git.oblomov.eu Git - linux-2.6/blob - net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/module.h>
  27 #include <linux/errno.h>
  28 #include <linux/types.h>
  29 #include <linux/socket.h>
  30 #include <linux/sockios.h>
  31 #include <linux/net.h>
  32 #include <linux/jiffies.h>
  33 #include <linux/in.h>
  34 #include <linux/in6.h>
  35 #include <linux/netdevice.h>
  36 #include <linux/init.h>
  37 #include <linux/jhash.h>
  38 #include <linux/ipsec.h>
  39 #include <linux/times.h>
  40
  41 #include <linux/ipv6.h>
  42 #include <linux/icmpv6.h>
  43 #include <linux/random.h>
  44
  45 #include <net/tcp.h>
  46 #include <net/ndisc.h>
  47 #include <net/inet6_hashtables.h>
  48 #include <net/inet6_connection_sock.h>
  49 #include <net/ipv6.h>
  50 #include <net/transp_v6.h>
  51 #include <net/addrconf.h>
  52 #include <net/ip6_route.h>
  53 #include <net/ip6_checksum.h>
  54 #include <net/inet_ecn.h>
  55 #include <net/protocol.h>
  56 #include <net/xfrm.h>
  57 #include <net/snmp.h>
  58 #include <net/dsfield.h>
  59 #include <net/timewait_sock.h>
  60 #include <net/netdma.h>
  61 #include <net/inet_common.h>
  62
  63 #include <asm/uaccess.h>
  64
  65 #include <linux/proc_fs.h>
  66 #include <linux/seq_file.h>
  67
  68 #include <linux/crypto.h>
  69 #include <linux/scatterlist.h>
  70
  71 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  72 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  73                                       struct request_sock *req);
  74
  75 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  76
  77 static struct inet_connection_sock_af_ops ipv6_mapped;
  78 static struct inet_connection_sock_af_ops ipv6_specific;
  79 #ifdef CONFIG_TCP_MD5SIG
  80 static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  81 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  82 #else
  83 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  84                                                    struct in6_addr *addr)
  85 {
  86         return NULL;
  87 }
  88 #endif
  89
  90 static void tcp_v6_hash(struct sock *sk)
  91 {
  92         if (sk->sk_state != TCP_CLOSE) {
  93                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  94                         tcp_prot.hash(sk);
  95                         return;
  96                 }
  97                 local_bh_disable();
  98                 __inet6_hash(sk);
  99                 local_bh_enable();
 100         }
 101 }
 102
 103 static __inline__ __sum16 tcp_v6_check(struct tcphdr *th, int len,
 104                                    struct in6_addr *saddr,
 105                                    struct in6_addr *daddr,
 106                                    __wsum base)
 107 {
 108         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 109 }
 110
 111 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 112 {
 113         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 114                                             ipv6_hdr(skb)->saddr.s6_addr32,
 115                                             tcp_hdr(skb)->dest,
 116                                             tcp_hdr(skb)->source);
 117 }
 118
 119 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 120                           int addr_len)
 121 {
 122         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 123         struct inet_sock *inet = inet_sk(sk);
 124         struct inet_connection_sock *icsk = inet_csk(sk);
 125         struct ipv6_pinfo *np = inet6_sk(sk);
 126         struct tcp_sock *tp = tcp_sk(sk);
 127         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 128         struct flowi fl;
 129         struct dst_entry *dst;
 130         int addr_type;
 131         int err;
 132
 133         if (addr_len < SIN6_LEN_RFC2133)
 134                 return -EINVAL;
 135
 136         if (usin->sin6_family != AF_INET6)
 137                 return(-EAFNOSUPPORT);
 138
 139         memset(&fl, 0, sizeof(fl));
 140
 141         if (np->sndflow) {
 142                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 143                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 144                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 145                         struct ip6_flowlabel *flowlabel;
 146                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 147                         if (flowlabel == NULL)
 148                                 return -EINVAL;
 149                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 150                         fl6_sock_release(flowlabel);
 151                 }
 152         }
 153
 154         /*
 155          *      connect() to INADDR_ANY means loopback (BSD'ism).
 156          */
 157
 158         if(ipv6_addr_any(&usin->sin6_addr))
 159                 usin->sin6_addr.s6_addr[15] = 0x1;
 160
 161         addr_type = ipv6_addr_type(&usin->sin6_addr);
 162
 163         if(addr_type & IPV6_ADDR_MULTICAST)
 164                 return -ENETUNREACH;
 165
 166         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 167                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 168                     usin->sin6_scope_id) {
 169                         /* If interface is set while binding, indices
 170                          * must coincide.
 171                          */
 172                         if (sk->sk_bound_dev_if &&
 173                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 174                                 return -EINVAL;
 175
 176                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 177                 }
 178
 179                 /* Connect to link-local address requires an interface */
 180                 if (!sk->sk_bound_dev_if)
 181                         return -EINVAL;
 182         }
 183
 184         if (tp->rx_opt.ts_recent_stamp &&
 185             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 186                 tp->rx_opt.ts_recent = 0;
 187                 tp->rx_opt.ts_recent_stamp = 0;
 188                 tp->write_seq = 0;
 189         }
 190
 191         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 192         np->flow_label = fl.fl6_flowlabel;
 193
 194         /*
 195          *      TCP over IPv4
 196          */
 197
 198         if (addr_type == IPV6_ADDR_MAPPED) {
 199                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 200                 struct sockaddr_in sin;
 201
 202                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 203
 204                 if (__ipv6_only_sock(sk))
 205                         return -ENETUNREACH;
 206
 207                 sin.sin_family = AF_INET;
 208                 sin.sin_port = usin->sin6_port;
 209                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 210
 211                 icsk->icsk_af_ops = &ipv6_mapped;
 212                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 213 #ifdef CONFIG_TCP_MD5SIG
 214                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 215 #endif
 216
 217                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 218
 219                 if (err) {
 220                         icsk->icsk_ext_hdr_len = exthdrlen;
 221                         icsk->icsk_af_ops = &ipv6_specific;
 222                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 223 #ifdef CONFIG_TCP_MD5SIG
 224                         tp->af_specific = &tcp_sock_ipv6_specific;
 225 #endif
 226                         goto failure;
 227                 } else {
 228                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 229                                       inet->saddr);
 230                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 231                                       inet->rcv_saddr);
 232                 }
 233
 234                 return err;
 235         }
 236
 237         if (!ipv6_addr_any(&np->rcv_saddr))
 238                 saddr = &np->rcv_saddr;
 239
 240         fl.proto = IPPROTO_TCP;
 241         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 242         ipv6_addr_copy(&fl.fl6_src,
 243                        (saddr ? saddr : &np->saddr));
 244         fl.oif = sk->sk_bound_dev_if;
 245         fl.fl_ip_dport = usin->sin6_port;
 246         fl.fl_ip_sport = inet->sport;
 247
 248         if (np->opt && np->opt->srcrt) {
 249                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 250                 ipv6_addr_copy(&final, &fl.fl6_dst);
 251                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 252                 final_p = &final;
 253         }
 254
 255         security_sk_classify_flow(sk, &fl);
 256
 257         err = ip6_dst_lookup(sk, &dst, &fl);
 258         if (err)
 259                 goto failure;
 260         if (final_p)
 261                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 262
 263         err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
 264         if (err < 0) {
 265                 if (err == -EREMOTE)
 266                         err = ip6_dst_blackhole(sk, &dst, &fl);
 267                 if (err < 0)
 268                         goto failure;
 269         }
 270
 271         if (saddr == NULL) {
 272                 saddr = &fl.fl6_src;
 273                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 274         }
 275
 276         /* set the source address */
 277         ipv6_addr_copy(&np->saddr, saddr);
 278         inet->rcv_saddr = LOOPBACK4_IPV6;
 279
 280         sk->sk_gso_type = SKB_GSO_TCPV6;
 281         __ip6_dst_store(sk, dst, NULL, NULL);
 282
 283         icsk->icsk_ext_hdr_len = 0;
 284         if (np->opt)
 285                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 286                                           np->opt->opt_nflen);
 287
 288         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 289
 290         inet->dport = usin->sin6_port;
 291
 292         tcp_set_state(sk, TCP_SYN_SENT);
 293         err = inet6_hash_connect(&tcp_death_row, sk);
 294         if (err)
 295                 goto late_failure;
 296
 297         if (!tp->write_seq)
 298                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 299                                                              np->daddr.s6_addr32,
 300                                                              inet->sport,
 301                                                              inet->dport);
 302
 303         err = tcp_connect(sk);
 304         if (err)
 305                 goto late_failure;
 306
 307         return 0;
 308
 309 late_failure:
 310         tcp_set_state(sk, TCP_CLOSE);
 311         __sk_dst_reset(sk);
 312 failure:
 313         inet->dport = 0;
 314         sk->sk_route_caps = 0;
 315         return err;
 316 }
 317
 318 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 319                 int type, int code, int offset, __be32 info)
 320 {
 321         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 322         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 323         struct ipv6_pinfo *np;
 324         struct sock *sk;
 325         int err;
 326         struct tcp_sock *tp;
 327         __u32 seq;
 328         struct net *net = dev_net(skb->dev);
 329
 330         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 331                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 332
 333         if (sk == NULL) {
 334                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 335                                    ICMP6_MIB_INERRORS);
 336                 return;
 337         }
 338
 339         if (sk->sk_state == TCP_TIME_WAIT) {
 340                 inet_twsk_put(inet_twsk(sk));
 341                 return;
 342         }
 343
 344         bh_lock_sock(sk);
 345         if (sock_owned_by_user(sk))
 346                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 347
 348         if (sk->sk_state == TCP_CLOSE)
 349                 goto out;
 350
 351         tp = tcp_sk(sk);
 352         seq = ntohl(th->seq);
 353         if (sk->sk_state != TCP_LISTEN &&
 354             !between(seq, tp->snd_una, tp->snd_nxt)) {
 355                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 356                 goto out;
 357         }
 358
 359         np = inet6_sk(sk);
 360
 361         if (type == ICMPV6_PKT_TOOBIG) {
 362                 struct dst_entry *dst = NULL;
 363
 364                 if (sock_owned_by_user(sk))
 365                         goto out;
 366                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 367                         goto out;
 368
 369                 /* icmp should have updated the destination cache entry */
 370                 dst = __sk_dst_check(sk, np->dst_cookie);
 371
 372                 if (dst == NULL) {
 373                         struct inet_sock *inet = inet_sk(sk);
 374                         struct flowi fl;
 375
 376                         /* BUGGG_FUTURE: Again, it is not clear how
 377                            to handle rthdr case. Ignore this complexity
 378                            for now.
