net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/tcp_memcontrol.h>
  65 #include <net/busy_poll.h>
  66
  67 #include <linux/proc_fs.h>
  68 #include <linux/seq_file.h>
  69
  70 #include <linux/crypto.h>
  71 #include <linux/scatterlist.h>
  72
  73 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  74 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  75                                       struct request_sock *req);
  76
  77 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  78
  79 static const struct inet_connection_sock_af_ops ipv6_mapped;
  80 static const struct inet_connection_sock_af_ops ipv6_specific;
  81 #ifdef CONFIG_TCP_MD5SIG
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  83 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  84 #else
  85 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  86                                                    const struct in6_addr *addr)
  87 {
  88         return NULL;
  89 }
  90 #endif
  91
  92 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  93 {
  94         struct dst_entry *dst = skb_dst(skb);
  95
  96         if (dst) {
  97                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  98
  99                 dst_hold(dst);
 100                 sk->sk_rx_dst = dst;
 101                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 102                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 103         }
 104 }
 105
 106 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
 107 {
 108         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 109                                             ipv6_hdr(skb)->saddr.s6_addr32,
 110                                             tcp_hdr(skb)->dest,
 111                                             tcp_hdr(skb)->source);
 112 }
 113
 114 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 115                           int addr_len)
 116 {
 117         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 118         struct inet_sock *inet = inet_sk(sk);
 119         struct inet_connection_sock *icsk = inet_csk(sk);
 120         struct ipv6_pinfo *np = inet6_sk(sk);
 121         struct tcp_sock *tp = tcp_sk(sk);
 122         struct in6_addr *saddr = NULL, *final_p, final;
 123         struct flowi6 fl6;
 124         struct dst_entry *dst;
 125         int addr_type;
 126         int err;
 127
 128         if (addr_len < SIN6_LEN_RFC2133)
 129                 return -EINVAL;
 130
 131         if (usin->sin6_family != AF_INET6)
 132                 return -EAFNOSUPPORT;
 133
 134         memset(&fl6, 0, sizeof(fl6));
 135
 136         if (np->sndflow) {
 137                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 138                 IP6_ECN_flow_init(fl6.flowlabel);
 139                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 140                         struct ip6_flowlabel *flowlabel;
 141                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 142                         if (!flowlabel)
 143                                 return -EINVAL;
 144                         fl6_sock_release(flowlabel);
 145                 }
 146         }
 147
 148         /*
 149          *      connect() to INADDR_ANY means loopback (BSD'ism).
 150          */
 151
 152         if (ipv6_addr_any(&usin->sin6_addr))
 153                 usin->sin6_addr.s6_addr[15] = 0x1;
 154
 155         addr_type = ipv6_addr_type(&usin->sin6_addr);
 156
 157         if (addr_type & IPV6_ADDR_MULTICAST)
 158                 return -ENETUNREACH;
 159
 160         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 161                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 162                     usin->sin6_scope_id) {
 163                         /* If interface is set while binding, indices
 164                          * must coincide.
 165                          */
 166                         if (sk->sk_bound_dev_if &&
 167                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 168                                 return -EINVAL;
 169
 170                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 171                 }
 172
 173                 /* Connect to link-local address requires an interface */
 174                 if (!sk->sk_bound_dev_if)
 175                         return -EINVAL;
 176         }
 177
 178         if (tp->rx_opt.ts_recent_stamp &&
 179             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 180                 tp->rx_opt.ts_recent = 0;
 181                 tp->rx_opt.ts_recent_stamp = 0;
 182                 tp->write_seq = 0;
 183         }
 184
 185         sk->sk_v6_daddr = usin->sin6_addr;
 186         np->flow_label = fl6.flowlabel;
 187
 188         /*
 189          *      TCP over IPv4
 190          */
 191
 192         if (addr_type == IPV6_ADDR_MAPPED) {
 193                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 194                 struct sockaddr_in sin;
 195
 196                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 197
 198                 if (__ipv6_only_sock(sk))
 199                         return -ENETUNREACH;
 200
 201                 sin.sin_family = AF_INET;
 202                 sin.sin_port = usin->sin6_port;
 203                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 204
 205                 icsk->icsk_af_ops = &ipv6_mapped;
 206                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 207 #ifdef CONFIG_TCP_MD5SIG
 208                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 209 #endif
 210
 211                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 212
 213                 if (err) {
 214                         icsk->icsk_ext_hdr_len = exthdrlen;
 215                         icsk->icsk_af_ops = &ipv6_specific;
 216                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 217 #ifdef CONFIG_TCP_MD5SIG
 218                         tp->af_specific = &tcp_sock_ipv6_specific;
 219 #endif
 220                         goto failure;
 221                 }
 222                 np->saddr = sk->sk_v6_rcv_saddr;
 223
 224                 return err;
 225         }
 226
 227         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 228                 saddr = &sk->sk_v6_rcv_saddr;
 229
 230         fl6.flowi6_proto = IPPROTO_TCP;
 231         fl6.daddr = sk->sk_v6_daddr;
 232         fl6.saddr = saddr ? *saddr : np->saddr;
 233         fl6.flowi6_oif = sk->sk_bound_dev_if;
 234         fl6.flowi6_mark = sk->sk_mark;
 235         fl6.fl6_dport = usin->sin6_port;
 236         fl6.fl6_sport = inet->inet_sport;
 237
 238         final_p = fl6_update_dst(&fl6, np->opt, &final);
 239
 240         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 241
 242         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 243         if (IS_ERR(dst)) {
 244                 err = PTR_ERR(dst);
 245                 goto failure;
 246         }
 247
 248         if (!saddr) {
 249                 saddr = &fl6.saddr;
 250                 sk->sk_v6_rcv_saddr = *saddr;
 251         }
 252
 253         /* set the source address */
 254         np->saddr = *saddr;
 255         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 256
 257         sk->sk_gso_type = SKB_GSO_TCPV6;
 258         __ip6_dst_store(sk, dst, NULL, NULL);
 259
 260         if (tcp_death_row.sysctl_tw_recycle &&
 261             !tp->rx_opt.ts_recent_stamp &&
 262             ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
 263                 tcp_fetch_timewait_stamp(sk, dst);
 264
 265         icsk->icsk_ext_hdr_len = 0;
 266         if (np->opt)
 267                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 268                                           np->opt->opt_nflen);
 269
 270         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 271
 272         inet->inet_dport = usin->sin6_port;
 273
 274         tcp_set_state(sk, TCP_SYN_SENT);
 275         err = inet6_hash_connect(&tcp_death_row, sk);
 276         if (err)
 277                 goto late_failure;
 278
 279         sk_set_txhash(sk);
 280
 281         if (!tp->write_seq && likely(!tp->repair))
 282                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 283                                                              sk->sk_v6_daddr.s6_addr32,
 284                                                              inet->inet_sport,
 285                                                              inet->inet_dport);
 286
 287         err = tcp_connect(sk);
 288         if (err)
 289                 goto late_failure;
 290
 291         return 0;
 292
 293 late_failure:
 294         tcp_set_state(sk, TCP_CLOSE);
 295         __sk_dst_reset(sk);
 296 failure:
 297         inet->inet_dport = 0;
 298         sk->sk_route_caps = 0;
 299         return err;
 300 }
 301
 302 static void tcp_v6_mtu_reduced(struct sock *sk)
 303 {
 304         struct dst_entry *dst;
 305
 306         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 307                 return;
 308
 309         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 310         if (!dst)
 311                 return;
 312
 313         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 314                 tcp_sync_mss(sk, dst_mtu(dst));
 315                 tcp_simple_retransmit(sk);
 316         }
 317 }
 318
 319 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 320                 u8 type, u8 code, int offset, __be32 info)
 321 {
 322         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 323         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 324         struct net *net = dev_net(skb->dev);
 325         struct request_sock *fastopen;
 326         struct ipv6_pinfo *np;
 327         struct tcp_sock *tp;
 328         __u32 seq, snd_una;
 329         struct sock *sk;
 330         int err;
 331
