net/dccp/ipv6.c

   1 /*
   2  *      DCCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Based on net/dccp6/ipv6.c
   6  *
   7  *      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
   8  *
   9  *      This program is free software; you can redistribute it and/or
  10  *      modify it under the terms of the GNU General Public License
  11  *      as published by the Free Software Foundation; either version
  12  *      2 of the License, or (at your option) any later version.
  13  */
  14
  15 #include <linux/module.h>
  16 #include <linux/random.h>
  17 #include <linux/slab.h>
  18 #include <linux/xfrm.h>
  19
  20 #include <net/addrconf.h>
  21 #include <net/inet_common.h>
  22 #include <net/inet_hashtables.h>
  23 #include <net/inet_sock.h>
  24 #include <net/inet6_connection_sock.h>
  25 #include <net/inet6_hashtables.h>
  26 #include <net/ip6_route.h>
  27 #include <net/ipv6.h>
  28 #include <net/protocol.h>
  29 #include <net/transp_v6.h>
  30 #include <net/ip6_checksum.h>
  31 #include <net/xfrm.h>
  32 #include <net/secure_seq.h>
  33
  34 #include "dccp.h"
  35 #include "ipv6.h"
  36 #include "feat.h"
  37
  38 /* The per-net dccp.v6_ctl_sk is used for sending RSTs and ACKs */
  39
  40 static const struct inet_connection_sock_af_ops dccp_ipv6_mapped;
  41 static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops;
  42
  43 /* add pseudo-header to DCCP checksum stored in skb->csum */
  44 static inline __sum16 dccp_v6_csum_finish(struct sk_buff *skb,
  45                                       const struct in6_addr *saddr,
  46                                       const struct in6_addr *daddr)
  47 {
  48         return csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_DCCP, skb->csum);
  49 }
  50
  51 static inline void dccp_v6_send_check(struct sock *sk, struct sk_buff *skb)
  52 {
  53         struct ipv6_pinfo *np = inet6_sk(sk);
  54         struct dccp_hdr *dh = dccp_hdr(skb);
  55
  56         dccp_csum_outgoing(skb);
  57         dh->dccph_checksum = dccp_v6_csum_finish(skb, &np->saddr, &sk->sk_v6_daddr);
  58 }
  59
  60 static inline __u64 dccp_v6_init_sequence(struct sk_buff *skb)
  61 {
  62         return secure_dccpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
  63                                              ipv6_hdr(skb)->saddr.s6_addr32,
  64                                              dccp_hdr(skb)->dccph_dport,
  65                                              dccp_hdr(skb)->dccph_sport     );
  66
  67 }
  68
  69 static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  70                         u8 type, u8 code, int offset, __be32 info)
  71 {
  72         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
  73         const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
  74         struct dccp_sock *dp;
  75         struct ipv6_pinfo *np;
  76         struct sock *sk;
  77         int err;
  78         __u64 seq;
  79         struct net *net = dev_net(skb->dev);
  80
  81         if (skb->len < offset + sizeof(*dh) ||
  82             skb->len < offset + __dccp_basic_hdr_len(dh)) {
  83                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
  84                                    ICMP6_MIB_INERRORS);
  85                 return;
  86         }
  87
  88         sk = __inet6_lookup_established(net, &dccp_hashinfo,
  89                                         &hdr->daddr, dh->dccph_dport,
  90                                         &hdr->saddr, ntohs(dh->dccph_sport),
  91                                         inet6_iif(skb));
  92
  93         if (!sk) {
  94                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
  95                                    ICMP6_MIB_INERRORS);
  96                 return;
  97         }
  98
  99         if (sk->sk_state == DCCP_TIME_WAIT) {
 100                 inet_twsk_put(inet_twsk(sk));
 101                 return;
 102         }
 103         seq = dccp_hdr_seq(dh);
 104         if (sk->sk_state == DCCP_NEW_SYN_RECV)
 105                 return dccp_req_err(sk, seq);
 106
 107         bh_lock_sock(sk);
 108         if (sock_owned_by_user(sk))
 109                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 110
 111         if (sk->sk_state == DCCP_CLOSED)
 112                 goto out;
 113
 114         dp = dccp_sk(sk);
 115         if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
 116             !between48(seq, dp->dccps_awl, dp->dccps_awh)) {
 117                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 118                 goto out;
 119         }
 120
 121         np = inet6_sk(sk);
 122
 123         if (type == NDISC_REDIRECT) {
 124                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 125
 126                 if (dst)
 127                         dst->ops->redirect(dst, sk, skb);
 128                 goto out;
 129         }
 130
 131         if (type == ICMPV6_PKT_TOOBIG) {
 132                 struct dst_entry *dst = NULL;
 133
 134                 if (!ip6_sk_accept_pmtu(sk))
 135                         goto out;
 136
 137                 if (sock_owned_by_user(sk))
 138                         goto out;
 139                 if ((1 << sk->sk_state) & (DCCPF_LISTEN | DCCPF_CLOSED))
 140                         goto out;
 141
 142                 dst = inet6_csk_update_pmtu(sk, ntohl(info));
 143                 if (!dst)
 144                         goto out;
 145
 146                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst))
 147                         dccp_sync_mss(sk, dst_mtu(dst));
 148                 goto out;
 149         }
 150
 151         icmpv6_err_convert(type, code, &err);
 152
 153         /* Might be for an request_sock */
 154         switch (sk->sk_state) {
 155         case DCCP_REQUESTING:
 156         case DCCP_RESPOND:  /* Cannot happen.
