net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/busy_poll.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <crypto/hash.h>
  70 #include <linux/scatterlist.h>
  71
  72 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  73 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  74                                       struct request_sock *req);
  75
  76 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  77
  78 static const struct inet_connection_sock_af_ops ipv6_mapped;
  79 static const struct inet_connection_sock_af_ops ipv6_specific;
  80 #ifdef CONFIG_TCP_MD5SIG
  81 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  83 #else
  84 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  85                                                    const struct in6_addr *addr)
  86 {
  87         return NULL;
  88 }
  89 #endif
  90
  91 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  92 {
  93         struct dst_entry *dst = skb_dst(skb);
  94
  95         if (dst && dst_hold_safe(dst)) {
  96                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  97
  98                 sk->sk_rx_dst = dst;
  99                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 100                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 101         }
 102 }
 103
 104 static u32 tcp_v6_init_sequence(const struct sk_buff *skb, u32 *tsoff)
 105 {
 106         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 107                                             ipv6_hdr(skb)->saddr.s6_addr32,
 108                                             tcp_hdr(skb)->dest,
 109                                             tcp_hdr(skb)->source, tsoff);
 110 }
 111
 112 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 113                           int addr_len)
 114 {
 115         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 116         struct inet_sock *inet = inet_sk(sk);
 117         struct inet_connection_sock *icsk = inet_csk(sk);
 118         struct ipv6_pinfo *np = inet6_sk(sk);
 119         struct tcp_sock *tp = tcp_sk(sk);
 120         struct in6_addr *saddr = NULL, *final_p, final;
 121         struct ipv6_txoptions *opt;
 122         struct flowi6 fl6;
 123         struct dst_entry *dst;
 124         int addr_type;
 125         int err;
 126         struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
 127
 128         if (addr_len < SIN6_LEN_RFC2133)
 129                 return -EINVAL;
 130
 131         if (usin->sin6_family != AF_INET6)
 132                 return -EAFNOSUPPORT;
 133
 134         memset(&fl6, 0, sizeof(fl6));
 135
 136         if (np->sndflow) {
 137                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 138                 IP6_ECN_flow_init(fl6.flowlabel);
 139                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 140                         struct ip6_flowlabel *flowlabel;
 141                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 142                         if (!flowlabel)
 143                                 return -EINVAL;
 144                         fl6_sock_release(flowlabel);
 145                 }
 146         }
 147
 148         /*
 149          *      connect() to INADDR_ANY means loopback (BSD'ism).
 150          */
 151
 152         if (ipv6_addr_any(&usin->sin6_addr))
 153                 usin->sin6_addr.s6_addr[15] = 0x1;
 154
 155         addr_type = ipv6_addr_type(&usin->sin6_addr);
 156
 157         if (addr_type & IPV6_ADDR_MULTICAST)
 158                 return -ENETUNREACH;
 159
 160         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 161                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 162                     usin->sin6_scope_id) {
 163                         /* If interface is set while binding, indices
 164                          * must coincide.
 165                          */
 166                         if (sk->sk_bound_dev_if &&
 167                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 168                                 return -EINVAL;
 169
 170                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 171                 }
 172
 173                 /* Connect to link-local address requires an interface */
 174                 if (!sk->sk_bound_dev_if)
 175                         return -EINVAL;
 176         }
 177
 178         if (tp->rx_opt.ts_recent_stamp &&
 179             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 180                 tp->rx_opt.ts_recent = 0;
 181                 tp->rx_opt.ts_recent_stamp = 0;
 182                 tp->write_seq = 0;
 183         }
 184
 185         sk->sk_v6_daddr = usin->sin6_addr;
 186         np->flow_label = fl6.flowlabel;
 187
 188         /*
 189          *      TCP over IPv4
 190          */
 191
 192         if (addr_type == IPV6_ADDR_MAPPED) {
 193                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 194                 struct sockaddr_in sin;
 195
 196                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 197
 198                 if (__ipv6_only_sock(sk))
 199                         return -ENETUNREACH;
 200
 201                 sin.sin_family = AF_INET;
 202                 sin.sin_port = usin->sin6_port;
 203                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 204
 205                 icsk->icsk_af_ops = &ipv6_mapped;
 206                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 207 #ifdef CONFIG_TCP_MD5SIG
 208                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 209 #endif
 210
 211                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 212
 213                 if (err) {
 214                         icsk->icsk_ext_hdr_len = exthdrlen;
 215                         icsk->icsk_af_ops = &ipv6_specific;
 216                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 217 #ifdef CONFIG_TCP_MD5SIG
 218                         tp->af_specific = &tcp_sock_ipv6_specific;
 219 #endif
 220                         goto failure;
 221                 }
 222                 np->saddr = sk->sk_v6_rcv_saddr;
 223
 224                 return err;
 225         }
 226
 227         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 228                 saddr = &sk->sk_v6_rcv_saddr;
 229
 230         fl6.flowi6_proto = IPPROTO_TCP;
 231         fl6.daddr = sk->sk_v6_daddr;
 232         fl6.saddr = saddr ? *saddr : np->saddr;
 233         fl6.flowi6_oif = sk->sk_bound_dev_if;
 234         fl6.flowi6_mark = sk->sk_mark;
 235         fl6.fl6_dport = usin->sin6_port;
 236         fl6.fl6_sport = inet->inet_sport;
 237         fl6.flowi6_uid = sk->sk_uid;
 238
 239         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 240         final_p = fl6_update_dst(&fl6, opt, &final);
 241
 242         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 243
 244         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 245         if (IS_ERR(dst)) {
 246                 err = PTR_ERR(dst);
 247                 goto failure;
 248         }
 249
 250         if (!saddr) {
 251                 saddr = &fl6.saddr;
 252                 sk->sk_v6_rcv_saddr = *saddr;
 253         }
 254
 255         /* set the source address */
 256         np->saddr = *saddr;
 257         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 258
 259         sk->sk_gso_type = SKB_GSO_TCPV6;
 260         ip6_dst_store(sk, dst, NULL, NULL);
 261
 262         if (tcp_death_row->sysctl_tw_recycle &&
 263             !tp->rx_opt.ts_recent_stamp &&
 264             ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
 265                 tcp_fetch_timewait_stamp(sk, dst);
 266
 267         icsk->icsk_ext_hdr_len = 0;
 268         if (opt)
 269                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 270                                          opt->opt_nflen;
 271
 272         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 273
 274         inet->inet_dport = usin->sin6_port;
 275
 276         tcp_set_state(sk, TCP_SYN_SENT);
 277         err = inet6_hash_connect(tcp_death_row, sk);
 278         if (err)
 279                 goto late_failure;
 280
 281         sk_set_txhash(sk);
 282
 283         if (!tp->write_seq && likely(!tp->repair))
 284                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 285                                                              sk->sk_v6_daddr.s6_addr32,
 286                                                              inet->inet_sport,
 287                                                              inet->inet_dport,
 288                                                              &tp->tsoffset);
 289
 290         err = tcp_connect(sk);
 291         if (err)
 292                 goto late_failure;
 293
 294         return 0;
 295
 296 late_failure:
 297         tcp_set_state(sk, TCP_CLOSE);
 298         __sk_dst_reset(sk);
 299 failure:
 300         inet->inet_dport = 0;
 301         sk->sk_route_caps = 0;
 302         return err;
 303 }
 304
 305 static void tcp_v6_mtu_reduced(struct sock *sk)
 306 {
 307         struct dst_entry *dst;
 308
 309         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 310                 return;
 311
 312         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 313         if (!dst)
 314                 return;
 315
 316         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 317                 tcp_sync_mss(sk, dst_mtu(dst));
 318                 tcp_simple_retransmit(sk);
 319         }
 320 }
 321
 322 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 323                 u8 type, u8 code, int offset, __be32 info)
 324 {
 325         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 326         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 327         struct net *net = dev_net(skb->dev);
 328         struct request_sock *fastopen;
 329         struct ipv6_pinfo *np;
 330         struct tcp_sock *tp;
 331         __u32 seq, snd_una;
 332         struct sock *sk;
 333         bool fatal;
 334         int err;
 335
 336         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 337                                         &hdr->daddr, th->dest,