 379                          */
 380                         memset(&fl, 0, sizeof(fl));
 381                         fl.proto = IPPROTO_TCP;
 382                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 383                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 384                         fl.oif = sk->sk_bound_dev_if;
 385                         fl.fl_ip_dport = inet->dport;
 386                         fl.fl_ip_sport = inet->sport;
 387                         security_skb_classify_flow(skb, &fl);
 388
 389                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 390                                 sk->sk_err_soft = -err;
 391                                 goto out;
 392                         }
 393
 394                         if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
 395                                 sk->sk_err_soft = -err;
 396                                 goto out;
 397                         }
 398
 399                 } else
 400                         dst_hold(dst);
 401
 402                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 403                         tcp_sync_mss(sk, dst_mtu(dst));
 404                         tcp_simple_retransmit(sk);
 405                 } /* else let the usual retransmit timer handle it */
 406                 dst_release(dst);
 407                 goto out;
 408         }
 409
 410         icmpv6_err_convert(type, code, &err);
 411
 412         /* Might be for an request_sock */
 413         switch (sk->sk_state) {
 414                 struct request_sock *req, **prev;
 415         case TCP_LISTEN:
 416                 if (sock_owned_by_user(sk))
 417                         goto out;
 418
 419                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 420                                            &hdr->saddr, inet6_iif(skb));
 421                 if (!req)
 422                         goto out;
 423
 424                 /* ICMPs are not backlogged, hence we cannot get
 425                  * an established socket here.
 426                  */
 427                 WARN_ON(req->sk != NULL);
 428
 429                 if (seq != tcp_rsk(req)->snt_isn) {
 430                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 431                         goto out;
 432                 }
 433
 434                 inet_csk_reqsk_queue_drop(sk, req, prev);
 435                 goto out;
 436
 437         case TCP_SYN_SENT:
 438         case TCP_SYN_RECV:  /* Cannot happen.
 439                                It can, it SYNs are crossed. --ANK */
 440                 if (!sock_owned_by_user(sk)) {
 441                         sk->sk_err = err;
 442                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 443
 444                         tcp_done(sk);
 445                 } else
 446                         sk->sk_err_soft = err;
 447                 goto out;
 448         }
 449
 450         if (!sock_owned_by_user(sk) && np->recverr) {
 451                 sk->sk_err = err;
 452                 sk->sk_error_report(sk);
 453         } else
 454                 sk->sk_err_soft = err;
 455
 456 out:
 457         bh_unlock_sock(sk);
 458         sock_put(sk);
 459 }
 460
 461
 462 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
 463 {
 464         struct inet6_request_sock *treq = inet6_rsk(req);
 465         struct ipv6_pinfo *np = inet6_sk(sk);
 466         struct sk_buff * skb;
 467         struct ipv6_txoptions *opt = NULL;
 468         struct in6_addr * final_p = NULL, final;
 469         struct flowi fl;
 470         struct dst_entry *dst;
 471         int err = -1;
 472
 473         memset(&fl, 0, sizeof(fl));
 474         fl.proto = IPPROTO_TCP;
 475         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 476         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 477         fl.fl6_flowlabel = 0;
 478         fl.oif = treq->iif;
 479         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 480         fl.fl_ip_sport = inet_rsk(req)->loc_port;
 481         security_req_classify_flow(req, &fl);
 482
 483         opt = np->opt;
 484         if (opt && opt->srcrt) {
 485                 struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 486                 ipv6_addr_copy(&final, &fl.fl6_dst);
 487                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 488                 final_p = &final;
 489         }
 490
 491         err = ip6_dst_lookup(sk, &dst, &fl);
 492         if (err)
 493                 goto done;
 494         if (final_p)
 495                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 496         if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
 497                 goto done;
 498
 499         skb = tcp_make_synack(sk, dst, req);
 500         if (skb) {
 501                 struct tcphdr *th = tcp_hdr(skb);
 502
 503                 th->check = tcp_v6_check(th, skb->len,
 504                                          &treq->loc_addr, &treq->rmt_addr,
 505                                          csum_partial(th, skb->len, skb->csum));
 506
 507                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 508                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 509                 err = net_xmit_eval(err);
 510         }
 511
 512 done:
 513         if (opt && opt != np->opt)
 514                 sock_kfree_s(sk, opt, opt->tot_len);
 515         dst_release(dst);
 516         return err;
 517 }
 518
 519 static inline void syn_flood_warning(struct sk_buff *skb)
 520 {
 521 #ifdef CONFIG_SYN_COOKIES
 522         if (sysctl_tcp_syncookies)
 523                 printk(KERN_INFO
 524                        "TCPv6: Possible SYN flooding on port %d. "
 525                        "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
 526         else
 527 #endif
 528                 printk(KERN_INFO
 529                        "TCPv6: Possible SYN flooding on port %d. "
 530                        "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
 531 }
 532
 533 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 534 {
 535         if (inet6_rsk(req)->pktopts)
 536                 kfree_skb(inet6_rsk(req)->pktopts);
 537 }
 538
 539 #ifdef CONFIG_TCP_MD5SIG
 540 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 541                                                    struct in6_addr *addr)
 542 {
 543         struct tcp_sock *tp = tcp_sk(sk);
 544         int i;
 545
 546         BUG_ON(tp == NULL);
 547
 548         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 549                 return NULL;
 550
 551         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 552                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
 553                         return &tp->md5sig_info->keys6[i].base;
 554         }
 555         return NULL;
 556 }
 557
 558 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 559                                                 struct sock *addr_sk)
 560 {
 561         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 562 }
 563
 564 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 565                                                       struct request_sock *req)
 566 {
 567         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 568 }
 569
 570 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 571                              char *newkey, u8 newkeylen)
 572 {
 573         /* Add key to the list */
 574         struct tcp_md5sig_key *key;
 575         struct tcp_sock *tp = tcp_sk(sk);
 576         struct tcp6_md5sig_key *keys;
 577
 578         key = tcp_v6_md5_do_lookup(sk, peer);
 579         if (key) {
 580                 /* modify existing entry - just update that one */
 581                 kfree(key->key);
 582                 key->key = newkey;
 583                 key->keylen = newkeylen;
 584         } else {
 585                 /* reallocate new list if current one is full. */
 586                 if (!tp->md5sig_info) {
 587                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 588                         if (!tp->md5sig_info) {
 589                                 kfree(newkey);
 590                                 return -ENOMEM;
 591                         }
 592                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 593                 }
 594                 if (tcp_alloc_md5sig_pool() == NULL) {
 595                         kfree(newkey);
 596                         return -ENOMEM;
 597                 }
 598                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 599                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 600                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 601
 602                         if (!keys) {
 603                                 tcp_free_md5sig_pool();
 604                                 kfree(newkey);
 605                                 return -ENOMEM;
 606                         }
 607
 608                         if (tp->md5sig_info->entries6)
 609                                 memmove(keys, tp->md5sig_info->keys6,
 610                                         (sizeof (tp->md5sig_info->keys6[0]) *
 611                                          tp->md5sig_info->entries6));
 612
 613                         kfree(tp->md5sig_info->keys6);
 614                         tp->md5sig_info->keys6 = keys;
 615                         tp->md5sig_info->alloced6++;
