup;
1392                 }
1393                 if (!nsk) {
1394                         reqsk_put(req);
1395                         goto discard_it;
1396                 }
1397                 if (nsk == sk) {
1398                         sock_hold(sk);
1399                         reqsk_put(req);
1400                         tcp_v6_restore_cb(skb);
1401                 } else if (tcp_child_process(sk, nsk, skb)) {
1402                         tcp_v6_send_reset(nsk, skb);
1403                         goto discard_it;
1404                 } else {
1405                         return 0;
1406                 }
1407         }
1408         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1409                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1410                 goto discard_and_relse;
1411         }
1412
1413         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1414                 goto discard_and_relse;
1415
1416         tcp_v6_fill_cb(skb, hdr, th);
1417
1418         if (tcp_v6_inbound_md5_hash(sk, skb))
1419                 goto discard_and_relse;
1420
1421         if (sk_filter(sk, skb))
1422                 goto discard_and_relse;
1423
1424         skb->dev = NULL;
1425
1426         if (sk->sk_state == TCP_LISTEN) {
1427                 ret = tcp_v6_do_rcv(sk, skb);
1428                 goto put_and_return;
1429         }
1430
1431         sk_incoming_cpu_update(sk);
1432
1433         bh_lock_sock_nested(sk);
1434         tcp_sk(sk)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
1435         ret = 0;
1436         if (!sock_owned_by_user(sk)) {
1437                 if (!tcp_prequeue(sk, skb))
1438                         ret = tcp_v6_do_rcv(sk, skb);
1439         } else if (unlikely(sk_add_backlog(sk, skb,
1440                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1441                 bh_unlock_sock(sk);
1442                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1443                 goto discard_and_relse;
1444         }
1445         bh_unlock_sock(sk);
1446
1447 put_and_return:
1448         sock_put(sk);
1449         return ret ? -1 : 0;
1450
1451 no_tcp_socket:
1452         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1453                 goto discard_it;
1454
1455         tcp_v6_fill_cb(skb, hdr, th);
1456
1457         if (tcp_checksum_complete(skb)) {
1458 csum_error:
1459                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1460 bad_packet:
1461                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1462         } else {
1463                 tcp_v6_send_reset(NULL, skb);
1464         }
1465
1466 discard_it:
1467         kfree_skb(skb);
1468         return 0;
1469
1470 discard_and_relse:
1471         sock_put(sk);
1472         goto discard_it;
1473
1474 do_time_wait:
1475         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1476                 inet_twsk_put(inet_twsk(sk));
1477                 goto discard_it;
1478         }
1479
1480         tcp_v6_fill_cb(skb, hdr, th);
1481
1482         if (tcp_checksum_complete(skb)) {
1483                 inet_twsk_put(inet_twsk(sk));
1484                 goto csum_error;
1485         }
1486
1487         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1488         case TCP_TW_SYN:
1489         {
1490                 struct sock *sk2;
1491
1492                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1493                                             &ipv6_hdr(skb)->saddr, th->source,
1494                                             &ipv6_hdr(skb)->daddr,
1495                                             ntohs(th->dest), tcp_v6_iif(skb));
1496                 if (sk2) {
1497                         struct inet_timewait_sock *tw = inet_twsk(sk);
1498                         inet_twsk_deschedule_put(tw);
1499                         sk = sk2;
1500                         tcp_v6_restore_cb(skb);
1501                         goto process;
1502                 }
1503                 /* Fall through to ACK */
1504         }
1505         case TCP_TW_ACK:
1506                 tcp_v6_timewait_ack(sk, skb);
1507                 break;
1508         case TCP_TW_RST:
1509                 tcp_v6_restore_cb(skb);
1510                 goto no_tcp_socket;
1511         case TCP_TW_SUCCESS:
1512                 ;
1513         }
1514         goto discard_it;
1515 }
1516