 338                                         &hdr->saddr, ntohs(th->source),
 339                                         skb->dev->ifindex);
 340
 341         if (!sk) {
 342                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 343                                   ICMP6_MIB_INERRORS);
 344                 return;
 345         }
 346
 347         if (sk->sk_state == TCP_TIME_WAIT) {
 348                 inet_twsk_put(inet_twsk(sk));
 349                 return;
 350         }
 351         seq = ntohl(th->seq);
 352         fatal = icmpv6_err_convert(type, code, &err);
 353         if (sk->sk_state == TCP_NEW_SYN_RECV)
 354                 return tcp_req_err(sk, seq, fatal);
 355
 356         bh_lock_sock(sk);
 357         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 358                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 359
 360         if (sk->sk_state == TCP_CLOSE)
 361                 goto out;
 362
 363         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 364                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 365                 goto out;
 366         }
 367
 368         tp = tcp_sk(sk);
 369         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 370         fastopen = tp->fastopen_rsk;
 371         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 372         if (sk->sk_state != TCP_LISTEN &&
 373             !between(seq, snd_una, tp->snd_nxt)) {
 374                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 375                 goto out;
 376         }
 377
 378         np = inet6_sk(sk);
 379
 380         if (type == NDISC_REDIRECT) {
 381                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 382
 383                 if (dst)
 384                         dst->ops->redirect(dst, sk, skb);
 385                 goto out;
 386         }
 387
 388         if (type == ICMPV6_PKT_TOOBIG) {
 389                 /* We are not interested in TCP_LISTEN and open_requests
 390                  * (SYN-ACKs send out by Linux are always <576bytes so
 391                  * they should go through unfragmented).
 392                  */
 393                 if (sk->sk_state == TCP_LISTEN)
 394                         goto out;
 395
 396                 if (!ip6_sk_accept_pmtu(sk))
 397                         goto out;
 398
 399                 tp->mtu_info = ntohl(info);
 400                 if (!sock_owned_by_user(sk))
 401                         tcp_v6_mtu_reduced(sk);
 402                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 403                                            &sk->sk_tsq_flags))
 404                         sock_hold(sk);
 405                 goto out;
 406         }
 407
 408
 409         /* Might be for an request_sock */
 410         switch (sk->sk_state) {
 411         case TCP_SYN_SENT:
 412         case TCP_SYN_RECV:
 413                 /* Only in fast or simultaneous open. If a fast open socket is
 414                  * is already accepted it is treated as a connected one below.
 415                  */
 416                 if (fastopen && !fastopen->sk)
 417                         break;
 418
 419                 if (!sock_owned_by_user(sk)) {
 420                         sk->sk_err = err;
 421                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 422
 423                         tcp_done(sk);
 424                 } else
 425                         sk->sk_err_soft = err;
 426                 goto out;
 427         }
 428
 429         if (!sock_owned_by_user(sk) && np->recverr) {
 430                 sk->sk_err = err;
 431                 sk->sk_error_report(sk);
 432         } else
 433                 sk->sk_err_soft = err;
 434
 435 out:
 436         bh_unlock_sock(sk);
 437         sock_put(sk);
 438 }
 439
 440
 441 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 442                               struct flowi *fl,
 443                               struct request_sock *req,
 444                               struct tcp_fastopen_cookie *foc,
 445                               enum tcp_synack_type synack_type)
 446 {
 447         struct inet_request_sock *ireq = inet_rsk(req);
 448         struct ipv6_pinfo *np = inet6_sk(sk);
 449         struct ipv6_txoptions *opt;
 450         struct flowi6 *fl6 = &fl->u.ip6;
 451         struct sk_buff *skb;
 452         int err = -ENOMEM;
 453
 454         /* First, grab a route. */
 455         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 456                                                IPPROTO_TCP)) == NULL)
 457                 goto done;
 458
 459         skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 460
 461         if (skb) {
 462                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 463                                     &ireq->ir_v6_rmt_addr);
 464
 465                 fl6->daddr = ireq->ir_v6_rmt_addr;
 466                 if (np->repflow && ireq->pktopts)
 467                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 468
 469                 rcu_read_lock();
 470                 opt = ireq->ipv6_opt;
 471                 if (!opt)
 472                         opt = rcu_dereference(np->opt);
 473                 err = ip6_xmit(sk, skb, fl6, opt, np->tclass);
 474                 rcu_read_unlock();
 475                 err = net_xmit_eval(err);
 476         }
 477
 478 done:
 479         return err;
 480 }
 481
 482
 483 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 484 {
 485         kfree(inet_rsk(req)->ipv6_opt);
 486         kfree_skb(inet_rsk(req)->pktopts);
 487 }
 488
 489 #ifdef CONFIG_TCP_MD5SIG
 490 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 491                                                    const struct in6_addr *addr)
 492 {
 493         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 494 }
 495
 496 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 497                                                 const struct sock *addr_sk)
 498 {
 499         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 500 }
 501
 502 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 503                                  int optlen)
 504 {
 505         struct tcp_md5sig cmd;
 506         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 507
 508         if (optlen < sizeof(cmd))
 509                 return -EINVAL;
 510
 511         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 512                 return -EFAULT;
 513
 514         if (sin6->sin6_family != AF_INET6)
 515                 return -EINVAL;
 516
 517         if (!cmd.tcpm_keylen) {
 518                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 519                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 520                                               AF_INET);
 521                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 522                                       AF_INET6);
 523         }
 524
 525         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 526                 return -EINVAL;
 527
 528         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 529                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 530                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 531
 532         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 533                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 534 }
 535
 536 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 537                                    const struct in6_addr *daddr,
 538                                    const struct in6_addr *saddr,
 539                                    const struct tcphdr *th, int nbytes)
 540 {
 541         struct tcp6_pseudohdr *bp;
 542         struct scatterlist sg;
 543         struct tcphdr *_th;
 544
 545         bp = hp->scratch;
 546         /* 1. TCP pseudo-header (RFC2460) */
 547         bp->saddr = *saddr;
 548         bp->daddr = *daddr;
 549         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 550         bp->len = cpu_to_be32(nbytes);
 551
 552         _th = (struct tcphdr *)(bp + 1);
 553         memcpy(_th, th, sizeof(*th));
 554         _th->check = 0;
 555
 556         sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 557         ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 558                                 sizeof(*bp) + sizeof(*th));
 559         return crypto_ahash_update(hp->md5_req);
 560 }
 561
 562 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 563                                const struct in6_addr *daddr, struct in6_addr *saddr,
 564                                const struct tcphdr *th)
 565 {
 566         struct tcp_md5sig_pool *hp;
 567         struct ahash_request *req;
 568
 569         hp = tcp_get_md5sig_pool();
 570         if (!hp)
 571                 goto clear_hash_noput;
 572         req = hp->md5_req;
 573
 574         if (crypto_ahash_init(req))
 575                 goto clear_hash;
 576         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 577                 goto clear_hash;
 578         if (tcp_md5_hash_key(hp, key))
 579                 goto clear_hash;
 580         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 581         if (crypto_ahash_final(req))
 582                 goto clear_hash;
 583
 584         tcp_put_md5sig_pool();
 585         return 0;
 586
 587 clear_hash:
 588         tcp_put_md5sig_pool();
 589 clear_hash_noput:
 590         memset(md5_hash, 0, 16);
 591         return 1;
 592 }
 593
 594 static int tcp_v6_md5_hash_skb(char *md5_hash,
 595                                const struct tcp_md5sig_key *key,
 596                                const struct sock *sk,
 597                                const struct sk_buff *skb)
 598 {
 599         const struct in6_addr *saddr, *daddr;
 600         struct tcp_md5sig_pool *hp;
 601         struct ahash_request *req;
 602         const struct tcphdr *th = tcp_hdr(skb);
 603
 604         if (sk) { /* valid for establish/request sockets */
 605                 saddr = &sk->sk_v6_rcv_saddr;
 606                 daddr = &sk->sk_v6_daddr;
 607         } else {
 608                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 609                 saddr = &ip6h->saddr;
