net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42 #include <linux/uaccess.h>
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/inet_common.h>
  63 #include <net/secure_seq.h>
  64 #include <net/busy_poll.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <crypto/hash.h>
  70 #include <linux/scatterlist.h>
  71
  72 static void     tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
  73 static void     tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
  74                                       struct request_sock *req);
  75
  76 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  77
  78 static const struct inet_connection_sock_af_ops ipv6_mapped;
  79 static const struct inet_connection_sock_af_ops ipv6_specific;
  80 #ifdef CONFIG_TCP_MD5SIG
  81 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  82 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  83 #else
  84 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
  85                                                    const struct in6_addr *addr)
  86 {
  87         return NULL;
  88 }
  89 #endif
  90
  91 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
  92 {
  93         struct dst_entry *dst = skb_dst(skb);
  94
  95         if (dst && dst_hold_safe(dst)) {
  96                 const struct rt6_info *rt = (const struct rt6_info *)dst;
  97
  98                 sk->sk_rx_dst = dst;
  99                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
 100                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
 101         }
 102 }
 103
 104 static u32 tcp_v6_init_sequence(const struct sk_buff *skb, u32 *tsoff)
 105 {
 106         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 107                                             ipv6_hdr(skb)->saddr.s6_addr32,
 108                                             tcp_hdr(skb)->dest,
 109                                             tcp_hdr(skb)->source, tsoff);
 110 }
 111
 112 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 113                           int addr_len)
 114 {
 115         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 116         struct inet_sock *inet = inet_sk(sk);
 117         struct inet_connection_sock *icsk = inet_csk(sk);
 118         struct ipv6_pinfo *np = inet6_sk(sk);
 119         struct tcp_sock *tp = tcp_sk(sk);
 120         struct in6_addr *saddr = NULL, *final_p, final;
 121         struct ipv6_txoptions *opt;
 122         struct flowi6 fl6;
 123         struct dst_entry *dst;
 124         int addr_type;
 125         int err;
 126
 127         if (addr_len < SIN6_LEN_RFC2133)
 128                 return -EINVAL;
 129
 130         if (usin->sin6_family != AF_INET6)
 131                 return -EAFNOSUPPORT;
 132
 133         memset(&fl6, 0, sizeof(fl6));
 134
 135         if (np->sndflow) {
 136                 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 137                 IP6_ECN_flow_init(fl6.flowlabel);
 138                 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
 139                         struct ip6_flowlabel *flowlabel;
 140                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
 141                         if (!flowlabel)
 142                                 return -EINVAL;
 143                         fl6_sock_release(flowlabel);
 144                 }
 145         }
 146
 147         /*
 148          *      connect() to INADDR_ANY means loopback (BSD'ism).
 149          */
 150
 151         if (ipv6_addr_any(&usin->sin6_addr))
 152                 usin->sin6_addr.s6_addr[15] = 0x1;
 153
 154         addr_type = ipv6_addr_type(&usin->sin6_addr);
 155
 156         if (addr_type & IPV6_ADDR_MULTICAST)
 157                 return -ENETUNREACH;
 158
 159         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 160                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 161                     usin->sin6_scope_id) {
 162                         /* If interface is set while binding, indices
 163                          * must coincide.
 164                          */
 165                         if (sk->sk_bound_dev_if &&
 166                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 167                                 return -EINVAL;
 168
 169                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 170                 }
 171
 172                 /* Connect to link-local address requires an interface */
 173                 if (!sk->sk_bound_dev_if)
 174                         return -EINVAL;
 175         }
 176
 177         if (tp->rx_opt.ts_recent_stamp &&
 178             !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
 179                 tp->rx_opt.ts_recent = 0;
 180                 tp->rx_opt.ts_recent_stamp = 0;
 181                 tp->write_seq = 0;
 182         }
 183
 184         sk->sk_v6_daddr = usin->sin6_addr;
 185         np->flow_label = fl6.flowlabel;
 186
 187         /*
 188          *      TCP over IPv4
 189          */
 190
 191         if (addr_type == IPV6_ADDR_MAPPED) {
 192                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 193                 struct sockaddr_in sin;
 194
 195                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 196
 197                 if (__ipv6_only_sock(sk))
 198                         return -ENETUNREACH;
 199
 200                 sin.sin_family = AF_INET;
 201                 sin.sin_port = usin->sin6_port;
 202                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 203
 204                 icsk->icsk_af_ops = &ipv6_mapped;
 205                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 206 #ifdef CONFIG_TCP_MD5SIG
 207                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 208 #endif
 209
 210                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 211
 212                 if (err) {
 213                         icsk->icsk_ext_hdr_len = exthdrlen;
 214                         icsk->icsk_af_ops = &ipv6_specific;
 215                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 216 #ifdef CONFIG_TCP_MD5SIG
 217                         tp->af_specific = &tcp_sock_ipv6_specific;
 218 #endif
 219                         goto failure;
 220                 }
 221                 np->saddr = sk->sk_v6_rcv_saddr;
 222
 223                 return err;
 224         }
 225
 226         if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
 227                 saddr = &sk->sk_v6_rcv_saddr;
 228
 229         fl6.flowi6_proto = IPPROTO_TCP;
 230         fl6.daddr = sk->sk_v6_daddr;
 231         fl6.saddr = saddr ? *saddr : np->saddr;
 232         fl6.flowi6_oif = sk->sk_bound_dev_if;
 233         fl6.flowi6_mark = sk->sk_mark;
 234         fl6.fl6_dport = usin->sin6_port;
 235         fl6.fl6_sport = inet->inet_sport;
 236         fl6.flowi6_uid = sk->sk_uid;
 237
 238         opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
 239         final_p = fl6_update_dst(&fl6, opt, &final);
 240
 241         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 242
 243         dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
 244         if (IS_ERR(dst)) {
 245                 err = PTR_ERR(dst);
 246                 goto failure;
 247         }
 248
 249         if (!saddr) {
 250                 saddr = &fl6.saddr;
 251                 sk->sk_v6_rcv_saddr = *saddr;
 252         }
 253
 254         /* set the source address */
 255         np->saddr = *saddr;
 256         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 257
 258         sk->sk_gso_type = SKB_GSO_TCPV6;
 259         ip6_dst_store(sk, dst, NULL, NULL);
 260
 261         if (tcp_death_row.sysctl_tw_recycle &&
 262             !tp->rx_opt.ts_recent_stamp &&
 263             ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
 264                 tcp_fetch_timewait_stamp(sk, dst);
 265
 266         icsk->icsk_ext_hdr_len = 0;
 267         if (opt)
 268                 icsk->icsk_ext_hdr_len = opt->opt_flen +
 269                                          opt->opt_nflen;
 270
 271         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 272
 273         inet->inet_dport = usin->sin6_port;
 274
 275         tcp_set_state(sk, TCP_SYN_SENT);
 276         err = inet6_hash_connect(&tcp_death_row, sk);
 277         if (err)
 278                 goto late_failure;
 279
 280         sk_set_txhash(sk);
 281
 282         if (!tp->write_seq && likely(!tp->repair))
 283                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 284                                                              sk->sk_v6_daddr.s6_addr32,
 285                                                              inet->inet_sport,
 286                                                              inet->inet_dport,
 287                                                              &tp->tsoffset);
 288
 289         err = tcp_connect(sk);
 290         if (err)
 291                 goto late_failure;
 292
 293         return 0;
 294
 295 late_failure:
 296         tcp_set_state(sk, TCP_CLOSE);
 297         __sk_dst_reset(sk);
 298 failure:
 299         inet->inet_dport = 0;
 300         sk->sk_route_caps = 0;
 301         return err;
 302 }
 303
 304 static void tcp_v6_mtu_reduced(struct sock *sk)
 305 {
 306         struct dst_entry *dst;
 307
 308         if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 309                 return;
 310
 311         dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
 312         if (!dst)
 313                 return;
 314
 315         if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 316                 tcp_sync_mss(sk, dst_mtu(dst));
 317                 tcp_simple_retransmit(sk);
 318         }
 319 }
 320
 321 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 322                 u8 type, u8 code, int offset, __be32 info)
 323 {
 324         const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
 325         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 326         struct net *net = dev_net(skb->dev);
 327         struct request_sock *fastopen;
 328         struct ipv6_pinfo *np;
 329         struct tcp_sock *tp;
 330         __u32 seq, snd_una;
 331         struct sock *sk;
 332         bool fatal;
 333         int err;
 334
 335         sk = __inet6_lookup_established(net, &tcp_hashinfo,