 332         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 333                                         &hdr->daddr, th->dest,
 334                                         &hdr->saddr, ntohs(th->source),
 335                                         skb->dev->ifindex);
 336
 337         if (!sk) {
 338                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 339                                    ICMP6_MIB_INERRORS);
 340                 return;
 341         }
 342
 343         if (sk->sk_state == TCP_TIME_WAIT) {
 344                 inet_twsk_put(inet_twsk(sk));
 345                 return;
 346         }
 347         seq = ntohl(th->seq);
 348         if (sk->sk_state == TCP_NEW_SYN_RECV)
 349                 return tcp_req_err(sk, seq);
 350
 351         bh_lock_sock(sk);
 352         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 353                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 354
 355         if (sk->sk_state == TCP_CLOSE)
 356                 goto out;
 357
 358         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 359                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 360                 goto out;
 361         }
 362
 363         tp = tcp_sk(sk);
 364         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 365         fastopen = tp->fastopen_rsk;
 366         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 367         if (sk->sk_state != TCP_LISTEN &&
 368             !between(seq, snd_una, tp->snd_nxt)) {
 369                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 370                 goto out;
 371         }
 372
 373         np = inet6_sk(sk);
 374
 375         if (type == NDISC_REDIRECT) {
 376                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 377
 378                 if (dst)
 379                         dst->ops->redirect(dst, sk, skb);
 380                 goto out;
 381         }
 382
 383         if (type == ICMPV6_PKT_TOOBIG) {
 384                 /* We are not interested in TCP_LISTEN and open_requests
 385                  * (SYN-ACKs send out by Linux are always <576bytes so
 386                  * they should go through unfragmented).
 387                  */
 388                 if (sk->sk_state == TCP_LISTEN)
 389                         goto out;
 390
 391                 if (!ip6_sk_accept_pmtu(sk))
 392                         goto out;
 393
 394                 tp->mtu_info = ntohl(info);
 395                 if (!sock_owned_by_user(sk))
 396                         tcp_v6_mtu_reduced(sk);
 397                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 398                                            &tp->tsq_flags))
 399                         sock_hold(sk);
 400                 goto out;
 401         }
 402
 403         icmpv6_err_convert(type, code, &err);
 404
 405         /* Might be for an request_sock */
 406         switch (sk->sk_state) {
 407         case TCP_SYN_SENT:
 408         case TCP_SYN_RECV:
 409                 /* Only in fast or simultaneous open. If a fast open socket is
 410                  * is already accepted it is treated as a connected one below.
 411                  */
 412                 if (fastopen && !fastopen->sk)
 413                         break;
 414
 415                 if (!sock_owned_by_user(sk)) {
 416                         sk->sk_err = err;
 417                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 418
 419                         tcp_done(sk);
 420                 } else
 421                         sk->sk_err_soft = err;
 422                 goto out;
 423         }
 424
 425         if (!sock_owned_by_user(sk) && np->recverr) {
 426                 sk->sk_err = err;
 427                 sk->sk_error_report(sk);
 428         } else
 429                 sk->sk_err_soft = err;
 430
 431 out:
 432         bh_unlock_sock(sk);
 433         sock_put(sk);
 434 }
 435
 436
 437 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 438                               struct flowi *fl,
 439                               struct request_sock *req,
 440                               u16 queue_mapping,
 441                               struct tcp_fastopen_cookie *foc,
 442                               bool attach_req)
 443 {
 444         struct inet_request_sock *ireq = inet_rsk(req);
 445         struct ipv6_pinfo *np = inet6_sk(sk);
 446         struct flowi6 *fl6 = &fl->u.ip6;
 447         struct sk_buff *skb;
 448         int err = -ENOMEM;
 449
 450         /* First, grab a route. */
 451         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 452                                                IPPROTO_TCP)) == NULL)
 453                 goto done;
 454
 455         skb = tcp_make_synack(sk, dst, req, foc, attach_req);
 456
 457         if (skb) {
 458                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 459                                     &ireq->ir_v6_rmt_addr);
 460
 461                 fl6->daddr = ireq->ir_v6_rmt_addr;
 462                 if (np->repflow && ireq->pktopts)
 463                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 464
 465                 skb_set_queue_mapping(skb, queue_mapping);
 466                 err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
 467                 err = net_xmit_eval(err);
 468         }
 469
 470 done:
 471         return err;
 472 }
 473
 474
 475 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 476 {
 477         kfree_skb(inet_rsk(req)->pktopts);
 478 }
 479
 480 #ifdef CONFIG_TCP_MD5SIG
 481 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 482                                                    const struct in6_addr *addr)
 483 {
 484         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 485 }
 486
 487 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 488                                                 const struct sock *addr_sk)
 489 {
 490         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 491 }
 492
 493 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 494                                  int optlen)
 495 {
 496         struct tcp_md5sig cmd;
 497         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 498
 499         if (optlen < sizeof(cmd))
 500                 return -EINVAL;
 501
 502         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 503                 return -EFAULT;
 504
 505         if (sin6->sin6_family != AF_INET6)
 506                 return -EINVAL;
 507
 508         if (!cmd.tcpm_keylen) {
 509                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 510                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 511                                               AF_INET);
 512                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 513                                       AF_INET6);
 514         }
 515
 516         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 517                 return -EINVAL;
 518
 519         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 520                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 521                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 522
 523         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 524                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 525 }
 526
 527 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 528                                         const struct in6_addr *daddr,
 529                                         const struct in6_addr *saddr, int nbytes)
 530 {
 531         struct tcp6_pseudohdr *bp;
 532         struct scatterlist sg;
 533
 534         bp = &hp->md5_blk.ip6;
 535         /* 1. TCP pseudo-header (RFC2460) */
 536         bp->saddr = *saddr;
 537         bp->daddr = *daddr;
 538         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 539         bp->len = cpu_to_be32(nbytes);
 540
 541         sg_init_one(&sg, bp, sizeof(*bp));
 542         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 543 }
 544
 545 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 546                                const struct in6_addr *daddr, struct in6_addr *saddr,
 547                                const struct tcphdr *th)
 548 {
 549         struct tcp_md5sig_pool *hp;
 550         struct hash_desc *desc;
 551
 552         hp = tcp_get_md5sig_pool();
 553         if (!hp)
 554                 goto clear_hash_noput;
 555         desc = &hp->md5_desc;
 556
 557         if (crypto_hash_init(desc))
 558                 goto clear_hash;
 559         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 560                 goto clear_hash;
 561         if (tcp_md5_hash_header(hp, th))
 562                 goto clear_hash;
 563         if (tcp_md5_hash_key(hp, key))
 564                 goto clear_hash;
 565         if (crypto_hash_final(desc, md5_hash))
 566                 goto clear_hash;
 567
 568         tcp_put_md5sig_pool();
 569         return 0;
 570
 571 clear_hash:
 572         tcp_put_md5sig_pool();
 573 clear_hash_noput:
 574         memset(md5_hash, 0, 16);
 575         return 1;
 576 }
 577
 578 static int tcp_v6_md5_hash_skb(char *md5_hash,
 579                                const struct tcp_md5sig_key *key,
 580                                const struct sock *sk,
 581                                const struct sk_buff *skb)
 582 {
 583         const struct in6_addr *saddr, *daddr;
 584         struct tcp_md5sig_pool *hp;
 585         struct hash_desc *desc;
 586         const struct tcphdr *th = tcp_hdr(skb);
 587
 588         if (sk) { /* valid for establish/request sockets */
 589                 saddr = &sk->sk_v6_rcv_saddr;
 590                 daddr = &sk->sk_v6_daddr;
 591         } else {
 592                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 593                 saddr = &ip6h->saddr;
 594                 daddr = &ip6h->daddr;