 610                 daddr = &ip6h->daddr;
 611         }
 612
 613         hp = tcp_get_md5sig_pool();
 614         if (!hp)
 615                 goto clear_hash_noput;
 616         req = hp->md5_req;
 617
 618         if (crypto_ahash_init(req))
 619                 goto clear_hash;
 620
 621         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 622                 goto clear_hash;
 623         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 624                 goto clear_hash;
 625         if (tcp_md5_hash_key(hp, key))
 626                 goto clear_hash;
 627         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 628         if (crypto_ahash_final(req))
 629                 goto clear_hash;
 630
 631         tcp_put_md5sig_pool();
 632         return 0;
 633
 634 clear_hash:
 635         tcp_put_md5sig_pool();
 636 clear_hash_noput:
 637         memset(md5_hash, 0, 16);
 638         return 1;
 639 }
 640
 641 #endif
 642
 643 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 644                                     const struct sk_buff *skb)
 645 {
 646 #ifdef CONFIG_TCP_MD5SIG
 647         const __u8 *hash_location = NULL;
 648         struct tcp_md5sig_key *hash_expected;
 649         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 650         const struct tcphdr *th = tcp_hdr(skb);
 651         int genhash;
 652         u8 newhash[16];
 653
 654         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 655         hash_location = tcp_parse_md5sig_option(th);
 656
 657         /* We've parsed the options - do we have a hash? */
 658         if (!hash_expected && !hash_location)
 659                 return false;
 660
 661         if (hash_expected && !hash_location) {
 662                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 663                 return true;
 664         }
 665
 666         if (!hash_expected && hash_location) {
 667                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 668                 return true;
 669         }
 670
 671         /* check the signature */
 672         genhash = tcp_v6_md5_hash_skb(newhash,
 673                                       hash_expected,
 674                                       NULL, skb);
 675
 676         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 677                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 678                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 679                                      genhash ? "failed" : "mismatch",
 680                                      &ip6h->saddr, ntohs(th->source),
 681                                      &ip6h->daddr, ntohs(th->dest));
 682                 return true;
 683         }
 684 #endif
 685         return false;
 686 }
 687
 688 static void tcp_v6_init_req(struct request_sock *req,
 689                             const struct sock *sk_listener,
 690                             struct sk_buff *skb)
 691 {
 692         struct inet_request_sock *ireq = inet_rsk(req);
 693         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 694
 695         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 696         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 697
 698         /* So that link locals have meaning */
 699         if (!sk_listener->sk_bound_dev_if &&
 700             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 701                 ireq->ir_iif = tcp_v6_iif(skb);
 702
 703         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 704             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 705              np->rxopt.bits.rxinfo ||
 706              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 707              np->rxopt.bits.rxohlim || np->repflow)) {
 708                 atomic_inc(&skb->users);
 709                 ireq->pktopts = skb;
 710         }
 711 }
 712
 713 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 714                                           struct flowi *fl,
 715                                           const struct request_sock *req,
 716                                           bool *strict)
 717 {
 718         if (strict)
 719                 *strict = true;
 720         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 721 }
 722
 723 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 724         .family         =       AF_INET6,
 725         .obj_size       =       sizeof(struct tcp6_request_sock),
 726         .rtx_syn_ack    =       tcp_rtx_synack,
 727         .send_ack       =       tcp_v6_reqsk_send_ack,
 728         .destructor     =       tcp_v6_reqsk_destructor,
 729         .send_reset     =       tcp_v6_send_reset,
 730         .syn_ack_timeout =      tcp_syn_ack_timeout,
 731 };
 732
 733 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 734         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 735                                 sizeof(struct ipv6hdr),
 736 #ifdef CONFIG_TCP_MD5SIG
 737         .req_md5_lookup =       tcp_v6_md5_lookup,
 738         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 739 #endif
 740         .init_req       =       tcp_v6_init_req,
 741 #ifdef CONFIG_SYN_COOKIES
 742         .cookie_init_seq =      cookie_v6_init_sequence,
 743 #endif
 744         .route_req      =       tcp_v6_route_req,
 745         .init_seq       =       tcp_v6_init_sequence,
 746         .send_synack    =       tcp_v6_send_synack,
 747 };
 748
 749 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 750                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 751                                  int oif, struct tcp_md5sig_key *key, int rst,
 752                                  u8 tclass, __be32 label)
 753 {
 754         const struct tcphdr *th = tcp_hdr(skb);
 755         struct tcphdr *t1;
 756         struct sk_buff *buff;
 757         struct flowi6 fl6;
 758         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 759         struct sock *ctl_sk = net->ipv6.tcp_sk;
 760         unsigned int tot_len = sizeof(struct tcphdr);
 761         struct dst_entry *dst;
 762         __be32 *topt;
 763
 764         if (tsecr)
 765                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 766 #ifdef CONFIG_TCP_MD5SIG
 767         if (key)
 768                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 769 #endif
 770
 771         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 772                          GFP_ATOMIC);
 773         if (!buff)
 774                 return;
 775
 776         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 777
 778         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 779         skb_reset_transport_header(buff);
 780
 781         /* Swap the send and the receive. */
 782         memset(t1, 0, sizeof(*t1));
 783         t1->dest = th->source;
 784         t1->source = th->dest;
 785         t1->doff = tot_len / 4;
 786         t1->seq = htonl(seq);
 787         t1->ack_seq = htonl(ack);
 788         t1->ack = !rst || !th->ack;
 789         t1->rst = rst;
 790         t1->window = htons(win);
 791
 792         topt = (__be32 *)(t1 + 1);
 793
 794         if (tsecr) {
 795                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 796                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 797                 *topt++ = htonl(tsval);
 798                 *topt++ = htonl(tsecr);
 799         }
 800
 801 #ifdef CONFIG_TCP_MD5SIG
 802         if (key) {
 803                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 804                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 805                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 806                                     &ipv6_hdr(skb)->saddr,
 807                                     &ipv6_hdr(skb)->daddr, t1);
 808         }
 809 #endif
 810
 811         memset(&fl6, 0, sizeof(fl6));
 812         fl6.daddr = ipv6_hdr(skb)->saddr;
 813         fl6.saddr = ipv6_hdr(skb)->daddr;
 814         fl6.flowlabel = label;
 815
 816         buff->ip_summed = CHECKSUM_PARTIAL;
 817         buff->csum = 0;
 818
 819         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 820
 821         fl6.flowi6_proto = IPPROTO_TCP;
 822         if (rt6_need_strict(&fl6.daddr) && !oif)
 823                 fl6.flowi6_oif = tcp_v6_iif(skb);
 824         else {
 825                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 826                         oif = skb->skb_iif;
 827
 828                 fl6.flowi6_oif = oif;
 829         }
 830
 831         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 832         fl6.fl6_dport = t1->dest;
 833         fl6.fl6_sport = t1->source;
 834         fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 835         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 836
 837         /* Pass a socket to ip6_dst_lookup either it is for RST
 838          * Underlying function will use this to retrieve the network
 839          * namespace
 840          */
 841         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 842         if (!IS_ERR(dst)) {
 843                 skb_dst_set(buff, dst);
 844                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 845                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 846                 if (rst)
 847                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 848                 return;
 849         }
 850
 851         kfree_skb(buff);
 852 }
 853
 854 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 855 {
 856         const struct tcphdr *th = tcp_hdr(skb);
 857         u32 seq = 0, ack_seq = 0;
 858         struct tcp_md5sig_key *key = NULL;
 859 #ifdef CONFIG_TCP_MD5SIG
 860         const __u8 *hash_location = NULL;
 861         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 862         unsigned char newhash[16];
 863         int genhash;
 864         struct sock *sk1 = NULL;
 865 #endif
 866         int oif;
 867
 868         if (th->rst)
 869                 return;
 870
 871         /* If sk not NULL, it means we did a successful lookup and incoming
 872          * route had to be correct. prequeue might have dropped our dst.
