3 * Linux INET6 implementation
6 * Pedro Roque <roque@di.fc.ul.pt>
10 * linux/net/ipv4/tcp_input.c
11 * linux/net/ipv4/tcp_output.c
14 * Hideaki YOSHIFUJI : sin6_scope_id support
15 * YOSHIFUJI Hideaki @USAGI and: Support IPV6_V6ONLY socket option, which
16 * Alexey Kuznetsov allow both IPv4 and IPv6 sockets to bind
17 * a single port at the same time.
18 * YOSHIFUJI Hideaki @USAGI: convert /proc/net/tcp6 to seq_file.
20 * This program is free software; you can redistribute it and/or
21 * modify it under the terms of the GNU General Public License
22 * as published by the Free Software Foundation; either version
23 * 2 of the License, or (at your option) any later version.
26 #include <linux/bottom_half.h>
27 #include <linux/module.h>
28 #include <linux/errno.h>
29 #include <linux/types.h>
30 #include <linux/socket.h>
31 #include <linux/sockios.h>
32 #include <linux/net.h>
33 #include <linux/jiffies.h>
35 #include <linux/in6.h>
36 #include <linux/netdevice.h>
37 #include <linux/init.h>
38 #include <linux/jhash.h>
39 #include <linux/ipsec.h>
40 #include <linux/times.h>
41 #include <linux/slab.h>
42 #include <linux/uaccess.h>
43 #include <linux/ipv6.h>
44 #include <linux/icmpv6.h>
45 #include <linux/random.h>
48 #include <net/ndisc.h>
49 #include <net/inet6_hashtables.h>
50 #include <net/inet6_connection_sock.h>
52 #include <net/transp_v6.h>
53 #include <net/addrconf.h>
54 #include <net/ip6_route.h>
55 #include <net/ip6_checksum.h>
56 #include <net/inet_ecn.h>
57 #include <net/protocol.h>
60 #include <net/dsfield.h>
61 #include <net/timewait_sock.h>
62 #include <net/inet_common.h>
63 #include <net/secure_seq.h>
64 #include <net/busy_poll.h>
66 #include <linux/proc_fs.h>
67 #include <linux/seq_file.h>
69 #include <linux/crypto.h>
70 #include <linux/scatterlist.h>
72 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
73 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
74 struct request_sock *req);
76 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
78 static const struct inet_connection_sock_af_ops ipv6_mapped;
79 static const struct inet_connection_sock_af_ops ipv6_specific;
80 #ifdef CONFIG_TCP_MD5SIG
81 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
82 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
84 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
85 const struct in6_addr *addr)
91 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
93 struct dst_entry *dst = skb_dst(skb);
95 if (dst && dst_hold_safe(dst)) {
96 const struct rt6_info *rt = (const struct rt6_info *)dst;
99 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
100 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
104 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
106 return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
107 ipv6_hdr(skb)->saddr.s6_addr32,
109 tcp_hdr(skb)->source);
112 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
115 struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
116 struct inet_sock *inet = inet_sk(sk);
117 struct inet_connection_sock *icsk = inet_csk(sk);
118 struct ipv6_pinfo *np = inet6_sk(sk);
119 struct tcp_sock *tp = tcp_sk(sk);
120 struct in6_addr *saddr = NULL, *final_p, final;
121 struct ipv6_txoptions *opt;
123 struct dst_entry *dst;
127 if (addr_len < SIN6_LEN_RFC2133)
130 if (usin->sin6_family != AF_INET6)
131 return -EAFNOSUPPORT;
133 memset(&fl6, 0, sizeof(fl6));
136 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
137 IP6_ECN_flow_init(fl6.flowlabel);
138 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
139 struct ip6_flowlabel *flowlabel;
140 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
143 fl6_sock_release(flowlabel);
148 * connect() to INADDR_ANY means loopback (BSD'ism).
151 if (ipv6_addr_any(&usin->sin6_addr))
152 usin->sin6_addr.s6_addr[15] = 0x1;
154 addr_type = ipv6_addr_type(&usin->sin6_addr);
156 if (addr_type & IPV6_ADDR_MULTICAST)
159 if (addr_type&IPV6_ADDR_LINKLOCAL) {
160 if (addr_len >= sizeof(struct sockaddr_in6) &&
161 usin->sin6_scope_id) {
162 /* If interface is set while binding, indices
165 if (sk->sk_bound_dev_if &&
166 sk->sk_bound_dev_if != usin->sin6_scope_id)
169 sk->sk_bound_dev_if = usin->sin6_scope_id;
172 /* Connect to link-local address requires an interface */
173 if (!sk->sk_bound_dev_if)
177 if (tp->rx_opt.ts_recent_stamp &&
178 !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
179 tp->rx_opt.ts_recent = 0;
180 tp->rx_opt.ts_recent_stamp = 0;
184 sk->sk_v6_daddr = usin->sin6_addr;
185 np->flow_label = fl6.flowlabel;
191 if (addr_type == IPV6_ADDR_MAPPED) {
192 u32 exthdrlen = icsk->icsk_ext_hdr_len;
193 struct sockaddr_in sin;
195 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
197 if (__ipv6_only_sock(sk))
200 sin.sin_family = AF_INET;
201 sin.sin_port = usin->sin6_port;
202 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
204 icsk->icsk_af_ops = &ipv6_mapped;
205 sk->sk_backlog_rcv = tcp_v4_do_rcv;
206 #ifdef CONFIG_TCP_MD5SIG
207 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
210 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
213 icsk->icsk_ext_hdr_len = exthdrlen;
214 icsk->icsk_af_ops = &ipv6_specific;
215 sk->sk_backlog_rcv = tcp_v6_do_rcv;
216 #ifdef CONFIG_TCP_MD5SIG
217 tp->af_specific = &tcp_sock_ipv6_specific;
221 np->saddr = sk->sk_v6_rcv_saddr;
226 if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
227 saddr = &sk->sk_v6_rcv_saddr;
229 fl6.flowi6_proto = IPPROTO_TCP;
230 fl6.daddr = sk->sk_v6_daddr;
231 fl6.saddr = saddr ? *saddr : np->saddr;
232 fl6.flowi6_oif = sk->sk_bound_dev_if;
233 fl6.flowi6_mark = sk->sk_mark;
234 fl6.fl6_dport = usin->sin6_port;
235 fl6.fl6_sport = inet->inet_sport;
237 opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
238 final_p = fl6_update_dst(&fl6, opt, &final);
240 security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
242 dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
250 sk->sk_v6_rcv_saddr = *saddr;
253 /* set the source address */
255 inet->inet_rcv_saddr = LOOPBACK4_IPV6;
257 sk->sk_gso_type = SKB_GSO_TCPV6;
258 ip6_dst_store(sk, dst, NULL, NULL);
260 if (tcp_death_row.sysctl_tw_recycle &&