 595         }
 596
 597         hp = tcp_get_md5sig_pool();
 598         if (!hp)
 599                 goto clear_hash_noput;
 600         desc = &hp->md5_desc;
 601
 602         if (crypto_hash_init(desc))
 603                 goto clear_hash;
 604
 605         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 606                 goto clear_hash;
 607         if (tcp_md5_hash_header(hp, th))
 608                 goto clear_hash;
 609         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 610                 goto clear_hash;
 611         if (tcp_md5_hash_key(hp, key))
 612                 goto clear_hash;
 613         if (crypto_hash_final(desc, md5_hash))
 614                 goto clear_hash;
 615
 616         tcp_put_md5sig_pool();
 617         return 0;
 618
 619 clear_hash:
 620         tcp_put_md5sig_pool();
 621 clear_hash_noput:
 622         memset(md5_hash, 0, 16);
 623         return 1;
 624 }
 625
 626 #endif
 627
 628 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 629                                     const struct sk_buff *skb)
 630 {
 631 #ifdef CONFIG_TCP_MD5SIG
 632         const __u8 *hash_location = NULL;
 633         struct tcp_md5sig_key *hash_expected;
 634         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 635         const struct tcphdr *th = tcp_hdr(skb);
 636         int genhash;
 637         u8 newhash[16];
 638
 639         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 640         hash_location = tcp_parse_md5sig_option(th);
 641
 642         /* We've parsed the options - do we have a hash? */
 643         if (!hash_expected && !hash_location)
 644                 return false;
 645
 646         if (hash_expected && !hash_location) {
 647                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 648                 return true;
 649         }
 650
 651         if (!hash_expected && hash_location) {
 652                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 653                 return true;
 654         }
 655
 656         /* check the signature */
 657         genhash = tcp_v6_md5_hash_skb(newhash,
 658                                       hash_expected,
 659                                       NULL, skb);
 660
 661         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 662                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 663                                      genhash ? "failed" : "mismatch",
 664                                      &ip6h->saddr, ntohs(th->source),
 665                                      &ip6h->daddr, ntohs(th->dest));
 666                 return true;
 667         }
 668 #endif
 669         return false;
 670 }
 671
 672 static void tcp_v6_init_req(struct request_sock *req,
 673                             const struct sock *sk_listener,
 674                             struct sk_buff *skb)
 675 {
 676         struct inet_request_sock *ireq = inet_rsk(req);
 677         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 678
 679         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 680         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 681
 682         /* So that link locals have meaning */
 683         if (!sk_listener->sk_bound_dev_if &&
 684             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 685                 ireq->ir_iif = tcp_v6_iif(skb);
 686
 687         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 688             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 689              np->rxopt.bits.rxinfo ||
 690              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 691              np->rxopt.bits.rxohlim || np->repflow)) {
 692                 atomic_inc(&skb->users);
 693                 ireq->pktopts = skb;
 694         }
 695 }
 696
 697 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 698                                           struct flowi *fl,
 699                                           const struct request_sock *req,
 700                                           bool *strict)
 701 {
 702         if (strict)
 703                 *strict = true;
 704         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 705 }
 706
 707 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 708         .family         =       AF_INET6,
 709         .obj_size       =       sizeof(struct tcp6_request_sock),
 710         .rtx_syn_ack    =       tcp_rtx_synack,
 711         .send_ack       =       tcp_v6_reqsk_send_ack,
 712         .destructor     =       tcp_v6_reqsk_destructor,
 713         .send_reset     =       tcp_v6_send_reset,
 714         .syn_ack_timeout =      tcp_syn_ack_timeout,
 715 };
 716
 717 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 718         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 719                                 sizeof(struct ipv6hdr),
 720 #ifdef CONFIG_TCP_MD5SIG
 721         .req_md5_lookup =       tcp_v6_md5_lookup,
 722         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 723 #endif
 724         .init_req       =       tcp_v6_init_req,
 725 #ifdef CONFIG_SYN_COOKIES
 726         .cookie_init_seq =      cookie_v6_init_sequence,
 727 #endif
 728         .route_req      =       tcp_v6_route_req,
 729         .init_seq       =       tcp_v6_init_sequence,
 730         .send_synack    =       tcp_v6_send_synack,
 731 };
 732
 733 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 734                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 735                                  int oif, struct tcp_md5sig_key *key, int rst,
 736                                  u8 tclass, u32 label)
 737 {
 738         const struct tcphdr *th = tcp_hdr(skb);
 739         struct tcphdr *t1;
 740         struct sk_buff *buff;
 741         struct flowi6 fl6;
 742         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 743         struct sock *ctl_sk = net->ipv6.tcp_sk;
 744         unsigned int tot_len = sizeof(struct tcphdr);
 745         struct dst_entry *dst;
 746         __be32 *topt;
 747
 748         if (tsecr)
 749                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 750 #ifdef CONFIG_TCP_MD5SIG
 751         if (key)
 752                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 753 #endif
 754
 755         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 756                          GFP_ATOMIC);
 757         if (!buff)
 758                 return;
 759
 760         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 761
 762         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 763         skb_reset_transport_header(buff);
 764
 765         /* Swap the send and the receive. */
 766         memset(t1, 0, sizeof(*t1));
 767         t1->dest = th->source;
 768         t1->source = th->dest;
 769         t1->doff = tot_len / 4;
 770         t1->seq = htonl(seq);
 771         t1->ack_seq = htonl(ack);
 772         t1->ack = !rst || !th->ack;
 773         t1->rst = rst;
 774         t1->window = htons(win);
 775
 776         topt = (__be32 *)(t1 + 1);
 777
 778         if (tsecr) {
 779                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 780                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 781                 *topt++ = htonl(tsval);
 782                 *topt++ = htonl(tsecr);
 783         }
 784
 785 #ifdef CONFIG_TCP_MD5SIG
 786         if (key) {
 787                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 788                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 789                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 790                                     &ipv6_hdr(skb)->saddr,
 791                                     &ipv6_hdr(skb)->daddr, t1);
 792         }
 793 #endif
 794
 795         memset(&fl6, 0, sizeof(fl6));
 796         fl6.daddr = ipv6_hdr(skb)->saddr;
 797         fl6.saddr = ipv6_hdr(skb)->daddr;
 798         fl6.flowlabel = label;
 799
 800         buff->ip_summed = CHECKSUM_PARTIAL;
 801         buff->csum = 0;
 802
 803         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 804
 805         fl6.flowi6_proto = IPPROTO_TCP;
 806         if (rt6_need_strict(&fl6.daddr) && !oif)
 807                 fl6.flowi6_oif = tcp_v6_iif(skb);
 808         else
 809                 fl6.flowi6_oif = oif;
 810         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 811         fl6.fl6_dport = t1->dest;
 812         fl6.fl6_sport = t1->source;
 813         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 814
 815         /* Pass a socket to ip6_dst_lookup either it is for RST
 816          * Underlying function will use this to retrieve the network
 817          * namespace
 818          */
 819         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 820         if (!IS_ERR(dst)) {
 821                 skb_dst_set(buff, dst);
 822                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 823                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 824                 if (rst)
 825                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
 826                 return;
 827         }
 828
 829         kfree_skb(buff);
 830 }
 831
 832 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 833 {
 834         const struct tcphdr *th = tcp_hdr(skb);
 835         u32 seq = 0, ack_seq = 0;
 836         struct tcp_md5sig_key *key = NULL;
 837 #ifdef CONFIG_TCP_MD5SIG
 838         const __u8 *hash_location = NULL;
 839         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 840         unsigned char newhash[16];
 841         int genhash;
 842         struct sock *sk1 = NULL;
 843 #endif
 844         int oif;
 845
 846         if (th->rst)
 847                 return;
 848
 849         /* If sk not NULL, it means we did a successful lookup and incoming
 850          * route had to be correct. prequeue might have dropped our dst.