 616                 }
 617
 618                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 619                                peer);
 620                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 621                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 622
 623                 tp->md5sig_info->entries6++;
 624         }
 625         return 0;
 626 }
 627
 628 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 629                                u8 *newkey, __u8 newkeylen)
 630 {
 631         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 632                                  newkey, newkeylen);
 633 }
 634
 635 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
 636 {
 637         struct tcp_sock *tp = tcp_sk(sk);
 638         int i;
 639
 640         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 641                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
 642                         /* Free the key */
 643                         kfree(tp->md5sig_info->keys6[i].base.key);
 644                         tp->md5sig_info->entries6--;
 645
 646                         if (tp->md5sig_info->entries6 == 0) {
 647                                 kfree(tp->md5sig_info->keys6);
 648                                 tp->md5sig_info->keys6 = NULL;
 649                                 tp->md5sig_info->alloced6 = 0;
 650                         } else {
 651                                 /* shrink the database */
 652                                 if (tp->md5sig_info->entries6 != i)
 653                                         memmove(&tp->md5sig_info->keys6[i],
 654                                                 &tp->md5sig_info->keys6[i+1],
 655                                                 (tp->md5sig_info->entries6 - i)
 656                                                 * sizeof (tp->md5sig_info->keys6[0]));
 657                         }
 658                         tcp_free_md5sig_pool();
 659                         return 0;
 660                 }
 661         }
 662         return -ENOENT;
 663 }
 664
 665 static void tcp_v6_clear_md5_list (struct sock *sk)
 666 {
 667         struct tcp_sock *tp = tcp_sk(sk);
 668         int i;
 669
 670         if (tp->md5sig_info->entries6) {
 671                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 672                         kfree(tp->md5sig_info->keys6[i].base.key);
 673                 tp->md5sig_info->entries6 = 0;
 674                 tcp_free_md5sig_pool();
 675         }
 676
 677         kfree(tp->md5sig_info->keys6);
 678         tp->md5sig_info->keys6 = NULL;
 679         tp->md5sig_info->alloced6 = 0;
 680
 681         if (tp->md5sig_info->entries4) {
 682                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 683                         kfree(tp->md5sig_info->keys4[i].base.key);
 684                 tp->md5sig_info->entries4 = 0;
 685                 tcp_free_md5sig_pool();
 686         }
 687
 688         kfree(tp->md5sig_info->keys4);
 689         tp->md5sig_info->keys4 = NULL;
 690         tp->md5sig_info->alloced4 = 0;
 691 }
 692
 693 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 694                                   int optlen)
 695 {
 696         struct tcp_md5sig cmd;
 697         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 698         u8 *newkey;
 699
 700         if (optlen < sizeof(cmd))
 701                 return -EINVAL;
 702
 703         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 704                 return -EFAULT;
 705
 706         if (sin6->sin6_family != AF_INET6)
 707                 return -EINVAL;
 708
 709         if (!cmd.tcpm_keylen) {
 710                 if (!tcp_sk(sk)->md5sig_info)
 711                         return -ENOENT;
 712                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 713                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 714                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 715         }
 716
 717         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 718                 return -EINVAL;
 719
 720         if (!tcp_sk(sk)->md5sig_info) {
 721                 struct tcp_sock *tp = tcp_sk(sk);
 722                 struct tcp_md5sig_info *p;
 723
 724                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 725                 if (!p)
 726                         return -ENOMEM;
 727
 728                 tp->md5sig_info = p;
 729                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 730         }
 731
 732         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 733         if (!newkey)
 734                 return -ENOMEM;
 735         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 736                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 737                                          newkey, cmd.tcpm_keylen);
 738         }
 739         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 740 }
 741
 742 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 743                                         struct in6_addr *daddr,
 744                                         struct in6_addr *saddr, int nbytes)
 745 {
 746         struct tcp6_pseudohdr *bp;
 747         struct scatterlist sg;
 748
 749         bp = &hp->md5_blk.ip6;
 750         /* 1. TCP pseudo-header (RFC2460) */
 751         ipv6_addr_copy(&bp->saddr, saddr);
 752         ipv6_addr_copy(&bp->daddr, daddr);
 753         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 754         bp->len = cpu_to_be32(nbytes);
 755
 756         sg_init_one(&sg, bp, sizeof(*bp));
 757         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 758 }
 759
 760 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 761                                struct in6_addr *daddr, struct in6_addr *saddr,
 762                                struct tcphdr *th)
 763 {
 764         struct tcp_md5sig_pool *hp;
 765         struct hash_desc *desc;
 766
 767         hp = tcp_get_md5sig_pool();
 768         if (!hp)
 769                 goto clear_hash_noput;
 770         desc = &hp->md5_desc;
 771
 772         if (crypto_hash_init(desc))
 773                 goto clear_hash;
 774         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 775                 goto clear_hash;
 776         if (tcp_md5_hash_header(hp, th))
 777                 goto clear_hash;
 778         if (tcp_md5_hash_key(hp, key))
 779                 goto clear_hash;
 780         if (crypto_hash_final(desc, md5_hash))
 781                 goto clear_hash;
 782
 783         tcp_put_md5sig_pool();
 784         return 0;
 785
 786 clear_hash:
 787         tcp_put_md5sig_pool();
 788 clear_hash_noput:
 789         memset(md5_hash, 0, 16);
 790         return 1;
 791 }
 792
 793 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 794                                struct sock *sk, struct request_sock *req,
 795                                struct sk_buff *skb)
 796 {
 797         struct in6_addr *saddr, *daddr;
 798         struct tcp_md5sig_pool *hp;
 799         struct hash_desc *desc;
 800         struct tcphdr *th = tcp_hdr(skb);
 801
 802         if (sk) {
 803                 saddr = &inet6_sk(sk)->saddr;
 804                 daddr = &inet6_sk(sk)->daddr;
 805         } else if (req) {
 806                 saddr = &inet6_rsk(req)->loc_addr;
 807                 daddr = &inet6_rsk(req)->rmt_addr;
 808         } else {
 809                 struct ipv6hdr *ip6h = ipv6_hdr(skb);
 810                 saddr = &ip6h->saddr;
 811                 daddr = &ip6h->daddr;
 812         }
 813
 814         hp = tcp_get_md5sig_pool();
 815         if (!hp)
 816                 goto clear_hash_noput;
 817         desc = &hp->md5_desc;
 818
 819         if (crypto_hash_init(desc))
 820                 goto clear_hash;
 821
 822         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 823                 goto clear_hash;
 824         if (tcp_md5_hash_header(hp, th))
 825                 goto clear_hash;
 826         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 827                 goto clear_hash;
 828         if (tcp_md5_hash_key(hp, key))
 829                 goto clear_hash;
 830         if (crypto_hash_final(desc, md5_hash))
 831                 goto clear_hash;
 832
 833         tcp_put_md5sig_pool();
 834         return 0;
 835
 836 clear_hash:
 837         tcp_put_md5sig_pool();
 838 clear_hash_noput:
 839         memset(md5_hash, 0, 16);
 840         return 1;
 841 }
 842
 843 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 844 {
 845         __u8 *hash_location = NULL;
 846         struct tcp_md5sig_key *hash_expected;
 847         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 848         struct tcphdr *th = tcp_hdr(skb);
 849         int genhash;
 850         u8 newhash[16];
 851
 852         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 853         hash_location = tcp_parse_md5sig_option(th);
 854
 855         /* We've parsed the options - do we have a hash? */
 856         if (!hash_expected && !hash_location)
 857                 return 0;
 858
 859         if (hash_expected && !hash_location) {
 860                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 861                 return 1;
 862         }
 863
 864         if (!hash_expected && hash_location) {
 865                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 866                 return 1;
 867         }
 868