261 !tp->rx_opt.ts_recent_stamp &&
262 ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
263 tcp_fetch_timewait_stamp(sk, dst);
265 icsk->icsk_ext_hdr_len = 0;
267 icsk->icsk_ext_hdr_len = opt->opt_flen +
270 tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
272 inet->inet_dport = usin->sin6_port;
274 tcp_set_state(sk, TCP_SYN_SENT);
275 err = inet6_hash_connect(&tcp_death_row, sk);
281 if (!tp->write_seq && likely(!tp->repair))
282 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
283 sk->sk_v6_daddr.s6_addr32,
287 err = tcp_connect(sk);
294 tcp_set_state(sk, TCP_CLOSE);
297 inet->inet_dport = 0;
298 sk->sk_route_caps = 0;
302 static void tcp_v6_mtu_reduced(struct sock *sk)
304 struct dst_entry *dst;
306 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
309 dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
313 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
314 tcp_sync_mss(sk, dst_mtu(dst));
315 tcp_simple_retransmit(sk);
319 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
320 u8 type, u8 code, int offset, __be32 info)
322 const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
323 const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
324 struct net *net = dev_net(skb->dev);
325 struct request_sock *fastopen;
326 struct ipv6_pinfo *np;
332 sk = __inet6_lookup_established(net, &tcp_hashinfo,
333 &hdr->daddr, th->dest,
334 &hdr->saddr, ntohs(th->source),
338 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
343 if (sk->sk_state == TCP_TIME_WAIT) {
344 inet_twsk_put(inet_twsk(sk));
347 seq = ntohl(th->seq);
348 if (sk->sk_state == TCP_NEW_SYN_RECV)
349 return tcp_req_err(sk, seq);
352 if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
353 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
355 if (sk->sk_state == TCP_CLOSE)
358 if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
359 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
364 /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
365 fastopen = tp->fastopen_rsk;
366 snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
367 if (sk->sk_state != TCP_LISTEN &&
368 !between(seq, snd_una, tp->snd_nxt)) {
369 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
375 if (type == NDISC_REDIRECT) {
376 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
379 dst->ops->redirect(dst, sk, skb);
383 if (type == ICMPV6_PKT_TOOBIG) {
384 /* We are not interested in TCP_LISTEN and open_requests
385 * (SYN-ACKs send out by Linux are always <576bytes so
386 * they should go through unfragmented).
388 if (sk->sk_state == TCP_LISTEN)
391 if (!ip6_sk_accept_pmtu(sk))
394 tp->mtu_info = ntohl(info);
395 if (!sock_owned_by_user(sk))
396 tcp_v6_mtu_reduced(sk);
397 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
403 icmpv6_err_convert(type, code, &err);
405 /* Might be for an request_sock */
406 switch (sk->sk_state) {
409 /* Only in fast or simultaneous open. If a fast open socket is
410 * is already accepted it is treated as a connected one below.
412 if (fastopen && !fastopen->sk)
415 if (!sock_owned_by_user(sk)) {
417 sk->sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */
421 sk->sk_err_soft = err;
425 if (!sock_owned_by_user(sk) && np->recverr) {
427 sk->sk_error_report(sk);
429 sk->sk_err_soft = err;
437 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
439 struct request_sock *req,
440 struct tcp_fastopen_cookie *foc,
443 struct inet_request_sock *ireq = inet_rsk(req);
444 struct ipv6_pinfo *np = inet6_sk(sk);
445 struct flowi6 *fl6 = &fl->u.ip6;
449 /* First, grab a route. */
450 if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
451 IPPROTO_TCP)) == NULL)
454 skb = tcp_make_synack(sk, dst, req, foc, attach_req);
457 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
458 &ireq->ir_v6_rmt_addr);
460 fl6->daddr = ireq->ir_v6_rmt_addr;
461 if (np->repflow && ireq->pktopts)
462 fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
465 err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
468 err = net_xmit_eval(err);
476 static void tcp_v6_reqsk_destructor(struct request_sock *req)
478 kfree_skb(inet_rsk(req)->pktopts);
481 #ifdef CONFIG_TCP_MD5SIG
482 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
483 const struct in6_addr *addr)
485 return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
488 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
489 const struct sock *addr_sk)
491 return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
494 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
497 struct tcp_md5sig cmd;
498 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
500 if (optlen < sizeof(cmd))
503 if (copy_from_user(&cmd, optval, sizeof(cmd)))
506 if (sin6->sin6_family != AF_INET6)
509 if (!cmd.tcpm_keylen) {
510 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
511 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
513 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
517 if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
520 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
521 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
522 AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
524 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
525 AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
528 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
529 const struct in6_addr *daddr,
530 const struct in6_addr *saddr, int nbytes)
532 struct tcp6_pseudohdr *bp;
533 struct scatterlist sg;
535 bp = &hp->md5_blk.ip6;
536 /* 1. TCP pseudo-header (RFC2460) */
539 bp->protocol = cpu_to_be32(IPPROTO_TCP);
540 bp->len = cpu_to_be32(nbytes);
542 sg_init_one(&sg, bp, sizeof(*bp));
543 return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
546 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
547 const struct in6_addr *daddr, struct in6_addr *saddr,
548 const struct tcphdr *th)
550 struct tcp_md5sig_pool *hp;
551 struct hash_desc *desc;
553 hp = tcp_get_md5sig_pool();
555 goto clear_hash_noput;
556 desc = &hp->md5_desc;
558 if (crypto_hash_init(desc))
560 if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
562 if (tcp_md5_hash_header(hp, th))