1517 static void tcp_v6_early_demux(struct sk_buff *skb)
1518 {
1519         const struct ipv6hdr *hdr;
1520         const struct tcphdr *th;
1521         struct sock *sk;
1522
1523         if (skb->pkt_type != PACKET_HOST)
1524                 return;
1525
1526         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1527                 return;
1528
1529         hdr = ipv6_hdr(skb);
1530         th = tcp_hdr(skb);
1531
1532         if (th->doff < sizeof(struct tcphdr) / 4)
1533                 return;
1534
1535         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1536         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1537                                         &hdr->saddr, th->source,
1538                                         &hdr->daddr, ntohs(th->dest),
1539                                         inet6_iif(skb));
1540         if (sk) {
1541                 skb->sk = sk;
1542                 skb->destructor = sock_edemux;
1543                 if (sk_fullsock(sk)) {
1544                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1545
1546                         if (dst)
1547                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1548                         if (dst &&
1549                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1550                                 skb_dst_set_noref(skb, dst);
1551                 }
1552         }
1553 }
1554
1555 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1556         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1557         .twsk_unique    = tcp_twsk_unique,
1558         .twsk_destructor = tcp_twsk_destructor,
1559 };
1560
1561 static const struct inet_connection_sock_af_ops ipv6_specific = {
1562         .queue_xmit        = inet6_csk_xmit,
1563         .send_check        = tcp_v6_send_check,
1564         .rebuild_header    = inet6_sk_rebuild_header,
1565         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1566         .conn_request      = tcp_v6_conn_request,
1567         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1568         .net_header_len    = sizeof(struct ipv6hdr),
1569         .net_frag_header_len = sizeof(struct frag_hdr),
1570         .setsockopt        = ipv6_setsockopt,
1571         .getsockopt        = ipv6_getsockopt,
1572         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1573         .sockaddr_len      = sizeof(struct sockaddr_in6),
1574         .bind_conflict     = inet6_csk_bind_conflict,
1575 #ifdef CONFIG_COMPAT
1576         .compat_setsockopt = compat_ipv6_setsockopt,
1577         .compat_getsockopt = compat_ipv6_getsockopt,
1578 #endif
1579         .mtu_reduced       = tcp_v6_mtu_reduced,
1580 };
1581
1582 #ifdef CONFIG_TCP_MD5SIG
1583 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1584         .md5_lookup     =       tcp_v6_md5_lookup,
1585         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1586         .md5_parse      =       tcp_v6_parse_md5_keys,
1587 };
1588 #endif
1589
1590 /*
1591  *      TCP over IPv4 via INET6 API
1592  */
1593 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1594         .queue_xmit        = ip_queue_xmit,
1595         .send_check        = tcp_v4_send_check,
1596         .rebuild_header    = inet_sk_rebuild_header,
1597         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1598         .conn_request      = tcp_v6_conn_request,
1599         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1600         .net_header_len    = sizeof(struct iphdr),
1601         .setsockopt        = ipv6_setsockopt,
1602         .getsockopt        = ipv6_getsockopt,
1603         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1604         .sockaddr_len      = sizeof(struct sockaddr_in6),
1605         .bind_conflict     = inet6_csk_bind_conflict,
1606 #ifdef CONFIG_COMPAT
1607         .compat_setsockopt = compat_ipv6_setsockopt,
1608         .compat_getsockopt = compat_ipv6_getsockopt,
1609 #endif
1610         .mtu_reduced       = tcp_v4_mtu_reduced,
1611 };
1612
1613 #ifdef CONFIG_TCP_MD5SIG
1614 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1615         .md5_lookup     =       tcp_v4_md5_lookup,
1616         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1617         .md5_parse      =       tcp_v6_parse_md5_keys,
1618 };
1619 #endif
1620
1621 /* NOTE: A lot of things set to zero explicitly by call to
1622  *       sk_alloc() so need not be done here.