 336                                         &hdr->daddr, th->dest,
 337                                         &hdr->saddr, ntohs(th->source),
 338                                         skb->dev->ifindex);
 339
 340         if (!sk) {
 341                 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
 342                                   ICMP6_MIB_INERRORS);
 343                 return;
 344         }
 345
 346         if (sk->sk_state == TCP_TIME_WAIT) {
 347                 inet_twsk_put(inet_twsk(sk));
 348                 return;
 349         }
 350         seq = ntohl(th->seq);
 351         fatal = icmpv6_err_convert(type, code, &err);
 352         if (sk->sk_state == TCP_NEW_SYN_RECV)
 353                 return tcp_req_err(sk, seq, fatal);
 354
 355         bh_lock_sock(sk);
 356         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
 357                 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
 358
 359         if (sk->sk_state == TCP_CLOSE)
 360                 goto out;
 361
 362         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 363                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
 364                 goto out;
 365         }
 366
 367         tp = tcp_sk(sk);
 368         /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
 369         fastopen = tp->fastopen_rsk;
 370         snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
 371         if (sk->sk_state != TCP_LISTEN &&
 372             !between(seq, snd_una, tp->snd_nxt)) {
 373                 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
 374                 goto out;
 375         }
 376
 377         np = inet6_sk(sk);
 378
 379         if (type == NDISC_REDIRECT) {
 380                 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 381
 382                 if (dst)
 383                         dst->ops->redirect(dst, sk, skb);
 384                 goto out;
 385         }
 386
 387         if (type == ICMPV6_PKT_TOOBIG) {
 388                 /* We are not interested in TCP_LISTEN and open_requests
 389                  * (SYN-ACKs send out by Linux are always <576bytes so
 390                  * they should go through unfragmented).
 391                  */
 392                 if (sk->sk_state == TCP_LISTEN)
 393                         goto out;
 394
 395                 if (!ip6_sk_accept_pmtu(sk))
 396                         goto out;
 397
 398                 tp->mtu_info = ntohl(info);
 399                 if (!sock_owned_by_user(sk))
 400                         tcp_v6_mtu_reduced(sk);
 401                 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
 402                                            &sk->sk_tsq_flags))
 403                         sock_hold(sk);
 404                 goto out;
 405         }
 406
 407
 408         /* Might be for an request_sock */
 409         switch (sk->sk_state) {
 410         case TCP_SYN_SENT:
 411         case TCP_SYN_RECV:
 412                 /* Only in fast or simultaneous open. If a fast open socket is
 413                  * is already accepted it is treated as a connected one below.
 414                  */
 415                 if (fastopen && !fastopen->sk)
 416                         break;
 417
 418                 if (!sock_owned_by_user(sk)) {
 419                         sk->sk_err = err;
 420                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 421
 422                         tcp_done(sk);
 423                 } else
 424                         sk->sk_err_soft = err;
 425                 goto out;
 426         }
 427
 428         if (!sock_owned_by_user(sk) && np->recverr) {
 429                 sk->sk_err = err;
 430                 sk->sk_error_report(sk);
 431         } else
 432                 sk->sk_err_soft = err;
 433
 434 out:
 435         bh_unlock_sock(sk);
 436         sock_put(sk);
 437 }
 438
 439
 440 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 441                               struct flowi *fl,
 442                               struct request_sock *req,
 443                               struct tcp_fastopen_cookie *foc,
 444                               enum tcp_synack_type synack_type)
 445 {
 446         struct inet_request_sock *ireq = inet_rsk(req);
 447         struct ipv6_pinfo *np = inet6_sk(sk);
 448         struct ipv6_txoptions *opt;
 449         struct flowi6 *fl6 = &fl->u.ip6;
 450         struct sk_buff *skb;
 451         int err = -ENOMEM;
 452
 453         /* First, grab a route. */
 454         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
 455                                                IPPROTO_TCP)) == NULL)
 456                 goto done;
 457
 458         skb = tcp_make_synack(sk, dst, req, foc, synack_type);
 459
 460         if (skb) {
 461                 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
 462                                     &ireq->ir_v6_rmt_addr);
 463
 464                 fl6->daddr = ireq->ir_v6_rmt_addr;
 465                 if (np->repflow && ireq->pktopts)
 466                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 467
 468                 rcu_read_lock();
 469                 opt = ireq->ipv6_opt;
 470                 if (!opt)
 471                         opt = rcu_dereference(np->opt);
 472                 err = ip6_xmit(sk, skb, fl6, opt, np->tclass);
 473                 rcu_read_unlock();
 474                 err = net_xmit_eval(err);
 475         }
 476
 477 done:
 478         return err;
 479 }
 480
 481
 482 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 483 {
 484         kfree(inet_rsk(req)->ipv6_opt);
 485         kfree_skb(inet_rsk(req)->pktopts);
 486 }
 487
 488 #ifdef CONFIG_TCP_MD5SIG
 489 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
 490                                                    const struct in6_addr *addr)
 491 {
 492         return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
 493 }
 494
 495 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
 496                                                 const struct sock *addr_sk)
 497 {
 498         return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
 499 }
 500
 501 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
 502                                  int optlen)
 503 {
 504         struct tcp_md5sig cmd;
 505         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 506
 507         if (optlen < sizeof(cmd))
 508                 return -EINVAL;
 509
 510         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 511                 return -EFAULT;
 512
 513         if (sin6->sin6_family != AF_INET6)
 514                 return -EINVAL;
 515
 516         if (!cmd.tcpm_keylen) {
 517                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 518                         return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 519                                               AF_INET);
 520                 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 521                                       AF_INET6);
 522         }
 523
 524         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 525                 return -EINVAL;
 526
 527         if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 528                 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
 529                                       AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 530
 531         return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
 532                               AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 533 }
 534
 535 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
 536                                    const struct in6_addr *daddr,
 537                                    const struct in6_addr *saddr,
 538                                    const struct tcphdr *th, int nbytes)
 539 {
 540         struct tcp6_pseudohdr *bp;
 541         struct scatterlist sg;
 542         struct tcphdr *_th;
 543
 544         bp = hp->scratch;
 545         /* 1. TCP pseudo-header (RFC2460) */
 546         bp->saddr = *saddr;
 547         bp->daddr = *daddr;
 548         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 549         bp->len = cpu_to_be32(nbytes);
 550
 551         _th = (struct tcphdr *)(bp + 1);
 552         memcpy(_th, th, sizeof(*th));
 553         _th->check = 0;
 554
 555         sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
 556         ahash_request_set_crypt(hp->md5_req, &sg, NULL,
 557                                 sizeof(*bp) + sizeof(*th));
 558         return crypto_ahash_update(hp->md5_req);
 559 }
 560
 561 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
 562                                const struct in6_addr *daddr, struct in6_addr *saddr,
 563                                const struct tcphdr *th)
 564 {
 565         struct tcp_md5sig_pool *hp;
 566         struct ahash_request *req;
 567
 568         hp = tcp_get_md5sig_pool();
 569         if (!hp)
 570                 goto clear_hash_noput;
 571         req = hp->md5_req;
 572
 573         if (crypto_ahash_init(req))
 574                 goto clear_hash;
 575         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
 576                 goto clear_hash;
 577         if (tcp_md5_hash_key(hp, key))
 578                 goto clear_hash;
 579         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 580         if (crypto_ahash_final(req))
 581                 goto clear_hash;
 582
 583         tcp_put_md5sig_pool();
 584         return 0;
 585
 586 clear_hash:
 587         tcp_put_md5sig_pool();
 588 clear_hash_noput:
 589         memset(md5_hash, 0, 16);
 590         return 1;
 591 }
 592
 593 static int tcp_v6_md5_hash_skb(char *md5_hash,
 594                                const struct tcp_md5sig_key *key,
 595                                const struct sock *sk,
 596                                const struct sk_buff *skb)
 597 {
 598         const struct in6_addr *saddr, *daddr;
 599         struct tcp_md5sig_pool *hp;
 600         struct ahash_request *req;
 601         const struct tcphdr *th = tcp_hdr(skb);
 602
 603         if (sk) { /* valid for establish/request sockets */
 604                 saddr = &sk->sk_v6_rcv_saddr;
 605                 daddr = &sk->sk_v6_daddr;
 606         } else {