564 if (tcp_md5_hash_key(hp, key))
566 if (crypto_hash_final(desc, md5_hash))
569 tcp_put_md5sig_pool();
573 tcp_put_md5sig_pool();
575 memset(md5_hash, 0, 16);
579 static int tcp_v6_md5_hash_skb(char *md5_hash,
580 const struct tcp_md5sig_key *key,
581 const struct sock *sk,
582 const struct sk_buff *skb)
584 const struct in6_addr *saddr, *daddr;
585 struct tcp_md5sig_pool *hp;
586 struct hash_desc *desc;
587 const struct tcphdr *th = tcp_hdr(skb);
589 if (sk) { /* valid for establish/request sockets */
590 saddr = &sk->sk_v6_rcv_saddr;
591 daddr = &sk->sk_v6_daddr;
593 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
594 saddr = &ip6h->saddr;
595 daddr = &ip6h->daddr;
598 hp = tcp_get_md5sig_pool();
600 goto clear_hash_noput;
601 desc = &hp->md5_desc;
603 if (crypto_hash_init(desc))
606 if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
608 if (tcp_md5_hash_header(hp, th))
610 if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
612 if (tcp_md5_hash_key(hp, key))
614 if (crypto_hash_final(desc, md5_hash))
617 tcp_put_md5sig_pool();
621 tcp_put_md5sig_pool();
623 memset(md5_hash, 0, 16);
629 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
630 const struct sk_buff *skb)
632 #ifdef CONFIG_TCP_MD5SIG
633 const __u8 *hash_location = NULL;
634 struct tcp_md5sig_key *hash_expected;
635 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
636 const struct tcphdr *th = tcp_hdr(skb);
640 hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
641 hash_location = tcp_parse_md5sig_option(th);
643 /* We've parsed the options - do we have a hash? */
644 if (!hash_expected && !hash_location)
647 if (hash_expected && !hash_location) {
648 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
652 if (!hash_expected && hash_location) {
653 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
657 /* check the signature */
658 genhash = tcp_v6_md5_hash_skb(newhash,
662 if (genhash || memcmp(hash_location, newhash, 16) != 0) {
663 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
664 genhash ? "failed" : "mismatch",
665 &ip6h->saddr, ntohs(th->source),
666 &ip6h->daddr, ntohs(th->dest));
673 static void tcp_v6_init_req(struct request_sock *req,
674 const struct sock *sk_listener,
677 struct inet_request_sock *ireq = inet_rsk(req);
678 const struct ipv6_pinfo *np = inet6_sk(sk_listener);
680 ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
681 ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
683 /* So that link locals have meaning */
684 if (!sk_listener->sk_bound_dev_if &&
685 ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
686 ireq->ir_iif = tcp_v6_iif(skb);
688 if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
689 (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
690 np->rxopt.bits.rxinfo ||
691 np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
692 np->rxopt.bits.rxohlim || np->repflow)) {
693 atomic_inc(&skb->users);
698 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
700 const struct request_sock *req,
705 return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
708 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
710 .obj_size = sizeof(struct tcp6_request_sock),
711 .rtx_syn_ack = tcp_rtx_synack,
712 .send_ack = tcp_v6_reqsk_send_ack,
713 .destructor = tcp_v6_reqsk_destructor,
714 .send_reset = tcp_v6_send_reset,
715 .syn_ack_timeout = tcp_syn_ack_timeout,
718 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
719 .mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) -
720 sizeof(struct ipv6hdr),
721 #ifdef CONFIG_TCP_MD5SIG
722 .req_md5_lookup = tcp_v6_md5_lookup,
723 .calc_md5_hash = tcp_v6_md5_hash_skb,
725 .init_req = tcp_v6_init_req,
726 #ifdef CONFIG_SYN_COOKIES
727 .cookie_init_seq = cookie_v6_init_sequence,
729 .route_req = tcp_v6_route_req,
730 .init_seq = tcp_v6_init_sequence,
731 .send_synack = tcp_v6_send_synack,
734 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
735 u32 ack, u32 win, u32 tsval, u32 tsecr,
736 int oif, struct tcp_md5sig_key *key, int rst,
737 u8 tclass, u32 label)
739 const struct tcphdr *th = tcp_hdr(skb);
741 struct sk_buff *buff;
743 struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
744 struct sock *ctl_sk = net->ipv6.tcp_sk;
745 unsigned int tot_len = sizeof(struct tcphdr);
746 struct dst_entry *dst;
750 tot_len += TCPOLEN_TSTAMP_ALIGNED;
751 #ifdef CONFIG_TCP_MD5SIG
753 tot_len += TCPOLEN_MD5SIG_ALIGNED;
756 buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
761 skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
763 t1 = (struct tcphdr *) skb_push(buff, tot_len);
764 skb_reset_transport_header(buff);
766 /* Swap the send and the receive. */
767 memset(t1, 0, sizeof(*t1));
768 t1->dest = th->source;
769 t1->source = th->dest;
770 t1->doff = tot_len / 4;
771 t1->seq = htonl(seq);
772 t1->ack_seq = htonl(ack);
773 t1->ack = !rst || !th->ack;
775 t1->window = htons(win);
777 topt = (__be32 *)(t1 + 1);
780 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
781 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
782 *topt++ = htonl(tsval);
783 *topt++ = htonl(tsecr);
786 #ifdef CONFIG_TCP_MD5SIG
788 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
789 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
790 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
791 &ipv6_hdr(skb)->saddr,
792 &ipv6_hdr(skb)->daddr, t1);
796 memset(&fl6, 0, sizeof(fl6));
797 fl6.daddr = ipv6_hdr(skb)->saddr;
798 fl6.saddr = ipv6_hdr(skb)->daddr;
799 fl6.flowlabel = label;
801 buff->ip_summed = CHECKSUM_PARTIAL;
804 __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
806 fl6.flowi6_proto = IPPROTO_TCP;
807 if (rt6_need_strict(&fl6.daddr) && !oif)
808 fl6.flowi6_oif = tcp_v6_iif(skb);
810 fl6.flowi6_oif = oif;
811 fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
812 fl6.fl6_dport = t1->dest;
813 fl6.fl6_sport = t1->source;
814 security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
816 /* Pass a socket to ip6_dst_lookup either it is for RST
817 * Underlying function will use this to retrieve the network
820 dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
822 skb_dst_set(buff, dst);
