net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/net.h>
  34 #include <linux/jiffies.h>
  35 #include <linux/in.h>
  36 #include <linux/in6.h>
  37 #include <linux/netdevice.h>
  38 #include <linux/init.h>
  39 #include <linux/jhash.h>
  40 #include <linux/ipsec.h>
  41 #include <linux/times.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63
  64 #include <asm/uaccess.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <linux/crypto.h>
  70 #include <linux/scatterlist.h>
  71
  72 /* Socket used for sending RSTs and ACKs */
  73 static struct socket *tcp6_socket;
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
  77 static void     tcp_v6_send_check(struct sock *sk, int len,
  78                                   struct sk_buff *skb);
  79
  80 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  81
  82 static struct inet_connection_sock_af_ops ipv6_mapped;
  83 static struct inet_connection_sock_af_ops ipv6_specific;
  84 #ifdef CONFIG_TCP_MD5SIG
  85 static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  86 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  87 #endif
  88
  89 static void tcp_v6_hash(struct sock *sk)
  90 {
  91         if (sk->sk_state != TCP_CLOSE) {
  92                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  93                         tcp_prot.hash(sk);
  94                         return;
  95                 }
  96                 local_bh_disable();
  97                 __inet6_hash(sk);
  98                 local_bh_enable();
  99         }
 100 }
 101
 102 static __inline__ __sum16 tcp_v6_check(struct tcphdr *th, int len,
 103                                    struct in6_addr *saddr,
 104                                    struct in6_addr *daddr,
 105                                    __wsum base)
 106 {
 107         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 108 }
 109
 110 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 111 {
 112         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 113                                             ipv6_hdr(skb)->saddr.s6_addr32,
 114                                             tcp_hdr(skb)->dest,
 115                                             tcp_hdr(skb)->source);
 116 }
 117
 118 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 119                           int addr_len)
 120 {
 121         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 122         struct inet_sock *inet = inet_sk(sk);
 123         struct inet_connection_sock *icsk = inet_csk(sk);
 124         struct ipv6_pinfo *np = inet6_sk(sk);
 125         struct tcp_sock *tp = tcp_sk(sk);
 126         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 127         struct flowi fl;
 128         struct dst_entry *dst;
 129         int addr_type;
 130         int err;
 131
 132         if (addr_len < SIN6_LEN_RFC2133)
 133                 return -EINVAL;
 134
 135         if (usin->sin6_family != AF_INET6)
 136                 return(-EAFNOSUPPORT);
 137
 138         memset(&fl, 0, sizeof(fl));
 139
 140         if (np->sndflow) {
 141                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 142                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 143                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 144                         struct ip6_flowlabel *flowlabel;
 145                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 146                         if (flowlabel == NULL)
 147                                 return -EINVAL;
 148                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 149                         fl6_sock_release(flowlabel);
 150                 }
 151         }
 152
 153         /*
 154          *      connect() to INADDR_ANY means loopback (BSD'ism).
 155          */
 156
 157         if(ipv6_addr_any(&usin->sin6_addr))
 158                 usin->sin6_addr.s6_addr[15] = 0x1;
 159
 160         addr_type = ipv6_addr_type(&usin->sin6_addr);
 161
 162         if(addr_type & IPV6_ADDR_MULTICAST)
 163                 return -ENETUNREACH;
 164
 165         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 166                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 167                     usin->sin6_scope_id) {
 168                         /* If interface is set while binding, indices
 169                          * must coincide.
 170                          */
 171                         if (sk->sk_bound_dev_if &&
 172                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 173                                 return -EINVAL;
 174
 175                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 176                 }
 177
 178                 /* Connect to link-local address requires an interface */
 179                 if (!sk->sk_bound_dev_if)
 180                         return -EINVAL;
 181         }
 182
 183         if (tp->rx_opt.ts_recent_stamp &&
 184             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 185                 tp->rx_opt.ts_recent = 0;
 186                 tp->rx_opt.ts_recent_stamp = 0;
 187                 tp->write_seq = 0;
 188         }
 189
 190         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 191         np->flow_label = fl.fl6_flowlabel;
 192
 193         /*
 194          *      TCP over IPv4
 195          */
 196
 197         if (addr_type == IPV6_ADDR_MAPPED) {
 198                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 199                 struct sockaddr_in sin;
 200
 201                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 202
 203                 if (__ipv6_only_sock(sk))
 204                         return -ENETUNREACH;
 205
 206                 sin.sin_family = AF_INET;
 207                 sin.sin_port = usin->sin6_port;
 208                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 209
 210                 icsk->icsk_af_ops = &ipv6_mapped;
 211                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 212 #ifdef CONFIG_TCP_MD5SIG
 213                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 214 #endif
 215
 216                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 217
 218                 if (err) {
 219                         icsk->icsk_ext_hdr_len = exthdrlen;
 220                         icsk->icsk_af_ops = &ipv6_specific;
 221                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                         tp->af_specific = &tcp_sock_ipv6_specific;
 224 #endif
 225                         goto failure;
 226                 } else {
 227                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 228                                       inet->saddr);
 229                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 230                                       inet->rcv_saddr);
 231                 }
 232
 233                 return err;
 234         }
 235
 236         if (!ipv6_addr_any(&np->rcv_saddr))
 237                 saddr = &np->rcv_saddr;
 238
 239         fl.proto = IPPROTO_TCP;
 240         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 241         ipv6_addr_copy(&fl.fl6_src,
 242                        (saddr ? saddr : &np->saddr));
 243         fl.oif = sk->sk_bound_dev_if;
 244         fl.fl_ip_dport = usin->sin6_port;
 245         fl.fl_ip_sport = inet->sport;
 246
 247         if (np->opt && np->opt->srcrt) {
 248                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 249                 ipv6_addr_copy(&final, &fl.fl6_dst);
 250                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 251                 final_p = &final;
 252         }
 253
 254         security_sk_classify_flow(sk, &fl);
 255
 256         err = ip6_dst_lookup(sk, &dst, &fl);
 257         if (err)
 258                 goto failure;
 259         if (final_p)
 260                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 261
 262         if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
 263                 if (err == -EREMOTE)
 264                         err = ip6_dst_blackhole(sk, &dst, &fl);
 265                 if (err < 0)
 266                         goto failure;
 267         }
 268
 269         if (saddr == NULL) {
 270                 saddr = &fl.fl6_src;
 271                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 272         }
 273
 274         /* set the source address */
 275         ipv6_addr_copy(&np->saddr, saddr);
 276         inet->rcv_saddr = LOOPBACK4_IPV6;
 277
 278         sk->sk_gso_type = SKB_GSO_TCPV6;
 279         __ip6_dst_store(sk, dst, NULL, NULL);
 280
 281         icsk->icsk_ext_hdr_len = 0;
 282         if (np->opt)
 283                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 284                                           np->opt->opt_nflen);
 285
 286         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 287
 288         inet->dport = usin->sin6_port;
 289
 290         tcp_set_state(sk, TCP_SYN_SENT);
 291         err = inet6_hash_connect(&tcp_death_row, sk);
 292         if (err)
 293                 goto late_failure;
 294
 295         if (!tp->write_seq)
 296                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 297                                                              np->daddr.s6_addr32,
 298                                                              inet->sport,
 299                                                              inet->dport);
 300
 301         err = tcp_connect(sk);
 302         if (err)
 303                 goto late_failure;
 304
 305         return 0;
 306
 307 late_failure:
 308         tcp_set_state(sk, TCP_CLOSE);
 309         __sk_dst_reset(sk);
 310 failure:
 311         inet->dport = 0;
 312         sk->sk_route_caps = 0;
 313         return err;
 314 }
 315
 316 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 317                 int type, int code, int offset, __be32 info)
 318 {
 319         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 320         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 321         struct ipv6_pinfo *np;
 322         struct sock *sk;
 323         int err;
 324         struct tcp_sock *tp;
 325         __u32 seq;
 326
 327         sk = inet6_lookup(skb->dev->nd_net, &tcp_hashinfo, &hdr->daddr,
 328                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 329
 330         if (sk == NULL) {
 331                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 332                 return;
 333         }
 334
 335         if (sk->sk_state == TCP_TIME_WAIT) {
 336                 inet_twsk_put(inet_twsk(sk));
 337                 return;
 338         }
 339
 340         bh_lock_sock(sk);
 341         if (sock_owned_by_user(sk))
 342                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 343
 344         if (sk->sk_state == TCP_CLOSE)
 345                 goto out;
 346
 347         tp = tcp_sk(sk);
 348         seq = ntohl(th->seq);
 349         if (sk->sk_state != TCP_LISTEN &&
 350             !between(seq, tp->snd_una, tp->snd_nxt)) {
 351                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 352                 goto out;
 353         }
 354
 355         np = inet6_sk(sk);
 356
 357         if (type == ICMPV6_PKT_TOOBIG) {
 358                 struct dst_entry *dst = NULL;
 359
 360                 if (sock_owned_by_user(sk))
 361                         goto out;
 362                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 363                         goto out;
 364
 365                 /* icmp should have updated the destination cache entry */
 366                 dst = __sk_dst_check(sk, np->dst_cookie);
 367
 368                 if (dst == NULL) {
 369                         struct inet_sock *inet = inet_sk(sk);
 370                         struct flowi fl;
 371
 372                         /* BUGGG_FUTURE: Again, it is not clear how
 373                            to handle rthdr case. Ignore this complexity
 374                            for now.