 607                 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 608                 saddr = &ip6h->saddr;
 609                 daddr = &ip6h->daddr;
 610         }
 611
 612         hp = tcp_get_md5sig_pool();
 613         if (!hp)
 614                 goto clear_hash_noput;
 615         req = hp->md5_req;
 616
 617         if (crypto_ahash_init(req))
 618                 goto clear_hash;
 619
 620         if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
 621                 goto clear_hash;
 622         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 623                 goto clear_hash;
 624         if (tcp_md5_hash_key(hp, key))
 625                 goto clear_hash;
 626         ahash_request_set_crypt(req, NULL, md5_hash, 0);
 627         if (crypto_ahash_final(req))
 628                 goto clear_hash;
 629
 630         tcp_put_md5sig_pool();
 631         return 0;
 632
 633 clear_hash:
 634         tcp_put_md5sig_pool();
 635 clear_hash_noput:
 636         memset(md5_hash, 0, 16);
 637         return 1;
 638 }
 639
 640 #endif
 641
 642 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
 643                                     const struct sk_buff *skb)
 644 {
 645 #ifdef CONFIG_TCP_MD5SIG
 646         const __u8 *hash_location = NULL;
 647         struct tcp_md5sig_key *hash_expected;
 648         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 649         const struct tcphdr *th = tcp_hdr(skb);
 650         int genhash;
 651         u8 newhash[16];
 652
 653         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 654         hash_location = tcp_parse_md5sig_option(th);
 655
 656         /* We've parsed the options - do we have a hash? */
 657         if (!hash_expected && !hash_location)
 658                 return false;
 659
 660         if (hash_expected && !hash_location) {
 661                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 662                 return true;
 663         }
 664
 665         if (!hash_expected && hash_location) {
 666                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 667                 return true;
 668         }
 669
 670         /* check the signature */
 671         genhash = tcp_v6_md5_hash_skb(newhash,
 672                                       hash_expected,
 673                                       NULL, skb);
 674
 675         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 676                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
 677                 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 678                                      genhash ? "failed" : "mismatch",
 679                                      &ip6h->saddr, ntohs(th->source),
 680                                      &ip6h->daddr, ntohs(th->dest));
 681                 return true;
 682         }
 683 #endif
 684         return false;
 685 }
 686
 687 static void tcp_v6_init_req(struct request_sock *req,
 688                             const struct sock *sk_listener,
 689                             struct sk_buff *skb)
 690 {
 691         struct inet_request_sock *ireq = inet_rsk(req);
 692         const struct ipv6_pinfo *np = inet6_sk(sk_listener);
 693
 694         ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
 695         ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
 696
 697         /* So that link locals have meaning */
 698         if (!sk_listener->sk_bound_dev_if &&
 699             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
 700                 ireq->ir_iif = tcp_v6_iif(skb);
 701
 702         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
 703             (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
 704              np->rxopt.bits.rxinfo ||
 705              np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
 706              np->rxopt.bits.rxohlim || np->repflow)) {
 707                 atomic_inc(&skb->users);
 708                 ireq->pktopts = skb;
 709         }
 710 }
 711
 712 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
 713                                           struct flowi *fl,
 714                                           const struct request_sock *req,
 715                                           bool *strict)
 716 {
 717         if (strict)
 718                 *strict = true;
 719         return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
 720 }
 721
 722 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 723         .family         =       AF_INET6,
 724         .obj_size       =       sizeof(struct tcp6_request_sock),
 725         .rtx_syn_ack    =       tcp_rtx_synack,
 726         .send_ack       =       tcp_v6_reqsk_send_ack,
 727         .destructor     =       tcp_v6_reqsk_destructor,
 728         .send_reset     =       tcp_v6_send_reset,
 729         .syn_ack_timeout =      tcp_syn_ack_timeout,
 730 };
 731
 732 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 733         .mss_clamp      =       IPV6_MIN_MTU - sizeof(struct tcphdr) -
 734                                 sizeof(struct ipv6hdr),
 735 #ifdef CONFIG_TCP_MD5SIG
 736         .req_md5_lookup =       tcp_v6_md5_lookup,
 737         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 738 #endif
 739         .init_req       =       tcp_v6_init_req,
 740 #ifdef CONFIG_SYN_COOKIES
 741         .cookie_init_seq =      cookie_v6_init_sequence,
 742 #endif
 743         .route_req      =       tcp_v6_route_req,
 744         .init_seq       =       tcp_v6_init_sequence,
 745         .send_synack    =       tcp_v6_send_synack,
 746 };
 747
 748 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
 749                                  u32 ack, u32 win, u32 tsval, u32 tsecr,
 750                                  int oif, struct tcp_md5sig_key *key, int rst,
 751                                  u8 tclass, __be32 label)
 752 {
 753         const struct tcphdr *th = tcp_hdr(skb);
 754         struct tcphdr *t1;
 755         struct sk_buff *buff;
 756         struct flowi6 fl6;
 757         struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 758         struct sock *ctl_sk = net->ipv6.tcp_sk;
 759         unsigned int tot_len = sizeof(struct tcphdr);
 760         struct dst_entry *dst;
 761         __be32 *topt;
 762
 763         if (tsecr)
 764                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 765 #ifdef CONFIG_TCP_MD5SIG
 766         if (key)
 767                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 768 #endif
 769
 770         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 771                          GFP_ATOMIC);
 772         if (!buff)
 773                 return;
 774
 775         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 776
 777         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 778         skb_reset_transport_header(buff);
 779
 780         /* Swap the send and the receive. */
 781         memset(t1, 0, sizeof(*t1));
 782         t1->dest = th->source;
 783         t1->source = th->dest;
 784         t1->doff = tot_len / 4;
 785         t1->seq = htonl(seq);
 786         t1->ack_seq = htonl(ack);
 787         t1->ack = !rst || !th->ack;
 788         t1->rst = rst;
 789         t1->window = htons(win);
 790
 791         topt = (__be32 *)(t1 + 1);
 792
 793         if (tsecr) {
 794                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 795                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 796                 *topt++ = htonl(tsval);
 797                 *topt++ = htonl(tsecr);
 798         }
 799
 800 #ifdef CONFIG_TCP_MD5SIG
 801         if (key) {
 802                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 803                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 804                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 805                                     &ipv6_hdr(skb)->saddr,
 806                                     &ipv6_hdr(skb)->daddr, t1);
 807         }
 808 #endif
 809
 810         memset(&fl6, 0, sizeof(fl6));
 811         fl6.daddr = ipv6_hdr(skb)->saddr;
 812         fl6.saddr = ipv6_hdr(skb)->daddr;
 813         fl6.flowlabel = label;
 814
 815         buff->ip_summed = CHECKSUM_PARTIAL;
 816         buff->csum = 0;
 817
 818         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 819
 820         fl6.flowi6_proto = IPPROTO_TCP;
 821         if (rt6_need_strict(&fl6.daddr) && !oif)
 822                 fl6.flowi6_oif = tcp_v6_iif(skb);
 823         else {
 824                 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
 825                         oif = skb->skb_iif;
 826
 827                 fl6.flowi6_oif = oif;
 828         }
 829
 830         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 831         fl6.fl6_dport = t1->dest;
 832         fl6.fl6_sport = t1->source;
 833         fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
 834         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 835
 836         /* Pass a socket to ip6_dst_lookup either it is for RST
 837          * Underlying function will use this to retrieve the network
 838          * namespace
 839          */
 840         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
 841         if (!IS_ERR(dst)) {
 842                 skb_dst_set(buff, dst);
 843                 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
 844                 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
 845                 if (rst)
 846                         TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
 847                 return;
 848         }
 849
 850         kfree_skb(buff);
 851 }
 852
 853 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
 854 {
 855         const struct tcphdr *th = tcp_hdr(skb);
 856         u32 seq = 0, ack_seq = 0;
 857         struct tcp_md5sig_key *key = NULL;
 858 #ifdef CONFIG_TCP_MD5SIG
 859         const __u8 *hash_location = NULL;
 860         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 861         unsigned char newhash[16];
 862         int genhash;
 863         struct sock *sk1 = NULL;
 864 #endif
 865         int oif;
 866
 867         if (th->rst)
 868                 return;
 869
 870         /* If sk not NULL, it means we did a successful lookup and incoming
 871          * route had to be correct. prequeue might have dropped our dst.