 157                                It can, it SYNs are crossed. --ANK */
 158                 if (!sock_owned_by_user(sk)) {
 159                         DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
 160                         sk->sk_err = err;
 161                         /*
 162                          * Wake people up to see the error
 163                          * (see connect in sock.c)
 164                          */
 165                         sk->sk_error_report(sk);
 166                         dccp_done(sk);
 167                 } else
 168                         sk->sk_err_soft = err;
 169                 goto out;
 170         }
 171
 172         if (!sock_owned_by_user(sk) && np->recverr) {
 173                 sk->sk_err = err;
 174                 sk->sk_error_report(sk);
 175         } else
 176                 sk->sk_err_soft = err;
 177
 178 out:
 179         bh_unlock_sock(sk);
 180         sock_put(sk);
 181 }
 182
 183
 184 static int dccp_v6_send_response(const struct sock *sk, struct request_sock *req)
 185 {
 186         struct inet_request_sock *ireq = inet_rsk(req);
 187         struct ipv6_pinfo *np = inet6_sk(sk);
 188         struct sk_buff *skb;
 189         struct in6_addr *final_p, final;
 190         struct flowi6 fl6;
 191         int err = -1;
 192         struct dst_entry *dst;
 193
 194         memset(&fl6, 0, sizeof(fl6));
 195         fl6.flowi6_proto = IPPROTO_DCCP;
 196         fl6.daddr = ireq->ir_v6_rmt_addr;
 197         fl6.saddr = ireq->ir_v6_loc_addr;
 198         fl6.flowlabel = 0;
 199         fl6.flowi6_oif = ireq->ir_iif;
 200         fl6.fl6_dport = ireq->ir_rmt_port;
 201         fl6.fl6_sport = htons(ireq->ir_num);
 202         security_req_classify_flow(req, flowi6_to_flowi(&fl6));
 203
 204
 205         final_p = fl6_update_dst(&fl6, np->opt, &final);
 206
 207         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 208         if (IS_ERR(dst)) {
 209                 err = PTR_ERR(dst);
 210                 dst = NULL;
 211                 goto done;
 212         }
 213
 214         skb = dccp_make_response(sk, dst, req);
 215         if (skb != NULL) {
 216                 struct dccp_hdr *dh = dccp_hdr(skb);
 217
 218                 dh->dccph_checksum = dccp_v6_csum_finish(skb,
 219                                                          &ireq->ir_v6_loc_addr,
 220                                                          &ireq->ir_v6_rmt_addr);
 221                 fl6.daddr = ireq->ir_v6_rmt_addr;
 222                 err = ip6_xmit(sk, skb, &fl6, np->opt, np->tclass);
 223                 err = net_xmit_eval(err);
 224         }
 225
 226 done:
 227         dst_release(dst);
 228         return err;
 229 }
 230
 231 static void dccp_v6_reqsk_destructor(struct request_sock *req)
 232 {
 233         dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg);
 234         kfree_skb(inet_rsk(req)->pktopts);
 235 }
 236
 237 static void dccp_v6_ctl_send_reset(const struct sock *sk, struct sk_buff *rxskb)
 238 {
 239         const struct ipv6hdr *rxip6h;
 240         struct sk_buff *skb;
 241         struct flowi6 fl6;
 242         struct net *net = dev_net(skb_dst(rxskb)->dev);
 243         struct sock *ctl_sk = net->dccp.v6_ctl_sk;
 244         struct dst_entry *dst;
 245
 246         if (dccp_hdr(rxskb)->dccph_type == DCCP_PKT_RESET)
 247                 return;
 248
 249         if (!ipv6_unicast_destination(rxskb))
 250                 return;
 251
 252         skb = dccp_ctl_make_reset(ctl_sk, rxskb);
 253         if (skb == NULL)
 254                 return;
 255
 256         rxip6h = ipv6_hdr(rxskb);
 257         dccp_hdr(skb)->dccph_checksum = dccp_v6_csum_finish(skb, &rxip6h->saddr,
 258                                                             &rxip6h->daddr);
 259
 260         memset(&fl6, 0, sizeof(fl6));
 261         fl6.daddr = rxip6h->saddr;
 262         fl6.saddr = rxip6h->daddr;
 263
 264         fl6.flowi6_proto = IPPROTO_DCCP;
 265         fl6.flowi6_oif = inet6_iif(rxskb);
 266         fl6.fl6_dport = dccp_hdr(skb)->dccph_dport;
 267         fl6.fl6_sport = dccp_hdr(skb)->dccph_sport;
 268         security_skb_classify_flow(rxskb, flowi6_to_flowi(&fl6));
 269
 270         /* sk = NULL, but it is safe for now. RST socket required. */
 271         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 272         if (!IS_ERR(dst)) {
 273                 skb_dst_set(skb, dst);
 274                 ip6_xmit(ctl_sk, skb, &fl6, NULL, 0);
 275                 DCCP_INC_STATS_BH(DCCP_MIB_OUTSEGS);
 276                 DCCP_INC_STATS_BH(DCCP_MIB_OUTRSTS);
 277                 return;
 278         }
 279
 280         kfree_skb(skb);
 281 }
 282
 283 static struct request_sock_ops dccp6_request_sock_ops = {
 284         .family         = AF_INET6,
 285         .obj_size       = sizeof(struct dccp6_request_sock),
 286         .rtx_syn_ack    = dccp_v6_send_response,
 287         .send_ack       = dccp_reqsk_send_ack,
 288         .destructor     = dccp_v6_reqsk_destructor,
 289         .send_reset     = dccp_v6_ctl_send_reset,
 290         .syn_ack_timeout = dccp_syn_ack_timeout,
 291 };
 292
 293 static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 294 {
 295         struct request_sock *req;
 296         struct dccp_request_sock *dreq;
 297         struct inet_request_sock *ireq;
 298         struct ipv6_pinfo *np = inet6_sk(sk);
 299         const __be32 service = dccp_hdr_request(skb)->dccph_req_service;
 300         struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
 301
 302         if (skb->protocol == htons(ETH_P_IP))
 303                 return dccp_v4_conn_request(sk, skb);
 304
 305         if (!ipv6_unicast_destination(skb))
 306                 return 0;       /* discard, don't send a reset here */
 307
 308         if (dccp_bad_service_code(sk, service)) {
 309                 dcb->dccpd_reset_code = DCCP_RESET_CODE_BAD_SERVICE_CODE;
 310                 goto drop;
 311         }
 312         /*
 313          * There are no SYN attacks on IPv6, yet...