 375                          */
 376                         memset(&fl, 0, sizeof(fl));
 377                         fl.proto = IPPROTO_TCP;
 378                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 379                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 380                         fl.oif = sk->sk_bound_dev_if;
 381                         fl.fl_ip_dport = inet->dport;
 382                         fl.fl_ip_sport = inet->sport;
 383                         security_skb_classify_flow(skb, &fl);
 384
 385                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 386                                 sk->sk_err_soft = -err;
 387                                 goto out;
 388                         }
 389
 390                         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 391                                 sk->sk_err_soft = -err;
 392                                 goto out;
 393                         }
 394
 395                 } else
 396                         dst_hold(dst);
 397
 398                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 399                         tcp_sync_mss(sk, dst_mtu(dst));
 400                         tcp_simple_retransmit(sk);
 401                 } /* else let the usual retransmit timer handle it */
 402                 dst_release(dst);
 403                 goto out;
 404         }
 405
 406         icmpv6_err_convert(type, code, &err);
 407
 408         /* Might be for an request_sock */
 409         switch (sk->sk_state) {
 410                 struct request_sock *req, **prev;
 411         case TCP_LISTEN:
 412                 if (sock_owned_by_user(sk))
 413                         goto out;
 414
 415                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 416                                            &hdr->saddr, inet6_iif(skb));
 417                 if (!req)
 418                         goto out;
 419
 420                 /* ICMPs are not backlogged, hence we cannot get
 421                  * an established socket here.
 422                  */
 423                 BUG_TRAP(req->sk == NULL);
 424
 425                 if (seq != tcp_rsk(req)->snt_isn) {
 426                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 427                         goto out;
 428                 }
 429
 430                 inet_csk_reqsk_queue_drop(sk, req, prev);
 431                 goto out;
 432
 433         case TCP_SYN_SENT:
 434         case TCP_SYN_RECV:  /* Cannot happen.
 435                                It can, it SYNs are crossed. --ANK */
 436                 if (!sock_owned_by_user(sk)) {
 437                         sk->sk_err = err;
 438                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 439
 440                         tcp_done(sk);
 441                 } else
 442                         sk->sk_err_soft = err;
 443                 goto out;
 444         }
 445
 446         if (!sock_owned_by_user(sk) && np->recverr) {
 447                 sk->sk_err = err;
 448                 sk->sk_error_report(sk);
 449         } else
 450                 sk->sk_err_soft = err;
 451
 452 out:
 453         bh_unlock_sock(sk);
 454         sock_put(sk);
 455 }
 456
 457
 458 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
 459 {
 460         struct inet6_request_sock *treq = inet6_rsk(req);
 461         struct ipv6_pinfo *np = inet6_sk(sk);
 462         struct sk_buff * skb;
 463         struct ipv6_txoptions *opt = NULL;
 464         struct in6_addr * final_p = NULL, final;
 465         struct flowi fl;
 466         struct dst_entry *dst;
 467         int err = -1;
 468
 469         memset(&fl, 0, sizeof(fl));
 470         fl.proto = IPPROTO_TCP;
 471         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 472         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 473         fl.fl6_flowlabel = 0;
 474         fl.oif = treq->iif;
 475         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 476         fl.fl_ip_sport = inet_sk(sk)->sport;
 477         security_req_classify_flow(req, &fl);
 478
 479         opt = np->opt;
 480         if (opt && opt->srcrt) {
 481                 struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 482                 ipv6_addr_copy(&final, &fl.fl6_dst);
 483                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 484                 final_p = &final;
 485         }
 486
 487         err = ip6_dst_lookup(sk, &dst, &fl);
 488         if (err)
 489                 goto done;
 490         if (final_p)
 491                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 492         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 493                 goto done;
 494
 495         skb = tcp_make_synack(sk, dst, req);
 496         if (skb) {
 497                 struct tcphdr *th = tcp_hdr(skb);
 498
 499                 th->check = tcp_v6_check(th, skb->len,
 500                                          &treq->loc_addr, &treq->rmt_addr,
 501                                          csum_partial((char *)th, skb->len, skb->csum));
 502
 503                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 504                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 505                 err = net_xmit_eval(err);
 506         }
 507
 508 done:
 509         if (opt && opt != np->opt)
 510                 sock_kfree_s(sk, opt, opt->tot_len);
 511         dst_release(dst);
 512         return err;
 513 }
 514
 515 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 516 {
 517         if (inet6_rsk(req)->pktopts)
 518                 kfree_skb(inet6_rsk(req)->pktopts);
 519 }
 520
 521 #ifdef CONFIG_TCP_MD5SIG
 522 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 523                                                    struct in6_addr *addr)
 524 {
 525         struct tcp_sock *tp = tcp_sk(sk);
 526         int i;
 527
 528         BUG_ON(tp == NULL);
 529
 530         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 531                 return NULL;
 532
 533         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 534                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, addr) == 0)
 535                         return &tp->md5sig_info->keys6[i].base;
 536         }
 537         return NULL;
 538 }
 539
 540 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 541                                                 struct sock *addr_sk)
 542 {
 543         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 544 }
 545
 546 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 547                                                       struct request_sock *req)
 548 {
 549         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 550 }
 551
 552 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 553                              char *newkey, u8 newkeylen)
 554 {
 555         /* Add key to the list */
 556         struct tcp_md5sig_key *key;
 557         struct tcp_sock *tp = tcp_sk(sk);
 558         struct tcp6_md5sig_key *keys;
 559
 560         key = tcp_v6_md5_do_lookup(sk, peer);
 561         if (key) {
 562                 /* modify existing entry - just update that one */
 563                 kfree(key->key);
 564                 key->key = newkey;
 565                 key->keylen = newkeylen;
 566         } else {
 567                 /* reallocate new list if current one is full. */
 568                 if (!tp->md5sig_info) {
 569                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 570                         if (!tp->md5sig_info) {
 571                                 kfree(newkey);
 572                                 return -ENOMEM;
 573                         }
 574                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 575                 }
 576                 if (tcp_alloc_md5sig_pool() == NULL) {
 577                         kfree(newkey);
 578                         return -ENOMEM;
 579                 }
 580                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 581                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 582                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 583
 584                         if (!keys) {
 585                                 tcp_free_md5sig_pool();
 586                                 kfree(newkey);
 587                                 return -ENOMEM;
 588                         }
 589
 590                         if (tp->md5sig_info->entries6)
 591                                 memmove(keys, tp->md5sig_info->keys6,
 592                                         (sizeof (tp->md5sig_info->keys6[0]) *
 593                                          tp->md5sig_info->entries6));
 594
 595                         kfree(tp->md5sig_info->keys6);
 596                         tp->md5sig_info->keys6 = keys;
 597                         tp->md5sig_info->alloced6++;
 598                 }
 599
 600                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 601                                peer);
 602                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 603                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 604
 605                 tp->md5sig_info->entries6++;
 606         }
 607         return 0;
 608 }
 609
 610 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 611                                u8 *newkey, __u8 newkeylen)
 612 {
 613         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 614                                  newkey, newkeylen);
 615 }
 616
 617 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
 618 {
 619         struct tcp_sock *tp = tcp_sk(sk);
 620         int i;
 621
 622         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 623                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, peer) == 0) {
 624                         /* Free the key */
 625                         kfree(tp->md5sig_info->keys6[i].base.key);
 626                         tp->md5sig_info->entries6--;
 627
 628                         if (tp->md5sig_info->entries6 == 0) {
 629                                 kfree(tp->md5sig_info->keys6);
 630                                 tp->md5sig_info->keys6 = NULL;
 631                                 tp->md5sig_info->alloced6 = 0;
 632                         } else {
 633                                 /* shrink the database */
 634                                 if (tp->md5sig_info->entries6 != i)
 635                                         memmove(&tp->md5sig_info->keys6[i],
 636                                                 &tp->md5sig_info->keys6[i+1],
 637                                                 (tp->md5sig_info->entries6 - i)
 638                                                 * sizeof (tp->md5sig_info->keys6[0]));
 639                         }
 640                         tcp_free_md5sig_pool();
 641                         return 0;
 642                 }
 643         }