 872          */
 873         if (!sk && !ipv6_unicast_destination(skb))
 874                 return;
 875
 876 #ifdef CONFIG_TCP_MD5SIG
 877         rcu_read_lock();
 878         hash_location = tcp_parse_md5sig_option(th);
 879         if (sk && sk_fullsock(sk)) {
 880                 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
 881         } else if (hash_location) {
 882                 /*
 883                  * active side is lost. Try to find listening socket through
 884                  * source port, and then find md5 key through listening socket.
 885                  * we are not loose security here:
 886                  * Incoming packet is checked with md5 hash with finding key,
 887                  * no RST generated if md5 hash doesn't match.
 888                  */
 889                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
 890                                            &tcp_hashinfo, NULL, 0,
 891                                            &ipv6h->saddr,
 892                                            th->source, &ipv6h->daddr,
 893                                            ntohs(th->source), tcp_v6_iif(skb));
 894                 if (!sk1)
 895                         goto out;
 896
 897                 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
 898                 if (!key)
 899                         goto out;
 900
 901                 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
 902                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
 903                         goto out;
 904         }
 905 #endif
 906
 907         if (th->ack)
 908                 seq = ntohl(th->ack_seq);
 909         else
 910                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
 911                           (th->doff << 2);
 912
 913         oif = sk ? sk->sk_bound_dev_if : 0;
 914         tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
 915
 916 #ifdef CONFIG_TCP_MD5SIG
 917 out:
 918         rcu_read_unlock();
 919 #endif
 920 }
 921
 922 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
 923                             u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
 924                             struct tcp_md5sig_key *key, u8 tclass,
 925                             __be32 label)
 926 {
 927         tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
 928                              tclass, label);
 929 }
 930
 931 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 932 {
 933         struct inet_timewait_sock *tw = inet_twsk(sk);
 934         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 935
 936         tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
 937                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
 938                         tcp_time_stamp + tcptw->tw_ts_offset,
 939                         tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
 940                         tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
 941
 942         inet_twsk_put(tw);
 943 }
 944
 945 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
 946                                   struct request_sock *req)
 947 {
 948         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
 949          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
 950          */
 951         /* RFC 7323 2.3
 952          * The window field (SEG.WND) of every outgoing segment, with the
 953          * exception of <SYN> segments, MUST be right-shifted by
 954          * Rcv.Wind.Shift bits:
 955          */
 956         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
 957                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
 958                         tcp_rsk(req)->rcv_nxt,
 959                         req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
 960                         tcp_time_stamp + tcp_rsk(req)->ts_off,
 961                         req->ts_recent, sk->sk_bound_dev_if,
 962                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
 963                         0, 0);
 964 }
 965
 966
 967 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
 968 {
 969 #ifdef CONFIG_SYN_COOKIES
 970         const struct tcphdr *th = tcp_hdr(skb);
 971
 972         if (!th->syn)
 973                 sk = cookie_v6_check(sk, skb);
 974 #endif
 975         return sk;
 976 }
 977
 978 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 979 {
 980         if (skb->protocol == htons(ETH_P_IP))
 981                 return tcp_v4_conn_request(sk, skb);
 982
 983         if (!ipv6_unicast_destination(skb))
 984                 goto drop;
 985
 986         return tcp_conn_request(&tcp6_request_sock_ops,
 987                                 &tcp_request_sock_ipv6_ops, sk, skb);
 988
 989 drop:
 990         tcp_listendrop(sk);
 991         return 0; /* don't send reset */
 992 }
 993
 994 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
 995                                          struct request_sock *req,
 996                                          struct dst_entry *dst,
 997                                          struct request_sock *req_unhash,
 998                                          bool *own_req)
 999 {
1000         struct inet_request_sock *ireq;
1001         struct ipv6_pinfo *newnp;
1002         const struct ipv6_pinfo *np = inet6_sk(sk);
1003         struct ipv6_txoptions *opt;
1004         struct tcp6_sock *newtcp6sk;
1005         struct inet_sock *newinet;
1006         struct tcp_sock *newtp;
1007         struct sock *newsk;
1008 #ifdef CONFIG_TCP_MD5SIG
1009         struct tcp_md5sig_key *key;
1010 #endif
1011         struct flowi6 fl6;
1012
1013         if (skb->protocol == htons(ETH_P_IP)) {
1014                 /*
1015                  *      v6 mapped
1016                  */
1017
1018                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1019                                              req_unhash, own_req);
1020
1021                 if (!newsk)
1022                         return NULL;
1023
1024                 newtcp6sk = (struct tcp6_sock *)newsk;
1025                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1026
1027                 newinet = inet_sk(newsk);
1028                 newnp = inet6_sk(newsk);
1029                 newtp = tcp_sk(newsk);
1030
1031                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1032
1033                 newnp->saddr = newsk->sk_v6_rcv_saddr;
1034
1035                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1036                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1037 #ifdef CONFIG_TCP_MD5SIG
1038                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1039 #endif
1040
1041                 newnp->ipv6_ac_list = NULL;
1042                 newnp->ipv6_fl_list = NULL;
1043                 newnp->pktoptions  = NULL;
1044                 newnp->opt         = NULL;
1045                 newnp->mcast_oif   = tcp_v6_iif(skb);
1046                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1047                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1048                 if (np->repflow)
1049                         newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1050
1051                 /*
1052                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1053                  * here, tcp_create_openreq_child now does this for us, see the comment in
1054                  * that function for the gory details. -acme
1055                  */
1056
1057                 /* It is tricky place. Until this moment IPv4 tcp
1058                    worked with IPv6 icsk.icsk_af_ops.