 314          */
 315         dcb->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY;
 316         if (inet_csk_reqsk_queue_is_full(sk))
 317                 goto drop;
 318
 319         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
 320                 goto drop;
 321
 322         req = inet_reqsk_alloc(&dccp6_request_sock_ops, sk, true);
 323         if (req == NULL)
 324                 goto drop;
 325
 326         if (dccp_reqsk_init(req, dccp_sk(sk), skb))
 327                 goto drop_and_free;
 328
 329         dreq = dccp_rsk(req);
 330         if (dccp_parse_options(sk, dreq, skb))
 331                 goto drop_and_free;
 332
 333         if (security_inet_conn_request(sk, skb, req))
 334                 goto drop_and_free;
 335
 336         ireq = inet_rsk(req);
 337         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 338         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 339         ireq->ireq_family = AF_INET6;
 340
 341         if (ipv6_opt_accepted(sk, skb, IP6CB(skb)) ||
 342             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
 343             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
 344                 atomic_inc(&skb->users);
 345                 ireq->pktopts = skb;
 346         }
 347         ireq->ir_iif = sk->sk_bound_dev_if;
 348
 349         /* So that link locals have meaning */
 350         if (!sk->sk_bound_dev_if &&
 351             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 352                 ireq->ir_iif = inet6_iif(skb);
 353
 354         /*
 355          * Step 3: Process LISTEN state
 356          *
 357          *   Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookie
 358          *
 359          * Setting S.SWL/S.SWH to is deferred to dccp_create_openreq_child().
 360          */
 361         dreq->dreq_isr     = dcb->dccpd_seq;
 362         dreq->dreq_gsr     = dreq->dreq_isr;
 363         dreq->dreq_iss     = dccp_v6_init_sequence(skb);
 364         dreq->dreq_gss     = dreq->dreq_iss;
 365         dreq->dreq_service = service;
 366
 367         if (dccp_v6_send_response(sk, req))
 368                 goto drop_and_free;
 369
 370         inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
 371         return 0;
 372
 373 drop_and_free:
 374         reqsk_free(req);
 375 drop:
 376         DCCP_INC_STATS_BH(DCCP_MIB_ATTEMPTFAILS);
 377         return -1;
 378 }
 379
 380 static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
 381                                               struct sk_buff *skb,
 382                                               struct request_sock *req,
 383                                               struct dst_entry *dst)
 384 {
 385         struct inet_request_sock *ireq = inet_rsk(req);
 386         struct ipv6_pinfo *newnp;
 387         const struct ipv6_pinfo *np = inet6_sk(sk);
 388         struct inet_sock *newinet;
 389         struct dccp6_sock *newdp6;
 390         struct sock *newsk;
 391
 392         if (skb->protocol == htons(ETH_P_IP)) {
 393                 /*
 394                  *      v6 mapped
 395                  */
 396                 newsk = dccp_v4_request_recv_sock(sk, skb, req, dst);
 397                 if (newsk == NULL)
 398                         return NULL;
 399
 400                 newdp6 = (struct dccp6_sock *)newsk;
 401                 newinet = inet_sk(newsk);
 402                 newinet->pinet6 = &newdp6->inet6;
 403                 newnp = inet6_sk(newsk);
 404
 405                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 406
 407                 newnp->saddr = newsk->sk_v6_rcv_saddr;
 408
 409                 inet_csk(newsk)->icsk_af_ops = &dccp_ipv6_mapped;
 410                 newsk->sk_backlog_rcv = dccp_v4_do_rcv;
 411                 newnp->pktoptions  = NULL;
 412                 newnp->opt         = NULL;
 413                 newnp->mcast_oif   = inet6_iif(skb);
 414                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
 415
 416                 /*
 417                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
 418                  * here, dccp_create_openreq_child now does this for us, see the comment in
 419                  * that function for the gory details. -acme
 420                  */
 421
 422                 /* It is tricky place. Until this moment IPv4 tcp
 423                    worked with IPv6 icsk.icsk_af_ops.