 873          */
 874         if (!sk && !ipv6_unicast_destination(skb))
 875                 return;
 876
 877 #ifdef CONFIG_TCP_MD5SIG
 878         rcu_read_lock();
 879         hash_location = tcp_parse_md5sig_option(th);
 880         if (sk && sk_fullsock(sk)) {
 881                 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 882         } else if (hash_location) {
 883                 /*
 884                  * active side is lost. Try to find listening socket through
 885                  * source port, and then find md5 key through listening socket.
 886                  * we are not loose security here:
 887                  * Incoming packet is checked with md5 hash with finding key,
 888                  * no RST generated if md5 hash doesn't match.
 889                  */
 890                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 891                                            &tcp_hashinfo, NULL, 0,
 892                                            &ipv6h->saddr,
 893                                            th->source, &ipv6h->daddr,
 894                                            ntohs(th->source), tcp_v6_iif(skb));
 895                 if (!sk1)
 896                         goto out;
 897
 898                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 899                 if (!key)
 900                         goto out;
 901
 902                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 903                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 904                         goto out;
 905         }
 906 #endif
 907
 908         if (th->ack)
 909                 seq = ntohl(th->ack_seq);
 910         else
 911                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 912                           (th->doff << 2);
 913
 914         oif = sk ? sk->sk_bound_dev_if : 0;
 915         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 916
 917 #ifdef CONFIG_TCP_MD5SIG
 918 out:
 919         rcu_read_unlock();
 920 #endif
 921 }
 922
 923 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 924                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 925                             struct tcp_md5sig_key *key, u8 tclass,
 926                             __be32 label)
 927 {
 928         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 929                              tclass, label);
 930 }
 931
 932 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 933 {
 934         struct inet_timewait_sock *tw = inet_twsk(sk);
 935         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 936
 937         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 938                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 939                         tcp_time_stamp + tcptw->tw_ts_offset,
 940                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 941                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 942
 943         inet_twsk_put(tw);
 944 }
 945
 946 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 947                                   struct request_sock *req)
 948 {
 949         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 950          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 951          */
 952         /* RFC 7323 2.3
 953          * The window field (SEG.WND) of every outgoing segment, with the
 954          * exception of <SYN> segments, MUST be right-shifted by
 955          * Rcv.Wind.Shift bits:
 956          */
 957         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 958                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
 959                         tcp_rsk(req)->rcv_nxt,
 960                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
 961                         tcp_time_stamp + tcp_rsk(req)->ts_off,
 962                         req->ts_recent, sk->sk_bound_dev_if,
 963                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 964                         0, 0);
 965 }
 966
 967
 968 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
 969 {
 970 #ifdef CONFIG_SYN_COOKIES
 971         const struct tcphdr *th = tcp_hdr(skb);
 972
 973         if (!th->syn)
 974                 sk = cookie_v6_check(sk, skb);
 975 #endif
 976         return sk;
 977 }
 978
 979 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 980 {
 981         if (skb->protocol == htons(ETH_P_IP))
 982                 return tcp_v4_conn_request(sk, skb);
 983
 984         if (!ipv6_unicast_destination(skb))
 985                 goto drop;
 986
 987         return tcp_conn_request(&tcp6_request_sock_ops,
 988                                 &tcp_request_sock_ipv6_ops, sk, skb);
 989
 990 drop:
 991         tcp_listendrop(sk);
 992         return 0; /* don't send reset */
 993 }
 994
 995 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
 996                                          struct request_sock *req,
 997                                          struct dst_entry *dst,
 998                                          struct request_sock *req_unhash,
 999                                          bool *own_req)
1000 {
1001         struct inet_request_sock *ireq;
1002         struct ipv6_pinfo *newnp;
1003         const struct ipv6_pinfo *np = inet6_sk(sk);
1004         struct ipv6_txoptions *opt;
1005         struct tcp6_sock *newtcp6sk;
1006         struct inet_sock *newinet;
1007         struct tcp_sock *newtp;
1008         struct sock *newsk;
1009 #ifdef CONFIG_TCP_MD5SIG
1010         struct tcp_md5sig_key *key;
1011 #endif
1012         struct flowi6 fl6;
1013
1014         if (skb->protocol == htons(ETH_P_IP)) {
1015                 /*
1016                  *      v6 mapped
1017                  */
1018
1019                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1020                                              req_unhash, own_req);
1021
1022                 if (!newsk)
1023                         return NULL;
1024
1025                 newtcp6sk = (struct tcp6_sock *)newsk;
1026                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1027
1028                 newinet = inet_sk(newsk);
1029                 newnp = inet6_sk(newsk);
1030                 newtp = tcp_sk(newsk);
1031
1032                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1033
1034                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1035
1036                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1037                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1038 #ifdef CONFIG_TCP_MD5SIG
1039                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1040 #endif
1041
1042                 newnp->ipv6_ac_list = NULL;
1043                 newnp->ipv6_fl_list = NULL;
1044                 newnp->pktoptions  = NULL;
1045                 newnp->opt         = NULL;
1046                 newnp->mcast_oif   = tcp_v6_iif(skb);
1047                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1048                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1049                 if (np->repflow)
1050                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1051
1052                 /*
1053                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1054                  * here, tcp_create_openreq_child now does this for us, see the comment in
1055                  * that function for the gory details. -acme
1056                  */
1057
1058                 /* It is tricky place. Until this moment IPv4 tcp
1059                    worked with IPv6 icsk.icsk_af_ops.