1059                    Sync it now.
1060                  */
1061                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1062
1063                 return newsk;
1064         }
1065
1066         ireq = inet_rsk(req);
1067
1068         if (sk_acceptq_is_full(sk))
1069                 goto out_overflow;
1070
1071         if (!dst) {
1072                 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1073                 if (!dst)
1074                         goto out;
1075         }
1076
1077         newsk = tcp_create_openreq_child(sk, req, skb);
1078         if (!newsk)
1079                 goto out_nonewsk;
1080
1081         /*
1082          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1083          * count here, tcp_create_openreq_child now does this for us, see the
1084          * comment in that function for the gory details. -acme
1085          */
1086
1087         newsk->sk_gso_type = SKB_GSO_TCPV6;
1088         ip6_dst_store(newsk, dst, NULL, NULL);
1089         inet6_sk_rx_dst_set(newsk, skb);
1090
1091         newtcp6sk = (struct tcp6_sock *)newsk;
1092         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1093
1094         newtp = tcp_sk(newsk);
1095         newinet = inet_sk(newsk);
1096         newnp = inet6_sk(newsk);
1097
1098         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1099
1100         newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1101         newnp->saddr = ireq->ir_v6_loc_addr;
1102         newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1103         newsk->sk_bound_dev_if = ireq->ir_iif;
1104
1105         /* Now IPv6 options...
1106
1107            First: no IPv4 options.
1108          */
1109         newinet->inet_opt = NULL;
1110         newnp->ipv6_ac_list = NULL;
1111         newnp->ipv6_fl_list = NULL;
1112
1113         /* Clone RX bits */
1114         newnp->rxopt.all = np->rxopt.all;
1115
1116         newnp->pktoptions = NULL;
1117         newnp->opt        = NULL;
1118         newnp->mcast_oif  = tcp_v6_iif(skb);
1119         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1120         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1121         if (np->repflow)
1122                 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1123
1124         /* Clone native IPv6 options from listening socket (if any)
1125
1126            Yes, keeping reference count would be much more clever,
1127            but we make one more one thing there: reattach optmem
1128            to newsk.
1129          */
1130         opt = ireq->ipv6_opt;
1131         if (!opt)
1132                 opt = rcu_dereference(np->opt);
1133         if (opt) {
1134                 opt = ipv6_dup_options(newsk, opt);
1135                 RCU_INIT_POINTER(newnp->opt, opt);
1136         }
1137         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1138         if (opt)
1139                 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1140                                                     opt->opt_flen;
1141
1142         tcp_ca_openreq_child(newsk, dst);
1143
1144         tcp_sync_mss(newsk, dst_mtu(dst));
1145         newtp->advmss = dst_metric_advmss(dst);
1146         if (tcp_sk(sk)->rx_opt.user_mss &&
1147             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1148                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1149
1150         tcp_initialize_rcv_mss(newsk);
1151
1152         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1153         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1154
1155 #ifdef CONFIG_TCP_MD5SIG
1156         /* Copy over the MD5 key from the original socket */
1157         key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1158         if (key) {
1159                 /* We're using one, so create a matching key
1160                  * on the newsk structure. If we fail to get
1161                  * memory, then we end up not copying the key
1162                  * across. Shucks.
1163                  */
1164                 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1165                                AF_INET6, key->key, key->keylen,
1166                                sk_gfp_mask(sk, GFP_ATOMIC));
1167         }
1168 #endif
1169
1170         if (__inet_inherit_port(sk, newsk) < 0) {
1171                 inet_csk_prepare_forced_close(newsk);
1172                 tcp_done(newsk);
1173                 goto out;
1174         }
1175         *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1176         if (*own_req) {
1177                 tcp_move_syn(newtp, req);
1178
1179                 /* Clone pktoptions received with SYN, if we own the req */
1180                 if (ireq->pktopts) {
1181                         newnp->pktoptions = skb_clone(ireq->pktopts,
1182                                                       sk_gfp_mask(sk, GFP_ATOMIC));
1183                         consume_skb(ireq->pktopts);
1184                         ireq->pktopts = NULL;
1185                         if (newnp->pktoptions)
1186                                 skb_set_owner_r(newnp->pktoptions, newsk);
1187                 }
1188         }
1189
1190         return newsk;
1191
1192 out_overflow:
1193         __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1194 out_nonewsk:
1195         dst_release(dst);
1196 out:
1197         tcp_listendrop(sk);
1198         return NULL;
1199 }
1200
1201 static void tcp_v6_restore_cb(struct sk_buff *skb)
1202 {
1203         /* We need to move header back to the beginning if xfrm6_policy_check()
1204          * and tcp_v6_fill_cb() are going to be called again.
1205          * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1206          */
1207         memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1208                 sizeof(struct inet6_skb_parm));
1209 }
1210
1211 /* The socket must have it's spinlock held when we get
1212  * here, unless it is a TCP_LISTEN socket.
1213  *
1214  * We have a potential double-lock case here, so even when
1215  * doing backlog processing we use the BH locking scheme.
1216  * This is because we cannot sleep with the original spinlock
1217  * held.
1218  */
1219 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1220 {
1221         struct ipv6_pinfo *np = inet6_sk(sk);
1222         struct tcp_sock *tp;
1223         struct sk_buff *opt_skb = NULL;
1224
1225         /* Imagine: socket is IPv6. IPv4 packet arrives,
1226            goes to IPv4 receive handler and backlogged.
1227            From backlog it always goes here. Kerboom...
1228            Fortunately, tcp_rcv_established and rcv_established
1229            handle them correctly, but it is not case with
1230            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1231          */
1232
1233         if (skb->protocol == htons(ETH_P_IP))
1234                 return tcp_v4_do_rcv(sk, skb);
1235
1236         if (tcp_filter(sk, skb))
1237                 goto discard;
1238
1239         /*
1240          *      socket locking is here for SMP purposes as backlog rcv
1241          *      is currently called with bh processing disabled.
1242          */
1243
1244         /* Do Stevens' IPV6_PKTOPTIONS.
1245
1246            Yes, guys, it is the only place in our code, where we
1247            may make it not affecting IPv4.
1248            The rest of code is protocol independent,
1249            and I do not like idea to uglify IPv4.
1250
1251            Actually, all the idea behind IPV6_PKTOPTIONS
1252            looks not very well thought. For now we latch
1253            options, received in the last packet, enqueued
1254            by tcp. Feel free to propose better solution.
1255                                                --ANK (980728)
1256          */
1257         if (np->rxopt.all)
1258                 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1259
1260         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1261                 struct dst_entry *dst = sk->sk_rx_dst;
1262
1263                 sock_rps_save_rxhash(sk, skb);
1264                 sk_mark_napi_id(sk, skb);
1265                 if (dst) {
1266                         if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1267                             dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1268                                 dst_release(dst);
1269                                 sk->sk_rx_dst = NULL;
1270                         }
1271                 }
1272
1273                 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1274                 if (opt_skb)
1275                         goto ipv6_pktoptions;
1276                 return 0;
1277         }
1278
1279         if (tcp_checksum_complete(skb))
1280                 goto csum_err;
1281
1282         if (sk->sk_state == TCP_LISTEN) {
1283                 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1284
1285                 if (!nsk)
1286                         goto discard;
1287
1288                 if (nsk != sk) {
1289                         sock_rps_save_rxhash(nsk, skb);
1290                         sk_mark_napi_id(nsk, skb);
1291                         if (tcp_child_process(sk, nsk, skb))
1292                                 goto reset;
1293                         if (opt_skb)
1294                                 __kfree_skb(opt_skb);
1295                         return 0;
1296                 }
1297         } else
1298                 sock_rps_save_rxhash(sk, skb);
1299
1300         if (tcp_rcv_state_process(sk, skb))
1301                 goto reset;
1302         if (opt_skb)
1303                 goto ipv6_pktoptions;
1304         return 0;
1305
1306 reset:
1307         tcp_v6_send_reset(sk, skb);
1308 discard:
1309         if (opt_skb)
1310                 __kfree_skb(opt_skb);
1311         kfree_skb(skb);
1312         return 0;
1313 csum_err:
1314         TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1315         TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1316         goto discard;
1317
1318
1319 ipv6_pktoptions:
1320         /* Do you ask, what is it?