 424                    Sync it now.
 425                  */
 426                 dccp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
 427
 428                 return newsk;
 429         }
 430
 431
 432         if (sk_acceptq_is_full(sk))
 433                 goto out_overflow;
 434
 435         if (!dst) {
 436                 struct flowi6 fl6;
 437
 438                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_DCCP);
 439                 if (!dst)
 440                         goto out;
 441         }
 442
 443         newsk = dccp_create_openreq_child(sk, req, skb);
 444         if (newsk == NULL)
 445                 goto out_nonewsk;
 446
 447         /*
 448          * No need to charge this sock to the relevant IPv6 refcnt debug socks
 449          * count here, dccp_create_openreq_child now does this for us, see the
 450          * comment in that function for the gory details. -acme
 451          */
 452
 453         __ip6_dst_store(newsk, dst, NULL, NULL);
 454         newsk->sk_route_caps = dst->dev->features & ~(NETIF_F_IP_CSUM |
 455                                                       NETIF_F_TSO);
 456         newdp6 = (struct dccp6_sock *)newsk;
 457         newinet = inet_sk(newsk);
 458         newinet->pinet6 = &newdp6->inet6;
 459         newnp = inet6_sk(newsk);
 460
 461         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 462
 463         newsk->sk_v6_daddr      = ireq->ir_v6_rmt_addr;
 464         newnp->saddr            = ireq->ir_v6_loc_addr;
 465         newsk->sk_v6_rcv_saddr  = ireq->ir_v6_loc_addr;
 466         newsk->sk_bound_dev_if  = ireq->ir_iif;
 467
 468         /* Now IPv6 options...
 469
 470            First: no IPv4 options.
 471          */
 472         newinet->inet_opt = NULL;
 473
 474         /* Clone RX bits */
 475         newnp->rxopt.all = np->rxopt.all;
 476
 477         /* Clone pktoptions received with SYN */
 478         newnp->pktoptions = NULL;
 479         if (ireq->pktopts != NULL) {
 480                 newnp->pktoptions = skb_clone(ireq->pktopts, GFP_ATOMIC);
 481                 consume_skb(ireq->pktopts);
 482                 ireq->pktopts = NULL;
 483                 if (newnp->pktoptions)
 484                         skb_set_owner_r(newnp->pktoptions, newsk);
 485         }
 486         newnp->opt        = NULL;
 487         newnp->mcast_oif  = inet6_iif(skb);
 488         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
 489
 490         /*
 491          * Clone native IPv6 options from listening socket (if any)
 492          *
 493          * Yes, keeping reference count would be much more clever, but we make
 494          * one more one thing there: reattach optmem to newsk.
 495          */
 496         if (np->opt != NULL)
 497                 newnp->opt = ipv6_dup_options(newsk, np->opt);
 498
 499         inet_csk(newsk)->icsk_ext_hdr_len = 0;
 500         if (newnp->opt != NULL)
 501                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
 502                                                      newnp->opt->opt_flen);
 503
 504         dccp_sync_mss(newsk, dst_mtu(dst));
 505
 506         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
 507         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
 508
 509         if (__inet_inherit_port(sk, newsk) < 0) {
 510                 inet_csk_prepare_forced_close(newsk);
 511                 dccp_done(newsk);
 512                 goto out;
 513         }
 514         __inet_hash(newsk, NULL);
 515
 516         return newsk;
 517
 518 out_overflow:
 519         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 520 out_nonewsk:
 521         dst_release(dst);
 522 out:
 523         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
 524         return NULL;
 525 }
 526
 527 /* The socket must have it's spinlock held when we get
 528  * here.
 529  *
 530  * We have a potential double-lock case here, so even when
 531  * doing backlog processing we use the BH locking scheme.
 532  * This is because we cannot sleep with the original spinlock
 533  * held.
 534  */
 535 static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
 536 {
 537         struct ipv6_pinfo *np = inet6_sk(sk);
 538         struct sk_buff *opt_skb = NULL;
 539
 540         /* Imagine: socket is IPv6. IPv4 packet arrives,
 541            goes to IPv4 receive handler and backlogged.
 542            From backlog it always goes here. Kerboom...
 543            Fortunately, dccp_rcv_established and rcv_established
 544            handle them correctly, but it is not case with
 545            dccp_v6_hnd_req and dccp_v6_ctl_send_reset().   --ANK
 546          */
 547
 548         if (skb->protocol == htons(ETH_P_IP))
 549                 return dccp_v4_do_rcv(sk, skb);
 550
 551         if (sk_filter(sk, skb))
 552                 goto discard;
 553
 554         /*
 555          * socket locking is here for SMP purposes as backlog rcv is currently
 556          * called with bh processing disabled.
 557          */
 558
 559         /* Do Stevens' IPV6_PKTOPTIONS.
 560
 561            Yes, guys, it is the only place in our code, where we
 562            may make it not affecting IPv4.
 563            The rest of code is protocol independent,
 564            and I do not like idea to uglify IPv4.
 565
 566            Actually, all the idea behind IPV6_PKTOPTIONS
 567            looks not very well thought. For now we latch
 568            options, received in the last packet, enqueued
 569            by tcp. Feel free to propose better solution.
 570                                                --ANK (980728)
 571          */
 572         if (np->rxopt.all)
 573         /*
 574          * FIXME: Add handling of IPV6_PKTOPTIONS skb. See the comments below
 575          *        (wrt ipv6_pktopions) and net/ipv6/tcp_ipv6.c for an example.