 851          */
 852         if (!sk && !ipv6_unicast_destination(skb))
 853                 return;
 854
 855 #ifdef CONFIG_TCP_MD5SIG
 856         hash_location = tcp_parse_md5sig_option(th);
 857         if (!sk && hash_location) {
 858                 /*
 859                  * active side is lost. Try to find listening socket through
 860                  * source port, and then find md5 key through listening socket.
 861                  * we are not loose security here:
 862                  * Incoming packet is checked with md5 hash with finding key,
 863                  * no RST generated if md5 hash doesn't match.
 864                  */
 865                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 866                                            &tcp_hashinfo, &ipv6h->saddr,
 867                                            th->source, &ipv6h->daddr,
 868                                            ntohs(th->source), tcp_v6_iif(skb));
 869                 if (!sk1)
 870                         return;
 871
 872                 rcu_read_lock();
 873                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 874                 if (!key)
 875                         goto release_sk1;
 876
 877                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 878                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 879                         goto release_sk1;
 880         } else {
 881                 key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
 882         }
 883 #endif
 884
 885         if (th->ack)
 886                 seq = ntohl(th->ack_seq);
 887         else
 888                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 889                           (th->doff << 2);
 890
 891         oif = sk ? sk->sk_bound_dev_if : 0;
 892         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 893
 894 #ifdef CONFIG_TCP_MD5SIG
 895 release_sk1:
 896         if (sk1) {
 897                 rcu_read_unlock();
 898                 sock_put(sk1);
 899         }
 900 #endif
 901 }
 902
 903 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 904                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 905                             struct tcp_md5sig_key *key, u8 tclass,
 906                             u32 label)
 907 {
 908         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 909                              tclass, label);
 910 }
 911
 912 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 913 {
 914         struct inet_timewait_sock *tw = inet_twsk(sk);
 915         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 916
 917         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 918                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 919                         tcp_time_stamp + tcptw->tw_ts_offset,
 920                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 921                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 922
 923         inet_twsk_put(tw);
 924 }
 925
 926 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 927                                   struct request_sock *req)
 928 {
 929         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 930          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 931          */
 932         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 933                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
 934                         tcp_rsk(req)->rcv_nxt, req->rcv_wnd,
 935                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
 936                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 937                         0, 0);
 938 }
 939
 940
 941 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
 942 {
 943 #ifdef CONFIG_SYN_COOKIES
 944         const struct tcphdr *th = tcp_hdr(skb);
 945
 946         if (!th->syn)
 947                 sk = cookie_v6_check(sk, skb);
 948 #endif
 949         return sk;
 950 }
 951
 952 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 953 {
 954         if (skb->protocol == htons(ETH_P_IP))
 955                 return tcp_v4_conn_request(sk, skb);
 956
 957         if (!ipv6_unicast_destination(skb))
 958                 goto drop;
 959
 960         return tcp_conn_request(&tcp6_request_sock_ops,
 961                                 &tcp_request_sock_ipv6_ops, sk, skb);
 962
 963 drop:
 964         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 965         return 0; /* don't send reset */
 966 }
 967
 968 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
 969                                          struct request_sock *req,
 970                                          struct dst_entry *dst)
 971 {
 972         struct inet_request_sock *ireq;
 973         struct ipv6_pinfo *newnp;
 974         const struct ipv6_pinfo *np = inet6_sk(sk);
 975         struct tcp6_sock *newtcp6sk;
 976         struct inet_sock *newinet;
 977         struct tcp_sock *newtp;
 978         struct sock *newsk;
 979 #ifdef CONFIG_TCP_MD5SIG
 980         struct tcp_md5sig_key *key;
 981 #endif
 982         struct flowi6 fl6;
 983
 984         if (skb->protocol == htons(ETH_P_IP)) {
 985                 /*
 986                  *      v6 mapped
 987                  */
 988
 989                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
 990
 991                 if (!newsk)
 992                         return NULL;
 993
 994                 newtcp6sk = (struct tcp6_sock *)newsk;
 995                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
 996
 997                 newinet = inet_sk(newsk);
 998                 newnp = inet6_sk(newsk);
 999                 newtp = tcp_sk(newsk);
1000
1001                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1002
1003                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1004
1005                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1006                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1007 #ifdef CONFIG_TCP_MD5SIG
1008                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1009 #endif
1010
1011                 newnp->ipv6_ac_list = NULL;
1012                 newnp->ipv6_fl_list = NULL;
1013                 newnp->pktoptions  = NULL;
1014                 newnp->opt         = NULL;
1015                 newnp->mcast_oif   = tcp_v6_iif(skb);
1016                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1017                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1018                 if (np->repflow)
1019                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1020
1021                 /*
1022                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1023                  * here, tcp_create_openreq_child now does this for us, see the comment in
1024                  * that function for the gory details. -acme
1025                  */
1026
1027                 /* It is tricky place. Until this moment IPv4 tcp
1028                    worked with IPv6 icsk.icsk_af_ops.
1029                    Sync it now.
1030                  */
1031                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1032
1033                 return newsk;
1034         }
1035
1036         ireq = inet_rsk(req);
1037
1038         if (sk_acceptq_is_full(sk))
1039                 goto out_overflow;
1040
1041         if (!dst) {
1042                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1043                 if (!dst)
1044                         goto out;
1045         }
1046
1047         newsk = tcp_create_openreq_child(sk, req, skb);
1048         if (!newsk)
1049                 goto out_nonewsk;
1050
1051         /*
1052          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1053          * count here, tcp_create_openreq_child now does this for us, see the
1054          * comment in that function for the gory details. -acme
1055          */
1056
1057         newsk->sk_gso_type = SKB_GSO_TCPV6;
1058         __ip6_dst_store(newsk, dst, NULL, NULL);
1059         inet6_sk_rx_dst_set(newsk, skb);
1060
1061         newtcp6sk = (struct tcp6_sock *)newsk;
1062         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1063
1064         newtp = tcp_sk(newsk);
1065         newinet = inet_sk(newsk);
1066         newnp = inet6_sk(newsk);
1067
1068         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1069
1070         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1071         newnp->saddr = ireq->ir_v6_loc_addr;
1072         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1073         newsk->sk_bound_dev_if = ireq->ir_iif;
1074
1075         /* Now IPv6 options...