1321
1322            1. skb was enqueued by tcp.
1323            2. skb is added to tail of read queue, rather than out of order.
1324            3. socket is not in passive state.
1325            4. Finally, it really contains options, which user wants to receive.
1326          */
1327         tp = tcp_sk(sk);
1328         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1329             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1330                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1331                         np->mcast_oif = tcp_v6_iif(opt_skb);
1332                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1333                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1334                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1335                         np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1336                 if (np->repflow)
1337                         np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1338                 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1339                         skb_set_owner_r(opt_skb, sk);
1340                         tcp_v6_restore_cb(opt_skb);
1341                         opt_skb = xchg(&np->pktoptions, opt_skb);
1342                 } else {
1343                         __kfree_skb(opt_skb);
1344                         opt_skb = xchg(&np->pktoptions, NULL);
1345                 }
1346         }
1347
1348         kfree_skb(opt_skb);
1349         return 0;
1350 }
1351
1352 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1353                            const struct tcphdr *th)
1354 {
1355         /* This is tricky: we move IP6CB at its correct location into
1356          * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1357          * _decode_session6() uses IP6CB().
1358          * barrier() makes sure compiler won't play aliasing games.
1359          */
1360         memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1361                 sizeof(struct inet6_skb_parm));
1362         barrier();
1363
1364         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1365         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1366                                     skb->len - th->doff*4);
1367         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1368         TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1369         TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1370         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1371         TCP_SKB_CB(skb)->sacked = 0;
1372 }
1373
1374 static int tcp_v6_rcv(struct sk_buff *skb)
1375 {
1376         const struct tcphdr *th;
1377         const struct ipv6hdr *hdr;
1378         bool refcounted;
1379         struct sock *sk;
1380         int ret;
1381         struct net *net = dev_net(skb->dev);
1382
1383         if (skb->pkt_type != PACKET_HOST)
1384                 goto discard_it;
1385
1386         /*
1387          *      Count it even if it's bad.
1388          */
1389         __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1390
1391         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1392                 goto discard_it;
1393
1394         th = (const struct tcphdr *)skb->data;
1395
1396         if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1397                 goto bad_packet;
1398         if (!pskb_may_pull(skb, th->doff*4))
1399                 goto discard_it;
1400
1401         if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1402                 goto csum_error;
1403
1404         th = (const struct tcphdr *)skb->data;
1405         hdr = ipv6_hdr(skb);
1406
1407 lookup:
1408         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1409                                 th->source, th->dest, inet6_iif(skb),
1410                                 &refcounted);
1411         if (!sk)
1412                 goto no_tcp_socket;
1413
1414 process:
1415         if (sk->sk_state == TCP_TIME_WAIT)
1416                 goto do_time_wait;
1417
1418         if (sk->sk_state == TCP_NEW_SYN_RECV) {
1419                 struct request_sock *req = inet_reqsk(sk);
1420                 struct sock *nsk;
1421
1422                 sk = req->rsk_listener;
1423                 tcp_v6_fill_cb(skb, hdr, th);
1424                 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1425                         sk_drops_add(sk, skb);
1426                         reqsk_put(req);
1427                         goto discard_it;
1428                 }
1429                 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1430                         inet_csk_reqsk_queue_drop_and_put(sk, req);
1431                         goto lookup;
1432                 }
1433                 sock_hold(sk);
1434                 refcounted = true;
1435                 nsk = tcp_check_req(sk, skb, req, false);
1436                 if (!nsk) {
1437                         reqsk_put(req);
1438                         goto discard_and_relse;
1439                 }
1440                 if (nsk == sk) {
1441                         reqsk_put(req);
1442                         tcp_v6_restore_cb(skb);
1443                 } else if (tcp_child_process(sk, nsk, skb)) {
1444                         tcp_v6_send_reset(nsk, skb);
1445                         goto discard_and_relse;
1446                 } else {
1447                         sock_put(sk);
1448                         return 0;
1449                 }
1450         }
1451         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1452                 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1453                 goto discard_and_relse;
1454         }
1455
1456         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1457                 goto discard_and_relse;
1458
1459         tcp_v6_fill_cb(skb, hdr, th);
1460
1461         if (tcp_v6_inbound_md5_hash(sk, skb))
1462                 goto discard_and_relse;
1463
1464         if (tcp_filter(sk, skb))
1465                 goto discard_and_relse;
1466         th = (const struct tcphdr *)skb->data;
1467         hdr = ipv6_hdr(skb);
1468
1469         skb->dev = NULL;
1470
1471         if (sk->sk_state == TCP_LISTEN) {
1472                 ret = tcp_v6_do_rcv(sk, skb);
1473                 goto put_and_return;
1474         }
1475
1476         sk_incoming_cpu_update(sk);
1477
1478         bh_lock_sock_nested(sk);
1479         tcp_segs_in(tcp_sk(sk), skb);
1480         ret = 0;
1481         if (!sock_owned_by_user(sk)) {
1482                 if (!tcp_prequeue(sk, skb))
1483                         ret = tcp_v6_do_rcv(sk, skb);
1484         } else if (tcp_add_backlog(sk, skb)) {
1485                 goto discard_and_relse;
1486         }
1487         bh_unlock_sock(sk);
1488
1489 put_and_return:
1490         if (refcounted)
1491                 sock_put(sk);
1492         return ret ? -1 : 0;
1493
1494 no_tcp_socket:
1495         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1496                 goto discard_it;
1497
1498         tcp_v6_fill_cb(skb, hdr, th);
1499
1500         if (tcp_checksum_complete(skb)) {
1501 csum_error:
1502                 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1503 bad_packet:
1504                 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1505         } else {
1506                 tcp_v6_send_reset(NULL, skb);
1507         }
1508
1509 discard_it:
1510         kfree_skb(skb);
1511         return 0;
1512
1513 discard_and_relse:
1514         sk_drops_add(sk, skb);
1515         if (refcounted)
1516                 sock_put(sk);
1517         goto discard_it;
1518
1519 do_time_wait:
1520         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1521                 inet_twsk_put(inet_twsk(sk));
1522                 goto discard_it;
1523         }
1524
1525         tcp_v6_fill_cb(skb, hdr, th);
1526
1527         if (tcp_checksum_complete(skb)) {
1528                 inet_twsk_put(inet_twsk(sk));
1529                 goto csum_error;
1530         }
1531
1532         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1533         case TCP_TW_SYN:
1534         {
1535                 struct sock *sk2;
1536
1537                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1538                                             skb, __tcp_hdrlen(th),
1539                                             &ipv6_hdr(skb)->saddr, th->source,
1540                                             &ipv6_hdr(skb)->daddr,
1541                                             ntohs(th->dest), tcp_v6_iif(skb));
1542                 if (sk2) {
1543                         struct inet_timewait_sock *tw = inet_twsk(sk);
1544                         inet_twsk_deschedule_put(tw);
1545                         sk = sk2;
1546                         tcp_v6_restore_cb(skb);
1547                         refcounted = false;