 576          */
 577                 opt_skb = skb_clone(skb, GFP_ATOMIC);
 578
 579         if (sk->sk_state == DCCP_OPEN) { /* Fast path */
 580                 if (dccp_rcv_established(sk, skb, dccp_hdr(skb), skb->len))
 581                         goto reset;
 582                 if (opt_skb) {
 583                         /* XXX This is where we would goto ipv6_pktoptions. */
 584                         __kfree_skb(opt_skb);
 585                 }
 586                 return 0;
 587         }
 588
 589         /*
 590          *  Step 3: Process LISTEN state
 591          *     If S.state == LISTEN,
 592          *       If P.type == Request or P contains a valid Init Cookie option,
 593          *            (* Must scan the packet's options to check for Init
 594          *               Cookies.  Only Init Cookies are processed here,
 595          *               however; other options are processed in Step 8.  This
 596          *               scan need only be performed if the endpoint uses Init
 597          *               Cookies *)
 598          *            (* Generate a new socket and switch to that socket *)
 599          *            Set S := new socket for this port pair
 600          *            S.state = RESPOND
 601          *            Choose S.ISS (initial seqno) or set from Init Cookies
 602          *            Initialize S.GAR := S.ISS
 603          *            Set S.ISR, S.GSR, S.SWL, S.SWH from packet or Init Cookies
 604          *            Continue with S.state == RESPOND
 605          *            (* A Response packet will be generated in Step 11 *)
 606          *       Otherwise,
 607          *            Generate Reset(No Connection) unless P.type == Reset
 608          *            Drop packet and return
 609          *
 610          * NOTE: the check for the packet types is done in
 611          *       dccp_rcv_state_process
 612          */
 613
 614         if (dccp_rcv_state_process(sk, skb, dccp_hdr(skb), skb->len))
 615                 goto reset;
 616         if (opt_skb) {
 617                 /* XXX This is where we would goto ipv6_pktoptions. */
 618                 __kfree_skb(opt_skb);
 619         }
 620         return 0;
 621
 622 reset:
 623         dccp_v6_ctl_send_reset(sk, skb);
 624 discard:
 625         if (opt_skb != NULL)
 626                 __kfree_skb(opt_skb);
 627         kfree_skb(skb);
 628         return 0;
 629 }
 630
 631 static int dccp_v6_rcv(struct sk_buff *skb)
 632 {
 633         const struct dccp_hdr *dh;
 634         struct sock *sk;
 635         int min_cov;
 636
 637         /* Step 1: Check header basics */
 638
 639         if (dccp_invalid_packet(skb))
 640                 goto discard_it;
 641
 642         /* Step 1: If header checksum is incorrect, drop packet and return. */
 643         if (dccp_v6_csum_finish(skb, &ipv6_hdr(skb)->saddr,
 644                                      &ipv6_hdr(skb)->daddr)) {
 645                 DCCP_WARN("dropped packet with invalid checksum\n");
 646                 goto discard_it;
 647         }
 648
 649         dh = dccp_hdr(skb);
 650
 651         DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(dh);
 652         DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
 653
 654         if (dccp_packet_without_ack(skb))
 655                 DCCP_SKB_CB(skb)->dccpd_ack_seq = DCCP_PKT_WITHOUT_ACK_SEQ;
 656         else
 657                 DCCP_SKB_CB(skb)->dccpd_ack_seq = dccp_hdr_ack_seq(skb);
 658
 659 lookup:
 660         sk = __inet6_lookup_skb(&dccp_hashinfo, skb,
 661                                 dh->dccph_sport, dh->dccph_dport,
 662                                 inet6_iif(skb));
 663         if (!sk) {
 664                 dccp_pr_debug("failed to look up flow ID in table and "
 665                               "get corresponding socket\n");
 666                 goto no_dccp_socket;
 667         }
 668
 669         /*
 670          * Step 2:
 671          *      ... or S.state == TIMEWAIT,
 672          *              Generate Reset(No Connection) unless P.type == Reset
 673          *              Drop packet and return
 674          */
 675         if (sk->sk_state == DCCP_TIME_WAIT) {
 676                 dccp_pr_debug("sk->sk_state == DCCP_TIME_WAIT: do_time_wait\n");
 677                 inet_twsk_put(inet_twsk(sk));
 678                 goto no_dccp_socket;
 679         }
 680
 681         if (sk->sk_state == DCCP_NEW_SYN_RECV) {
 682                 struct request_sock *req = inet_reqsk(sk);
 683                 struct sock *nsk = NULL;
 684
 685                 sk = req->rsk_listener;
 686                 if (likely(sk->sk_state == DCCP_LISTEN)) {
 687                         nsk = dccp_check_req(sk, skb, req);
 688                 } else {
 689                         inet_csk_reqsk_queue_drop_and_put(sk, req);
 690                         goto lookup;
 691                 }
 692                 if (!nsk) {
 693                         reqsk_put(req);
 694                         goto discard_it;
 695                 }
 696                 if (nsk == sk) {
 697                         sock_hold(sk);
 698                         reqsk_put(req);
 699                 } else if (dccp_child_process(sk, nsk, skb)) {
 700                         dccp_v6_ctl_send_reset(sk, skb);
 701                         goto discard_it;
 702                 } else {
 703                         return 0;
 704                 }
 705         }
 706         /*
 707          * RFC 4340, sec. 9.2.1: Minimum Checksum Coverage
 708          *      o if MinCsCov = 0, only packets with CsCov = 0 are accepted
 709          *      o if MinCsCov > 0, also accept packets with CsCov >= MinCsCov
 710          */
 711         min_cov = dccp_sk(sk)->dccps_pcrlen;
 712         if (dh->dccph_cscov  &&  (min_cov == 0 || dh->dccph_cscov < min_cov))  {
 713                 dccp_pr_debug("Packet CsCov %d does not satisfy MinCsCov %d\n",
 714                               dh->dccph_cscov, min_cov);
 715                 /* FIXME: send Data Dropped option (see also dccp_v4_rcv) */
 716                 goto discard_and_relse;
 717         }
 718
 719         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 720                 goto discard_and_relse;
 721
 722         return sk_receive_skb(sk, skb, 1) ? -1 : 0;
 723
 724 no_dccp_socket:
 725         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
 726                 goto discard_it;
 727         /*
 728          * Step 2:
 729          *      If no socket ...