1076
1077            First: no IPv4 options.
1078          */
1079         newinet->inet_opt = NULL;
1080         newnp->ipv6_ac_list = NULL;
1081         newnp->ipv6_fl_list = NULL;
1082
1083         /* Clone RX bits */
1084         newnp->rxopt.all = np->rxopt.all;
1085
1086         /* Clone pktoptions received with SYN */
1087         newnp->pktoptions = NULL;
1088         if (ireq->pktopts) {
1089                 newnp->pktoptions = skb_clone(ireq->pktopts,
1090                                               sk_gfp_atomic(sk, GFP_ATOMIC));
1091                 consume_skb(ireq->pktopts);
1092                 ireq->pktopts = NULL;
1093                 if (newnp->pktoptions)
1094                         skb_set_owner_r(newnp->pktoptions, newsk);
1095         }
1096         newnp->opt        = NULL;
1097         newnp->mcast_oif  = tcp_v6_iif(skb);
1098         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1099         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1100         if (np->repflow)
1101                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1102
1103         /* Clone native IPv6 options from listening socket (if any)
1104
1105            Yes, keeping reference count would be much more clever,
1106            but we make one more one thing there: reattach optmem
1107            to newsk.
1108          */
1109         if (np->opt)
1110                 newnp->opt = ipv6_dup_options(newsk, np->opt);
1111
1112         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1113         if (newnp->opt)
1114                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1115                                                      newnp->opt->opt_flen);
1116
1117         tcp_ca_openreq_child(newsk, dst);
1118
1119         tcp_sync_mss(newsk, dst_mtu(dst));
1120         newtp->advmss = dst_metric_advmss(dst);
1121         if (tcp_sk(sk)->rx_opt.user_mss &&
1122             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1123                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1124
1125         tcp_initialize_rcv_mss(newsk);
1126
1127         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1128         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1129
1130 #ifdef CONFIG_TCP_MD5SIG
1131         /* Copy over the MD5 key from the original socket */
1132         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1133         if (key) {
1134                 /* We're using one, so create a matching key
1135                  * on the newsk structure. If we fail to get
1136                  * memory, then we end up not copying the key
1137                  * across. Shucks.
1138                  */
1139                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1140                                AF_INET6, key->key, key->keylen,
1141                                sk_gfp_atomic(sk, GFP_ATOMIC));
1142         }
1143 #endif
1144
1145         if (__inet_inherit_port(sk, newsk) < 0) {
1146                 inet_csk_prepare_forced_close(newsk);
1147                 tcp_done(newsk);
1148                 goto out;
1149         }
1150         __inet_hash(newsk, NULL);
1151
1152         return newsk;
1153
1154 out_overflow:
1155         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1156 out_nonewsk:
1157         dst_release(dst);
1158 out:
1159         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1160         return NULL;
1161 }
1162
1163 /* The socket must have it's spinlock held when we get
1164  * here, unless it is a TCP_LISTEN socket.
1165  *
1166  * We have a potential double-lock case here, so even when
1167  * doing backlog processing we use the BH locking scheme.
1168  * This is because we cannot sleep with the original spinlock
1169  * held.
1170  */
1171 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1172 {
1173         struct ipv6_pinfo *np = inet6_sk(sk);
1174         struct tcp_sock *tp;
1175         struct sk_buff *opt_skb = NULL;
1176
1177         /* Imagine: socket is IPv6. IPv4 packet arrives,
1178            goes to IPv4 receive handler and backlogged.
1179            From backlog it always goes here. Kerboom...
1180            Fortunately, tcp_rcv_established and rcv_established
1181            handle them correctly, but it is not case with
1182            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1183          */
1184
1185         if (skb->protocol == htons(ETH_P_IP))
1186                 return tcp_v4_do_rcv(sk, skb);
1187
1188         if (sk_filter(sk, skb))
1189                 goto discard;
1190
1191         /*
1192          *      socket locking is here for SMP purposes as backlog rcv
1193          *      is currently called with bh processing disabled.
1194          */
1195
1196         /* Do Stevens' IPV6_PKTOPTIONS.
1197
1198            Yes, guys, it is the only place in our code, where we
1199            may make it not affecting IPv4.
1200            The rest of code is protocol independent,
1201            and I do not like idea to uglify IPv4.
1202
1203            Actually, all the idea behind IPV6_PKTOPTIONS
1204            looks not very well thought. For now we latch
1205            options, received in the last packet, enqueued
1206            by tcp. Feel free to propose better solution.
1207                                                --ANK (980728)
1208          */
1209         if (np->rxopt.all)
1210                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
1211
1212         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1213                 struct dst_entry *dst = sk->sk_rx_dst;
1214
1215                 sock_rps_save_rxhash(sk, skb);
1216                 sk_mark_napi_id(sk, skb);
1217                 if (dst) {
1218                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1219                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1220                                 dst_release(dst);
1221                                 sk->sk_rx_dst = NULL;
1222                         }
1223                 }
1224
1225                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1226                 if (opt_skb)
1227                         goto ipv6_pktoptions;
1228                 return 0;
1229         }
1230
1231         if (tcp_checksum_complete(skb))
1232                 goto csum_err;
1233
1234         if (sk->sk_state == TCP_LISTEN) {
1235                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1236
1237                 if (!nsk)
1238                         goto discard;
1239
1240                 if (nsk != sk) {
1241                         sock_rps_save_rxhash(nsk, skb);
1242                         sk_mark_napi_id(nsk, skb);
1243                         if (tcp_child_process(sk, nsk, skb))
1244                                 goto reset;
1245                         if (opt_skb)
1246                                 __kfree_skb(opt_skb);
1247                         return 0;
1248                 }
1249         } else
1250                 sock_rps_save_rxhash(sk, skb);
1251
1252         if (tcp_rcv_state_process(sk, skb))
1253                 goto reset;
1254         if (opt_skb)
1255                 goto ipv6_pktoptions;
1256         return 0;
1257
1258 reset:
1259         tcp_v6_send_reset(sk, skb);
1260 discard:
1261         if (opt_skb)
1262                 __kfree_skb(opt_skb);
1263         kfree_skb(skb);
1264         return 0;
1265 csum_err:
1266         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1267         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1268         goto discard;
1269
1270
1271 ipv6_pktoptions:
1272         /* Do you ask, what is it?
1273
1274            1. skb was enqueued by tcp.
1275            2. skb is added to tail of read queue, rather than out of order.
1276            3. socket is not in passive state.
1277            4. Finally, it really contains options, which user wants to receive.