1060                    Sync it now.
1061                  */
1062                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1063
1064                 return newsk;
1065         }
1066
1067         ireq = inet_rsk(req);
1068
1069         if (sk_acceptq_is_full(sk))
1070                 goto out_overflow;
1071
1072         if (!dst) {
1073                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1074                 if (!dst)
1075                         goto out;
1076         }
1077
1078         newsk = tcp_create_openreq_child(sk, req, skb);
1079         if (!newsk)
1080                 goto out_nonewsk;
1081
1082         /*
1083          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1084          * count here, tcp_create_openreq_child now does this for us, see the
1085          * comment in that function for the gory details. -acme
1086          */
1087
1088         newsk->sk_gso_type = SKB_GSO_TCPV6;
1089         ip6_dst_store(newsk, dst, NULL, NULL);
1090         inet6_sk_rx_dst_set(newsk, skb);
1091
1092         newtcp6sk = (struct tcp6_sock *)newsk;
1093         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1094
1095         newtp = tcp_sk(newsk);
1096         newinet = inet_sk(newsk);
1097         newnp = inet6_sk(newsk);
1098
1099         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1100
1101         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1102         newnp->saddr = ireq->ir_v6_loc_addr;
1103         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1104         newsk->sk_bound_dev_if = ireq->ir_iif;
1105
1106         /* Now IPv6 options...
1107
1108            First: no IPv4 options.
1109          */
1110         newinet->inet_opt = NULL;
1111         newnp->ipv6_ac_list = NULL;
1112         newnp->ipv6_fl_list = NULL;
1113
1114         /* Clone RX bits */
1115         newnp->rxopt.all = np->rxopt.all;
1116
1117         newnp->pktoptions = NULL;
1118         newnp->opt        = NULL;
1119         newnp->mcast_oif  = tcp_v6_iif(skb);
1120         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1121         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1122         if (np->repflow)
1123                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1124
1125         /* Clone native IPv6 options from listening socket (if any)
1126
1127            Yes, keeping reference count would be much more clever,
1128            but we make one more one thing there: reattach optmem
1129            to newsk.
1130          */
1131         opt = ireq->ipv6_opt;
1132         if (!opt)
1133                 opt = rcu_dereference(np->opt);
1134         if (opt) {
1135                 opt = ipv6_dup_options(newsk, opt);
1136                 RCU_INIT_POINTER(newnp->opt, opt);
1137         }
1138         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1139         if (opt)
1140                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1141                                                     opt->opt_flen;
1142
1143         tcp_ca_openreq_child(newsk, dst);
1144
1145         tcp_sync_mss(newsk, dst_mtu(dst));
1146         newtp->advmss = dst_metric_advmss(dst);
1147         if (tcp_sk(sk)->rx_opt.user_mss &&
1148             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1149                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1150
1151         tcp_initialize_rcv_mss(newsk);
1152
1153         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1154         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1155
1156 #ifdef CONFIG_TCP_MD5SIG
1157         /* Copy over the MD5 key from the original socket */
1158         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1159         if (key) {
1160                 /* We're using one, so create a matching key
1161                  * on the newsk structure. If we fail to get
1162                  * memory, then we end up not copying the key
1163                  * across. Shucks.
1164                  */
1165                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1166                                AF_INET6, key->key, key->keylen,
1167                                sk_gfp_mask(sk, GFP_ATOMIC));
1168         }
1169 #endif
1170
1171         if (__inet_inherit_port(sk, newsk) < 0) {
1172                 inet_csk_prepare_forced_close(newsk);
1173                 tcp_done(newsk);
1174                 goto out;
1175         }
1176         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1177         if (*own_req) {
1178                 tcp_move_syn(newtp, req);
1179
1180                 /* Clone pktoptions received with SYN, if we own the req */
1181                 if (ireq->pktopts) {
1182                         newnp->pktoptions = skb_clone(ireq->pktopts,
1183                                                       sk_gfp_mask(sk, GFP_ATOMIC));
1184                         consume_skb(ireq->pktopts);
1185                         ireq->pktopts = NULL;
1186                         if (newnp->pktoptions)
1187                                 skb_set_owner_r(newnp->pktoptions, newsk);
1188                 }
1189         }
1190
1191         return newsk;
1192
1193 out_overflow:
1194         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1195 out_nonewsk:
1196         dst_release(dst);
1197 out:
1198         tcp_listendrop(sk);
1199         return NULL;
1200 }
1201
1202 static void tcp_v6_restore_cb(struct sk_buff *skb)
1203 {
1204         /* We need to move header back to the beginning if xfrm6_policy_check()
1205          * and tcp_v6_fill_cb() are going to be called again.
1206          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1207          */
1208         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1209                 sizeof(struct inet6_skb_parm));
1210 }
1211
1212 /* The socket must have it's spinlock held when we get
1213  * here, unless it is a TCP_LISTEN socket.
1214  *
1215  * We have a potential double-lock case here, so even when
1216  * doing backlog processing we use the BH locking scheme.
1217  * This is because we cannot sleep with the original spinlock
1218  * held.
1219  */
1220 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1221 {
1222         struct ipv6_pinfo *np = inet6_sk(sk);
1223         struct tcp_sock *tp;
1224         struct sk_buff *opt_skb = NULL;
1225
1226         /* Imagine: socket is IPv6. IPv4 packet arrives,
1227            goes to IPv4 receive handler and backlogged.
1228            From backlog it always goes here. Kerboom...
1229            Fortunately, tcp_rcv_established and rcv_established
1230            handle them correctly, but it is not case with
1231            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1232          */
1233
1234         if (skb->protocol == htons(ETH_P_IP))
1235                 return tcp_v4_do_rcv(sk, skb);
1236
1237         if (tcp_filter(sk, skb))
1238                 goto discard;
1239
1240         /*
1241          *      socket locking is here for SMP purposes as backlog rcv
1242          *      is currently called with bh processing disabled.
1243          */
1244
1245         /* Do Stevens' IPV6_PKTOPTIONS.
1246
1247            Yes, guys, it is the only place in our code, where we
1248            may make it not affecting IPv4.
1249            The rest of code is protocol independent,
1250            and I do not like idea to uglify IPv4.
1251
1252            Actually, all the idea behind IPV6_PKTOPTIONS
1253            looks not very well thought. For now we latch
1254            options, received in the last packet, enqueued
1255            by tcp. Feel free to propose better solution.
1256                                                --ANK (980728)
1257          */
1258         if (np->rxopt.all)
1259                 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1260
1261         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1262                 struct dst_entry *dst = sk->sk_rx_dst;
1263
1264                 sock_rps_save_rxhash(sk, skb);
1265                 sk_mark_napi_id(sk, skb);
1266                 if (dst) {
1267                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1268                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1269                                 dst_release(dst);
1270                                 sk->sk_rx_dst = NULL;
1271                         }
1272                 }
1273
1274                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1275                 if (opt_skb)
1276                         goto ipv6_pktoptions;
1277                 return 0;
1278         }
1279
1280         if (tcp_checksum_complete(skb))
1281                 goto csum_err;
1282
1283         if (sk->sk_state == TCP_LISTEN) {
1284                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1285
1286                 if (!nsk)
1287                         goto discard;
1288
1289                 if (nsk != sk) {
1290                         sock_rps_save_rxhash(nsk, skb);
1291                         sk_mark_napi_id(nsk, skb);
1292                         if (tcp_child_process(sk, nsk, skb))
1293                                 goto reset;
1294                         if (opt_skb)
1295                                 __kfree_skb(opt_skb);
1296                         return 0;
1297                 }
1298         } else
1299                 sock_rps_save_rxhash(sk, skb);
1300
1301         if (tcp_rcv_state_process(sk, skb))
1302                 goto reset;
1303         if (opt_skb)
1304                 goto ipv6_pktoptions;
1305         return 0;
1306
1307 reset:
1308         tcp_v6_send_reset(sk, skb);
1309 discard:
1310         if (opt_skb)
1311                 __kfree_skb(opt_skb);
1312         kfree_skb(skb);
1313         return 0;
1314 csum_err:
1315         TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1316         TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1317         goto discard;
1318
1319
1320 ipv6_pktoptions:
1321         /* Do you ask, what is it?