 730          *              Generate Reset(No Connection) unless P.type == Reset
 731          *              Drop packet and return
 732          */
 733         if (dh->dccph_type != DCCP_PKT_RESET) {
 734                 DCCP_SKB_CB(skb)->dccpd_reset_code =
 735                                         DCCP_RESET_CODE_NO_CONNECTION;
 736                 dccp_v6_ctl_send_reset(sk, skb);
 737         }
 738
 739 discard_it:
 740         kfree_skb(skb);
 741         return 0;
 742
 743 discard_and_relse:
 744         sock_put(sk);
 745         goto discard_it;
 746 }
 747
 748 static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 749                            int addr_len)
 750 {
 751         struct sockaddr_in6 *usin = (struct sockaddr_in6 *)uaddr;
 752         struct inet_connection_sock *icsk = inet_csk(sk);
 753         struct inet_sock *inet = inet_sk(sk);
 754         struct ipv6_pinfo *np = inet6_sk(sk);
 755         struct dccp_sock *dp = dccp_sk(sk);
 756         struct in6_addr *saddr = NULL, *final_p, final;
 757         struct flowi6 fl6;
 758         struct dst_entry *dst;
 759         int addr_type;
 760         int err;
 761
 762         dp->dccps_role = DCCP_ROLE_CLIENT;
 763
 764         if (addr_len < SIN6_LEN_RFC2133)
 765                 return -EINVAL;
 766
 767         if (usin->sin6_family != AF_INET6)
 768                 return -EAFNOSUPPORT;
 769
 770         memset(&fl6, 0, sizeof(fl6));
 771
 772         if (np->sndflow) {
 773                 fl6.flowlabel = usin->sin6_flowinfo & IPV6_FLOWINFO_MASK;
 774                 IP6_ECN_flow_init(fl6.flowlabel);
 775                 if (fl6.flowlabel & IPV6_FLOWLABEL_MASK) {
 776                         struct ip6_flowlabel *flowlabel;
 777                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 778                         if (flowlabel == NULL)
 779                                 return -EINVAL;
 780                         fl6_sock_release(flowlabel);
 781                 }
 782         }
 783         /*
 784          * connect() to INADDR_ANY means loopback (BSD'ism).
 785          */
 786         if (ipv6_addr_any(&usin->sin6_addr))
 787                 usin->sin6_addr.s6_addr[15] = 1;
 788
 789         addr_type = ipv6_addr_type(&usin->sin6_addr);
 790
 791         if (addr_type & IPV6_ADDR_MULTICAST)
 792                 return -ENETUNREACH;
 793
 794         if (addr_type & IPV6_ADDR_LINKLOCAL) {
 795                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 796                     usin->sin6_scope_id) {
 797                         /* If interface is set while binding, indices
 798                          * must coincide.
 799                          */
 800                         if (sk->sk_bound_dev_if &&
 801                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 802                                 return -EINVAL;
 803
 804                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 805                 }
 806
 807                 /* Connect to link-local address requires an interface */
 808                 if (!sk->sk_bound_dev_if)
 809                         return -EINVAL;
 810         }
 811
 812         sk->sk_v6_daddr = usin->sin6_addr;
 813         np->flow_label = fl6.flowlabel;
 814
 815         /*
 816          * DCCP over IPv4
 817          */
 818         if (addr_type == IPV6_ADDR_MAPPED) {
 819                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 820                 struct sockaddr_in sin;
 821
 822                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 823
 824                 if (__ipv6_only_sock(sk))
 825                         return -ENETUNREACH;
 826
 827                 sin.sin_family = AF_INET;
 828                 sin.sin_port = usin->sin6_port;
 829                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 830
 831                 icsk->icsk_af_ops = &dccp_ipv6_mapped;
 832                 sk->sk_backlog_rcv = dccp_v4_do_rcv;
 833
 834                 err = dccp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 835                 if (err) {
 836                         icsk->icsk_ext_hdr_len = exthdrlen;
 837                         icsk->icsk_af_ops = &dccp_ipv6_af_ops;