1278          */
1279         tp = tcp_sk(sk);
1280         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1281             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1282                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1283                         np->mcast_oif = tcp_v6_iif(opt_skb);
1284                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1285                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1286                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1287                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1288                 if (np->repflow)
1289                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1290                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1291                         skb_set_owner_r(opt_skb, sk);
1292                         opt_skb = xchg(&np->pktoptions, opt_skb);
1293                 } else {
1294                         __kfree_skb(opt_skb);
1295                         opt_skb = xchg(&np->pktoptions, NULL);
1296                 }
1297         }
1298
1299         kfree_skb(opt_skb);
1300         return 0;
1301 }
1302
1303 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1304                            const struct tcphdr *th)
1305 {
1306         /* This is tricky: we move IP6CB at its correct location into
1307          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1308          * _decode_session6() uses IP6CB().
1309          * barrier() makes sure compiler won't play aliasing games.
1310          */
1311         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1312                 sizeof(struct inet6_skb_parm));
1313         barrier();
1314
1315         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1316         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1317                                     skb->len - th->doff*4);
1318         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1319         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1320         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1321         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1322         TCP_SKB_CB(skb)->sacked = 0;
1323 }
1324
1325 static void tcp_v6_restore_cb(struct sk_buff *skb)
1326 {
1327         /* We need to move header back to the beginning if xfrm6_policy_check()
1328          * and tcp_v6_fill_cb() are going to be called again.
1329          */
1330         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1331                 sizeof(struct inet6_skb_parm));
1332 }
1333
1334 static int tcp_v6_rcv(struct sk_buff *skb)
1335 {
1336         const struct tcphdr *th;
1337         const struct ipv6hdr *hdr;
1338         struct sock *sk;
1339         int ret;
1340         struct net *net = dev_net(skb->dev);
1341
1342         if (skb->pkt_type != PACKET_HOST)
1343                 goto discard_it;
1344
1345         /*
1346          *      Count it even if it's bad.
1347          */
1348         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1349
1350         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1351                 goto discard_it;
1352
1353         th = tcp_hdr(skb);
1354
1355         if (th->doff < sizeof(struct tcphdr)/4)
1356                 goto bad_packet;
1357         if (!pskb_may_pull(skb, th->doff*4))
1358                 goto discard_it;
1359
1360         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1361                 goto csum_error;
1362
1363         th = tcp_hdr(skb);
1364         hdr = ipv6_hdr(skb);
1365
1366         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1367                                 inet6_iif(skb));
1368         if (!sk)
1369                 goto no_tcp_socket;
1370
1371 process:
1372         if (sk->sk_state == TCP_TIME_WAIT)
1373                 goto do_time_wait;
1374
1375         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1376                 struct request_sock *req = inet_reqsk(sk);
1377                 struct sock *nsk = NULL;
1378
1379                 sk = req->rsk_listener;
1380                 tcp_v6_fill_cb(skb, hdr, th);
1381                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1382                         reqsk_put(req);
1383                         goto discard_it;
1384                 }
1385                 if (sk->sk_state == TCP_LISTEN)
1386                         nsk = tcp_check_req(sk, skb, req, false);
1387                 if (!nsk) {
1388                         reqsk_put(req);
1389                         goto discard_it;
1390                 }
1391                 if (nsk == sk) {
1392                         sock_hold(sk);
1393                         reqsk_put(req);
1394                         tcp_v6_restore_cb(skb);
1395                 } else if (tcp_child_process(sk, nsk, skb)) {
1396                         tcp_v6_send_reset(nsk, skb);
1397                         goto discard_it;
1398                 } else {
1399                         return 0;
1400                 }
1401         }
1402         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1403                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1404                 goto discard_and_relse;
1405         }
1406
1407         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1408                 goto discard_and_relse;
1409
1410         tcp_v6_fill_cb(skb, hdr, th);
1411
1412         if (tcp_v6_inbound_md5_hash(sk, skb))
1413                 goto discard_and_relse;
1414
1415         if (sk_filter(sk, skb))
1416                 goto discard_and_relse;
1417
1418         skb->dev = NULL;
1419
1420         if (sk->sk_state == TCP_LISTEN) {
1421                 ret = tcp_v6_do_rcv(sk, skb);
1422                 goto put_and_return;
1423         }
1424
1425         sk_incoming_cpu_update(sk);
1426
1427         bh_lock_sock_nested(sk);
1428         tcp_sk(sk)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
1429         ret = 0;
1430         if (!sock_owned_by_user(sk)) {
1431                 if (!tcp_prequeue(sk, skb))
1432                         ret = tcp_v6_do_rcv(sk, skb);
1433         } else if (unlikely(sk_add_backlog(sk, skb,
1434                                            sk->sk_rcvbuf + sk->sk_sndbuf))) {
1435                 bh_unlock_sock(sk);
1436                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1437                 goto discard_and_relse;
1438         }
1439         bh_unlock_sock(sk);
1440
1441 put_and_return:
1442         sock_put(sk);
1443         return ret ? -1 : 0;
1444
1445 no_tcp_socket:
1446         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1447                 goto discard_it;
1448
1449         tcp_v6_fill_cb(skb, hdr, th);
1450
1451         if (tcp_checksum_complete(skb)) {
1452 csum_error:
1453                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1454 bad_packet:
1455                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1456         } else {
1457                 tcp_v6_send_reset(NULL, skb);
1458         }
1459
1460 discard_it:
1461         kfree_skb(skb);
1462         return 0;
1463
1464 discard_and_relse:
1465         sock_put(sk);
1466         goto discard_it;
1467
1468 do_time_wait:
1469         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1470                 inet_twsk_put(inet_twsk(sk));
1471                 goto discard_it;
1472         }
1473
1474         tcp_v6_fill_cb(skb, hdr, th);
1475
1476         if (tcp_checksum_complete(skb)) {
1477                 inet_twsk_put(inet_twsk(sk));
1478                 goto csum_error;
1479         }
1480
1481         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1482         case TCP_TW_SYN:
1483         {
1484                 struct sock *sk2;
1485
1486                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1487                                             &ipv6_hdr(skb)->saddr, th->source,
1488                                             &ipv6_hdr(skb)->daddr,
1489                                             ntohs(th->dest), tcp_v6_iif(skb));
1490                 if (sk2) {
1491                         struct inet_timewait_sock *tw = inet_twsk(sk);
1492                         inet_twsk_deschedule_put(tw);
1493                         sk = sk2;
1494                         tcp_v6_restore_cb(skb);
1495                         goto process;
1496                 }
1497                 /* Fall through to ACK */
1498         }
1499         case TCP_TW_ACK:
1500                 tcp_v6_timewait_ack(sk, skb);
1501                 break;
1502         case TCP_TW_RST:
1503                 tcp_v6_restore_cb(skb);
1504                 goto no_tcp_socket;
1505         case TCP_TW_SUCCESS:
1506                 ;
1507         }
1508         goto discard_it;
1509 }
1510
1511 static void tcp_v6_early_demux(struct sk_buff *skb)
1512 {
1513         const struct ipv6hdr *hdr;
1514         const struct tcphdr *th;