1322
1323            1. skb was enqueued by tcp.
1324            2. skb is added to tail of read queue, rather than out of order.
1325            3. socket is not in passive state.
1326            4. Finally, it really contains options, which user wants to receive.
1327          */
1328         tp = tcp_sk(sk);
1329         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1330             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1331                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1332                         np->mcast_oif = tcp_v6_iif(opt_skb);
1333                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1334                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1335                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1336                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1337                 if (np->repflow)
1338                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1339                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1340                         skb_set_owner_r(opt_skb, sk);
1341                         tcp_v6_restore_cb(opt_skb);
1342                         opt_skb = xchg(&np->pktoptions, opt_skb);
1343                 } else {
1344                         __kfree_skb(opt_skb);
1345                         opt_skb = xchg(&np->pktoptions, NULL);
1346                 }
1347         }
1348
1349         kfree_skb(opt_skb);
1350         return 0;
1351 }
1352
1353 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1354                            const struct tcphdr *th)
1355 {
1356         /* This is tricky: we move IP6CB at its correct location into
1357          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1358          * _decode_session6() uses IP6CB().
1359          * barrier() makes sure compiler won't play aliasing games.
1360          */
1361         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1362                 sizeof(struct inet6_skb_parm));
1363         barrier();
1364
1365         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1366         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1367                                     skb->len - th->doff*4);
1368         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1369         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1370         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1371         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1372         TCP_SKB_CB(skb)->sacked = 0;
1373 }
1374
1375 static int tcp_v6_rcv(struct sk_buff *skb)
1376 {
1377         const struct tcphdr *th;
1378         const struct ipv6hdr *hdr;
1379         bool refcounted;
1380         struct sock *sk;
1381         int ret;
1382         struct net *net = dev_net(skb->dev);
1383
1384         if (skb->pkt_type != PACKET_HOST)
1385                 goto discard_it;
1386
1387         /*
1388          *      Count it even if it's bad.
1389          */
1390         __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1391
1392         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1393                 goto discard_it;
1394
1395         th = (const struct tcphdr *)skb->data;
1396
1397         if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1398                 goto bad_packet;
1399         if (!pskb_may_pull(skb, th->doff*4))
1400                 goto discard_it;
1401
1402         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1403                 goto csum_error;
1404
1405         th = (const struct tcphdr *)skb->data;
1406         hdr = ipv6_hdr(skb);
1407
1408 lookup:
1409         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1410                                 th->source, th->dest, inet6_iif(skb),
1411                                 &refcounted);
1412         if (!sk)
1413                 goto no_tcp_socket;
1414
1415 process:
1416         if (sk->sk_state == TCP_TIME_WAIT)
1417                 goto do_time_wait;
1418
1419         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1420                 struct request_sock *req = inet_reqsk(sk);
1421                 struct sock *nsk;
1422
1423                 sk = req->rsk_listener;
1424                 tcp_v6_fill_cb(skb, hdr, th);
1425                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1426                         sk_drops_add(sk, skb);
1427                         reqsk_put(req);
1428                         goto discard_it;
1429                 }
1430                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1431                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1432                         goto lookup;
1433                 }
1434                 sock_hold(sk);
1435                 refcounted = true;
1436                 nsk = tcp_check_req(sk, skb, req, false);
1437                 if (!nsk) {
1438                         reqsk_put(req);
1439                         goto discard_and_relse;
1440                 }
1441                 if (nsk == sk) {
1442                         reqsk_put(req);
1443                         tcp_v6_restore_cb(skb);
1444                 } else if (tcp_child_process(sk, nsk, skb)) {
1445                         tcp_v6_send_reset(nsk, skb);
1446                         goto discard_and_relse;
1447                 } else {
1448                         sock_put(sk);
1449                         return 0;
1450                 }
1451         }
1452         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1453                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1454                 goto discard_and_relse;
1455         }
1456
1457         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1458                 goto discard_and_relse;
1459
1460         tcp_v6_fill_cb(skb, hdr, th);
1461
1462         if (tcp_v6_inbound_md5_hash(sk, skb))
1463                 goto discard_and_relse;
1464
1465         if (tcp_filter(sk, skb))
1466                 goto discard_and_relse;
1467         th = (const struct tcphdr *)skb->data;
1468         hdr = ipv6_hdr(skb);
1469
1470         skb->dev = NULL;
1471
1472         if (sk->sk_state == TCP_LISTEN) {
1473                 ret = tcp_v6_do_rcv(sk, skb);
1474                 goto put_and_return;
1475         }
1476
1477         sk_incoming_cpu_update(sk);
1478
1479         bh_lock_sock_nested(sk);
1480         tcp_segs_in(tcp_sk(sk), skb);
1481         ret = 0;
1482         if (!sock_owned_by_user(sk)) {
1483                 if (!tcp_prequeue(sk, skb))
1484                         ret = tcp_v6_do_rcv(sk, skb);
1485         } else if (tcp_add_backlog(sk, skb)) {
1486                 goto discard_and_relse;
1487         }
1488         bh_unlock_sock(sk);
1489
1490 put_and_return:
1491         if (refcounted)
1492                 sock_put(sk);
1493         return ret ? -1 : 0;
1494
1495 no_tcp_socket:
1496         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1497                 goto discard_it;
1498
1499         tcp_v6_fill_cb(skb, hdr, th);
1500
1501         if (tcp_checksum_complete(skb)) {
1502 csum_error:
1503                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1504 bad_packet:
1505                 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1506         } else {
1507                 tcp_v6_send_reset(NULL, skb);
1508         }
1509
1510 discard_it:
1511         kfree_skb(skb);
1512         return 0;
1513
1514 discard_and_relse:
1515         sk_drops_add(sk, skb);
1516         if (refcounted)
1517                 sock_put(sk);
1518         goto discard_it;
1519
1520 do_time_wait:
1521         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1522                 inet_twsk_put(inet_twsk(sk));
1523                 goto discard_it;
1524         }
1525
1526         tcp_v6_fill_cb(skb, hdr, th);
1527
1528         if (tcp_checksum_complete(skb)) {
1529                 inet_twsk_put(inet_twsk(sk));
1530                 goto csum_error;
1531         }
1532
1533         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1534         case TCP_TW_SYN:
1535         {
1536                 struct sock *sk2;
1537
1538                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1539                                             skb, __tcp_hdrlen(th),
1540                                             &ipv6_hdr(skb)->saddr, th->source,
1541                                             &ipv6_hdr(skb)->daddr,
1542                                             ntohs(th->dest), tcp_v6_iif(skb));
1543                 if (sk2) {
1544                         struct inet_timewait_sock *tw = inet_twsk(sk);
1545                         inet_twsk_deschedule_put(tw);
1546                         sk = sk2;
1547                         tcp_v6_restore_cb(skb);
1548                         refcounted = false;
1549                         goto process;
1550                 }
1551                 /* Fall through to ACK */
1552         }
1553         case TCP_TW_ACK:
1554                 tcp_v6_timewait_ack(sk, skb);
1555                 break;
1556         case TCP_TW_RST:
1557                 tcp_v6_restore_cb(skb);
1558                 tcp_v6_send_reset(sk, skb);
1559                 inet_twsk_deschedule_put(inet_twsk(sk));
1560                 goto discard_it;
1561         case TCP_TW_SUCCESS:
1562                 ;
1563         }
1564         goto discard_it;
1565 }
1566
1567 static void tcp_v6_early_demux(struct sk_buff *skb)