 838                         sk->sk_backlog_rcv = dccp_v6_do_rcv;
 839                         goto failure;
 840                 }
 841                 np->saddr = sk->sk_v6_rcv_saddr;
 842                 return err;
 843         }
 844
 845         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 846                 saddr = &sk->sk_v6_rcv_saddr;
 847
 848         fl6.flowi6_proto = IPPROTO_DCCP;
 849         fl6.daddr = sk->sk_v6_daddr;
 850         fl6.saddr = saddr ? *saddr : np->saddr;
 851         fl6.flowi6_oif = sk->sk_bound_dev_if;
 852         fl6.fl6_dport = usin->sin6_port;
 853         fl6.fl6_sport = inet->inet_sport;
 854         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 855
 856         final_p = fl6_update_dst(&fl6, np->opt, &final);
 857
 858         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 859         if (IS_ERR(dst)) {
 860                 err = PTR_ERR(dst);
 861                 goto failure;
 862         }
 863
 864         if (saddr == NULL) {
 865                 saddr = &fl6.saddr;
 866                 sk->sk_v6_rcv_saddr = *saddr;
 867         }
 868
 869         /* set the source address */
 870         np->saddr = *saddr;
 871         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 872
 873         __ip6_dst_store(sk, dst, NULL, NULL);
 874
 875         icsk->icsk_ext_hdr_len = 0;
 876         if (np->opt != NULL)
 877                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 878                                           np->opt->opt_nflen);
 879
 880         inet->inet_dport = usin->sin6_port;
 881
 882         dccp_set_state(sk, DCCP_REQUESTING);
 883         err = inet6_hash_connect(&dccp_death_row, sk);
 884         if (err)
 885                 goto late_failure;
 886
 887         dp->dccps_iss = secure_dccpv6_sequence_number(np->saddr.s6_addr32,
 888                                                       sk->sk_v6_daddr.s6_addr32,
 889                                                       inet->inet_sport,
 890                                                       inet->inet_dport);
 891         err = dccp_connect(sk);
 892         if (err)
 893                 goto late_failure;
 894
 895         return 0;
 896
 897 late_failure:
 898         dccp_set_state(sk, DCCP_CLOSED);
 899         __sk_dst_reset(sk);
 900 failure:
 901         inet->inet_dport = 0;
 902         sk->sk_route_caps = 0;
 903         return err;
 904 }
 905
 906 static const struct inet_connection_sock_af_ops dccp_ipv6_af_ops = {
 907         .queue_xmit        = inet6_csk_xmit,
 908         .send_check        = dccp_v6_send_check,
 909         .rebuild_header    = inet6_sk_rebuild_header,
 910         .conn_request      = dccp_v6_conn_request,
 911         .syn_recv_sock     = dccp_v6_request_recv_sock,
 912         .net_header_len    = sizeof(struct ipv6hdr),
 913         .setsockopt        = ipv6_setsockopt,
 914         .getsockopt        = ipv6_getsockopt,
 915         .addr2sockaddr     = inet6_csk_addr2sockaddr,
 916         .sockaddr_len      = sizeof(struct sockaddr_in6),
 917         .bind_conflict     = inet6_csk_bind_conflict,
 918 #ifdef CONFIG_COMPAT
 919         .compat_setsockopt = compat_ipv6_setsockopt,
 920         .compat_getsockopt = compat_ipv6_getsockopt,
 921 #endif
 922 };
 923
 924 /*
 925  *      DCCP over IPv4 via INET6 API
 926  */
 927 static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = {
 928         .queue_xmit        = ip_queue_xmit,
 929         .send_check        = dccp_v4_send_check,
 930         .rebuild_header    = inet_sk_rebuild_header,
 931         .conn_request      = dccp_v6_conn_request,
 932         .syn_recv_sock     = dccp_v6_request_recv_sock,
 933         .net_header_len    = sizeof(struct iphdr),
 934         .setsockopt        = ipv6_setsockopt,
 935         .getsockopt        = ipv6_getsockopt,
 936         .addr2sockaddr     = inet6_csk_addr2sockaddr,
 937         .sockaddr_len      = sizeof(struct sockaddr_in6),
 938 #ifdef CONFIG_COMPAT
 939         .compat_setsockopt = compat_ipv6_setsockopt,
 940         .compat_getsockopt = compat_ipv6_getsockopt,
 941 #endif
 942 };
 943
 944 /* NOTE: A lot of things set to zero explicitly by call to
 945  *       sk_alloc() so need not be done here.