1515         struct sock *sk;
1516
1517         if (skb->pkt_type != PACKET_HOST)
1518                 return;
1519
1520         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1521                 return;
1522
1523         hdr = ipv6_hdr(skb);
1524         th = tcp_hdr(skb);
1525
1526         if (th->doff < sizeof(struct tcphdr) / 4)
1527                 return;
1528
1529         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1530         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1531                                         &hdr->saddr, th->source,
1532                                         &hdr->daddr, ntohs(th->dest),
1533                                         inet6_iif(skb));
1534         if (sk) {
1535                 skb->sk = sk;
1536                 skb->destructor = sock_edemux;
1537                 if (sk_fullsock(sk)) {
1538                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1539
1540                         if (dst)
1541                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1542                         if (dst &&
1543                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1544                                 skb_dst_set_noref(skb, dst);
1545                 }
1546         }
1547 }
1548
1549 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1550         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1551         .twsk_unique    = tcp_twsk_unique,
1552         .twsk_destructor = tcp_twsk_destructor,
1553 };
1554
1555 static const struct inet_connection_sock_af_ops ipv6_specific = {
1556         .queue_xmit        = inet6_csk_xmit,
1557         .send_check        = tcp_v6_send_check,
1558         .rebuild_header    = inet6_sk_rebuild_header,
1559         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1560         .conn_request      = tcp_v6_conn_request,
1561         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1562         .net_header_len    = sizeof(struct ipv6hdr),
1563         .net_frag_header_len = sizeof(struct frag_hdr),
1564         .setsockopt        = ipv6_setsockopt,
1565         .getsockopt        = ipv6_getsockopt,
1566         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1567         .sockaddr_len      = sizeof(struct sockaddr_in6),
1568         .bind_conflict     = inet6_csk_bind_conflict,
1569 #ifdef CONFIG_COMPAT
1570         .compat_setsockopt = compat_ipv6_setsockopt,
1571         .compat_getsockopt = compat_ipv6_getsockopt,
1572 #endif
1573         .mtu_reduced       = tcp_v6_mtu_reduced,
1574 };
1575
1576 #ifdef CONFIG_TCP_MD5SIG
1577 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1578         .md5_lookup     =       tcp_v6_md5_lookup,
1579         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1580         .md5_parse      =       tcp_v6_parse_md5_keys,
1581 };
1582 #endif
1583
1584 /*
1585  *      TCP over IPv4 via INET6 API
1586  */
1587 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1588         .queue_xmit        = ip_queue_xmit,
1589         .send_check        = tcp_v4_send_check,
1590         .rebuild_header    = inet_sk_rebuild_header,
1591         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1592         .conn_request      = tcp_v6_conn_request,
1593         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1594         .net_header_len    = sizeof(struct iphdr),
1595         .setsockopt        = ipv6_setsockopt,
1596         .getsockopt        = ipv6_getsockopt,
1597         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1598         .sockaddr_len      = sizeof(struct sockaddr_in6),
1599         .bind_conflict     = inet6_csk_bind_conflict,
1600 #ifdef CONFIG_COMPAT
1601         .compat_setsockopt = compat_ipv6_setsockopt,
1602         .compat_getsockopt = compat_ipv6_getsockopt,
1603 #endif
1604         .mtu_reduced       = tcp_v4_mtu_reduced,
1605 };
1606
1607 #ifdef CONFIG_TCP_MD5SIG
1608 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1609         .md5_lookup     =       tcp_v4_md5_lookup,
1610         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1611         .md5_parse      =       tcp_v6_parse_md5_keys,
1612 };
1613 #endif
1614
1615 /* NOTE: A lot of things set to zero explicitly by call to
1616  *       sk_alloc() so need not be done here.
1617  */
1618 static int tcp_v6_init_sock(struct sock *sk)
1619 {
1620         struct inet_connection_sock *icsk = inet_csk(sk);
1621
1622         tcp_init_sock(sk);
1623
1624         icsk->icsk_af_ops = &ipv6_specific;
1625
1626 #ifdef CONFIG_TCP_MD5SIG
1627         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1628 #endif
1629
1630         return 0;
1631 }
1632
1633 static void tcp_v6_destroy_sock(struct sock *sk)
1634 {
1635         tcp_v4_destroy_sock(sk);
1636         inet6_destroy_sock(sk);
1637 }
1638
1639 #ifdef CONFIG_PROC_FS
1640 /* Proc filesystem TCPv6 sock list dumping. */
1641 static void get_openreq6(struct seq_file *seq,
1642                          const struct request_sock *req, int i)
1643 {
1644         long ttd = req->rsk_timer.expires - jiffies;
1645         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1646         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1647
1648         if (ttd < 0)
1649                 ttd = 0;
1650
1651         seq_printf(seq,
1652                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1653                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1654                    i,
1655                    src->s6_addr32[0], src->s6_addr32[1],
1656                    src->s6_addr32[2], src->s6_addr32[3],
1657                    inet_rsk(req)->ir_num,
1658                    dest->s6_addr32[0], dest->s6_addr32[1],
1659                    dest->s6_addr32[2], dest->s6_addr32[3],
1660                    ntohs(inet_rsk(req)->ir_rmt_port),
1661                    TCP_SYN_RECV,
1662                    0, 0, /* could print option size, but that is af dependent. */
1663                    1,   /* timers active (only the expire timer) */
1664                    jiffies_to_clock_t(ttd),
1665                    req->num_timeout,
1666                    from_kuid_munged(seq_user_ns(seq),
1667                                     sock_i_uid(req->rsk_listener)),
1668                    0,  /* non standard timer */
1669                    0, /* open_requests have no inode */
1670                    0, req);
1671 }
1672
1673 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1674 {
1675         const struct in6_addr *dest, *src;
1676         __u16 destp, srcp;
1677         int timer_active;
1678         unsigned long timer_expires;
1679         const struct inet_sock *inet = inet_sk(sp);
1680         const struct tcp_sock *tp = tcp_sk(sp);
1681         const struct inet_connection_sock *icsk = inet_csk(sp);
1682         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1683
1684         dest  = &sp->sk_v6_daddr;
1685         src   = &sp->sk_v6_rcv_saddr;
1686         destp = ntohs(inet->inet_dport);
1687         srcp  = ntohs(inet->inet_sport);
1688
1689         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1690                 timer_active    = 1;
1691                 timer_expires   = icsk->icsk_timeout;
1692         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1693                 timer_active    = 4;
1694                 timer_expires   = icsk->icsk_timeout;
1695         } else if (timer_pending(&sp->sk_timer)) {
1696                 timer_active    = 2;
1697                 timer_expires   = sp->sk_timer.expires;
1698         } else {
1699                 timer_active    = 0;
1700                 timer_expires = jiffies;
1701         }
1702
1703         seq_printf(seq,
1704                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1705                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1706                    i,
1707                    src->s6_addr32[0], src->s6_addr32[1],
1708                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1709                    dest->s6_addr32[0], dest->s6_addr32[1],
1710                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1711                    sp->sk_state,
1712                    tp->write_seq-tp->snd_una,
1713                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1714                    timer_active,
1715                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1716                    icsk->icsk_retransmits,
1717                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1718                    icsk->icsk_probes_out,
1719                    sock_i_ino(sp),
1720                    atomic_read(&sp->sk_refcnt), sp,
1721                    jiffies_to_clock_t(icsk->icsk_rto),
1722                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1723                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1724                    tp->snd_cwnd,
1725                    sp->sk_state == TCP_LISTEN ?