1623  */
1624 static int tcp_v6_init_sock(struct sock *sk)
1625 {
1626         struct inet_connection_sock *icsk = inet_csk(sk);
1627
1628         tcp_init_sock(sk);
1629
1630         icsk->icsk_af_ops = &ipv6_specific;
1631
1632 #ifdef CONFIG_TCP_MD5SIG
1633         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1634 #endif
1635
1636         return 0;
1637 }
1638
1639 static void tcp_v6_destroy_sock(struct sock *sk)
1640 {
1641         tcp_v4_destroy_sock(sk);
1642         inet6_destroy_sock(sk);
1643 }
1644
1645 #ifdef CONFIG_PROC_FS
1646 /* Proc filesystem TCPv6 sock list dumping. */
1647 static void get_openreq6(struct seq_file *seq,
1648                          const struct request_sock *req, int i)
1649 {
1650         long ttd = req->rsk_timer.expires - jiffies;
1651         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1652         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1653
1654         if (ttd < 0)
1655                 ttd = 0;
1656
1657         seq_printf(seq,
1658                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1659                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1660                    i,
1661                    src->s6_addr32[0], src->s6_addr32[1],
1662                    src->s6_addr32[2], src->s6_addr32[3],
1663                    inet_rsk(req)->ir_num,
1664                    dest->s6_addr32[0], dest->s6_addr32[1],
1665                    dest->s6_addr32[2], dest->s6_addr32[3],
1666                    ntohs(inet_rsk(req)->ir_rmt_port),
1667                    TCP_SYN_RECV,
1668                    0, 0, /* could print option size, but that is af dependent. */
1669                    1,   /* timers active (only the expire timer) */
1670                    jiffies_to_clock_t(ttd),
1671                    req->num_timeout,
1672                    from_kuid_munged(seq_user_ns(seq),
1673                                     sock_i_uid(req->rsk_listener)),
1674                    0,  /* non standard timer */
1675                    0, /* open_requests have no inode */
1676                    0, req);
1677 }
1678
1679 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1680 {
1681         const struct in6_addr *dest, *src;
1682         __u16 destp, srcp;
1683         int timer_active;
1684         unsigned long timer_expires;
1685         const struct inet_sock *inet = inet_sk(sp);
1686         const struct tcp_sock *tp = tcp_sk(sp);
1687         const struct inet_connection_sock *icsk = inet_csk(sp);
1688         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1689
1690         dest  = &sp->sk_v6_daddr;
1691         src   = &sp->sk_v6_rcv_saddr;
1692         destp = ntohs(inet->inet_dport);
1693         srcp  = ntohs(inet->inet_sport);
1694
1695         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1696                 timer_active    = 1;
1697                 timer_expires   = icsk->icsk_timeout;
1698         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1699                 timer_active    = 4;
1700                 timer_expires   = icsk->icsk_timeout;
1701         } else if (timer_pending(&sp->sk_timer)) {
1702                 timer_active    = 2;
1703                 timer_expires   = sp->sk_timer.expires;
1704         } else {
1705                 timer_active    = 0;
1706                 timer_expires = jiffies;
1707         }
1708
1709         seq_printf(seq,
1710                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1711                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1712                    i,
1713                    src->s6_addr32[0], src->s6_addr32[1],
1714                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1715                    dest->s6_addr32[0], dest->s6_addr32[1],
1716                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1717                    sp->sk_state,
1718                    tp->write_seq-tp->snd_una,
1719                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1720                    timer_active,
1721                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1722                    icsk->icsk_retransmits,
1723                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1724                    icsk->icsk_probes_out,
1725                    sock_i_ino(sp),
1726                    atomic_read(&sp->sk_refcnt), sp,
1727                    jiffies_to_clock_t(icsk->icsk_rto),
1728                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1729                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1730                    tp->snd_cwnd,
1731                    sp->sk_state == TCP_LISTEN ?