 644         return -ENOENT;
 645 }
 646
 647 static void tcp_v6_clear_md5_list (struct sock *sk)
 648 {
 649         struct tcp_sock *tp = tcp_sk(sk);
 650         int i;
 651
 652         if (tp->md5sig_info->entries6) {
 653                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 654                         kfree(tp->md5sig_info->keys6[i].base.key);
 655                 tp->md5sig_info->entries6 = 0;
 656                 tcp_free_md5sig_pool();
 657         }
 658
 659         kfree(tp->md5sig_info->keys6);
 660         tp->md5sig_info->keys6 = NULL;
 661         tp->md5sig_info->alloced6 = 0;
 662
 663         if (tp->md5sig_info->entries4) {
 664                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 665                         kfree(tp->md5sig_info->keys4[i].base.key);
 666                 tp->md5sig_info->entries4 = 0;
 667                 tcp_free_md5sig_pool();
 668         }
 669
 670         kfree(tp->md5sig_info->keys4);
 671         tp->md5sig_info->keys4 = NULL;
 672         tp->md5sig_info->alloced4 = 0;
 673 }
 674
 675 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 676                                   int optlen)
 677 {
 678         struct tcp_md5sig cmd;
 679         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 680         u8 *newkey;
 681
 682         if (optlen < sizeof(cmd))
 683                 return -EINVAL;
 684
 685         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 686                 return -EFAULT;
 687
 688         if (sin6->sin6_family != AF_INET6)
 689                 return -EINVAL;
 690
 691         if (!cmd.tcpm_keylen) {
 692                 if (!tcp_sk(sk)->md5sig_info)
 693                         return -ENOENT;
 694                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 695                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 696                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 697         }
 698
 699         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 700                 return -EINVAL;
 701
 702         if (!tcp_sk(sk)->md5sig_info) {
 703                 struct tcp_sock *tp = tcp_sk(sk);
 704                 struct tcp_md5sig_info *p;
 705
 706                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 707                 if (!p)
 708                         return -ENOMEM;
 709
 710                 tp->md5sig_info = p;
 711                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 712         }
 713
 714         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 715         if (!newkey)
 716                 return -ENOMEM;
 717         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 718                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 719                                          newkey, cmd.tcpm_keylen);
 720         }
 721         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 722 }
 723
 724 static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 725                                    struct in6_addr *saddr,
 726                                    struct in6_addr *daddr,
 727                                    struct tcphdr *th, int protocol,
 728                                    unsigned int tcplen)
 729 {
 730         struct scatterlist sg[4];
 731         __u16 data_len;
 732         int block = 0;
 733         __sum16 cksum;
 734         struct tcp_md5sig_pool *hp;
 735         struct tcp6_pseudohdr *bp;
 736         struct hash_desc *desc;
 737         int err;
 738         unsigned int nbytes = 0;
 739
 740         hp = tcp_get_md5sig_pool();
 741         if (!hp) {
 742                 printk(KERN_WARNING "%s(): hash pool not found...\n", __FUNCTION__);
 743                 goto clear_hash_noput;
 744         }
 745         bp = &hp->md5_blk.ip6;
 746         desc = &hp->md5_desc;
 747
 748         /* 1. TCP pseudo-header (RFC2460) */
 749         ipv6_addr_copy(&bp->saddr, saddr);
 750         ipv6_addr_copy(&bp->daddr, daddr);
 751         bp->len = htonl(tcplen);
 752         bp->protocol = htonl(protocol);
 753
 754         sg_init_table(sg, 4);
 755
 756         sg_set_buf(&sg[block++], bp, sizeof(*bp));
 757         nbytes += sizeof(*bp);
 758
 759         /* 2. TCP header, excluding options */
 760         cksum = th->check;
 761         th->check = 0;
 762         sg_set_buf(&sg[block++], th, sizeof(*th));
 763         nbytes += sizeof(*th);
 764
 765         /* 3. TCP segment data (if any) */
 766         data_len = tcplen - (th->doff << 2);
 767         if (data_len > 0) {
 768                 u8 *data = (u8 *)th + (th->doff << 2);
 769                 sg_set_buf(&sg[block++], data, data_len);
 770                 nbytes += data_len;
 771         }
 772
 773         /* 4. shared key */
 774         sg_set_buf(&sg[block++], key->key, key->keylen);
 775         nbytes += key->keylen;
 776
 777         sg_mark_end(&sg[block - 1]);
 778
 779         /* Now store the hash into the packet */
 780         err = crypto_hash_init(desc);
 781         if (err) {
 782                 printk(KERN_WARNING "%s(): hash_init failed\n", __FUNCTION__);
 783                 goto clear_hash;
 784         }
 785         err = crypto_hash_update(desc, sg, nbytes);
 786         if (err) {
 787                 printk(KERN_WARNING "%s(): hash_update failed\n", __FUNCTION__);
 788                 goto clear_hash;
 789         }
 790         err = crypto_hash_final(desc, md5_hash);
 791         if (err) {
 792                 printk(KERN_WARNING "%s(): hash_final failed\n", __FUNCTION__);
 793                 goto clear_hash;
 794         }
 795
 796         /* Reset header, and free up the crypto */
 797         tcp_put_md5sig_pool();
 798         th->check = cksum;
 799 out:
 800         return 0;
 801 clear_hash:
 802         tcp_put_md5sig_pool();
 803 clear_hash_noput:
 804         memset(md5_hash, 0, 16);
 805         goto out;
 806 }
 807
 808 static int tcp_v6_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 809                                 struct sock *sk,
 810                                 struct dst_entry *dst,
 811                                 struct request_sock *req,
 812                                 struct tcphdr *th, int protocol,
 813                                 unsigned int tcplen)
 814 {
 815         struct in6_addr *saddr, *daddr;
 816
 817         if (sk) {
 818                 saddr = &inet6_sk(sk)->saddr;
 819                 daddr = &inet6_sk(sk)->daddr;
 820         } else {
 821                 saddr = &inet6_rsk(req)->loc_addr;
 822                 daddr = &inet6_rsk(req)->rmt_addr;
 823         }
 824         return tcp_v6_do_calc_md5_hash(md5_hash, key,
 825                                        saddr, daddr,
 826                                        th, protocol, tcplen);
 827 }
 828
 829 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 830 {
 831         __u8 *hash_location = NULL;
 832         struct tcp_md5sig_key *hash_expected;
 833         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 834         struct tcphdr *th = tcp_hdr(skb);
 835         int length = (th->doff << 2) - sizeof (*th);
 836         int genhash;
 837         u8 *ptr;
 838         u8 newhash[16];
 839
 840         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 841
 842         /* If the TCP option is too short, we can short cut */
 843         if (length < TCPOLEN_MD5SIG)
 844                 return hash_expected ? 1 : 0;
 845
 846         /* parse options */
 847         ptr = (u8*)(th + 1);
 848         while (length > 0) {
 849                 int opcode = *ptr++;
 850                 int opsize;
 851
 852                 switch(opcode) {
 853                 case TCPOPT_EOL:
 854                         goto done_opts;
 855                 case TCPOPT_NOP:
 856                         length--;
 857                         continue;
 858                 default:
 859                         opsize = *ptr++;
 860                         if (opsize < 2 || opsize > length)
 861                                 goto done_opts;
 862                         if (opcode == TCPOPT_MD5SIG) {
 863                                 hash_location = ptr;
 864                                 goto done_opts;
 865                         }
 866                 }
 867                 ptr += opsize - 2;
 868                 length -= opsize;
 869         }
 870
 871 done_opts:
 872         /* do we have a hash as expected? */
 873         if (!hash_expected) {
 874                 if (!hash_location)
 875                         return 0;
 876                 if (net_ratelimit()) {
 877                         printk(KERN_INFO "MD5 Hash NOT expected but found "
 878                                "(" NIP6_FMT ", %u)->"
 879                                "(" NIP6_FMT ", %u)\n",
 880                                NIP6(ip6h->saddr), ntohs(th->source),
 881                                NIP6(ip6h->daddr), ntohs(th->dest));
 882                 }
 883                 return 1;
 884         }
 885
 886         if (!hash_location) {
 887                 if (net_ratelimit()) {
 888                         printk(KERN_INFO "MD5 Hash expected but NOT found "
 889                                "(" NIP6_FMT ", %u)->"
 890                                "(" NIP6_FMT ", %u)\n",
 891                                NIP6(ip6h->saddr), ntohs(th->source),
 892                                NIP6(ip6h->daddr), ntohs(th->dest));
 893                 }
 894                 return 1;
 895         }
 896
 897         /* check the signature */
 898         genhash = tcp_v6_do_calc_md5_hash(newhash,
 899                                           hash_expected,
 900                                           &ip6h->saddr, &ip6h->daddr,
 901                                           th, sk->sk_protocol,
 902                                           skb->len);
 903         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 904                 if (net_ratelimit()) {
 905                         printk(KERN_INFO "MD5 Hash %s for "
 906                                "(" NIP6_FMT ", %u)->"
 907                                "(" NIP6_FMT ", %u)\n",
 908                                genhash ? "failed" : "mismatch",
 909                                NIP6(ip6h->saddr), ntohs(th->source),
 910                                NIP6(ip6h->daddr), ntohs(th->dest));
 911                 }
 912                 return 1;
 913         }
 914         return 0;
 915 }
 916 #endif
 917
 918 static struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 919         .family         =       AF_INET6,
 920         .obj_size       =       sizeof(struct tcp6_request_sock),
 921         .rtx_syn_ack    =       tcp_v6_send_synack,
 922         .send_ack       =       tcp_v6_reqsk_send_ack,
 923         .destructor     =       tcp_v6_reqsk_destructor,
 924         .send_reset     =       tcp_v6_send_reset
 925 };
 926
 927 #ifdef CONFIG_TCP_MD5SIG