 946  */
 947 static int dccp_v6_init_sock(struct sock *sk)
 948 {
 949         static __u8 dccp_v6_ctl_sock_initialized;
 950         int err = dccp_init_sock(sk, dccp_v6_ctl_sock_initialized);
 951
 952         if (err == 0) {
 953                 if (unlikely(!dccp_v6_ctl_sock_initialized))
 954                         dccp_v6_ctl_sock_initialized = 1;
 955                 inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops;
 956         }
 957
 958         return err;
 959 }
 960
 961 static void dccp_v6_destroy_sock(struct sock *sk)
 962 {
 963         dccp_destroy_sock(sk);
 964         inet6_destroy_sock(sk);
 965 }
 966
 967 static struct timewait_sock_ops dccp6_timewait_sock_ops = {
 968         .twsk_obj_size  = sizeof(struct dccp6_timewait_sock),
 969 };
 970
 971 static struct proto dccp_v6_prot = {
 972         .name              = "DCCPv6",
 973         .owner             = THIS_MODULE,
 974         .close             = dccp_close,
 975         .connect           = dccp_v6_connect,
 976         .disconnect        = dccp_disconnect,
 977         .ioctl             = dccp_ioctl,
 978         .init              = dccp_v6_init_sock,
 979         .setsockopt        = dccp_setsockopt,
 980         .getsockopt        = dccp_getsockopt,
 981         .sendmsg           = dccp_sendmsg,
 982         .recvmsg           = dccp_recvmsg,
 983         .backlog_rcv       = dccp_v6_do_rcv,
 984         .hash              = inet_hash,
 985         .unhash            = inet_unhash,
 986         .accept            = inet_csk_accept,
 987         .get_port          = inet_csk_get_port,
 988         .shutdown          = dccp_shutdown,
 989         .destroy           = dccp_v6_destroy_sock,
 990         .orphan_count      = &dccp_orphan_count,
 991         .max_header        = MAX_DCCP_HEADER,
 992         .obj_size          = sizeof(struct dccp6_sock),
 993         .slab_flags        = SLAB_DESTROY_BY_RCU,
 994         .rsk_prot          = &dccp6_request_sock_ops,
 995         .twsk_prot         = &dccp6_timewait_sock_ops,
 996         .h.hashinfo        = &dccp_hashinfo,
 997 #ifdef CONFIG_COMPAT
 998         .compat_setsockopt = compat_dccp_setsockopt,
 999         .compat_getsockopt = compat_dccp_getsockopt,
1000 #endif
1001 };
1002
1003 static const struct inet6_protocol dccp_v6_protocol = {
1004         .handler        = dccp_v6_rcv,
1005         .err_handler    = dccp_v6_err,
1006         .flags          = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
1007 };
1008
1009 static const struct proto_ops inet6_dccp_ops = {
1010         .family            = PF_INET6,
1011         .owner             = THIS_MODULE,
1012         .release           = inet6_release,
1013         .bind              = inet6_bind,
1014         .connect           = inet_stream_connect,
1015         .socketpair        = sock_no_socketpair,
1016         .accept            = inet_accept,
1017         .getname           = inet6_getname,
1018         .poll              = dccp_poll,
1019         .ioctl             = inet6_ioctl,
1020         .listen            = inet_dccp_listen,
1021         .shutdown          = inet_shutdown,
1022         .setsockopt        = sock_common_setsockopt,
1023         .getsockopt        = sock_common_getsockopt,
1024         .sendmsg           = inet_sendmsg,
1025         .recvmsg           = sock_common_recvmsg,
1026         .mmap              = sock_no_mmap,
1027         .sendpage          = sock_no_sendpage,
1028 #ifdef CONFIG_COMPAT
1029         .compat_setsockopt = compat_sock_common_setsockopt,
1030         .compat_getsockopt = compat_sock_common_getsockopt,
1031 #endif
1032 };
1033
1034 static struct inet_protosw dccp_v6_protosw = {
1035         .type           = SOCK_DCCP,
1036         .protocol       = IPPROTO_DCCP,
1037         .prot           = &dccp_v6_prot,
1038         .ops            = &inet6_dccp_ops,
1039         .flags          = INET_PROTOSW_ICSK,
1040 };
1041
1042 static int __net_init dccp_v6_init_net(struct net *net)
1043 {
1044         if (dccp_hashinfo.bhash == NULL)
1045                 return -ESOCKTNOSUPPORT;
1046
1047         return inet_ctl_sock_create(&net->dccp.v6_ctl_sk, PF_INET6,
1048                                     SOCK_DCCP, IPPROTO_DCCP, net);
1049 }
1050
1051 static void __net_exit dccp_v6_exit_net(struct net *net)
1052 {
1053         inet_ctl_sock_destroy(net->dccp.v6_ctl_sk);
1054 }
1055
1056 static struct pernet_operations dccp_v6_ops = {
1057         .init   = dccp_v6_init_net,
1058         .exit   = dccp_v6_exit_net,
1059 };
1060
1061 static int __init dccp_v6_init(void)
1062 {
1063         int err = proto_register(&dccp_v6_prot, 1);
1064
1065         if (err != 0)
1066                 goto out;
1067
1068         err = inet6_add_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1069         if (err != 0)
1070                 goto out_unregister_proto;
1071
1072         inet6_register_protosw(&dccp_v6_protosw);
1073
1074         err = register_pernet_subsys(&dccp_v6_ops);
1075         if (err != 0)
1076                 goto out_destroy_ctl_sock;
1077 out:
1078         return err;
1079
1080 out_destroy_ctl_sock:
1081         inet6_del_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1082         inet6_unregister_protosw(&dccp_v6_protosw);
1083 out_unregister_proto:
1084         proto_unregister(&dccp_v6_prot);
1085         goto out;
1086 }
1087
1088 static void __exit dccp_v6_exit(void)
1089 {
1090         unregister_pernet_subsys(&dccp_v6_ops);
1091         inet6_del_protocol(&dccp_v6_protocol, IPPROTO_DCCP);
1092         inet6_unregister_protosw(&dccp_v6_protosw);
1093         proto_unregister(&dccp_v6_prot);
1094 }
1095
1096 module_init(dccp_v6_init);
1097 module_exit(dccp_v6_exit);
1098
1099 /*
1100  * __stringify doesn't likes enums, so use SOCK_DCCP (6) and IPPROTO_DCCP (33)
1101  * values directly, Also cover the case where the protocol is not specified,
1102  * i.e. net-pf-PF_INET6-proto-0-type-SOCK_DCCP
1103  */
1104 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 33, 6);
1105 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 0, 6);
1106 MODULE_LICENSE("GPL");
1107 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
1108 MODULE_DESCRIPTION("DCCPv6 - Datagram Congestion Controlled Protocol");