823 ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
824 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
826 TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
833 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
835 const struct tcphdr *th = tcp_hdr(skb);
836 u32 seq = 0, ack_seq = 0;
837 struct tcp_md5sig_key *key = NULL;
838 #ifdef CONFIG_TCP_MD5SIG
839 const __u8 *hash_location = NULL;
840 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
841 unsigned char newhash[16];
843 struct sock *sk1 = NULL;
850 /* If sk not NULL, it means we did a successful lookup and incoming
851 * route had to be correct. prequeue might have dropped our dst.
853 if (!sk && !ipv6_unicast_destination(skb))
856 #ifdef CONFIG_TCP_MD5SIG
857 hash_location = tcp_parse_md5sig_option(th);
858 if (sk && sk_fullsock(sk)) {
859 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
860 } else if (hash_location) {
862 * active side is lost. Try to find listening socket through
863 * source port, and then find md5 key through listening socket.
864 * we are not loose security here:
865 * Incoming packet is checked with md5 hash with finding key,
866 * no RST generated if md5 hash doesn't match.
868 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
869 &tcp_hashinfo, &ipv6h->saddr,
870 th->source, &ipv6h->daddr,
871 ntohs(th->source), tcp_v6_iif(skb));
876 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
880 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
881 if (genhash || memcmp(hash_location, newhash, 16) != 0)
887 seq = ntohl(th->ack_seq);
889 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
892 oif = sk ? sk->sk_bound_dev_if : 0;
893 tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
895 #ifdef CONFIG_TCP_MD5SIG
904 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
905 u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
906 struct tcp_md5sig_key *key, u8 tclass,
909 tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
913 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
915 struct inet_timewait_sock *tw = inet_twsk(sk);
916 struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
918 tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
919 tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
920 tcp_time_stamp + tcptw->tw_ts_offset,
921 tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
922 tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
927 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
928 struct request_sock *req)
930 /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
931 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
933 tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
934 tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
935 tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
936 tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
937 tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
942 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
944 #ifdef CONFIG_SYN_COOKIES
945 const struct tcphdr *th = tcp_hdr(skb);
948 sk = cookie_v6_check(sk, skb);
953 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
955 if (skb->protocol == htons(ETH_P_IP))
956 return tcp_v4_conn_request(sk, skb);
958 if (!ipv6_unicast_destination(skb))
961 return tcp_conn_request(&tcp6_request_sock_ops,
962 &tcp_request_sock_ipv6_ops, sk, skb);
965 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
966 return 0; /* don't send reset */
969 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
970 struct request_sock *req,
971 struct dst_entry *dst,
972 struct request_sock *req_unhash,
975 struct inet_request_sock *ireq;
976 struct ipv6_pinfo *newnp;
977 const struct ipv6_pinfo *np = inet6_sk(sk);
978 struct ipv6_txoptions *opt;
979 struct tcp6_sock *newtcp6sk;
980 struct inet_sock *newinet;
981 struct tcp_sock *newtp;
983 #ifdef CONFIG_TCP_MD5SIG
984 struct tcp_md5sig_key *key;
988 if (skb->protocol == htons(ETH_P_IP)) {
993 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
994 req_unhash, own_req);
999 newtcp6sk = (struct tcp6_sock *)newsk;
1000 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1002 newinet = inet_sk(newsk);
1003 newnp = inet6_sk(newsk);
1004 newtp = tcp_sk(newsk);
1006 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1008 newnp->saddr = newsk->sk_v6_rcv_saddr;
1010 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1011 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1012 #ifdef CONFIG_TCP_MD5SIG
1013 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1016 newnp->ipv6_ac_list = NULL;
1017 newnp->ipv6_fl_list = NULL;
1018 newnp->pktoptions = NULL;
1020 newnp->mcast_oif = tcp_v6_iif(skb);
1021 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1022 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1024 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1027 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1028 * here, tcp_create_openreq_child now does this for us, see the comment in
1029 * that function for the gory details. -acme
1032 /* It is tricky place. Until this moment IPv4 tcp
1033 worked with IPv6 icsk.icsk_af_ops.
1036 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1041 ireq = inet_rsk(req);
1043 if (sk_acceptq_is_full(sk))
1047 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1052 newsk = tcp_create_openreq_child(sk, req, skb);
1057 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1058 * count here, tcp_create_openreq_child now does this for us, see the
1059 * comment in that function for the gory details. -acme
1062 newsk->sk_gso_type = SKB_GSO_TCPV6;
1063 ip6_dst_store(newsk, dst, NULL, NULL);
1064 inet6_sk_rx_dst_set(newsk, skb);
1066 newtcp6sk = (struct tcp6_sock *)newsk;
1067 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1069 newtp = tcp_sk(newsk);
1070 newinet = inet_sk(newsk);
1071 newnp = inet6_sk(newsk);
1073 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1075 newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1076 newnp->saddr = ireq->ir_v6_loc_addr;
1077 newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1078 newsk->sk_bound_dev_if = ireq->ir_iif;
1080 /* Now IPv6 options...