1732                         fastopenq->max_qlen :
1733                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1734                    );
1735 }
1736
1737 static void get_timewait6_sock(struct seq_file *seq,
1738                                struct inet_timewait_sock *tw, int i)
1739 {
1740         long delta = tw->tw_timer.expires - jiffies;
1741         const struct in6_addr *dest, *src;
1742         __u16 destp, srcp;
1743
1744         dest = &tw->tw_v6_daddr;
1745         src  = &tw->tw_v6_rcv_saddr;
1746         destp = ntohs(tw->tw_dport);
1747         srcp  = ntohs(tw->tw_sport);
1748
1749         seq_printf(seq,
1750                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1751                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1752                    i,
1753                    src->s6_addr32[0], src->s6_addr32[1],
1754                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1755                    dest->s6_addr32[0], dest->s6_addr32[1],
1756                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1757                    tw->tw_substate, 0, 0,
1758                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1759                    atomic_read(&tw->tw_refcnt), tw);
1760 }
1761
1762 static int tcp6_seq_show(struct seq_file *seq, void *v)
1763 {
1764         struct tcp_iter_state *st;
1765         struct sock *sk = v;
1766
1767         if (v == SEQ_START_TOKEN) {
1768                 seq_puts(seq,
1769                          "  sl  "
1770                          "local_address                         "
1771                          "remote_address                        "
1772                          "st tx_queue rx_queue tr tm->when retrnsmt"
1773                          "   uid  timeout inode\n");
1774                 goto out;
1775         }
1776         st = seq->private;
1777
1778         if (sk->sk_state == TCP_TIME_WAIT)
1779                 get_timewait6_sock(seq, v, st->num);
1780         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1781                 get_openreq6(seq, v, st->num);
1782         else
1783                 get_tcp6_sock(seq, v, st->num);
1784 out:
1785         return 0;
1786 }
1787
1788 static const struct file_operations tcp6_afinfo_seq_fops = {
1789         .owner   = THIS_MODULE,
1790         .open    = tcp_seq_open,
1791         .read    = seq_read,
1792         .llseek  = seq_lseek,
1793         .release = seq_release_net
1794 };
1795
1796 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1797         .name           = "tcp6",
1798         .family         = AF_INET6,
1799         .seq_fops       = &tcp6_afinfo_seq_fops,
1800         .seq_ops        = {
1801                 .show           = tcp6_seq_show,
1802         },
1803 };
1804
1805 int __net_init tcp6_proc_init(struct net *net)
1806 {
1807         return tcp_proc_register(net, &tcp6_seq_afinfo);
1808 }
1809
1810 void tcp6_proc_exit(struct net *net)
1811 {
1812         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1813 }
1814 #endif
1815
1816 static void tcp_v6_clear_sk(struct sock *sk, int size)
1817 {
1818         struct inet_sock *inet = inet_sk(sk);
1819
1820         /* we do not want to clear pinet6 field, because of RCU lookups */
1821         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1822
1823         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1824         memset(&inet->pinet6 + 1, 0, size);
1825 }
1826
1827 struct proto tcpv6_prot = {
1828         .name                   = "TCPv6",
1829         .owner                  = THIS_MODULE,
1830         .close                  = tcp_close,
1831         .connect                = tcp_v6_connect,
1832         .disconnect             = tcp_disconnect,
1833         .accept                 = inet_csk_accept,
1834         .ioctl                  = tcp_ioctl,
1835         .init                   = tcp_v6_init_sock,
1836         .destroy                = tcp_v6_destroy_sock,
1837         .shutdown               = tcp_shutdown,
1838         .setsockopt             = tcp_setsockopt,