 869         /* check the signature */
 870         genhash = tcp_v6_md5_hash_skb(newhash,
 871                                       hash_expected,
 872                                       NULL, NULL, skb);
 873
 874         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 875                 if (net_ratelimit()) {
 876                         printk(KERN_INFO "MD5 Hash %s for (%pI6, %u)->(%pI6, %u)\n",
 877                                genhash ? "failed" : "mismatch",
 878                                &ip6h->saddr, ntohs(th->source),
 879                                &ip6h->daddr, ntohs(th->dest));
 880                 }
 881                 return 1;
 882         }
 883         return 0;
 884 }
 885 #endif
 886
 887 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 888         .family         =       AF_INET6,
 889         .obj_size       =       sizeof(struct tcp6_request_sock),
 890         .rtx_syn_ack    =       tcp_v6_send_synack,
 891         .send_ack       =       tcp_v6_reqsk_send_ack,
 892         .destructor     =       tcp_v6_reqsk_destructor,
 893         .send_reset     =       tcp_v6_send_reset
 894 };
 895
 896 #ifdef CONFIG_TCP_MD5SIG
 897 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 898         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 899 };
 900 #endif
 901
 902 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 903         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 904         .twsk_unique    = tcp_twsk_unique,
 905         .twsk_destructor= tcp_twsk_destructor,
 906 };
 907
 908 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 909 {
 910         struct ipv6_pinfo *np = inet6_sk(sk);
 911         struct tcphdr *th = tcp_hdr(skb);
 912
 913         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 914                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 915                 skb->csum_start = skb_transport_header(skb) - skb->head;
 916                 skb->csum_offset = offsetof(struct tcphdr, check);
 917         } else {
 918                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 919                                             csum_partial(th, th->doff<<2,
 920                                                          skb->csum));
 921         }
 922 }
 923
 924 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 925 {
 926         struct ipv6hdr *ipv6h;
 927         struct tcphdr *th;
 928
 929         if (!pskb_may_pull(skb, sizeof(*th)))
 930                 return -EINVAL;
 931
 932         ipv6h = ipv6_hdr(skb);
 933         th = tcp_hdr(skb);
 934
 935         th->check = 0;
 936         th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
 937                                      IPPROTO_TCP, 0);
 938         skb->csum_start = skb_transport_header(skb) - skb->head;
 939         skb->csum_offset = offsetof(struct tcphdr, check);
 940         skb->ip_summed = CHECKSUM_PARTIAL;
 941         return 0;
 942 }
 943
 944 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 945                                  u32 ts, struct tcp_md5sig_key *key, int rst)
 946 {
 947         struct tcphdr *th = tcp_hdr(skb), *t1;
 948         struct sk_buff *buff;
 949         struct flowi fl;
 950         struct net *net = dev_net(skb->dst->dev);
 951         struct sock *ctl_sk = net->ipv6.tcp_sk;
 952         unsigned int tot_len = sizeof(struct tcphdr);
 953         __be32 *topt;
 954
 955         if (ts)
 956                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 957 #ifdef CONFIG_TCP_MD5SIG
 958         if (key)
 959                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
 960 #endif
 961
 962         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
 963                          GFP_ATOMIC);
 964         if (buff == NULL)
 965                 return;
 966
 967         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 968
 969         t1 = (struct tcphdr *) skb_push(buff, tot_len);
 970
 971         /* Swap the send and the receive. */
 972         memset(t1, 0, sizeof(*t1));
 973         t1->dest = th->source;
 974         t1->source = th->dest;
 975         t1->doff = tot_len / 4;
 976         t1->seq = htonl(seq);
 977         t1->ack_seq = htonl(ack);
 978         t1->ack = !rst || !th->ack;
 979         t1->rst = rst;
 980         t1->window = htons(win);
 981
 982         topt = (__be32 *)(t1 + 1);
 983
 984         if (ts) {
 985                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 986                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
 987                 *topt++ = htonl(tcp_time_stamp);
 988                 *topt++ = htonl(ts);
 989         }
 990
 991 #ifdef CONFIG_TCP_MD5SIG
 992         if (key) {
 993                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
 994                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
 995                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
 996                                     &ipv6_hdr(skb)->saddr,
 997                                     &ipv6_hdr(skb)->daddr, t1);
 998         }
 999 #endif
1000
1001         buff->csum = csum_partial(t1, tot_len, 0);
1002
1003         memset(&fl, 0, sizeof(fl));
1004         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1005         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1006
1007         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1008                                     tot_len, IPPROTO_TCP,
1009                                     buff->csum);
1010
1011         fl.proto = IPPROTO_TCP;
1012         fl.oif = inet6_iif(skb);
1013         fl.fl_ip_dport = t1->dest;
1014         fl.fl_ip_sport = t1->source;
1015         security_skb_classify_flow(skb, &fl);
1016
1017         /* Pass a socket to ip6_dst_lookup either it is for RST
1018          * Underlying function will use this to retrieve the network
1019          * namespace
1020          */
1021         if (!ip6_dst_lookup(ctl_sk, &buff->dst, &fl)) {
1022                 if (xfrm_lookup(net, &buff->dst, &fl, NULL, 0) >= 0) {
1023                         ip6_xmit(ctl_sk, buff, &fl, NULL, 0);
1024                         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
1025                         if (rst)
1026                                 TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
1027                         return;
1028                 }
1029         }
1030
1031         kfree_skb(buff);
1032 }
1033
1034 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
1035 {
1036         struct tcphdr *th = tcp_hdr(skb);
1037         u32 seq = 0, ack_seq = 0;
1038         struct tcp_md5sig_key *key = NULL;
1039
1040         if (th->rst)
1041                 return;
1042
1043         if (!ipv6_unicast_destination(skb))
1044                 return;
1045
1046 #ifdef CONFIG_TCP_MD5SIG
1047         if (sk)
1048                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1049 #endif
1050
1051         if (th->ack)
1052                 seq = ntohl(th->ack_seq);
1053         else
1054                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
1055                           (th->doff << 2);
1056
1057         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1);
1058 }
1059
1060 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
1061                             struct tcp_md5sig_key *key)
1062 {
1063         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0);
1064 }
1065
1066 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1067 {
1068         struct inet_timewait_sock *tw = inet_twsk(sk);
1069         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1070
1071         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1072                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1073                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw));
1074
1075         inet_twsk_put(tw);
1076 }
1077
1078 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1079                                   struct request_sock *req)
1080 {
1081         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1082                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
1083 }
1084
1085
1086 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1087 {
1088         struct request_sock *req, **prev;
1089         const struct tcphdr *th = tcp_hdr(skb);
1090         struct sock *nsk;
1091
1092         /* Find possible connection requests. */
1093         req = inet6_csk_search_req(sk, &prev, th->source,
1094                                    &ipv6_hdr(skb)->saddr,
1095                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1096         if (req)
1097                 return tcp_check_req(sk, skb, req, prev);
1098
1099         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1100                         &ipv6_hdr(skb)->saddr, th->source,
1101                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1102
1103         if (nsk) {
1104                 if (nsk->sk_state != TCP_TIME_WAIT) {
1105                         bh_lock_sock(nsk);
1106                         return nsk;
1107                 }
1108                 inet_twsk_put(inet_twsk(nsk));
1109                 return NULL;
1110         }
1111
1112 #ifdef CONFIG_SYN_COOKIES
1113         if (!th->rst && !th->syn && th->ack)
1114                 sk = cookie_v6_check(sk, skb);
1115 #endif
1116         return sk;
1117 }
1118
1119 /* FIXME: this is substantially similar to the ipv4 code.