1082 First: no IPv4 options.
1084 newinet->inet_opt = NULL;
1085 newnp->ipv6_ac_list = NULL;
1086 newnp->ipv6_fl_list = NULL;
1089 newnp->rxopt.all = np->rxopt.all;
1091 newnp->pktoptions = NULL;
1093 newnp->mcast_oif = tcp_v6_iif(skb);
1094 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1095 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1097 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1099 /* Clone native IPv6 options from listening socket (if any)
1101 Yes, keeping reference count would be much more clever,
1102 but we make one more one thing there: reattach optmem
1105 opt = rcu_dereference(np->opt);
1107 opt = ipv6_dup_options(newsk, opt);
1108 RCU_INIT_POINTER(newnp->opt, opt);
1110 inet_csk(newsk)->icsk_ext_hdr_len = 0;
1112 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1115 tcp_ca_openreq_child(newsk, dst);
1117 tcp_sync_mss(newsk, dst_mtu(dst));
1118 newtp->advmss = dst_metric_advmss(dst);
1119 if (tcp_sk(sk)->rx_opt.user_mss &&
1120 tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1121 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1123 tcp_initialize_rcv_mss(newsk);
1125 newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1126 newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1128 #ifdef CONFIG_TCP_MD5SIG
1129 /* Copy over the MD5 key from the original socket */
1130 key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1132 /* We're using one, so create a matching key
1133 * on the newsk structure. If we fail to get
1134 * memory, then we end up not copying the key
1137 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1138 AF_INET6, key->key, key->keylen,
1139 sk_gfp_mask(sk, GFP_ATOMIC));
1143 if (__inet_inherit_port(sk, newsk) < 0) {
1144 inet_csk_prepare_forced_close(newsk);
1148 *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1150 tcp_move_syn(newtp, req);
1152 /* Clone pktoptions received with SYN, if we own the req */
1153 if (ireq->pktopts) {
1154 newnp->pktoptions = skb_clone(ireq->pktopts,
1155 sk_gfp_mask(sk, GFP_ATOMIC));
1156 consume_skb(ireq->pktopts);
1157 ireq->pktopts = NULL;
1158 if (newnp->pktoptions)
1159 skb_set_owner_r(newnp->pktoptions, newsk);
1166 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1170 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1174 /* The socket must have it's spinlock held when we get
1175 * here, unless it is a TCP_LISTEN socket.
1177 * We have a potential double-lock case here, so even when
1178 * doing backlog processing we use the BH locking scheme.
1179 * This is because we cannot sleep with the original spinlock
1182 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1184 struct ipv6_pinfo *np = inet6_sk(sk);
1185 struct tcp_sock *tp;
1186 struct sk_buff *opt_skb = NULL;
1188 /* Imagine: socket is IPv6. IPv4 packet arrives,
1189 goes to IPv4 receive handler and backlogged.
1190 From backlog it always goes here. Kerboom...
1191 Fortunately, tcp_rcv_established and rcv_established
1192 handle them correctly, but it is not case with
1193 tcp_v6_hnd_req and tcp_v6_send_reset(). --ANK
1196 if (skb->protocol == htons(ETH_P_IP))
1197 return tcp_v4_do_rcv(sk, skb);
1199 if (sk_filter(sk, skb))
1203 * socket locking is here for SMP purposes as backlog rcv
1204 * is currently called with bh processing disabled.
1207 /* Do Stevens' IPV6_PKTOPTIONS.
1209 Yes, guys, it is the only place in our code, where we
1210 may make it not affecting IPv4.
1211 The rest of code is protocol independent,
1212 and I do not like idea to uglify IPv4.
1214 Actually, all the idea behind IPV6_PKTOPTIONS
1215 looks not very well thought. For now we latch
1216 options, received in the last packet, enqueued
1217 by tcp. Feel free to propose better solution.
1221 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1223 if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1224 struct dst_entry *dst = sk->sk_rx_dst;
1226 sock_rps_save_rxhash(sk, skb);
1227 sk_mark_napi_id(sk, skb);
1229 if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1230 dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1232 sk->sk_rx_dst = NULL;
1236 tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1238 goto ipv6_pktoptions;
1242 if (tcp_checksum_complete(skb))
1245 if (sk->sk_state == TCP_LISTEN) {
1246 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1252 sock_rps_save_rxhash(nsk, skb);
1253 sk_mark_napi_id(nsk, skb);
1254 if (tcp_child_process(sk, nsk, skb))
1257 __kfree_skb(opt_skb);
1261 sock_rps_save_rxhash(sk, skb);
1263 if (tcp_rcv_state_process(sk, skb))
1266 goto ipv6_pktoptions;
1270 tcp_v6_send_reset(sk, skb);
1273 __kfree_skb(opt_skb);
1277 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1278 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1283 /* Do you ask, what is it?
1285 1. skb was enqueued by tcp.
1286 2. skb is added to tail of read queue, rather than out of order.
1287 3. socket is not in passive state.
1288 4. Finally, it really contains options, which user wants to receive.
1291 if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1292 !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1293 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1294 np->mcast_oif = tcp_v6_iif(opt_skb);
1295 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1296 np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1297 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1298 np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1300 np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1301 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1302 skb_set_owner_r(opt_skb, sk);
1303 opt_skb = xchg(&np->pktoptions, opt_skb);
1305 __kfree_skb(opt_skb);
1306 opt_skb = xchg(&np->pktoptions, NULL);
1314 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1315 const struct tcphdr *th)
1317 /* This is tricky: we move IP6CB at its correct location into
1318 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1319 * _decode_session6() uses IP6CB().