1568 {
1569         const struct ipv6hdr *hdr;
1570         const struct tcphdr *th;
1571         struct sock *sk;
1572
1573         if (skb->pkt_type != PACKET_HOST)
1574                 return;
1575
1576         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1577                 return;
1578
1579         hdr = ipv6_hdr(skb);
1580         th = tcp_hdr(skb);
1581
1582         if (th->doff < sizeof(struct tcphdr) / 4)
1583                 return;
1584
1585         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1586         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1587                                         &hdr->saddr, th->source,
1588                                         &hdr->daddr, ntohs(th->dest),
1589                                         inet6_iif(skb));
1590         if (sk) {
1591                 skb->sk = sk;
1592                 skb->destructor = sock_edemux;
1593                 if (sk_fullsock(sk)) {
1594                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1595
1596                         if (dst)
1597                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1598                         if (dst &&
1599                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1600                                 skb_dst_set_noref(skb, dst);
1601                 }
1602         }
1603 }
1604
1605 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1606         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1607         .twsk_unique    = tcp_twsk_unique,
1608         .twsk_destructor = tcp_twsk_destructor,
1609 };
1610
1611 static const struct inet_connection_sock_af_ops ipv6_specific = {
1612         .queue_xmit        = inet6_csk_xmit,
1613         .send_check        = tcp_v6_send_check,
1614         .rebuild_header    = inet6_sk_rebuild_header,
1615         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1616         .conn_request      = tcp_v6_conn_request,
1617         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1618         .net_header_len    = sizeof(struct ipv6hdr),
1619         .net_frag_header_len = sizeof(struct frag_hdr),
1620         .setsockopt        = ipv6_setsockopt,
1621         .getsockopt        = ipv6_getsockopt,
1622         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1623         .sockaddr_len      = sizeof(struct sockaddr_in6),
1624 #ifdef CONFIG_COMPAT
1625         .compat_setsockopt = compat_ipv6_setsockopt,
1626         .compat_getsockopt = compat_ipv6_getsockopt,
1627 #endif
1628         .mtu_reduced       = tcp_v6_mtu_reduced,
1629 };
1630
1631 #ifdef CONFIG_TCP_MD5SIG
1632 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1633         .md5_lookup     =       tcp_v6_md5_lookup,
1634         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1635         .md5_parse      =       tcp_v6_parse_md5_keys,
1636 };
1637 #endif
1638
1639 /*
1640  *      TCP over IPv4 via INET6 API
1641  */
1642 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1643         .queue_xmit        = ip_queue_xmit,
1644         .send_check        = tcp_v4_send_check,
1645         .rebuild_header    = inet_sk_rebuild_header,
1646         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1647         .conn_request      = tcp_v6_conn_request,
1648         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1649         .net_header_len    = sizeof(struct iphdr),
1650         .setsockopt        = ipv6_setsockopt,
1651         .getsockopt        = ipv6_getsockopt,
1652         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1653         .sockaddr_len      = sizeof(struct sockaddr_in6),
1654 #ifdef CONFIG_COMPAT
1655         .compat_setsockopt = compat_ipv6_setsockopt,
1656         .compat_getsockopt = compat_ipv6_getsockopt,
1657 #endif
1658         .mtu_reduced       = tcp_v4_mtu_reduced,
1659 };
1660
1661 #ifdef CONFIG_TCP_MD5SIG
1662 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1663         .md5_lookup     =       tcp_v4_md5_lookup,
1664         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1665         .md5_parse      =       tcp_v6_parse_md5_keys,
1666 };
1667 #endif
1668
1669 /* NOTE: A lot of things set to zero explicitly by call to
1670  *       sk_alloc() so need not be done here.
1671  */
1672 static int tcp_v6_init_sock(struct sock *sk)
1673 {
1674         struct inet_connection_sock *icsk = inet_csk(sk);
1675
1676         tcp_init_sock(sk);
1677
1678         icsk->icsk_af_ops = &ipv6_specific;
1679
1680 #ifdef CONFIG_TCP_MD5SIG
1681         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1682 #endif
1683
1684         return 0;
1685 }
1686
1687 static void tcp_v6_destroy_sock(struct sock *sk)
1688 {
1689         tcp_v4_destroy_sock(sk);
1690         inet6_destroy_sock(sk);
1691 }
1692
1693 #ifdef CONFIG_PROC_FS
1694 /* Proc filesystem TCPv6 sock list dumping. */
1695 static void get_openreq6(struct seq_file *seq,
1696                          const struct request_sock *req, int i)
1697 {
1698         long ttd = req->rsk_timer.expires - jiffies;
1699         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1700         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1701
1702         if (ttd < 0)
1703                 ttd = 0;
1704
1705         seq_printf(seq,
1706                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1707                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1708                    i,
1709                    src->s6_addr32[0], src->s6_addr32[1],
1710                    src->s6_addr32[2], src->s6_addr32[3],
1711                    inet_rsk(req)->ir_num,
1712                    dest->s6_addr32[0], dest->s6_addr32[1],
1713                    dest->s6_addr32[2], dest->s6_addr32[3],
1714                    ntohs(inet_rsk(req)->ir_rmt_port),
1715                    TCP_SYN_RECV,
1716                    0, 0, /* could print option size, but that is af dependent. */
1717                    1,   /* timers active (only the expire timer) */
1718                    jiffies_to_clock_t(ttd),
1719                    req->num_timeout,
1720                    from_kuid_munged(seq_user_ns(seq),
1721                                     sock_i_uid(req->rsk_listener)),
1722                    0,  /* non standard timer */
1723                    0, /* open_requests have no inode */
1724                    0, req);
1725 }
1726
1727 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1728 {
1729         const struct in6_addr *dest, *src;
1730         __u16 destp, srcp;
1731         int timer_active;
1732         unsigned long timer_expires;
1733         const struct inet_sock *inet = inet_sk(sp);
1734         const struct tcp_sock *tp = tcp_sk(sp);
1735         const struct inet_connection_sock *icsk = inet_csk(sp);
1736         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1737         int rx_queue;
1738         int state;
1739
1740         dest  = &sp->sk_v6_daddr;
1741         src   = &sp->sk_v6_rcv_saddr;
1742         destp = ntohs(inet->inet_dport);
1743         srcp  = ntohs(inet->inet_sport);
1744
1745         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1746             icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1747             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1748                 timer_active    = 1;
1749                 timer_expires   = icsk->icsk_timeout;
1750         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1751                 timer_active    = 4;
1752                 timer_expires   = icsk->icsk_timeout;
1753         } else if (timer_pending(&sp->sk_timer)) {
1754                 timer_active    = 2;
1755                 timer_expires   = sp->sk_timer.expires;
1756         } else {
1757                 timer_active    = 0;
1758                 timer_expires = jiffies;
1759         }
1760
1761         state = sk_state_load(sp);
1762         if (state == TCP_LISTEN)
1763                 rx_queue = sp->sk_ack_backlog;
1764         else
1765                 /* Because we don't lock the socket,
1766                  * we might find a transient negative value.
1767                  */
1768                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1769
1770         seq_printf(seq,
1771                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1772                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1773                    i,
1774                    src->s6_addr32[0], src->s6_addr32[1],
1775                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1776                    dest->s6_addr32[0], dest->s6_addr32[1],
1777                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1778                    state,
1779                    tp->write_seq - tp->snd_una,
1780                    rx_queue,
1781                    timer_active,
1782                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1783                    icsk->icsk_retransmits,
1784                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1785                    icsk->icsk_probes_out,
1786                    sock_i_ino(sp),
1787                    atomic_read(&sp->sk_refcnt), sp,
1788                    jiffies_to_clock_t(icsk->icsk_rto),
1789                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1790                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1791                    tp->snd_cwnd,
1792                    state == TCP_LISTEN ?