 928 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 929         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 930 };
 931 #endif
 932
 933 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 934         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 935         .twsk_unique    = tcp_twsk_unique,
 936         .twsk_destructor= tcp_twsk_destructor,
 937 };
 938
 939 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 940 {
 941         struct ipv6_pinfo *np = inet6_sk(sk);
 942         struct tcphdr *th = tcp_hdr(skb);
 943
 944         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 945                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 946                 skb->csum_start = skb_transport_header(skb) - skb->head;
 947                 skb->csum_offset = offsetof(struct tcphdr, check);
 948         } else {
 949                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 950                                             csum_partial((char *)th, th->doff<<2,
 951                                                          skb->csum));
 952         }
 953 }
 954
 955 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 956 {
 957         struct ipv6hdr *ipv6h;
 958         struct tcphdr *th;
 959
 960         if (!pskb_may_pull(skb, sizeof(*th)))
 961                 return -EINVAL;
 962
 963         ipv6h = ipv6_hdr(skb);
 964         th = tcp_hdr(skb);
 965
 966         th->check = 0;
 967         th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
 968                                      IPPROTO_TCP, 0);
 969         skb->csum_start = skb_transport_header(skb) - skb->head;
 970         skb->csum_offset = offsetof(struct tcphdr, check);
 971         skb->ip_summed = CHECKSUM_PARTIAL;
 972         return 0;
 973 }
 974
 975 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 976 {
 977         struct tcphdr *th = tcp_hdr(skb), *t1;
 978         struct sk_buff *buff;
 979         struct flowi fl;
 980         unsigned int tot_len = sizeof(*th);
 981 #ifdef CONFIG_TCP_MD5SIG
 982         struct tcp_md5sig_key *key;
 983 #endif
 984
 985         if (th->rst)
 986                 return;
 987
 988         if (!ipv6_unicast_destination(skb))
 989                 return;
 990
 991 #ifdef CONFIG_TCP_MD5SIG
 992         if (sk)
 993                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
 994         else
 995                 key = NULL;
 996
 997         if (key)
 998                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 999 #endif
1000
1001         /*
1002          * We need to grab some memory, and put together an RST,
1003          * and then put it into the queue to be sent.
1004          */
1005
1006         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1007                          GFP_ATOMIC);
1008         if (buff == NULL)
1009                 return;
1010
1011         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1012
1013         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1014
1015         /* Swap the send and the receive. */
1016         memset(t1, 0, sizeof(*t1));
1017         t1->dest = th->source;
1018         t1->source = th->dest;
1019         t1->doff = tot_len / 4;
1020         t1->rst = 1;
1021
1022         if(th->ack) {
1023                 t1->seq = th->ack_seq;
1024         } else {
1025                 t1->ack = 1;
1026                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
1027                                     + skb->len - (th->doff<<2));
1028         }
1029
1030 #ifdef CONFIG_TCP_MD5SIG
1031         if (key) {
1032                 __be32 *opt = (__be32*)(t1 + 1);
1033                 opt[0] = htonl((TCPOPT_NOP << 24) |
1034                                (TCPOPT_NOP << 16) |
1035                                (TCPOPT_MD5SIG << 8) |
1036                                TCPOLEN_MD5SIG);
1037                 tcp_v6_do_calc_md5_hash((__u8 *)&opt[1], key,
1038                                         &ipv6_hdr(skb)->daddr,
1039                                         &ipv6_hdr(skb)->saddr,
1040                                         t1, IPPROTO_TCP, tot_len);
1041         }
1042 #endif
1043
1044         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
1045
1046         memset(&fl, 0, sizeof(fl));
1047         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1048         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1049
1050         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1051                                     sizeof(*t1), IPPROTO_TCP,
1052                                     buff->csum);
1053
1054         fl.proto = IPPROTO_TCP;
1055         fl.oif = inet6_iif(skb);
1056         fl.fl_ip_dport = t1->dest;
1057         fl.fl_ip_sport = t1->source;
1058         security_skb_classify_flow(skb, &fl);
1059
1060         /* sk = NULL, but it is safe for now. RST socket required. */
1061         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1062
1063                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1064                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1065                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1066                         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
1067                         return;
1068                 }
1069         }
1070
1071         kfree_skb(buff);
1072 }
1073
1074 static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
1075                             struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
1076 {
1077         struct tcphdr *th = tcp_hdr(skb), *t1;
1078         struct sk_buff *buff;
1079         struct flowi fl;
1080         unsigned int tot_len = sizeof(struct tcphdr);
1081         __be32 *topt;
1082 #ifdef CONFIG_TCP_MD5SIG
1083         struct tcp_md5sig_key *key;
1084         struct tcp_md5sig_key tw_key;
1085 #endif
1086
1087 #ifdef CONFIG_TCP_MD5SIG
1088         if (!tw && skb->sk) {
1089                 key = tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr);
1090         } else if (tw && tw->tw_md5_keylen) {
1091                 tw_key.key = tw->tw_md5_key;
1092                 tw_key.keylen = tw->tw_md5_keylen;
1093                 key = &tw_key;
1094         } else {
1095                 key = NULL;
1096         }
1097 #endif
1098
1099         if (ts)
1100                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
1101 #ifdef CONFIG_TCP_MD5SIG
1102         if (key)
1103                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1104 #endif
1105
1106         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1107                          GFP_ATOMIC);
1108         if (buff == NULL)
1109                 return;
1110
1111         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1112
1113         t1 = (struct tcphdr *) skb_push(buff,tot_len);
1114
1115         /* Swap the send and the receive. */
1116         memset(t1, 0, sizeof(*t1));
1117         t1->dest = th->source;
1118         t1->source = th->dest;
1119         t1->doff = tot_len/4;
1120         t1->seq = htonl(seq);
1121         t1->ack_seq = htonl(ack);
1122         t1->ack = 1;
1123         t1->window = htons(win);
1124
1125         topt = (__be32 *)(t1 + 1);
1126
1127         if (ts) {
1128                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1129                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1130                 *topt++ = htonl(tcp_time_stamp);
1131                 *topt = htonl(ts);
1132         }
1133
1134 #ifdef CONFIG_TCP_MD5SIG
1135         if (key) {
1136                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1137                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1138                 tcp_v6_do_calc_md5_hash((__u8 *)topt, key,
1139                                         &ipv6_hdr(skb)->daddr,
1140                                         &ipv6_hdr(skb)->saddr,
1141                                         t1, IPPROTO_TCP, tot_len);
1142         }
1143 #endif
1144
1145         buff->csum = csum_partial((char *)t1, tot_len, 0);
1146
1147         memset(&fl, 0, sizeof(fl));
1148         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1149         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1150
1151         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1152                                     tot_len, IPPROTO_TCP,
1153                                     buff->csum);
1154
1155         fl.proto = IPPROTO_TCP;
1156         fl.oif = inet6_iif(skb);
1157         fl.fl_ip_dport = t1->dest;
1158         fl.fl_ip_sport = t1->source;
1159         security_skb_classify_flow(skb, &fl);
1160
1161         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1162                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1163                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1164                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1165                         return;
1166                 }
1167         }
1168
1169         kfree_skb(buff);
1170 }
1171
1172 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1173 {
1174         struct inet_timewait_sock *tw = inet_twsk(sk);
1175         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1176
1177         tcp_v6_send_ack(tcptw, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1178                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1179                         tcptw->tw_ts_recent);
1180
1181         inet_twsk_put(tw);
1182 }
1183
1184 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
1185 {
1186         tcp_v6_send_ack(NULL, skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
1187 }
1188
1189
1190 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1191 {
1192         struct request_sock *req, **prev;
1193         const struct tcphdr *th = tcp_hdr(skb);
1194         struct sock *nsk;
1195
1196         /* Find possible connection requests. */
1197         req = inet6_csk_search_req(sk, &prev, th->source,
1198                                    &ipv6_hdr(skb)->saddr,
1199                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1200         if (req)
1201                 return tcp_check_req(sk, skb, req, prev);
1202
1203         nsk = __inet6_lookup_established(sk->sk_net, &tcp_hashinfo,
1204                         &ipv6_hdr(skb)->saddr, th->source,
1205                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1206
1207         if (nsk) {
1208                 if (nsk->sk_state != TCP_TIME_WAIT) {
1209                         bh_lock_sock(nsk);
1210                         return nsk;
1211                 }
1212                 inet_twsk_put(inet_twsk(nsk));
1213                 return NULL;
1214         }
1215
1216 #if 0 /*def CONFIG_SYN_COOKIES*/
1217         if (!th->rst && !th->syn && th->ack)
1218                 sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
1219 #endif
1220         return sk;
1221 }
1222
1223 /* FIXME: this is substantially similar to the ipv4 code.