1320 * barrier() makes sure compiler won't play aliasing games.
1322 memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1323 sizeof(struct inet6_skb_parm));
1326 TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1327 TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1328 skb->len - th->doff*4);
1329 TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1330 TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1331 TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1332 TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1333 TCP_SKB_CB(skb)->sacked = 0;
1336 static void tcp_v6_restore_cb(struct sk_buff *skb)
1338 /* We need to move header back to the beginning if xfrm6_policy_check()
1339 * and tcp_v6_fill_cb() are going to be called again.
1341 memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1342 sizeof(struct inet6_skb_parm));
1345 static int tcp_v6_rcv(struct sk_buff *skb)
1347 const struct tcphdr *th;
1348 const struct ipv6hdr *hdr;
1351 struct net *net = dev_net(skb->dev);
1353 if (skb->pkt_type != PACKET_HOST)
1357 * Count it even if it's bad.
1359 TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1361 if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1366 if (th->doff < sizeof(struct tcphdr)/4)
1368 if (!pskb_may_pull(skb, th->doff*4))
1371 if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1375 hdr = ipv6_hdr(skb);
1378 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1384 if (sk->sk_state == TCP_TIME_WAIT)
1387 if (sk->sk_state == TCP_NEW_SYN_RECV) {
1388 struct request_sock *req = inet_reqsk(sk);
1389 struct sock *nsk = NULL;
1391 sk = req->rsk_listener;
1392 tcp_v6_fill_cb(skb, hdr, th);
1393 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1397 if (likely(sk->sk_state == TCP_LISTEN)) {
1398 nsk = tcp_check_req(sk, skb, req, false);
1400 inet_csk_reqsk_queue_drop_and_put(sk, req);
1410 tcp_v6_restore_cb(skb);
1411 } else if (tcp_child_process(sk, nsk, skb)) {
1412 tcp_v6_send_reset(nsk, skb);
1418 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1419 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1420 goto discard_and_relse;
1423 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1424 goto discard_and_relse;
1426 tcp_v6_fill_cb(skb, hdr, th);
1428 if (tcp_v6_inbound_md5_hash(sk, skb))
1429 goto discard_and_relse;
1431 if (sk_filter(sk, skb))
1432 goto discard_and_relse;
1436 if (sk->sk_state == TCP_LISTEN) {
1437 ret = tcp_v6_do_rcv(sk, skb);
1438 goto put_and_return;
1441 sk_incoming_cpu_update(sk);
1443 bh_lock_sock_nested(sk);
1444 tcp_sk(sk)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
1446 if (!sock_owned_by_user(sk)) {
1447 if (!tcp_prequeue(sk, skb))
1448 ret = tcp_v6_do_rcv(sk, skb);
1449 } else if (unlikely(sk_add_backlog(sk, skb,
1450 sk->sk_rcvbuf + sk->sk_sndbuf))) {
1452 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1453 goto discard_and_relse;
1459 return ret ? -1 : 0;
1462 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1465 tcp_v6_fill_cb(skb, hdr, th);
1467 if (tcp_checksum_complete(skb)) {
1469 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1471 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1473 tcp_v6_send_reset(NULL, skb);
1485 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1486 inet_twsk_put(inet_twsk(sk));
1490 tcp_v6_fill_cb(skb, hdr, th);
1492 if (tcp_checksum_complete(skb)) {
1493 inet_twsk_put(inet_twsk(sk));
1497 switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1502 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1503 &ipv6_hdr(skb)->saddr, th->source,
1504 &ipv6_hdr(skb)->daddr,
1505 ntohs(th->dest), tcp_v6_iif(skb));
1507 struct inet_timewait_sock *tw = inet_twsk(sk);
1508 inet_twsk_deschedule_put(tw);
1510 tcp_v6_restore_cb(skb);
1513 /* Fall through to ACK */
1516 tcp_v6_timewait_ack(sk, skb);
1519 tcp_v6_restore_cb(skb);
1520 tcp_v6_send_reset(sk, skb);
1521 inet_twsk_deschedule_put(inet_twsk(sk));
1523 case TCP_TW_SUCCESS:
1529 static void tcp_v6_early_demux(struct sk_buff *skb)
1531 const struct ipv6hdr *hdr;
1532 const struct tcphdr *th;
1535 if (skb->pkt_type != PACKET_HOST)
1538 if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1541 hdr = ipv6_hdr(skb);
1544 if (th->doff < sizeof(struct tcphdr) / 4)
1547 /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1548 sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1549 &hdr->saddr, th->source,
1550 &hdr->daddr, ntohs(th->dest),
1554 skb->destructor = sock_edemux;
1555 if (sk_fullsock(sk)) {
1556 struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1559 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1561 inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1562 skb_dst_set_noref(skb, dst);
1567 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1568 .twsk_obj_size = sizeof(struct tcp6_timewait_sock),
1569 .twsk_unique = tcp_twsk_unique,
1570 .twsk_destructor = tcp_twsk_destructor,
1573 static const struct inet_connection_sock_af_ops ipv6_specific = {
1574 .queue_xmit = inet6_csk_xmit,
1575 .send_check = tcp_v6_send_check,
1576 .rebuild_header = inet6_sk_rebuild_header,