1120  * Can some kind of merge be done? -- erics
1121  */
1122 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1123 {
1124         struct inet6_request_sock *treq;
1125         struct ipv6_pinfo *np = inet6_sk(sk);
1126         struct tcp_options_received tmp_opt;
1127         struct tcp_sock *tp = tcp_sk(sk);
1128         struct request_sock *req = NULL;
1129         __u32 isn = TCP_SKB_CB(skb)->when;
1130 #ifdef CONFIG_SYN_COOKIES
1131         int want_cookie = 0;
1132 #else
1133 #define want_cookie 0
1134 #endif
1135
1136         if (skb->protocol == htons(ETH_P_IP))
1137                 return tcp_v4_conn_request(sk, skb);
1138
1139         if (!ipv6_unicast_destination(skb))
1140                 goto drop;
1141
1142         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1143                 if (net_ratelimit())
1144                         syn_flood_warning(skb);
1145 #ifdef CONFIG_SYN_COOKIES
1146                 if (sysctl_tcp_syncookies)
1147                         want_cookie = 1;
1148                 else
1149 #endif
1150                 goto drop;
1151         }
1152
1153         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1154                 goto drop;
1155
1156         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1157         if (req == NULL)
1158                 goto drop;
1159
1160 #ifdef CONFIG_TCP_MD5SIG
1161         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1162 #endif
1163
1164         tcp_clear_options(&tmp_opt);
1165         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1166         tmp_opt.user_mss = tp->rx_opt.user_mss;
1167
1168         tcp_parse_options(skb, &tmp_opt, 0);
1169
1170         if (want_cookie && !tmp_opt.saw_tstamp)
1171                 tcp_clear_options(&tmp_opt);
1172
1173         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1174         tcp_openreq_init(req, &tmp_opt, skb);
1175
1176         treq = inet6_rsk(req);
1177         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1178         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1179         if (!want_cookie)
1180                 TCP_ECN_create_request(req, tcp_hdr(skb));
1181
1182         if (want_cookie) {
1183                 isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1184                 req->cookie_ts = tmp_opt.tstamp_ok;
1185         } else if (!isn) {
1186                 if (ipv6_opt_accepted(sk, skb) ||
1187                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1188                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1189                         atomic_inc(&skb->users);
1190                         treq->pktopts = skb;
1191                 }
1192                 treq->iif = sk->sk_bound_dev_if;
1193
1194                 /* So that link locals have meaning */
1195                 if (!sk->sk_bound_dev_if &&
1196                     ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1197                         treq->iif = inet6_iif(skb);
1198
1199                 isn = tcp_v6_init_sequence(skb);
1200         }
1201
1202         tcp_rsk(req)->snt_isn = isn;
1203
1204         security_inet_conn_request(sk, skb, req);
1205
1206         if (tcp_v6_send_synack(sk, req))
1207                 goto drop;
1208
1209         if (!want_cookie) {
1210                 inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1211                 return 0;
1212         }
1213
1214 drop:
1215         if (req)
1216                 reqsk_free(req);
1217
1218         return 0; /* don't send reset */
1219 }
1220
1221 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1222                                           struct request_sock *req,
1223                                           struct dst_entry *dst)
1224 {
1225         struct inet6_request_sock *treq;
1226         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1227         struct tcp6_sock *newtcp6sk;
1228         struct inet_sock *newinet;
1229         struct tcp_sock *newtp;
1230         struct sock *newsk;
1231         struct ipv6_txoptions *opt;
1232 #ifdef CONFIG_TCP_MD5SIG
1233         struct tcp_md5sig_key *key;
1234 #endif
1235
1236         if (skb->protocol == htons(ETH_P_IP)) {
1237                 /*
1238                  *      v6 mapped
1239                  */
1240
1241                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1242
1243                 if (newsk == NULL)
1244                         return NULL;
1245
1246                 newtcp6sk = (struct tcp6_sock *)newsk;
1247                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1248
1249                 newinet = inet_sk(newsk);
1250                 newnp = inet6_sk(newsk);
1251                 newtp = tcp_sk(newsk);
1252
1253                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1254
1255                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
1256                               newinet->daddr);
1257
1258                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
1259                               newinet->saddr);
1260
1261                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1262
1263                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1264                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1265 #ifdef CONFIG_TCP_MD5SIG
1266                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1267 #endif
1268
1269                 newnp->pktoptions  = NULL;
1270                 newnp->opt         = NULL;
1271                 newnp->mcast_oif   = inet6_iif(skb);
1272                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1273
1274                 /*
1275                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1276                  * here, tcp_create_openreq_child now does this for us, see the comment in
1277                  * that function for the gory details. -acme
1278                  */
1279
1280                 /* It is tricky place. Until this moment IPv4 tcp
1281                    worked with IPv6 icsk.icsk_af_ops.
1282                    Sync it now.
1283                  */
1284                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1285
1286                 return newsk;
1287         }
1288
1289         treq = inet6_rsk(req);
1290         opt = np->opt;
1291
1292         if (sk_acceptq_is_full(sk))
1293                 goto out_overflow;
1294
1295         if (dst == NULL) {
1296                 struct in6_addr *final_p = NULL, final;
1297                 struct flowi fl;
1298
1299                 memset(&fl, 0, sizeof(fl));
1300                 fl.proto = IPPROTO_TCP;
1301                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
1302                 if (opt && opt->srcrt) {
1303                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
1304                         ipv6_addr_copy(&final, &fl.fl6_dst);
1305                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1306                         final_p = &final;
1307                 }
1308                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
1309                 fl.oif = sk->sk_bound_dev_if;
1310                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
1311                 fl.fl_ip_sport = inet_rsk(req)->loc_port;
1312                 security_req_classify_flow(req, &fl);
1313
1314                 if (ip6_dst_lookup(sk, &dst, &fl))
1315                         goto out;
1316
1317                 if (final_p)
1318                         ipv6_addr_copy(&fl.fl6_dst, final_p);
1319
1320                 if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
1321                         goto out;
1322         }
1323
1324         newsk = tcp_create_openreq_child(sk, req, skb);
1325         if (newsk == NULL)
1326                 goto out;
1327
1328         /*
1329          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1330          * count here, tcp_create_openreq_child now does this for us, see the
1331          * comment in that function for the gory details. -acme
1332          */
1333
1334         newsk->sk_gso_type = SKB_GSO_TCPV6;
1335         __ip6_dst_store(newsk, dst, NULL, NULL);
1336
1337         newtcp6sk = (struct tcp6_sock *)newsk;
1338         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1339
1340         newtp = tcp_sk(newsk);
1341         newinet = inet_sk(newsk);
1342         newnp = inet6_sk(newsk);
1343
1344         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1345
1346         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1347         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1348         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1349         newsk->sk_bound_dev_if = treq->iif;
1350
1351         /* Now IPv6 options...
1352
1353            First: no IPv4 options.
1354          */
1355         newinet->opt = NULL;
1356         newnp->ipv6_fl_list = NULL;
1357
1358         /* Clone RX bits */
1359         newnp->rxopt.all = np->rxopt.all;
1360
1361         /* Clone pktoptions received with SYN */
1362         newnp->pktoptions = NULL;
1363         if (treq->pktopts != NULL) {
1364                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1365                 kfree_skb(treq->pktopts);
1366                 treq->pktopts = NULL;
1367                 if (newnp->pktoptions)
1368                         skb_set_owner_r(newnp->pktoptions, newsk);
1369         }
1370         newnp->opt        = NULL;
1371         newnp->mcast_oif  = inet6_iif(skb);
1372         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1373
1374         /* Clone native IPv6 options from listening socket (if any)
1375
1376            Yes, keeping reference count would be much more clever,
1377            but we make one more one thing there: reattach optmem
1378            to newsk.
1379          */
1380         if (opt) {
1381                 newnp->opt = ipv6_dup_options(newsk, opt);
1382                 if (opt != np->opt)
1383                         sock_kfree_s(sk, opt, opt->tot_len);
1384         }
1385
1386         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1387         if (newnp->opt)
1388                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1389                                                      newnp->opt->opt_flen);
1390
1391         tcp_mtup_init(newsk);
1392         tcp_sync_mss(newsk, dst_mtu(dst));
1393         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
1394         tcp_initialize_rcv_mss(newsk);
1395
1396         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
1397
1398 #ifdef CONFIG_TCP_MD5SIG
1399         /* Copy over the MD5 key from the original socket */
1400         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1401                 /* We're using one, so create a matching key
1402                  * on the newsk structure. If we fail to get
1403                  * memory, then we end up not copying the key
1404                  * across. Shucks.