1793                         fastopenq->max_qlen :
1794                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1795                    );
1796 }
1797
1798 static void get_timewait6_sock(struct seq_file *seq,
1799                                struct inet_timewait_sock *tw, int i)
1800 {
1801         long delta = tw->tw_timer.expires - jiffies;
1802         const struct in6_addr *dest, *src;
1803         __u16 destp, srcp;
1804
1805         dest = &tw->tw_v6_daddr;
1806         src  = &tw->tw_v6_rcv_saddr;
1807         destp = ntohs(tw->tw_dport);
1808         srcp  = ntohs(tw->tw_sport);
1809
1810         seq_printf(seq,
1811                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1812                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1813                    i,
1814                    src->s6_addr32[0], src->s6_addr32[1],
1815                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1816                    dest->s6_addr32[0], dest->s6_addr32[1],
1817                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1818                    tw->tw_substate, 0, 0,
1819                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1820                    atomic_read(&tw->tw_refcnt), tw);
1821 }
1822
1823 static int tcp6_seq_show(struct seq_file *seq, void *v)
1824 {
1825         struct tcp_iter_state *st;
1826         struct sock *sk = v;
1827
1828         if (v == SEQ_START_TOKEN) {
1829                 seq_puts(seq,
1830                          "  sl  "
1831                          "local_address                         "
1832                          "remote_address                        "
1833                          "st tx_queue rx_queue tr tm->when retrnsmt"
1834                          "   uid  timeout inode\n");
1835                 goto out;
1836         }
1837         st = seq->private;
1838
1839         if (sk->sk_state == TCP_TIME_WAIT)
1840                 get_timewait6_sock(seq, v, st->num);
1841         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1842                 get_openreq6(seq, v, st->num);
1843         else
1844                 get_tcp6_sock(seq, v, st->num);
1845 out:
1846         return 0;
1847 }
1848
1849 static const struct file_operations tcp6_afinfo_seq_fops = {
1850         .owner   = THIS_MODULE,
1851         .open    = tcp_seq_open,
1852         .read    = seq_read,
1853         .llseek  = seq_lseek,
1854         .release = seq_release_net
1855 };
1856
1857 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1858         .name           = "tcp6",
1859         .family         = AF_INET6,
1860         .seq_fops       = &tcp6_afinfo_seq_fops,
1861         .seq_ops        = {
1862                 .show           = tcp6_seq_show,
1863         },
1864 };
1865
1866 int __net_init tcp6_proc_init(struct net *net)
1867 {
1868         return tcp_proc_register(net, &tcp6_seq_afinfo);
1869 }
1870
1871 void tcp6_proc_exit(struct net *net)
1872 {
1873         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1874 }
1875 #endif
1876
1877 struct proto tcpv6_prot = {
1878         .name                   = "TCPv6",
1879         .owner                  = THIS_MODULE,
1880         .close                  = tcp_close,
1881         .connect                = tcp_v6_connect,
1882         .disconnect             = tcp_disconnect,
1883         .accept                 = inet_csk_accept,
1884         .ioctl                  = tcp_ioctl,
1885         .init                   = tcp_v6_init_sock,
1886         .destroy                = tcp_v6_destroy_sock,
1887         .shutdown               = tcp_shutdown,
1888         .setsockopt             = tcp_setsockopt,
1889         .getsockopt             = tcp_getsockopt,
1890         .keepalive              = tcp_set_keepalive,
1891         .recvmsg                = tcp_recvmsg,
1892         .sendmsg                = tcp_sendmsg,
1893         .sendpage               = tcp_sendpage,
1894         .backlog_rcv            = tcp_v6_do_rcv,
1895         .release_cb             = tcp_release_cb,
1896         .hash                   = inet6_hash,
1897         .unhash                 = inet_unhash,
1898         .get_port               = inet_csk_get_port,
1899         .enter_memory_pressure  = tcp_enter_memory_pressure,
1900         .stream_memory_free     = tcp_stream_memory_free,
1901         .sockets_allocated      = &tcp_sockets_allocated,
1902         .memory_allocated       = &tcp_memory_allocated,
1903         .memory_pressure        = &tcp_memory_pressure,
1904         .orphan_count           = &tcp_orphan_count,
1905         .sysctl_mem             = sysctl_tcp_mem,
1906         .sysctl_wmem            = sysctl_tcp_wmem,
1907         .sysctl_rmem            = sysctl_tcp_rmem,
1908         .max_header             = MAX_TCP_HEADER,
1909         .obj_size               = sizeof(struct tcp6_sock),
1910         .slab_flags             = SLAB_DESTROY_BY_RCU,
1911         .twsk_prot              = &tcp6_timewait_sock_ops,
1912         .rsk_prot               = &tcp6_request_sock_ops,
1913         .h.hashinfo             = &tcp_hashinfo,
1914         .no_autobind            = true,
1915 #ifdef CONFIG_COMPAT
1916         .compat_setsockopt      = compat_tcp_setsockopt,
1917         .compat_getsockopt      = compat_tcp_getsockopt,
1918 #endif
1919         .diag_destroy           = tcp_abort,
1920 };
1921
1922 static const struct inet6_protocol tcpv6_protocol = {
1923         .early_demux    =       tcp_v6_early_demux,
1924         .handler        =       tcp_v6_rcv,
1925         .err_handler    =       tcp_v6_err,
1926         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1927 };
1928
1929 static struct inet_protosw tcpv6_protosw = {
1930         .type           =       SOCK_STREAM,
1931         .protocol       =       IPPROTO_TCP,
1932         .prot           =       &tcpv6_prot,
1933         .ops            =       &inet6_stream_ops,
1934         .flags          =       INET_PROTOSW_PERMANENT |
1935                                 INET_PROTOSW_ICSK,
1936 };
1937
1938 static int __net_init tcpv6_net_init(struct net *net)
1939 {
1940         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1941                                     SOCK_RAW, IPPROTO_TCP, net);
1942 }
1943
1944 static void __net_exit tcpv6_net_exit(struct net *net)
1945 {
1946         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1947 }
1948
1949 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1950 {
1951         inet_twsk_purge(&tcp_hashinfo, AF_INET6);
1952 }
1953
1954 static struct pernet_operations tcpv6_net_ops = {
1955         .init       = tcpv6_net_init,
1956         .exit       = tcpv6_net_exit,
1957         .exit_batch = tcpv6_net_exit_batch,
1958 };
1959
1960 int __init tcpv6_init(void)
1961 {
1962         int ret;
1963
1964         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1965         if (ret)
1966                 goto out;
1967
1968         /* register inet6 protocol */
1969         ret = inet6_register_protosw(&tcpv6_protosw);
1970         if (ret)
1971                 goto out_tcpv6_protocol;
1972
1973         ret = register_pernet_subsys(&tcpv6_net_ops);
1974         if (ret)
1975                 goto out_tcpv6_protosw;
1976 out:
1977         return ret;
1978
1979 out_tcpv6_protosw:
1980         inet6_unregister_protosw(&tcpv6_protosw);
1981 out_tcpv6_protocol:
1982         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1983         goto out;
1984 }
1985
1986 void tcpv6_exit(void)
1987 {
1988         unregister_pernet_subsys(&tcpv6_net_ops);
1989         inet6_unregister_protosw(&tcpv6_protosw);
1990         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1991 }