1577 .sk_rx_dst_set = inet6_sk_rx_dst_set,
1578 .conn_request = tcp_v6_conn_request,
1579 .syn_recv_sock = tcp_v6_syn_recv_sock,
1580 .net_header_len = sizeof(struct ipv6hdr),
1581 .net_frag_header_len = sizeof(struct frag_hdr),
1582 .setsockopt = ipv6_setsockopt,
1583 .getsockopt = ipv6_getsockopt,
1584 .addr2sockaddr = inet6_csk_addr2sockaddr,
1585 .sockaddr_len = sizeof(struct sockaddr_in6),
1586 .bind_conflict = inet6_csk_bind_conflict,
1587 #ifdef CONFIG_COMPAT
1588 .compat_setsockopt = compat_ipv6_setsockopt,
1589 .compat_getsockopt = compat_ipv6_getsockopt,
1591 .mtu_reduced = tcp_v6_mtu_reduced,
1594 #ifdef CONFIG_TCP_MD5SIG
1595 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1596 .md5_lookup = tcp_v6_md5_lookup,
1597 .calc_md5_hash = tcp_v6_md5_hash_skb,
1598 .md5_parse = tcp_v6_parse_md5_keys,
1603 * TCP over IPv4 via INET6 API
1605 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1606 .queue_xmit = ip_queue_xmit,
1607 .send_check = tcp_v4_send_check,
1608 .rebuild_header = inet_sk_rebuild_header,
1609 .sk_rx_dst_set = inet_sk_rx_dst_set,
1610 .conn_request = tcp_v6_conn_request,
1611 .syn_recv_sock = tcp_v6_syn_recv_sock,
1612 .net_header_len = sizeof(struct iphdr),
1613 .setsockopt = ipv6_setsockopt,
1614 .getsockopt = ipv6_getsockopt,
1615 .addr2sockaddr = inet6_csk_addr2sockaddr,
1616 .sockaddr_len = sizeof(struct sockaddr_in6),
1617 .bind_conflict = inet6_csk_bind_conflict,
1618 #ifdef CONFIG_COMPAT
1619 .compat_setsockopt = compat_ipv6_setsockopt,
1620 .compat_getsockopt = compat_ipv6_getsockopt,
1622 .mtu_reduced = tcp_v4_mtu_reduced,
1625 #ifdef CONFIG_TCP_MD5SIG
1626 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1627 .md5_lookup = tcp_v4_md5_lookup,
1628 .calc_md5_hash = tcp_v4_md5_hash_skb,
1629 .md5_parse = tcp_v6_parse_md5_keys,
1633 /* NOTE: A lot of things set to zero explicitly by call to
1634 * sk_alloc() so need not be done here.
1636 static int tcp_v6_init_sock(struct sock *sk)
1638 struct inet_connection_sock *icsk = inet_csk(sk);
1642 icsk->icsk_af_ops = &ipv6_specific;
1644 #ifdef CONFIG_TCP_MD5SIG
1645 tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1651 static void tcp_v6_destroy_sock(struct sock *sk)
1653 tcp_v4_destroy_sock(sk);
1654 inet6_destroy_sock(sk);
1657 #ifdef CONFIG_PROC_FS
1658 /* Proc filesystem TCPv6 sock list dumping. */
1659 static void get_openreq6(struct seq_file *seq,
1660 const struct request_sock *req, int i)
1662 long ttd = req->rsk_timer.expires - jiffies;
1663 const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1664 const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1670 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1671 "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1673 src->s6_addr32[0], src->s6_addr32[1],
1674 src->s6_addr32[2], src->s6_addr32[3],
1675 inet_rsk(req)->ir_num,
1676 dest->s6_addr32[0], dest->s6_addr32[1],
1677 dest->s6_addr32[2], dest->s6_addr32[3],
1678 ntohs(inet_rsk(req)->ir_rmt_port),
1680 0, 0, /* could print option size, but that is af dependent. */
1681 1, /* timers active (only the expire timer) */
1682 jiffies_to_clock_t(ttd),
1684 from_kuid_munged(seq_user_ns(seq),
1685 sock_i_uid(req->rsk_listener)),
1686 0, /* non standard timer */
1687 0, /* open_requests have no inode */
1691 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1693 const struct in6_addr *dest, *src;
1696 unsigned long timer_expires;
1697 const struct inet_sock *inet = inet_sk(sp);
1698 const struct tcp_sock *tp = tcp_sk(sp);
1699 const struct inet_connection_sock *icsk = inet_csk(sp);
1700 const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1704 dest = &sp->sk_v6_daddr;
1705 src = &sp->sk_v6_rcv_saddr;
1706 destp = ntohs(inet->inet_dport);
1707 srcp = ntohs(inet->inet_sport);
1709 if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1711 timer_expires = icsk->icsk_timeout;
1712 } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1714 timer_expires = icsk->icsk_timeout;
1715 } else if (timer_pending(&sp->sk_timer)) {
1717 timer_expires = sp->sk_timer.expires;
1720 timer_expires = jiffies;
1723 state = sk_state_load(sp);
1724 if (state == TCP_LISTEN)
1725 rx_queue = sp->sk_ack_backlog;
1727 /* Because we don't lock the socket,
1728 * we might find a transient negative value.
1730 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1733 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1734 "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1736 src->s6_addr32[0], src->s6_addr32[1],
1737 src->s6_addr32[2], src->s6_addr32[3], srcp,
1738 dest->s6_addr32[0], dest->s6_addr32[1],
1739 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1741 tp->write_seq - tp->snd_una,
1744 jiffies_delta_to_clock_t(timer_expires - jiffies),
1745 icsk->icsk_retransmits,
1746 from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1747 icsk->icsk_probes_out,
1749 atomic_read(&sp->sk_refcnt), sp,
1750 jiffies_to_clock_t(icsk->icsk_rto),
1751 jiffies_to_clock_t(icsk->icsk_ack.ato),
1752 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1754 state == TCP_LISTEN ?