1405                  */
1406                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1407                 if (newkey != NULL)
1408                         tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
1409                                           newkey, key->keylen);
1410         }
1411 #endif
1412
1413         __inet6_hash(newsk);
1414         __inet_inherit_port(sk, newsk);
1415
1416         return newsk;
1417
1418 out_overflow:
1419         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1420 out:
1421         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1422         if (opt && opt != np->opt)
1423                 sock_kfree_s(sk, opt, opt->tot_len);
1424         dst_release(dst);
1425         return NULL;
1426 }
1427
1428 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1429 {
1430         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1431                 if (!tcp_v6_check(tcp_hdr(skb), skb->len, &ipv6_hdr(skb)->saddr,
1432                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1433                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1434                         return 0;
1435                 }
1436         }
1437
1438         skb->csum = ~csum_unfold(tcp_v6_check(tcp_hdr(skb), skb->len,
1439                                               &ipv6_hdr(skb)->saddr,
1440                                               &ipv6_hdr(skb)->daddr, 0));
1441
1442         if (skb->len <= 76) {
1443                 return __skb_checksum_complete(skb);
1444         }
1445         return 0;
1446 }
1447
1448 /* The socket must have it's spinlock held when we get
1449  * here.
1450  *
1451  * We have a potential double-lock case here, so even when
1452  * doing backlog processing we use the BH locking scheme.
1453  * This is because we cannot sleep with the original spinlock
1454  * held.
1455  */
1456 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1457 {
1458         struct ipv6_pinfo *np = inet6_sk(sk);
1459         struct tcp_sock *tp;
1460         struct sk_buff *opt_skb = NULL;
1461
1462         /* Imagine: socket is IPv6. IPv4 packet arrives,
1463            goes to IPv4 receive handler and backlogged.
1464            From backlog it always goes here. Kerboom...
1465            Fortunately, tcp_rcv_established and rcv_established
1466            handle them correctly, but it is not case with
1467            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1468          */
1469
1470         if (skb->protocol == htons(ETH_P_IP))
1471                 return tcp_v4_do_rcv(sk, skb);
1472
1473 #ifdef CONFIG_TCP_MD5SIG
1474         if (tcp_v6_inbound_md5_hash (sk, skb))
1475                 goto discard;
1476 #endif
1477
1478         if (sk_filter(sk, skb))
1479                 goto discard;
1480
1481         /*
1482          *      socket locking is here for SMP purposes as backlog rcv
1483          *      is currently called with bh processing disabled.
1484          */
1485
1486         /* Do Stevens' IPV6_PKTOPTIONS.
1487
1488            Yes, guys, it is the only place in our code, where we
1489            may make it not affecting IPv4.
1490            The rest of code is protocol independent,
1491            and I do not like idea to uglify IPv4.
1492
1493            Actually, all the idea behind IPV6_PKTOPTIONS
1494            looks not very well thought. For now we latch
1495            options, received in the last packet, enqueued
1496            by tcp. Feel free to propose better solution.
1497                                                --ANK (980728)
1498          */
1499         if (np->rxopt.all)
1500                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1501
1502         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1503                 TCP_CHECK_TIMER(sk);
1504                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1505                         goto reset;
1506                 TCP_CHECK_TIMER(sk);
1507                 if (opt_skb)
1508                         goto ipv6_pktoptions;
1509                 return 0;
1510         }
1511
1512         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1513                 goto csum_err;
1514
1515         if (sk->sk_state == TCP_LISTEN) {
1516                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1517                 if (!nsk)
1518                         goto discard;
1519
1520                 /*
1521                  * Queue it on the new socket if the new socket is active,
1522                  * otherwise we just shortcircuit this and continue with
1523                  * the new socket..
1524                  */
1525                 if(nsk != sk) {
1526                         if (tcp_child_process(sk, nsk, skb))
1527                                 goto reset;
1528                         if (opt_skb)
1529                                 __kfree_skb(opt_skb);
1530                         return 0;
1531                 }
1532         }
1533
1534         TCP_CHECK_TIMER(sk);
1535         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1536                 goto reset;
1537         TCP_CHECK_TIMER(sk);
1538         if (opt_skb)
1539                 goto ipv6_pktoptions;
1540         return 0;
1541
1542 reset:
1543         tcp_v6_send_reset(sk, skb);
1544 discard:
1545         if (opt_skb)
1546                 __kfree_skb(opt_skb);
1547         kfree_skb(skb);
1548         return 0;
1549 csum_err:
1550         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1551         goto discard;
1552
1553
1554 ipv6_pktoptions:
1555         /* Do you ask, what is it?
1556
1557            1. skb was enqueued by tcp.
1558            2. skb is added to tail of read queue, rather than out of order.
1559            3. socket is not in passive state.
1560            4. Finally, it really contains options, which user wants to receive.
1561          */
1562         tp = tcp_sk(sk);
1563         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1564             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1565                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1566                         np->mcast_oif = inet6_iif(opt_skb);
1567                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1568                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1569                 if (ipv6_opt_accepted(sk, opt_skb)) {
1570                         skb_set_owner_r(opt_skb, sk);
1571                         opt_skb = xchg(&np->pktoptions, opt_skb);
1572                 } else {
1573                         __kfree_skb(opt_skb);
1574                         opt_skb = xchg(&np->pktoptions, NULL);
1575                 }
1576         }
1577
1578         if (opt_skb)
1579                 kfree_skb(opt_skb);
1580         return 0;
1581 }
1582
1583 static int tcp_v6_rcv(struct sk_buff *skb)
1584 {
1585         struct tcphdr *th;
1586         struct sock *sk;
1587         int ret;
1588         struct net *net = dev_net(skb->dev);
1589
1590         if (skb->pkt_type != PACKET_HOST)
1591                 goto discard_it;
1592
1593         /*
1594          *      Count it even if it's bad.