1224  * Can some kind of merge be done? -- erics
1225  */
1226 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1227 {
1228         struct inet6_request_sock *treq;
1229         struct ipv6_pinfo *np = inet6_sk(sk);
1230         struct tcp_options_received tmp_opt;
1231         struct tcp_sock *tp = tcp_sk(sk);
1232         struct request_sock *req = NULL;
1233         __u32 isn = TCP_SKB_CB(skb)->when;
1234
1235         if (skb->protocol == htons(ETH_P_IP))
1236                 return tcp_v4_conn_request(sk, skb);
1237
1238         if (!ipv6_unicast_destination(skb))
1239                 goto drop;
1240
1241         /*
1242          *      There are no SYN attacks on IPv6, yet...
1243          */
1244         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1245                 if (net_ratelimit())
1246                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
1247                 goto drop;
1248         }
1249
1250         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1251                 goto drop;
1252
1253         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1254         if (req == NULL)
1255                 goto drop;
1256
1257 #ifdef CONFIG_TCP_MD5SIG
1258         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1259 #endif
1260
1261         tcp_clear_options(&tmp_opt);
1262         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1263         tmp_opt.user_mss = tp->rx_opt.user_mss;
1264
1265         tcp_parse_options(skb, &tmp_opt, 0);
1266
1267         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1268         tcp_openreq_init(req, &tmp_opt, skb);
1269
1270         treq = inet6_rsk(req);
1271         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1272         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1273         TCP_ECN_create_request(req, tcp_hdr(skb));
1274         treq->pktopts = NULL;
1275         if (ipv6_opt_accepted(sk, skb) ||
1276             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1277             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1278                 atomic_inc(&skb->users);
1279                 treq->pktopts = skb;
1280         }
1281         treq->iif = sk->sk_bound_dev_if;
1282
1283         /* So that link locals have meaning */
1284         if (!sk->sk_bound_dev_if &&
1285             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1286                 treq->iif = inet6_iif(skb);
1287
1288         if (isn == 0)
1289                 isn = tcp_v6_init_sequence(skb);
1290
1291         tcp_rsk(req)->snt_isn = isn;
1292
1293         security_inet_conn_request(sk, skb, req);
1294
1295         if (tcp_v6_send_synack(sk, req))
1296                 goto drop;
1297
1298         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1299         return 0;
1300
1301 drop:
1302         if (req)
1303                 reqsk_free(req);
1304
1305         return 0; /* don't send reset */
1306 }
1307
1308 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1309                                           struct request_sock *req,
1310                                           struct dst_entry *dst)
1311 {
1312         struct inet6_request_sock *treq = inet6_rsk(req);
1313         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1314         struct tcp6_sock *newtcp6sk;
1315         struct inet_sock *newinet;
1316         struct tcp_sock *newtp;
1317         struct sock *newsk;
1318         struct ipv6_txoptions *opt;
1319 #ifdef CONFIG_TCP_MD5SIG
1320         struct tcp_md5sig_key *key;
1321 #endif
1322
1323         if (skb->protocol == htons(ETH_P_IP)) {
1324                 /*
1325                  *      v6 mapped
1326                  */
1327
1328                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1329
1330                 if (newsk == NULL)
1331                         return NULL;
1332
1333                 newtcp6sk = (struct tcp6_sock *)newsk;
1334                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1335
1336                 newinet = inet_sk(newsk);
1337                 newnp = inet6_sk(newsk);
1338                 newtp = tcp_sk(newsk);
1339
1340                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1341
1342                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
1343                               newinet->daddr);
1344
1345                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
1346                               newinet->saddr);
1347
1348                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1349
1350                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1351                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1352 #ifdef CONFIG_TCP_MD5SIG
1353                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1354 #endif
1355
1356                 newnp->pktoptions  = NULL;
1357                 newnp->opt         = NULL;
1358                 newnp->mcast_oif   = inet6_iif(skb);
1359                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1360
1361                 /*
1362                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1363                  * here, tcp_create_openreq_child now does this for us, see the comment in
1364                  * that function for the gory details. -acme
1365                  */
1366
1367                 /* It is tricky place. Until this moment IPv4 tcp
1368                    worked with IPv6 icsk.icsk_af_ops.
1369                    Sync it now.
1370                  */
1371                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1372
1373                 return newsk;
1374         }
1375
1376         opt = np->opt;
1377
1378         if (sk_acceptq_is_full(sk))
1379                 goto out_overflow;
1380
1381         if (dst == NULL) {
1382                 struct in6_addr *final_p = NULL, final;
1383                 struct flowi fl;
1384
1385                 memset(&fl, 0, sizeof(fl));
1386                 fl.proto = IPPROTO_TCP;
1387                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
1388                 if (opt && opt->srcrt) {
1389                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
1390                         ipv6_addr_copy(&final, &fl.fl6_dst);
1391                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1392                         final_p = &final;
1393                 }
1394                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
1395                 fl.oif = sk->sk_bound_dev_if;
1396                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
1397                 fl.fl_ip_sport = inet_sk(sk)->sport;
1398                 security_req_classify_flow(req, &fl);
1399
1400                 if (ip6_dst_lookup(sk, &dst, &fl))
1401                         goto out;
1402
1403                 if (final_p)
1404                         ipv6_addr_copy(&fl.fl6_dst, final_p);
1405
1406                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
1407                         goto out;
1408         }
1409
1410         newsk = tcp_create_openreq_child(sk, req, skb);
1411         if (newsk == NULL)
1412                 goto out;
1413
1414         /*
1415          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1416          * count here, tcp_create_openreq_child now does this for us, see the
1417          * comment in that function for the gory details. -acme
1418          */
1419
1420         newsk->sk_gso_type = SKB_GSO_TCPV6;
1421         __ip6_dst_store(newsk, dst, NULL, NULL);
1422
1423         newtcp6sk = (struct tcp6_sock *)newsk;
1424         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1425
1426         newtp = tcp_sk(newsk);
1427         newinet = inet_sk(newsk);
1428         newnp = inet6_sk(newsk);
1429
1430         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1431
1432         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1433         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1434         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1435         newsk->sk_bound_dev_if = treq->iif;
1436
1437         /* Now IPv6 options...
1438
1439            First: no IPv4 options.
1440          */
1441         newinet->opt = NULL;
1442         newnp->ipv6_fl_list = NULL;
1443
1444         /* Clone RX bits */
1445         newnp->rxopt.all = np->rxopt.all;
1446
1447         /* Clone pktoptions received with SYN */
1448         newnp->pktoptions = NULL;
1449         if (treq->pktopts != NULL) {
1450                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1451                 kfree_skb(treq->pktopts);
1452                 treq->pktopts = NULL;
1453                 if (newnp->pktoptions)
1454                         skb_set_owner_r(newnp->pktoptions, newsk);
1455         }
1456         newnp->opt        = NULL;
1457         newnp->mcast_oif  = inet6_iif(skb);
1458         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1459
1460         /* Clone native IPv6 options from listening socket (if any)
1461
1462            Yes, keeping reference count would be much more clever,
1463            but we make one more one thing there: reattach optmem
1464            to newsk.