1755 fastopenq->max_qlen :
1756 (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1760 static void get_timewait6_sock(struct seq_file *seq,
1761 struct inet_timewait_sock *tw, int i)
1763 long delta = tw->tw_timer.expires - jiffies;
1764 const struct in6_addr *dest, *src;
1767 dest = &tw->tw_v6_daddr;
1768 src = &tw->tw_v6_rcv_saddr;
1769 destp = ntohs(tw->tw_dport);
1770 srcp = ntohs(tw->tw_sport);
1773 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1774 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1776 src->s6_addr32[0], src->s6_addr32[1],
1777 src->s6_addr32[2], src->s6_addr32[3], srcp,
1778 dest->s6_addr32[0], dest->s6_addr32[1],
1779 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1780 tw->tw_substate, 0, 0,
1781 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1782 atomic_read(&tw->tw_refcnt), tw);
1785 static int tcp6_seq_show(struct seq_file *seq, void *v)
1787 struct tcp_iter_state *st;
1788 struct sock *sk = v;
1790 if (v == SEQ_START_TOKEN) {
1795 "st tx_queue rx_queue tr tm->when retrnsmt"
1796 " uid timeout inode\n");
1801 if (sk->sk_state == TCP_TIME_WAIT)
1802 get_timewait6_sock(seq, v, st->num);
1803 else if (sk->sk_state == TCP_NEW_SYN_RECV)
1804 get_openreq6(seq, v, st->num);
1806 get_tcp6_sock(seq, v, st->num);
1811 static const struct file_operations tcp6_afinfo_seq_fops = {
1812 .owner = THIS_MODULE,
1813 .open = tcp_seq_open,
1815 .llseek = seq_lseek,
1816 .release = seq_release_net
1819 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1822 .seq_fops = &tcp6_afinfo_seq_fops,
1824 .show = tcp6_seq_show,
1828 int __net_init tcp6_proc_init(struct net *net)
1830 return tcp_proc_register(net, &tcp6_seq_afinfo);
1833 void tcp6_proc_exit(struct net *net)
1835 tcp_proc_unregister(net, &tcp6_seq_afinfo);
1839 static void tcp_v6_clear_sk(struct sock *sk, int size)
1841 struct inet_sock *inet = inet_sk(sk);
1843 /* we do not want to clear pinet6 field, because of RCU lookups */
1844 sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1846 size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1847 memset(&inet->pinet6 + 1, 0, size);
1850 struct proto tcpv6_prot = {
1852 .owner = THIS_MODULE,
1854 .connect = tcp_v6_connect,
1855 .disconnect = tcp_disconnect,
1856 .accept = inet_csk_accept,
1858 .init = tcp_v6_init_sock,
1859 .destroy = tcp_v6_destroy_sock,
1860 .shutdown = tcp_shutdown,
1861 .setsockopt = tcp_setsockopt,
1862 .getsockopt = tcp_getsockopt,
1863 .recvmsg = tcp_recvmsg,
1864 .sendmsg = tcp_sendmsg,
1865 .sendpage = tcp_sendpage,
1866 .backlog_rcv = tcp_v6_do_rcv,
1867 .release_cb = tcp_release_cb,
1869 .unhash = inet_unhash,
1870 .get_port = inet_csk_get_port,
1871 .enter_memory_pressure = tcp_enter_memory_pressure,
1872 .stream_memory_free = tcp_stream_memory_free,
1873 .sockets_allocated = &tcp_sockets_allocated,
1874 .memory_allocated = &tcp_memory_allocated,
1875 .memory_pressure = &tcp_memory_pressure,
1876 .orphan_count = &tcp_orphan_count,
1877 .sysctl_mem = sysctl_tcp_mem,
1878 .sysctl_wmem = sysctl_tcp_wmem,
1879 .sysctl_rmem = sysctl_tcp_rmem,
1880 .max_header = MAX_TCP_HEADER,
1881 .obj_size = sizeof(struct tcp6_sock),
1882 .slab_flags = SLAB_DESTROY_BY_RCU,
1883 .twsk_prot = &tcp6_timewait_sock_ops,
1884 .rsk_prot = &tcp6_request_sock_ops,
1885 .h.hashinfo = &tcp_hashinfo,
1886 .no_autobind = true,
1887 #ifdef CONFIG_COMPAT
1888 .compat_setsockopt = compat_tcp_setsockopt,
1889 .compat_getsockopt = compat_tcp_getsockopt,
1891 .clear_sk = tcp_v6_clear_sk,
1892 .diag_destroy = tcp_abort,
1895 static const struct inet6_protocol tcpv6_protocol = {
1896 .early_demux = tcp_v6_early_demux,
1897 .handler = tcp_v6_rcv,
1898 .err_handler = tcp_v6_err,
1899 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1902 static struct inet_protosw tcpv6_protosw = {
1903 .type = SOCK_STREAM,
1904 .protocol = IPPROTO_TCP,
1905 .prot = &tcpv6_prot,
1906 .ops = &inet6_stream_ops,
1907 .flags = INET_PROTOSW_PERMANENT |
1911 static int __net_init tcpv6_net_init(struct net *net)
1913 return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1914 SOCK_RAW, IPPROTO_TCP, net);
1917 static void __net_exit tcpv6_net_exit(struct net *net)
1919 inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1922 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1924 inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1927 static struct pernet_operations tcpv6_net_ops = {
1928 .init = tcpv6_net_init,
1929 .exit = tcpv6_net_exit,
1930 .exit_batch = tcpv6_net_exit_batch,
1933 int __init tcpv6_init(void)
1937 ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1941 /* register inet6 protocol */
1942 ret = inet6_register_protosw(&tcpv6_protosw);
1944 goto out_tcpv6_protocol;
1946 ret = register_pernet_subsys(&tcpv6_net_ops);
1948 goto out_tcpv6_protosw;
1953 inet6_unregister_protosw(&tcpv6_protosw);
1955 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1959 void tcpv6_exit(void)
1961 unregister_pernet_subsys(&tcpv6_net_ops);
1962 inet6_unregister_protosw(&tcpv6_protosw);
1963 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);