1726                         fastopenq->max_qlen :
1727                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1728                    );
1729 }
1730
1731 static void get_timewait6_sock(struct seq_file *seq,
1732                                struct inet_timewait_sock *tw, int i)
1733 {
1734         long delta = tw->tw_timer.expires - jiffies;
1735         const struct in6_addr *dest, *src;
1736         __u16 destp, srcp;
1737
1738         dest = &tw->tw_v6_daddr;
1739         src  = &tw->tw_v6_rcv_saddr;
1740         destp = ntohs(tw->tw_dport);
1741         srcp  = ntohs(tw->tw_sport);
1742
1743         seq_printf(seq,
1744                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1745                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1746                    i,
1747                    src->s6_addr32[0], src->s6_addr32[1],
1748                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1749                    dest->s6_addr32[0], dest->s6_addr32[1],
1750                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1751                    tw->tw_substate, 0, 0,
1752                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1753                    atomic_read(&tw->tw_refcnt), tw);
1754 }
1755
1756 static int tcp6_seq_show(struct seq_file *seq, void *v)
1757 {
1758         struct tcp_iter_state *st;
1759         struct sock *sk = v;
1760
1761         if (v == SEQ_START_TOKEN) {
1762                 seq_puts(seq,
1763                          "  sl  "
1764                          "local_address                         "
1765                          "remote_address                        "
1766                          "st tx_queue rx_queue tr tm->when retrnsmt"
1767                          "   uid  timeout inode\n");
1768                 goto out;
1769         }
1770         st = seq->private;
1771
1772         if (sk->sk_state == TCP_TIME_WAIT)
1773                 get_timewait6_sock(seq, v, st->num);
1774         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1775                 get_openreq6(seq, v, st->num);
1776         else
1777                 get_tcp6_sock(seq, v, st->num);
1778 out:
1779         return 0;
1780 }
1781
1782 static const struct file_operations tcp6_afinfo_seq_fops = {
1783         .owner   = THIS_MODULE,
1784         .open    = tcp_seq_open,
1785         .read    = seq_read,
1786         .llseek  = seq_lseek,
1787         .release = seq_release_net
1788 };
1789
1790 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1791         .name           = "tcp6",
1792         .family         = AF_INET6,
1793         .seq_fops       = &tcp6_afinfo_seq_fops,
1794         .seq_ops        = {
1795                 .show           = tcp6_seq_show,
1796         },
1797 };
1798
1799 int __net_init tcp6_proc_init(struct net *net)
1800 {
1801         return tcp_proc_register(net, &tcp6_seq_afinfo);
1802 }
1803
1804 void tcp6_proc_exit(struct net *net)
1805 {
1806         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1807 }
1808 #endif
1809
1810 static void tcp_v6_clear_sk(struct sock *sk, int size)
1811 {
1812         struct inet_sock *inet = inet_sk(sk);
1813
1814         /* we do not want to clear pinet6 field, because of RCU lookups */
1815         sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1816
1817         size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1818         memset(&inet->pinet6 + 1, 0, size);
1819 }
1820
1821 struct proto tcpv6_prot = {
1822         .name                   = "TCPv6",
1823         .owner                  = THIS_MODULE,
1824         .close                  = tcp_close,
1825         .connect                = tcp_v6_connect,
1826         .disconnect             = tcp_disconnect,
1827         .accept                 = inet_csk_accept,
1828         .ioctl                  = tcp_ioctl,
1829         .init                   = tcp_v6_init_sock,
1830         .destroy                = tcp_v6_destroy_sock,
1831         .shutdown               = tcp_shutdown,
1832         .setsockopt             = tcp_setsockopt,
1833         .getsockopt             = tcp_getsockopt,
1834         .recvmsg                = tcp_recvmsg,
1835         .sendmsg                = tcp_sendmsg,
1836         .sendpage               = tcp_sendpage,
1837         .backlog_rcv            = tcp_v6_do_rcv,
1838         .release_cb             = tcp_release_cb,
1839         .hash                   = inet_hash,
1840         .unhash                 = inet_unhash,
1841         .get_port               = inet_csk_get_port,
1842         .enter_memory_pressure  = tcp_enter_memory_pressure,
1843         .stream_memory_free     = tcp_stream_memory_free,
1844         .sockets_allocated      = &tcp_sockets_allocated,
1845         .memory_allocated       = &tcp_memory_allocated,
1846         .memory_pressure        = &tcp_memory_pressure,
1847         .orphan_count           = &tcp_orphan_count,
1848         .sysctl_mem             = sysctl_tcp_mem,
1849         .sysctl_wmem            = sysctl_tcp_wmem,
1850         .sysctl_rmem            = sysctl_tcp_rmem,
1851         .max_header             = MAX_TCP_HEADER,
1852         .obj_size               = sizeof(struct tcp6_sock),
1853         .slab_flags             = SLAB_DESTROY_BY_RCU,
1854         .twsk_prot              = &tcp6_timewait_sock_ops,
1855         .rsk_prot               = &tcp6_request_sock_ops,
1856         .h.hashinfo             = &tcp_hashinfo,
1857         .no_autobind            = true,
1858 #ifdef CONFIG_COMPAT
1859         .compat_setsockopt      = compat_tcp_setsockopt,
1860         .compat_getsockopt      = compat_tcp_getsockopt,
1861 #endif
1862 #ifdef CONFIG_MEMCG_KMEM
1863         .proto_cgroup           = tcp_proto_cgroup,
1864 #endif
1865         .clear_sk               = tcp_v6_clear_sk,
1866 };
1867
1868 static const struct inet6_protocol tcpv6_protocol = {
1869         .early_demux    =       tcp_v6_early_demux,
1870         .handler        =       tcp_v6_rcv,
1871         .err_handler    =       tcp_v6_err,
1872         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1873 };
1874
1875 static struct inet_protosw tcpv6_protosw = {
1876         .type           =       SOCK_STREAM,
1877         .protocol       =       IPPROTO_TCP,
1878         .prot           =       &tcpv6_prot,
1879         .ops            =       &inet6_stream_ops,
1880         .flags          =       INET_PROTOSW_PERMANENT |
1881                                 INET_PROTOSW_ICSK,
1882 };
1883
1884 static int __net_init tcpv6_net_init(struct net *net)
1885 {
1886         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1887                                     SOCK_RAW, IPPROTO_TCP, net);
1888 }
1889
1890 static void __net_exit tcpv6_net_exit(struct net *net)
1891 {
1892         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1893 }
1894
1895 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1896 {
1897         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1898 }
1899
1900 static struct pernet_operations tcpv6_net_ops = {
1901         .init       = tcpv6_net_init,
1902         .exit       = tcpv6_net_exit,
1903         .exit_batch = tcpv6_net_exit_batch,
1904 };
1905
1906 int __init tcpv6_init(void)
1907 {
1908         int ret;
1909
1910         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1911         if (ret)
1912                 goto out;
1913
1914         /* register inet6 protocol */
1915         ret = inet6_register_protosw(&tcpv6_protosw);
1916         if (ret)
1917                 goto out_tcpv6_protocol;
1918
1919         ret = register_pernet_subsys(&tcpv6_net_ops);
1920         if (ret)
1921                 goto out_tcpv6_protosw;
1922 out:
1923         return ret;
1924
1925 out_tcpv6_protosw:
1926         inet6_unregister_protosw(&tcpv6_protosw);
1927 out_tcpv6_protocol:
1928         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1929         goto out;
1930 }
1931
1932 void tcpv6_exit(void)
1933 {
1934         unregister_pernet_subsys(&tcpv6_net_ops);
1935         inet6_unregister_protosw(&tcpv6_protosw);
1936         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1937 }