1465          */
1466         if (opt) {
1467                 newnp->opt = ipv6_dup_options(newsk, opt);
1468                 if (opt != np->opt)
1469                         sock_kfree_s(sk, opt, opt->tot_len);
1470         }
1471
1472         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1473         if (newnp->opt)
1474                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1475                                                      newnp->opt->opt_flen);
1476
1477         tcp_mtup_init(newsk);
1478         tcp_sync_mss(newsk, dst_mtu(dst));
1479         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
1480         tcp_initialize_rcv_mss(newsk);
1481
1482         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
1483
1484 #ifdef CONFIG_TCP_MD5SIG
1485         /* Copy over the MD5 key from the original socket */
1486         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1487                 /* We're using one, so create a matching key
1488                  * on the newsk structure. If we fail to get
1489                  * memory, then we end up not copying the key
1490                  * across. Shucks.
1491                  */
1492                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1493                 if (newkey != NULL)
1494                         tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
1495                                           newkey, key->keylen);
1496         }
1497 #endif
1498
1499         __inet6_hash(newsk);
1500         inet_inherit_port(sk, newsk);
1501
1502         return newsk;
1503
1504 out_overflow:
1505         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
1506 out:
1507         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
1508         if (opt && opt != np->opt)
1509                 sock_kfree_s(sk, opt, opt->tot_len);
1510         dst_release(dst);
1511         return NULL;
1512 }
1513
1514 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1515 {
1516         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1517                 if (!tcp_v6_check(tcp_hdr(skb), skb->len, &ipv6_hdr(skb)->saddr,
1518                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1519                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1520                         return 0;
1521                 }
1522         }
1523
1524         skb->csum = ~csum_unfold(tcp_v6_check(tcp_hdr(skb), skb->len,
1525                                               &ipv6_hdr(skb)->saddr,
1526                                               &ipv6_hdr(skb)->daddr, 0));
1527
1528         if (skb->len <= 76) {
1529                 return __skb_checksum_complete(skb);
1530         }
1531         return 0;
1532 }
1533
1534 /* The socket must have it's spinlock held when we get
1535  * here.
1536  *
1537  * We have a potential double-lock case here, so even when
1538  * doing backlog processing we use the BH locking scheme.
1539  * This is because we cannot sleep with the original spinlock
1540  * held.
1541  */
1542 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1543 {
1544         struct ipv6_pinfo *np = inet6_sk(sk);
1545         struct tcp_sock *tp;
1546         struct sk_buff *opt_skb = NULL;
1547
1548         /* Imagine: socket is IPv6. IPv4 packet arrives,
1549            goes to IPv4 receive handler and backlogged.
1550            From backlog it always goes here. Kerboom...
1551            Fortunately, tcp_rcv_established and rcv_established
1552            handle them correctly, but it is not case with
1553            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1554          */
1555
1556         if (skb->protocol == htons(ETH_P_IP))
1557                 return tcp_v4_do_rcv(sk, skb);
1558
1559 #ifdef CONFIG_TCP_MD5SIG
1560         if (tcp_v6_inbound_md5_hash (sk, skb))
1561                 goto discard;
1562 #endif
1563
1564         if (sk_filter(sk, skb))
1565                 goto discard;
1566
1567         /*
1568          *      socket locking is here for SMP purposes as backlog rcv
1569          *      is currently called with bh processing disabled.
1570          */
1571
1572         /* Do Stevens' IPV6_PKTOPTIONS.
1573
1574            Yes, guys, it is the only place in our code, where we
1575            may make it not affecting IPv4.
1576            The rest of code is protocol independent,
1577            and I do not like idea to uglify IPv4.
1578
1579            Actually, all the idea behind IPV6_PKTOPTIONS
1580            looks not very well thought. For now we latch
1581            options, received in the last packet, enqueued
1582            by tcp. Feel free to propose better solution.
1583                                                --ANK (980728)
1584          */
1585         if (np->rxopt.all)
1586                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1587
1588         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1589                 TCP_CHECK_TIMER(sk);
1590                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1591                         goto reset;
1592                 TCP_CHECK_TIMER(sk);
1593                 if (opt_skb)
1594                         goto ipv6_pktoptions;
1595                 return 0;
1596         }
1597
1598         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1599                 goto csum_err;
1600
1601         if (sk->sk_state == TCP_LISTEN) {
1602                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1603                 if (!nsk)
1604                         goto discard;
1605
1606                 /*
1607                  * Queue it on the new socket if the new socket is active,
1608                  * otherwise we just shortcircuit this and continue with
1609                  * the new socket..
1610                  */
1611                 if(nsk != sk) {
1612                         if (tcp_child_process(sk, nsk, skb))
1613                                 goto reset;
1614                         if (opt_skb)
1615                                 __kfree_skb(opt_skb);
1616                         return 0;
1617                 }
1618         }
1619
1620         TCP_CHECK_TIMER(sk);
1621         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1622                 goto reset;
1623         TCP_CHECK_TIMER(sk);
1624         if (opt_skb)
1625                 goto ipv6_pktoptions;
1626         return 0;
1627
1628 reset:
1629         tcp_v6_send_reset(sk, skb);
1630 discard:
1631         if (opt_skb)
1632                 __kfree_skb(opt_skb);
1633         kfree_skb(skb);
1634         return 0;
1635 csum_err:
1636         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1637         goto discard;
1638
1639
1640 ipv6_pktoptions:
1641         /* Do you ask, what is it?
1642
1643            1. skb was enqueued by tcp.
1644            2. skb is added to tail of read queue, rather than out of order.
1645            3. socket is not in passive state.
1646            4. Finally, it really contains options, which user wants to receive.
1647          */
1648         tp = tcp_sk(sk);
1649         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1650             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1651                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1652                         np->mcast_oif = inet6_iif(opt_skb);
1653                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1654                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1655                 if (ipv6_opt_accepted(sk, opt_skb)) {
1656                         skb_set_owner_r(opt_skb, sk);
1657                         opt_skb = xchg(&np->pktoptions, opt_skb);
1658                 } else {
1659                         __kfree_skb(opt_skb);
1660                         opt_skb = xchg(&np->pktoptions, NULL);
1661                 }
1662         }
1663
1664         if (opt_skb)
1665                 kfree_skb(opt_skb);
1666         return 0;
1667 }
1668
1669 static int tcp_v6_rcv(struct sk_buff *skb)
1670 {
1671         struct tcphdr *th;
1672         struct sock *sk;
1673         int ret;
1674
1675         if (skb->pkt_type != PACKET_HOST)
1676                 goto discard_it;
1677
1678         /*
1679          *      Count it even if it's bad.