1548                         goto process;
1549                 }
1550                 /* Fall through to ACK */
1551         }
1552         case TCP_TW_ACK:
1553                 tcp_v6_timewait_ack(sk, skb);
1554                 break;
1555         case TCP_TW_RST:
1556                 tcp_v6_restore_cb(skb);
1557                 tcp_v6_send_reset(sk, skb);
1558                 inet_twsk_deschedule_put(inet_twsk(sk));
1559                 goto discard_it;
1560         case TCP_TW_SUCCESS:
1561                 ;
1562         }
1563         goto discard_it;
1564 }
1565
1566 static void tcp_v6_early_demux(struct sk_buff *skb)
1567 {
1568         const struct ipv6hdr *hdr;
1569         const struct tcphdr *th;
1570         struct sock *sk;
1571
1572         if (skb->pkt_type != PACKET_HOST)
1573                 return;
1574
1575         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1576                 return;
1577
1578         hdr = ipv6_hdr(skb);
1579         th = tcp_hdr(skb);
1580
1581         if (th->doff < sizeof(struct tcphdr) / 4)
1582                 return;
1583
1584         /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1585         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1586                                         &hdr->saddr, th->source,
1587                                         &hdr->daddr, ntohs(th->dest),
1588                                         inet6_iif(skb));
1589         if (sk) {
1590                 skb->sk = sk;
1591                 skb->destructor = sock_edemux;
1592                 if (sk_fullsock(sk)) {
1593                         struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1594
1595                         if (dst)
1596                                 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1597                         if (dst &&
1598                             inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1599                                 skb_dst_set_noref(skb, dst);
1600                 }
1601         }
1602 }
1603
1604 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1605         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1606         .twsk_unique    = tcp_twsk_unique,
1607         .twsk_destructor = tcp_twsk_destructor,
1608 };
1609
1610 static const struct inet_connection_sock_af_ops ipv6_specific = {
1611         .queue_xmit        = inet6_csk_xmit,
1612         .send_check        = tcp_v6_send_check,
1613         .rebuild_header    = inet6_sk_rebuild_header,
1614         .sk_rx_dst_set     = inet6_sk_rx_dst_set,
1615         .conn_request      = tcp_v6_conn_request,
1616         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1617         .net_header_len    = sizeof(struct ipv6hdr),
1618         .net_frag_header_len = sizeof(struct frag_hdr),
1619         .setsockopt        = ipv6_setsockopt,
1620         .getsockopt        = ipv6_getsockopt,
1621         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1622         .sockaddr_len      = sizeof(struct sockaddr_in6),
1623         .bind_conflict     = inet6_csk_bind_conflict,
1624 #ifdef CONFIG_COMPAT
1625         .compat_setsockopt = compat_ipv6_setsockopt,
1626         .compat_getsockopt = compat_ipv6_getsockopt,
1627 #endif
1628         .mtu_reduced       = tcp_v6_mtu_reduced,
1629 };
1630
1631 #ifdef CONFIG_TCP_MD5SIG
1632 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1633         .md5_lookup     =       tcp_v6_md5_lookup,
1634         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1635         .md5_parse      =       tcp_v6_parse_md5_keys,
1636 };
1637 #endif
1638
1639 /*
1640  *      TCP over IPv4 via INET6 API
1641  */
1642 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1643         .queue_xmit        = ip_queue_xmit,
1644         .send_check        = tcp_v4_send_check,
1645         .rebuild_header    = inet_sk_rebuild_header,
1646         .sk_rx_dst_set     = inet_sk_rx_dst_set,
1647         .conn_request      = tcp_v6_conn_request,
1648         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1649         .net_header_len    = sizeof(struct iphdr),
1650         .setsockopt        = ipv6_setsockopt,
1651         .getsockopt        = ipv6_getsockopt,
1652         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1653         .sockaddr_len      = sizeof(struct sockaddr_in6),
1654         .bind_conflict     = inet6_csk_bind_conflict,
1655 #ifdef CONFIG_COMPAT
1656         .compat_setsockopt = compat_ipv6_setsockopt,
1657         .compat_getsockopt = compat_ipv6_getsockopt,
1658 #endif
1659         .mtu_reduced       = tcp_v4_mtu_reduced,
1660 };
1661
1662 #ifdef CONFIG_TCP_MD5SIG
1663 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1664         .md5_lookup     =       tcp_v4_md5_lookup,
1665         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1666         .md5_parse      =       tcp_v6_parse_md5_keys,
1667 };
1668 #endif
1669
1670 /* NOTE: A lot of things set to zero explicitly by call to
1671  *       sk_alloc() so need not be done here.
1672  */
1673 static int tcp_v6_init_sock(struct sock *sk)
1674 {
1675         struct inet_connection_sock *icsk = inet_csk(sk);
1676
1677         tcp_init_sock(sk);
1678
1679         icsk->icsk_af_ops = &ipv6_specific;
1680
1681 #ifdef CONFIG_TCP_MD5SIG
1682         tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1683 #endif
1684
1685         return 0;
1686 }
1687
1688 static void tcp_v6_destroy_sock(struct sock *sk)
1689 {
1690         tcp_v4_destroy_sock(sk);
1691         inet6_destroy_sock(sk);
1692 }
1693
1694 #ifdef CONFIG_PROC_FS
1695 /* Proc filesystem TCPv6 sock list dumping. */
1696 static void get_openreq6(struct seq_file *seq,
1697                          const struct request_sock *req, int i)
1698 {
1699         long ttd = req->rsk_timer.expires - jiffies;
1700         const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1701         const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1702
1703         if (ttd < 0)
1704                 ttd = 0;
1705
1706         seq_printf(seq,
1707                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1708                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1709                    i,
1710                    src->s6_addr32[0], src->s6_addr32[1],
1711                    src->s6_addr32[2], src->s6_addr32[3],
1712                    inet_rsk(req)->ir_num,
1713                    dest->s6_addr32[0], dest->s6_addr32[1],
1714                    dest->s6_addr32[2], dest->s6_addr32[3],
1715                    ntohs(inet_rsk(req)->ir_rmt_port),
1716                    TCP_SYN_RECV,
1717                    0, 0, /* could print option size, but that is af dependent. */
1718                    1,   /* timers active (only the expire timer) */
1719                    jiffies_to_clock_t(ttd),
1720                    req->num_timeout,
1721                    from_kuid_munged(seq_user_ns(seq),
1722                                     sock_i_uid(req->rsk_listener)),
1723                    0,  /* non standard timer */
1724                    0, /* open_requests have no inode */
1725                    0, req);
1726 }
1727
1728 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1729 {
1730         const struct in6_addr *dest, *src;
1731         __u16 destp, srcp;
1732         int timer_active;
1733         unsigned long timer_expires;
1734         const struct inet_sock *inet = inet_sk(sp);
1735         const struct tcp_sock *tp = tcp_sk(sp);
1736         const struct inet_connection_sock *icsk = inet_csk(sp);
1737         const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1738         int rx_queue;
1739         int state;
1740
1741         dest  = &sp->sk_v6_daddr;
1742         src   = &sp->sk_v6_rcv_saddr;
1743         destp = ntohs(inet->inet_dport);
1744         srcp  = ntohs(inet->inet_sport);
1745
1746         if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1747             icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
1748             icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1749                 timer_active    = 1;
1750                 timer_expires   = icsk->icsk_timeout;
1751         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1752                 timer_active    = 4;
1753                 timer_expires   = icsk->icsk_timeout;
1754         } else if (timer_pending(&sp->sk_timer)) {
1755                 timer_active    = 2;
1756                 timer_expires   = sp->sk_timer.expires;
1757         } else {
1758                 timer_active    = 0;
1759                 timer_expires = jiffies;
1760         }
1761
1762         state = sk_state_load(sp);
1763         if (state == TCP_LISTEN)
1764                 rx_queue = sp->sk_ack_backlog;
1765         else
1766                 /* Because we don't lock the socket,
1767                  * we might find a transient negative value.