1595          */
1596         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1597
1598         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1599                 goto discard_it;
1600
1601         th = tcp_hdr(skb);
1602
1603         if (th->doff < sizeof(struct tcphdr)/4)
1604                 goto bad_packet;
1605         if (!pskb_may_pull(skb, th->doff*4))
1606                 goto discard_it;
1607
1608         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1609                 goto bad_packet;
1610
1611         th = tcp_hdr(skb);
1612         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1613         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1614                                     skb->len - th->doff*4);
1615         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1616         TCP_SKB_CB(skb)->when = 0;
1617         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
1618         TCP_SKB_CB(skb)->sacked = 0;
1619
1620         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1621         if (!sk)
1622                 goto no_tcp_socket;
1623
1624 process:
1625         if (sk->sk_state == TCP_TIME_WAIT)
1626                 goto do_time_wait;
1627
1628         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1629                 goto discard_and_relse;
1630
1631         if (sk_filter(sk, skb))
1632                 goto discard_and_relse;
1633
1634         skb->dev = NULL;
1635
1636         bh_lock_sock_nested(sk);
1637         ret = 0;
1638         if (!sock_owned_by_user(sk)) {
1639 #ifdef CONFIG_NET_DMA
1640                 struct tcp_sock *tp = tcp_sk(sk);
1641                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1642                         tp->ucopy.dma_chan = get_softnet_dma();
1643                 if (tp->ucopy.dma_chan)
1644                         ret = tcp_v6_do_rcv(sk, skb);
1645                 else
1646 #endif
1647                 {
1648                         if (!tcp_prequeue(sk, skb))
1649                                 ret = tcp_v6_do_rcv(sk, skb);
1650                 }
1651         } else
1652                 sk_add_backlog(sk, skb);
1653         bh_unlock_sock(sk);
1654
1655         sock_put(sk);
1656         return ret ? -1 : 0;
1657
1658 no_tcp_socket:
1659         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1660                 goto discard_it;
1661
1662         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1663 bad_packet:
1664                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1665         } else {
1666                 tcp_v6_send_reset(NULL, skb);
1667         }
1668
1669 discard_it:
1670
1671         /*
1672          *      Discard frame
1673          */
1674
1675         kfree_skb(skb);
1676         return 0;
1677
1678 discard_and_relse:
1679         sock_put(sk);
1680         goto discard_it;
1681
1682 do_time_wait:
1683         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1684                 inet_twsk_put(inet_twsk(sk));
1685                 goto discard_it;
1686         }
1687
1688         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1689                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1690                 inet_twsk_put(inet_twsk(sk));
1691                 goto discard_it;
1692         }
1693
1694         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1695         case TCP_TW_SYN:
1696         {
1697                 struct sock *sk2;
1698
1699                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1700                                             &ipv6_hdr(skb)->daddr,
1701                                             ntohs(th->dest), inet6_iif(skb));
1702                 if (sk2 != NULL) {
1703                         struct inet_timewait_sock *tw = inet_twsk(sk);
1704                         inet_twsk_deschedule(tw, &tcp_death_row);
1705                         inet_twsk_put(tw);
1706                         sk = sk2;
1707                         goto process;
1708                 }
1709                 /* Fall through to ACK */
1710         }
1711         case TCP_TW_ACK:
1712                 tcp_v6_timewait_ack(sk, skb);
1713                 break;
1714         case TCP_TW_RST:
1715                 goto no_tcp_socket;
1716         case TCP_TW_SUCCESS:;
1717         }
1718         goto discard_it;
1719 }
1720
1721 static int tcp_v6_remember_stamp(struct sock *sk)
1722 {
1723         /* Alas, not yet... */
1724         return 0;
1725 }
1726
1727 static struct inet_connection_sock_af_ops ipv6_specific = {
1728         .queue_xmit        = inet6_csk_xmit,
1729         .send_check        = tcp_v6_send_check,
1730         .rebuild_header    = inet6_sk_rebuild_header,
1731         .conn_request      = tcp_v6_conn_request,
1732         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1733         .remember_stamp    = tcp_v6_remember_stamp,
1734         .net_header_len    = sizeof(struct ipv6hdr),
1735         .setsockopt        = ipv6_setsockopt,
1736         .getsockopt        = ipv6_getsockopt,
1737         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1738         .sockaddr_len      = sizeof(struct sockaddr_in6),
1739         .bind_conflict     = inet6_csk_bind_conflict,
1740 #ifdef CONFIG_COMPAT
1741         .compat_setsockopt = compat_ipv6_setsockopt,
1742         .compat_getsockopt = compat_ipv6_getsockopt,
1743 #endif
1744 };
1745
1746 #ifdef CONFIG_TCP_MD5SIG
1747 static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1748         .md5_lookup     =       tcp_v6_md5_lookup,
1749         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1750         .md5_add        =       tcp_v6_md5_add_func,
1751         .md5_parse      =       tcp_v6_parse_md5_keys,
1752 };
1753 #endif
1754
1755 /*
1756  *      TCP over IPv4 via INET6 API
1757  */
1758
1759 static struct inet_connection_sock_af_ops ipv6_mapped = {
1760         .queue_xmit        = ip_queue_xmit,
1761         .send_check        = tcp_v4_send_check,
1762         .rebuild_header    = inet_sk_rebuild_header,
1763         .conn_request      = tcp_v6_conn_request,
1764         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1765         .remember_stamp    = tcp_v4_remember_stamp,
1766         .net_header_len    = sizeof(struct iphdr),
1767         .setsockopt        = ipv6_setsockopt,
1768         .getsockopt        = ipv6_getsockopt,
1769         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1770         .sockaddr_len      = sizeof(struct sockaddr_in6),
1771         .bind_conflict     = inet6_csk_bind_conflict,
1772 #ifdef CONFIG_COMPAT
1773         .compat_setsockopt = compat_ipv6_setsockopt,
1774         .compat_getsockopt = compat_ipv6_getsockopt,
1775 #endif
1776 };
1777
1778 #ifdef CONFIG_TCP_MD5SIG
1779 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1780         .md5_lookup     =       tcp_v4_md5_lookup,
1781         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1782         .md5_add        =       tcp_v6_md5_add_func,
1783         .md5_parse      =       tcp_v6_parse_md5_keys,
1784 };
1785 #endif
1786
1787 /* NOTE: A lot of things set to zero explicitly by call to
1788  *       sk_alloc() so need not be done here.
1789  */
1790 static int tcp_v6_init_sock(struct sock *sk)
1791 {
1792         struct inet_connection_sock *icsk = inet_csk(sk);
1793         struct tcp_sock *tp = tcp_sk(sk);
1794
1795         skb_queue_head_init(&tp->out_of_order_queue);
1796         tcp_init_xmit_timers(sk);
1797         tcp_prequeue_init(tp);
1798
1799         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1800         tp->mdev = TCP_TIMEOUT_INIT;
1801
1802         /* So many TCP implementations out there (incorrectly) count the
1803          * initial SYN frame in their delayed-ACK and congestion control
1804          * algorithms that we must have the following bandaid to talk
1805          * efficiently to them.  -DaveM
1806          */
1807         tp->snd_cwnd = 2;
1808
1809         /* See draft-stevens-tcpca-spec-01 for discussion of the
1810          * initialization of these values.
1811          */
1812         tp->snd_ssthresh = 0x7fffffff;
1813         tp->snd_cwnd_clamp = ~0;
1814         tp->mss_cache = 536;
1815
1816         tp->reordering = sysctl_tcp_reordering;
1817
1818         sk->sk_state = TCP_CLOSE;
1819
1820         icsk->icsk_af_ops = &ipv6_specific;
1821         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1822         icsk->icsk_sync_mss = tcp_sync_mss;
1823         sk->sk_write_space = sk_stream_write_space;
1824         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1825
1826 #ifdef CONFIG_TCP_MD5SIG
1827         tp->af_specific = &tcp_sock_ipv6_specific;
1828 #endif
1829
1830         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1831         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1832
1833         percpu_counter_inc(&tcp_sockets_allocated);
1834
1835         return 0;
1836 }
1837
1838 static void tcp_v6_destroy_sock(struct sock *sk)
1839 {
1840 #ifdef CONFIG_TCP_MD5SIG
1841         /* Clean up the MD5 key list */
1842         if (tcp_sk(sk)->md5sig_info)
1843                 tcp_v6_clear_md5_list(sk);
1844 #endif
1845         tcp_v4_destroy_sock(sk);
1846         inet6_destroy_sock(sk);
1847 }
1848
1849 #ifdef CONFIG_PROC_FS
1850 /* Proc filesystem TCPv6 sock list dumping. */
1851 static void get_openreq6(struct seq_file *seq,
1852                          struct sock *sk, struct request_sock *req, int i, int uid)
1853 {
1854         int ttd = req->expires - jiffies;
1855         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1856         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1857
1858         if (ttd < 0)
1859                 ttd = 0;
1860
1861         seq_printf(seq,
1862                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1863                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1864                    i,
1865                    src->s6_addr32[0], src->s6_addr32[1],
1866                    src->s6_addr32[2], src->s6_addr32[3],
1867                    ntohs(inet_rsk(req)->loc_port),
1868                    dest->s6_addr32[0], dest->s6_addr32[1],
1869                    dest->s6_addr32[2], dest->s6_addr32[3],