1680          */
1681         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1682
1683         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1684                 goto discard_it;
1685
1686         th = tcp_hdr(skb);
1687
1688         if (th->doff < sizeof(struct tcphdr)/4)
1689                 goto bad_packet;
1690         if (!pskb_may_pull(skb, th->doff*4))
1691                 goto discard_it;
1692
1693         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1694                 goto bad_packet;
1695
1696         th = tcp_hdr(skb);
1697         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1698         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1699                                     skb->len - th->doff*4);
1700         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1701         TCP_SKB_CB(skb)->when = 0;
1702         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
1703         TCP_SKB_CB(skb)->sacked = 0;
1704
1705         sk = __inet6_lookup(skb->dev->nd_net, &tcp_hashinfo,
1706                         &ipv6_hdr(skb)->saddr, th->source,
1707                         &ipv6_hdr(skb)->daddr, ntohs(th->dest),
1708                         inet6_iif(skb));
1709
1710         if (!sk)
1711                 goto no_tcp_socket;
1712
1713 process:
1714         if (sk->sk_state == TCP_TIME_WAIT)
1715                 goto do_time_wait;
1716
1717         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1718                 goto discard_and_relse;
1719
1720         if (sk_filter(sk, skb))
1721                 goto discard_and_relse;
1722
1723         skb->dev = NULL;
1724
1725         bh_lock_sock_nested(sk);
1726         ret = 0;
1727         if (!sock_owned_by_user(sk)) {
1728 #ifdef CONFIG_NET_DMA
1729                 struct tcp_sock *tp = tcp_sk(sk);
1730                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1731                         tp->ucopy.dma_chan = get_softnet_dma();
1732                 if (tp->ucopy.dma_chan)
1733                         ret = tcp_v6_do_rcv(sk, skb);
1734                 else
1735 #endif
1736                 {
1737                         if (!tcp_prequeue(sk, skb))
1738                                 ret = tcp_v6_do_rcv(sk, skb);
1739                 }
1740         } else
1741                 sk_add_backlog(sk, skb);
1742         bh_unlock_sock(sk);
1743
1744         sock_put(sk);
1745         return ret ? -1 : 0;
1746
1747 no_tcp_socket:
1748         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1749                 goto discard_it;
1750
1751         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1752 bad_packet:
1753                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1754         } else {
1755                 tcp_v6_send_reset(NULL, skb);
1756         }
1757
1758 discard_it:
1759
1760         /*
1761          *      Discard frame
1762          */
1763
1764         kfree_skb(skb);
1765         return 0;
1766
1767 discard_and_relse:
1768         sock_put(sk);
1769         goto discard_it;
1770
1771 do_time_wait:
1772         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1773                 inet_twsk_put(inet_twsk(sk));
1774                 goto discard_it;
1775         }
1776
1777         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1778                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1779                 inet_twsk_put(inet_twsk(sk));
1780                 goto discard_it;
1781         }
1782
1783         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1784         case TCP_TW_SYN:
1785         {
1786                 struct sock *sk2;
1787
1788                 sk2 = inet6_lookup_listener(skb->dev->nd_net, &tcp_hashinfo,
1789                                             &ipv6_hdr(skb)->daddr,
1790                                             ntohs(th->dest), inet6_iif(skb));
1791                 if (sk2 != NULL) {
1792                         struct inet_timewait_sock *tw = inet_twsk(sk);
1793                         inet_twsk_deschedule(tw, &tcp_death_row);
1794                         inet_twsk_put(tw);
1795                         sk = sk2;
1796                         goto process;
1797                 }
1798                 /* Fall through to ACK */
1799         }
1800         case TCP_TW_ACK:
1801                 tcp_v6_timewait_ack(sk, skb);
1802                 break;
1803         case TCP_TW_RST:
1804                 goto no_tcp_socket;
1805         case TCP_TW_SUCCESS:;
1806         }
1807         goto discard_it;
1808 }
1809
1810 static int tcp_v6_remember_stamp(struct sock *sk)
1811 {
1812         /* Alas, not yet... */
1813         return 0;
1814 }
1815
1816 static struct inet_connection_sock_af_ops ipv6_specific = {
1817         .queue_xmit        = inet6_csk_xmit,
1818         .send_check        = tcp_v6_send_check,
1819         .rebuild_header    = inet6_sk_rebuild_header,
1820         .conn_request      = tcp_v6_conn_request,
1821         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1822         .remember_stamp    = tcp_v6_remember_stamp,
1823         .net_header_len    = sizeof(struct ipv6hdr),
1824         .setsockopt        = ipv6_setsockopt,
1825         .getsockopt        = ipv6_getsockopt,
1826         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1827         .sockaddr_len      = sizeof(struct sockaddr_in6),
1828         .bind_conflict     = inet6_csk_bind_conflict,
1829 #ifdef CONFIG_COMPAT
1830         .compat_setsockopt = compat_ipv6_setsockopt,
1831         .compat_getsockopt = compat_ipv6_getsockopt,
1832 #endif
1833 };
1834
1835 #ifdef CONFIG_TCP_MD5SIG
1836 static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1837         .md5_lookup     =       tcp_v6_md5_lookup,
1838         .calc_md5_hash  =       tcp_v6_calc_md5_hash,
1839         .md5_add        =       tcp_v6_md5_add_func,
1840         .md5_parse      =       tcp_v6_parse_md5_keys,
1841 };
1842 #endif
1843
1844 /*
1845  *      TCP over IPv4 via INET6 API
1846  */
1847
1848 static struct inet_connection_sock_af_ops ipv6_mapped = {
1849         .queue_xmit        = ip_queue_xmit,
1850         .send_check        = tcp_v4_send_check,
1851         .rebuild_header    = inet_sk_rebuild_header,
1852         .conn_request      = tcp_v6_conn_request,
1853         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1854         .remember_stamp    = tcp_v4_remember_stamp,
1855         .net_header_len    = sizeof(struct iphdr),
1856         .setsockopt        = ipv6_setsockopt,
1857         .getsockopt        = ipv6_getsockopt,
1858         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1859         .sockaddr_len      = sizeof(struct sockaddr_in6),
1860         .bind_conflict     = inet6_csk_bind_conflict,
1861 #ifdef CONFIG_COMPAT
1862         .compat_setsockopt = compat_ipv6_setsockopt,
1863         .compat_getsockopt = compat_ipv6_getsockopt,
1864 #endif
1865 };
1866
1867 #ifdef CONFIG_TCP_MD5SIG
1868 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1869         .md5_lookup     =       tcp_v4_md5_lookup,
1870         .calc_md5_hash  =       tcp_v4_calc_md5_hash,
1871         .md5_add        =       tcp_v6_md5_add_func,
1872         .md5_parse      =       tcp_v6_parse_md5_keys,
1873 };
1874 #endif
1875
1876 /* NOTE: A lot of things set to zero explicitly by call to
1877  *       sk_alloc() so need not be done here.
1878  */
1879 static int tcp_v6_init_sock(struct sock *sk)
1880 {
1881         struct inet_connection_sock *icsk = inet_csk(sk);
1882         struct tcp_sock *tp = tcp_sk(sk);
1883
1884         skb_queue_head_init(&tp->out_of_order_queue);
1885         tcp_init_xmit_timers(sk);
1886         tcp_prequeue_init(tp);
1887
1888         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1889         tp->mdev = TCP_TIMEOUT_INIT;
1890
1891         /* So many TCP implementations out there (incorrectly) count the
1892          * initial SYN frame in their delayed-ACK and congestion control
1893          * algorithms that we must have the following bandaid to talk
1894          * efficiently to them.  -DaveM
1895          */
1896         tp->snd_cwnd = 2;
1897
1898         /* See draft-stevens-tcpca-spec-01 for discussion of the
1899          * initialization of these values.