1768                  */
1769                 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1770
1771         seq_printf(seq,
1772                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1773                    "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1774                    i,
1775                    src->s6_addr32[0], src->s6_addr32[1],
1776                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1777                    dest->s6_addr32[0], dest->s6_addr32[1],
1778                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1779                    state,
1780                    tp->write_seq - tp->snd_una,
1781                    rx_queue,
1782                    timer_active,
1783                    jiffies_delta_to_clock_t(timer_expires - jiffies),
1784                    icsk->icsk_retransmits,
1785                    from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1786                    icsk->icsk_probes_out,
1787                    sock_i_ino(sp),
1788                    atomic_read(&sp->sk_refcnt), sp,
1789                    jiffies_to_clock_t(icsk->icsk_rto),
1790                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1791                    (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1792                    tp->snd_cwnd,
1793                    state == TCP_LISTEN ?
1794                         fastopenq->max_qlen :
1795                         (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1796                    );
1797 }
1798
1799 static void get_timewait6_sock(struct seq_file *seq,
1800                                struct inet_timewait_sock *tw, int i)
1801 {
1802         long delta = tw->tw_timer.expires - jiffies;
1803         const struct in6_addr *dest, *src;
1804         __u16 destp, srcp;
1805
1806         dest = &tw->tw_v6_daddr;
1807         src  = &tw->tw_v6_rcv_saddr;
1808         destp = ntohs(tw->tw_dport);
1809         srcp  = ntohs(tw->tw_sport);
1810
1811         seq_printf(seq,
1812                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1813                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1814                    i,
1815                    src->s6_addr32[0], src->s6_addr32[1],
1816                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1817                    dest->s6_addr32[0], dest->s6_addr32[1],
1818                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1819                    tw->tw_substate, 0, 0,
1820                    3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1821                    atomic_read(&tw->tw_refcnt), tw);
1822 }
1823
1824 static int tcp6_seq_show(struct seq_file *seq, void *v)
1825 {
1826         struct tcp_iter_state *st;
1827         struct sock *sk = v;
1828
1829         if (v == SEQ_START_TOKEN) {
1830                 seq_puts(seq,
1831                          "  sl  "
1832                          "local_address                         "
1833                          "remote_address                        "
1834                          "st tx_queue rx_queue tr tm->when retrnsmt"
1835                          "   uid  timeout inode\n");
1836                 goto out;
1837         }
1838         st = seq->private;
1839
1840         if (sk->sk_state == TCP_TIME_WAIT)
1841                 get_timewait6_sock(seq, v, st->num);
1842         else if (sk->sk_state == TCP_NEW_SYN_RECV)
1843                 get_openreq6(seq, v, st->num);
1844         else
1845                 get_tcp6_sock(seq, v, st->num);
1846 out:
1847         return 0;
1848 }
1849
1850 static const struct file_operations tcp6_afinfo_seq_fops = {
1851         .owner   = THIS_MODULE,
1852         .open    = tcp_seq_open,
1853         .read    = seq_read,
1854         .llseek  = seq_lseek,
1855         .release = seq_release_net
1856 };
1857
1858 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1859         .name           = "tcp6",
1860         .family         = AF_INET6,
1861         .seq_fops       = &tcp6_afinfo_seq_fops,
1862         .seq_ops        = {
1863                 .show           = tcp6_seq_show,
1864         },
1865 };
1866
1867 int __net_init tcp6_proc_init(struct net *net)
1868 {
1869         return tcp_proc_register(net, &tcp6_seq_afinfo);
1870 }
1871
1872 void tcp6_proc_exit(struct net *net)
1873 {
1874         tcp_proc_unregister(net, &tcp6_seq_afinfo);
1875 }
1876 #endif
1877
1878 struct proto tcpv6_prot = {
1879         .name                   = "TCPv6",
1880         .owner                  = THIS_MODULE,
1881         .close                  = tcp_close,
1882         .connect                = tcp_v6_connect,
1883         .disconnect             = tcp_disconnect,
1884         .accept                 = inet_csk_accept,
1885         .ioctl                  = tcp_ioctl,
1886         .init                   = tcp_v6_init_sock,
1887         .destroy                = tcp_v6_destroy_sock,
1888         .shutdown               = tcp_shutdown,
1889         .setsockopt             = tcp_setsockopt,
1890         .getsockopt             = tcp_getsockopt,
1891         .recvmsg                = tcp_recvmsg,
1892         .sendmsg                = tcp_sendmsg,
1893         .sendpage               = tcp_sendpage,
1894         .backlog_rcv            = tcp_v6_do_rcv,
1895         .release_cb             = tcp_release_cb,
1896         .hash                   = inet6_hash,
1897         .unhash                 = inet_unhash,
1898         .get_port               = inet_csk_get_port,
1899         .enter_memory_pressure  = tcp_enter_memory_pressure,
1900         .stream_memory_free     = tcp_stream_memory_free,
1901         .sockets_allocated      = &tcp_sockets_allocated,
1902         .memory_allocated       = &tcp_memory_allocated,
1903         .memory_pressure        = &tcp_memory_pressure,
1904         .orphan_count           = &tcp_orphan_count,
1905         .sysctl_mem             = sysctl_tcp_mem,
1906         .sysctl_wmem            = sysctl_tcp_wmem,
1907         .sysctl_rmem            = sysctl_tcp_rmem,
1908         .max_header             = MAX_TCP_HEADER,
1909         .obj_size               = sizeof(struct tcp6_sock),
1910         .slab_flags             = SLAB_DESTROY_BY_RCU,
1911         .twsk_prot              = &tcp6_timewait_sock_ops,
1912         .rsk_prot               = &tcp6_request_sock_ops,
1913         .h.hashinfo             = &tcp_hashinfo,
1914         .no_autobind            = true,
1915 #ifdef CONFIG_COMPAT
1916         .compat_setsockopt      = compat_tcp_setsockopt,
1917         .compat_getsockopt      = compat_tcp_getsockopt,
1918 #endif
1919         .diag_destroy           = tcp_abort,
1920 };
1921
1922 static const struct inet6_protocol tcpv6_protocol = {
1923         .early_demux    =       tcp_v6_early_demux,
1924         .handler        =       tcp_v6_rcv,
1925         .err_handler    =       tcp_v6_err,
1926         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1927 };
1928
1929 static struct inet_protosw tcpv6_protosw = {
1930         .type           =       SOCK_STREAM,
1931         .protocol       =       IPPROTO_TCP,
1932         .prot           =       &tcpv6_prot,
1933         .ops            =       &inet6_stream_ops,
1934         .flags          =       INET_PROTOSW_PERMANENT |
1935                                 INET_PROTOSW_ICSK,
1936 };
1937
1938 static int __net_init tcpv6_net_init(struct net *net)
1939 {
1940         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1941                                     SOCK_RAW, IPPROTO_TCP, net);
1942 }
1943
1944 static void __net_exit tcpv6_net_exit(struct net *net)
1945 {
1946         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1947 }
1948
1949 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1950 {
1951         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1952 }
1953
1954 static struct pernet_operations tcpv6_net_ops = {
1955         .init       = tcpv6_net_init,
1956         .exit       = tcpv6_net_exit,
1957         .exit_batch = tcpv6_net_exit_batch,
1958 };
1959
1960 int __init tcpv6_init(void)
1961 {
1962         int ret;
1963
1964         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1965         if (ret)
1966                 goto out;
1967
1968         /* register inet6 protocol */
1969         ret = inet6_register_protosw(&tcpv6_protosw);
1970         if (ret)
1971                 goto out_tcpv6_protocol;
1972
1973         ret = register_pernet_subsys(&tcpv6_net_ops);
1974         if (ret)
1975                 goto out_tcpv6_protosw;
1976 out:
1977         return ret;
1978
1979 out_tcpv6_protosw:
1980         inet6_unregister_protosw(&tcpv6_protosw);
1981 out_tcpv6_protocol:
1982         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1983         goto out;
1984 }
1985
1986 void tcpv6_exit(void)
1987 {
1988         unregister_pernet_subsys(&tcpv6_net_ops);
1989         inet6_unregister_protosw(&tcpv6_protosw);
1990         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1991 }