1870                    ntohs(inet_rsk(req)->rmt_port),
1871                    TCP_SYN_RECV,
1872                    0,0, /* could print option size, but that is af dependent. */
1873                    1,   /* timers active (only the expire timer) */
1874                    jiffies_to_clock_t(ttd),
1875                    req->retrans,
1876                    uid,
1877                    0,  /* non standard timer */
1878                    0, /* open_requests have no inode */
1879                    0, req);
1880 }
1881
1882 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1883 {
1884         struct in6_addr *dest, *src;
1885         __u16 destp, srcp;
1886         int timer_active;
1887         unsigned long timer_expires;
1888         struct inet_sock *inet = inet_sk(sp);
1889         struct tcp_sock *tp = tcp_sk(sp);
1890         const struct inet_connection_sock *icsk = inet_csk(sp);
1891         struct ipv6_pinfo *np = inet6_sk(sp);
1892
1893         dest  = &np->daddr;
1894         src   = &np->rcv_saddr;
1895         destp = ntohs(inet->dport);
1896         srcp  = ntohs(inet->sport);
1897
1898         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1899                 timer_active    = 1;
1900                 timer_expires   = icsk->icsk_timeout;
1901         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1902                 timer_active    = 4;
1903                 timer_expires   = icsk->icsk_timeout;
1904         } else if (timer_pending(&sp->sk_timer)) {
1905                 timer_active    = 2;
1906                 timer_expires   = sp->sk_timer.expires;
1907         } else {
1908                 timer_active    = 0;
1909                 timer_expires = jiffies;
1910         }
1911
1912         seq_printf(seq,
1913                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1914                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
1915                    i,
1916                    src->s6_addr32[0], src->s6_addr32[1],
1917                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1918                    dest->s6_addr32[0], dest->s6_addr32[1],
1919                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1920                    sp->sk_state,
1921                    tp->write_seq-tp->snd_una,
1922                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
1923                    timer_active,
1924                    jiffies_to_clock_t(timer_expires - jiffies),
1925                    icsk->icsk_retransmits,
1926                    sock_i_uid(sp),
1927                    icsk->icsk_probes_out,
1928                    sock_i_ino(sp),
1929                    atomic_read(&sp->sk_refcnt), sp,
1930                    jiffies_to_clock_t(icsk->icsk_rto),
1931                    jiffies_to_clock_t(icsk->icsk_ack.ato),
1932                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
1933                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
1934                    );
1935 }
1936
1937 static void get_timewait6_sock(struct seq_file *seq,
1938                                struct inet_timewait_sock *tw, int i)
1939 {
1940         struct in6_addr *dest, *src;
1941         __u16 destp, srcp;
1942         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
1943         int ttd = tw->tw_ttd - jiffies;
1944
1945         if (ttd < 0)
1946                 ttd = 0;
1947
1948         dest = &tw6->tw_v6_daddr;
1949         src  = &tw6->tw_v6_rcv_saddr;
1950         destp = ntohs(tw->tw_dport);
1951         srcp  = ntohs(tw->tw_sport);
1952
1953         seq_printf(seq,
1954                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1955                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1956                    i,
1957                    src->s6_addr32[0], src->s6_addr32[1],
1958                    src->s6_addr32[2], src->s6_addr32[3], srcp,
1959                    dest->s6_addr32[0], dest->s6_addr32[1],
1960                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
1961                    tw->tw_substate, 0, 0,
1962                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
1963                    atomic_read(&tw->tw_refcnt), tw);
1964 }
1965
1966 static int tcp6_seq_show(struct seq_file *seq, void *v)
1967 {
1968         struct tcp_iter_state *st;
1969
1970         if (v == SEQ_START_TOKEN) {
1971                 seq_puts(seq,
1972                          "  sl  "
1973                          "local_address                         "
1974                          "remote_address                        "
1975                          "st tx_queue rx_queue tr tm->when retrnsmt"
1976                          "   uid  timeout inode\n");
1977                 goto out;
1978         }
1979         st = seq->private;
1980
1981         switch (st->state) {
1982         case TCP_SEQ_STATE_LISTENING:
1983         case TCP_SEQ_STATE_ESTABLISHED:
1984                 get_tcp6_sock(seq, v, st->num);
1985                 break;
1986         case TCP_SEQ_STATE_OPENREQ:
1987                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
1988                 break;
1989         case TCP_SEQ_STATE_TIME_WAIT:
1990                 get_timewait6_sock(seq, v, st->num);
1991                 break;
1992         }
1993 out:
1994         return 0;
1995 }
1996
1997 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1998         .name           = "tcp6",
1999         .family         = AF_INET6,
2000         .seq_fops       = {
2001                 .owner          = THIS_MODULE,
2002         },
2003         .seq_ops        = {
2004                 .show           = tcp6_seq_show,
2005         },
2006 };
2007
2008 int tcp6_proc_init(struct net *net)
2009 {
2010         return tcp_proc_register(net, &tcp6_seq_afinfo);
2011 }
2012
2013 void tcp6_proc_exit(struct net *net)
2014 {
2015         tcp_proc_unregister(net, &tcp6_seq_afinfo);
2016 }
2017 #endif
2018
2019 struct proto tcpv6_prot = {
2020         .name                   = "TCPv6",
2021         .owner                  = THIS_MODULE,
2022         .close                  = tcp_close,
2023         .connect                = tcp_v6_connect,
2024         .disconnect             = tcp_disconnect,
2025         .accept                 = inet_csk_accept,
2026         .ioctl                  = tcp_ioctl,
2027         .init                   = tcp_v6_init_sock,
2028         .destroy                = tcp_v6_destroy_sock,
2029         .shutdown               = tcp_shutdown,
2030         .setsockopt             = tcp_setsockopt,
2031         .getsockopt             = tcp_getsockopt,
2032         .recvmsg                = tcp_recvmsg,
2033         .backlog_rcv            = tcp_v6_do_rcv,
2034         .hash                   = tcp_v6_hash,
2035         .unhash                 = inet_unhash,
2036         .get_port               = inet_csk_get_port,
2037         .enter_memory_pressure  = tcp_enter_memory_pressure,
2038         .sockets_allocated      = &tcp_sockets_allocated,
2039         .memory_allocated       = &tcp_memory_allocated,
2040         .memory_pressure        = &tcp_memory_pressure,
2041         .orphan_count           = &tcp_orphan_count,
2042         .sysctl_mem             = sysctl_tcp_mem,
2043         .sysctl_wmem            = sysctl_tcp_wmem,
2044         .sysctl_rmem            = sysctl_tcp_rmem,
2045         .max_header             = MAX_TCP_HEADER,
2046         .obj_size               = sizeof(struct tcp6_sock),
2047         .slab_flags             = SLAB_DESTROY_BY_RCU,
2048         .twsk_prot              = &tcp6_timewait_sock_ops,
2049         .rsk_prot               = &tcp6_request_sock_ops,
2050         .h.hashinfo             = &tcp_hashinfo,
2051 #ifdef CONFIG_COMPAT
2052         .compat_setsockopt      = compat_tcp_setsockopt,
2053         .compat_getsockopt      = compat_tcp_getsockopt,
2054 #endif
2055 };
2056
2057 static struct inet6_protocol tcpv6_protocol = {
2058         .handler        =       tcp_v6_rcv,
2059         .err_handler    =       tcp_v6_err,
2060         .gso_send_check =       tcp_v6_gso_send_check,
2061         .gso_segment    =       tcp_tso_segment,
2062         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2063 };
2064
2065 static struct inet_protosw tcpv6_protosw = {
2066         .type           =       SOCK_STREAM,
2067         .protocol       =       IPPROTO_TCP,
2068         .prot           =       &tcpv6_prot,
2069         .ops            =       &inet6_stream_ops,
2070         .capability     =       -1,
2071         .no_check       =       0,
2072         .flags          =       INET_PROTOSW_PERMANENT |
2073                                 INET_PROTOSW_ICSK,
2074 };
2075
2076 static int tcpv6_net_init(struct net *net)
2077 {
2078         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2079                                     SOCK_RAW, IPPROTO_TCP, net);
2080 }
2081
2082 static void tcpv6_net_exit(struct net *net)
2083 {
2084         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2085         inet_twsk_purge(net, &tcp_hashinfo, &tcp_death_row, AF_INET6);
2086 }
2087
2088 static struct pernet_operations tcpv6_net_ops = {
2089         .init = tcpv6_net_init,
2090         .exit = tcpv6_net_exit,
2091 };
2092
2093 int __init tcpv6_init(void)
2094 {
2095         int ret;
2096
2097         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2098         if (ret)
2099                 goto out;
2100
2101         /* register inet6 protocol */
2102         ret = inet6_register_protosw(&tcpv6_protosw);
2103         if (ret)
2104                 goto out_tcpv6_protocol;
2105
2106         ret = register_pernet_subsys(&tcpv6_net_ops);
2107         if (ret)
2108                 goto out_tcpv6_protosw;
2109 out:
2110         return ret;
2111
2112 out_tcpv6_protocol:
2113         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2114 out_tcpv6_protosw:
2115         inet6_unregister_protosw(&tcpv6_protosw);
2116         goto out;
2117 }
2118
2119 void tcpv6_exit(void)
2120 {
2121         unregister_pernet_subsys(&tcpv6_net_ops);
2122         inet6_unregister_protosw(&tcpv6_protosw);
2123         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2124 }