1839         .getsockopt             = tcp_getsockopt,
1840         .recvmsg                = tcp_recvmsg,
1841         .sendmsg                = tcp_sendmsg,
1842         .sendpage               = tcp_sendpage,
1843         .backlog_rcv            = tcp_v6_do_rcv,
1844         .release_cb             = tcp_release_cb,
1845         .hash                   = inet_hash,
1846         .unhash                 = inet_unhash,
1847         .get_port               = inet_csk_get_port,
1848         .enter_memory_pressure  = tcp_enter_memory_pressure,
1849         .stream_memory_free     = tcp_stream_memory_free,
1850         .sockets_allocated      = &tcp_sockets_allocated,
1851         .memory_allocated       = &tcp_memory_allocated,
1852         .memory_pressure        = &tcp_memory_pressure,
1853         .orphan_count           = &tcp_orphan_count,
1854         .sysctl_mem             = sysctl_tcp_mem,
1855         .sysctl_wmem            = sysctl_tcp_wmem,
1856         .sysctl_rmem            = sysctl_tcp_rmem,
1857         .max_header             = MAX_TCP_HEADER,
1858         .obj_size               = sizeof(struct tcp6_sock),
1859         .slab_flags             = SLAB_DESTROY_BY_RCU,
1860         .twsk_prot              = &tcp6_timewait_sock_ops,
1861         .rsk_prot               = &tcp6_request_sock_ops,
1862         .h.hashinfo             = &tcp_hashinfo,
1863         .no_autobind            = true,
1864 #ifdef CONFIG_COMPAT
1865         .compat_setsockopt      = compat_tcp_setsockopt,
1866         .compat_getsockopt      = compat_tcp_getsockopt,
1867 #endif
1868 #ifdef CONFIG_MEMCG_KMEM
1869         .proto_cgroup           = tcp_proto_cgroup,
1870 #endif
1871         .clear_sk               = tcp_v6_clear_sk,
1872 };
1873
1874 static const struct inet6_protocol tcpv6_protocol = {
1875         .early_demux    =       tcp_v6_early_demux,
1876         .handler        =       tcp_v6_rcv,
1877         .err_handler    =       tcp_v6_err,
1878         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1879 };
1880
1881 static struct inet_protosw tcpv6_protosw = {
1882         .type           =       SOCK_STREAM,
1883         .protocol       =       IPPROTO_TCP,
1884         .prot           =       &tcpv6_prot,
1885         .ops            =       &inet6_stream_ops,
1886         .flags          =       INET_PROTOSW_PERMANENT |
1887                                 INET_PROTOSW_ICSK,
1888 };
1889
1890 static int __net_init tcpv6_net_init(struct net *net)
1891 {
1892         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1893                                     SOCK_RAW, IPPROTO_TCP, net);
1894 }
1895
1896 static void __net_exit tcpv6_net_exit(struct net *net)
1897 {
1898         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1899 }
1900
1901 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1902 {
1903         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1904 }
1905
1906 static struct pernet_operations tcpv6_net_ops = {
1907         .init       = tcpv6_net_init,
1908         .exit       = tcpv6_net_exit,
1909         .exit_batch = tcpv6_net_exit_batch,
1910 };
1911
1912 int __init tcpv6_init(void)
1913 {
1914         int ret;
1915
1916         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1917         if (ret)
1918                 goto out;
1919
1920         /* register inet6 protocol */
1921         ret = inet6_register_protosw(&tcpv6_protosw);
1922         if (ret)
1923                 goto out_tcpv6_protocol;
1924
1925         ret = register_pernet_subsys(&tcpv6_net_ops);
1926         if (ret)
1927                 goto out_tcpv6_protosw;
1928 out:
1929         return ret;
1930
1931 out_tcpv6_protosw:
1932         inet6_unregister_protosw(&tcpv6_protosw);
1933 out_tcpv6_protocol:
1934         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1935         goto out;
1936 }
1937
1938 void tcpv6_exit(void)
1939 {
1940         unregister_pernet_subsys(&tcpv6_net_ops);
1941         inet6_unregister_protosw(&tcpv6_protosw);
1942         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1943 }