1900          */
1901         tp->snd_ssthresh = 0x7fffffff;
1902         tp->snd_cwnd_clamp = ~0;
1903         tp->mss_cache = 536;
1904
1905         tp->reordering = sysctl_tcp_reordering;
1906
1907         sk->sk_state = TCP_CLOSE;
1908
1909         icsk->icsk_af_ops = &ipv6_specific;
1910         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1911         icsk->icsk_sync_mss = tcp_sync_mss;
1912         sk->sk_write_space = sk_stream_write_space;
1913         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1914
1915 #ifdef CONFIG_TCP_MD5SIG
1916         tp->af_specific = &tcp_sock_ipv6_specific;
1917 #endif
1918
1919         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1920         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1921
1922         atomic_inc(&tcp_sockets_allocated);
1923
1924         return 0;
1925 }
1926
1927 static int tcp_v6_destroy_sock(struct sock *sk)
1928 {
1929 #ifdef CONFIG_TCP_MD5SIG
1930         /* Clean up the MD5 key list */
1931         if (tcp_sk(sk)->md5sig_info)
1932                 tcp_v6_clear_md5_list(sk);
1933 #endif
1934         tcp_v4_destroy_sock(sk);
1935         return inet6_destroy_sock(sk);
1936 }
1937
1938 #ifdef CONFIG_PROC_FS
1939 /* Proc filesystem TCPv6 sock list dumping. */
1940 static void get_openreq6(struct seq_file *seq,
1941                          struct sock *sk, struct request_sock *req, int i, int uid)
1942 {
1943         int ttd = req->expires - jiffies;
1944         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1945         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1946
1947         if (ttd < 0)
1948                 ttd = 0;
1949
1950         seq_printf(seq,
1951                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1952                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1953                    i,
1954                    src->s6_addr32[0], src->s6_addr32[1],
1955                    src->s6_addr32[2], src->s6_addr32[3],
1956                    ntohs(inet_sk(sk)->sport),
1957                    dest->s6_addr32[0], dest->s6_addr32[1],
1958                    dest->s6_addr32[2], dest->s6_addr32[3],
1959                    ntohs(inet_rsk(req)->rmt_port),
1960                    TCP_SYN_RECV,
1961                    0,0, /* could print option size, but that is af dependent. */
1962                    1,   /* timers active (only the expire timer) */
1963                    jiffies_to_clock_t(ttd),
1964                    req->retrans,
1965                    uid,
1966                    0,  /* non standard timer */
1967                    0, /* open_requests have no inode */
1968                    0, req);
1969 }
1970
1971 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1972 {
1973         struct in6_addr *dest, *src;
1974         __u16 destp, srcp;
1975         int timer_active;
1976         unsigned long timer_expires;
1977         struct inet_sock *inet = inet_sk(sp);
1978         struct tcp_sock *tp = tcp_sk(sp);
1979         const struct inet_connection_sock *icsk = inet_csk(sp);
1980         struct ipv6_pinfo *np = inet6_sk(sp);
1981
1982         dest  = &np->daddr;
1983         src   = &np->rcv_saddr;
1984         destp = ntohs(inet->dport);
1985         srcp  = ntohs(inet->sport);
1986
1987         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1988                 timer_active    = 1;
1989                 timer_expires   = icsk->icsk_timeout;
1990         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1991                 timer_active    = 4;
1992                 timer_expires   = icsk->icsk_timeout;
1993         } else if (timer_pending(&sp->sk_timer)) {
1994                 timer_active    = 2;
1995                 timer_expires   = sp->sk_timer.expires;
1996         } else {
1997                 timer_active    = 0;
1998                 timer_expires = jiffies;
1999         }
2000
2001         seq_printf(seq,
2002                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2003                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
2004                    i,
2005                    src->s6_addr32[0], src->s6_addr32[1],
2006                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2007                    dest->s6_addr32[0], dest->s6_addr32[1],
2008                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2009                    sp->sk_state,
2010                    tp->write_seq-tp->snd_una,
2011                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2012                    timer_active,
2013                    jiffies_to_clock_t(timer_expires - jiffies),
2014                    icsk->icsk_retransmits,
2015                    sock_i_uid(sp),
2016                    icsk->icsk_probes_out,
2017                    sock_i_ino(sp),
2018                    atomic_read(&sp->sk_refcnt), sp,
2019                    icsk->icsk_rto,
2020                    icsk->icsk_ack.ato,
2021                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2022                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
2023                    );
2024 }
2025
2026 static void get_timewait6_sock(struct seq_file *seq,
2027                                struct inet_timewait_sock *tw, int i)
2028 {
2029         struct in6_addr *dest, *src;
2030         __u16 destp, srcp;
2031         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2032         int ttd = tw->tw_ttd - jiffies;
2033
2034         if (ttd < 0)
2035                 ttd = 0;
2036
2037         dest = &tw6->tw_v6_daddr;
2038         src  = &tw6->tw_v6_rcv_saddr;
2039         destp = ntohs(tw->tw_dport);
2040         srcp  = ntohs(tw->tw_sport);
2041
2042         seq_printf(seq,
2043                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2044                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2045                    i,
2046                    src->s6_addr32[0], src->s6_addr32[1],
2047                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2048                    dest->s6_addr32[0], dest->s6_addr32[1],
2049                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2050                    tw->tw_substate, 0, 0,
2051                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2052                    atomic_read(&tw->tw_refcnt), tw);
2053 }
2054
2055 static int tcp6_seq_show(struct seq_file *seq, void *v)
2056 {
2057         struct tcp_iter_state *st;
2058
2059         if (v == SEQ_START_TOKEN) {
2060                 seq_puts(seq,
2061                          "  sl  "
2062                          "local_address                         "
2063                          "remote_address                        "
2064                          "st tx_queue rx_queue tr tm->when retrnsmt"
2065                          "   uid  timeout inode\n");
2066                 goto out;
2067         }
2068         st = seq->private;
2069
2070         switch (st->state) {
2071         case TCP_SEQ_STATE_LISTENING:
2072         case TCP_SEQ_STATE_ESTABLISHED:
2073                 get_tcp6_sock(seq, v, st->num);
2074                 break;
2075         case TCP_SEQ_STATE_OPENREQ:
2076                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2077                 break;
2078         case TCP_SEQ_STATE_TIME_WAIT:
2079                 get_timewait6_sock(seq, v, st->num);
2080                 break;
2081         }
2082 out:
2083         return 0;
2084 }
2085
2086 static struct file_operations tcp6_seq_fops;
2087 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2088         .owner          = THIS_MODULE,
2089         .name           = "tcp6",
2090         .family         = AF_INET6,
2091         .seq_show       = tcp6_seq_show,
2092         .seq_fops       = &tcp6_seq_fops,
2093 };
2094
2095 int __init tcp6_proc_init(void)
2096 {
2097         return tcp_proc_register(&tcp6_seq_afinfo);
2098 }
2099
2100 void tcp6_proc_exit(void)
2101 {
2102         tcp_proc_unregister(&tcp6_seq_afinfo);
2103 }
2104 #endif
2105
2106 DEFINE_PROTO_INUSE(tcpv6)
2107
2108 struct proto tcpv6_prot = {
2109         .name                   = "TCPv6",
2110         .owner                  = THIS_MODULE,
2111         .close                  = tcp_close,
2112         .connect                = tcp_v6_connect,
2113         .disconnect             = tcp_disconnect,
2114         .accept                 = inet_csk_accept,
2115         .ioctl                  = tcp_ioctl,
2116         .init                   = tcp_v6_init_sock,
2117         .destroy                = tcp_v6_destroy_sock,
2118         .shutdown               = tcp_shutdown,
2119         .setsockopt             = tcp_setsockopt,
2120         .getsockopt             = tcp_getsockopt,
2121         .recvmsg                = tcp_recvmsg,
2122         .backlog_rcv            = tcp_v6_do_rcv,
2123         .hash                   = tcp_v6_hash,
2124         .unhash                 = inet_unhash,
2125         .get_port               = inet_csk_get_port,
2126         .enter_memory_pressure  = tcp_enter_memory_pressure,
2127         .sockets_allocated      = &tcp_sockets_allocated,
2128         .memory_allocated       = &tcp_memory_allocated,
2129         .memory_pressure        = &tcp_memory_pressure,
2130         .orphan_count           = &tcp_orphan_count,
2131         .sysctl_mem             = sysctl_tcp_mem,
2132         .sysctl_wmem            = sysctl_tcp_wmem,
2133         .sysctl_rmem            = sysctl_tcp_rmem,
2134         .max_header             = MAX_TCP_HEADER,
2135         .obj_size               = sizeof(struct tcp6_sock),
2136         .twsk_prot              = &tcp6_timewait_sock_ops,
2137         .rsk_prot               = &tcp6_request_sock_ops,
2138         .hashinfo               = &tcp_hashinfo,
2139 #ifdef CONFIG_COMPAT
2140         .compat_setsockopt      = compat_tcp_setsockopt,
2141         .compat_getsockopt      = compat_tcp_getsockopt,
2142 #endif
2143         REF_PROTO_INUSE(tcpv6)
2144 };
2145
2146 static struct inet6_protocol tcpv6_protocol = {
2147         .handler        =       tcp_v6_rcv,
2148         .err_handler    =       tcp_v6_err,
2149         .gso_send_check =       tcp_v6_gso_send_check,
2150         .gso_segment    =       tcp_tso_segment,
2151         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2152 };
2153
2154 static struct inet_protosw tcpv6_protosw = {
2155         .type           =       SOCK_STREAM,
2156         .protocol       =       IPPROTO_TCP,
2157         .prot           =       &tcpv6_prot,
2158         .ops            =       &inet6_stream_ops,
2159         .capability     =       -1,
2160         .no_check       =       0,
2161         .flags          =       INET_PROTOSW_PERMANENT |
2162                                 INET_PROTOSW_ICSK,
2163 };
2164
2165 int __init tcpv6_init(void)
2166 {
2167         int ret;
2168
2169         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2170         if (ret)
2171                 goto out;
2172
2173         /* register inet6 protocol */
2174         ret = inet6_register_protosw(&tcpv6_protosw);
2175         if (ret)
2176                 goto out_tcpv6_protocol;
2177
2178         ret = inet_csk_ctl_sock_create(&tcp6_socket, PF_INET6,
2179                                        SOCK_RAW, IPPROTO_TCP);
2180         if (ret)
2181                 goto out_tcpv6_protosw;
2182 out:
2183         return ret;
2184
2185 out_tcpv6_protocol:
2186         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2187 out_tcpv6_protosw:
2188         inet6_unregister_protosw(&tcpv6_protosw);
2189         goto out;
2190 }
2191
2192 void tcpv6_exit(void)
2193 {
2194         sock_release(tcp6_socket);
2195         inet6_unregister_protosw(&tcpv6_protosw);
2196         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2197 }