?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Staging: Merge branch 'tidspbridge-for-2.6.39' of git://dev.omapzoom.org/pub/scm...
[zen-stable.git] / net / ipv6 / tcp_ipv6.c
blob20aa95e373599bc6d98e8f451ffeb7393c9a695c
1 /*
2 * TCP over IPv6
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 *
8 * Based on:
9 * linux/net/ipv4/tcp.c
10 * linux/net/ipv4/tcp_input.c
11 * linux/net/ipv4/tcp_output.c
12 *
13 * Fixes:
14 * Hideaki YOSHIFUJI : sin6_scope_id support
15 * YOSHIFUJI Hideaki @USAGI and: Support IPV6_V6ONLY socket option, which
16 * Alexey Kuznetsov allow both IPv4 and IPv6 sockets to bind
17 * a single port at the same time.
18 * YOSHIFUJI Hideaki @USAGI: convert /proc/net/tcp6 to seq_file.
19 *
20 * This program is free software; you can redistribute it and/or
21 * modify it under the terms of the GNU General Public License
22 * as published by the Free Software Foundation; either version
23 * 2 of the License, or (at your option) any later version.
24 */
25
26 #include <linux/bottom_half.h>
27 #include <linux/module.h>
28 #include <linux/errno.h>
29 #include <linux/types.h>
30 #include <linux/socket.h>
31 #include <linux/sockios.h>
32 #include <linux/net.h>
33 #include <linux/jiffies.h>
34 #include <linux/in.h>
35 #include <linux/in6.h>
36 #include <linux/netdevice.h>
37 #include <linux/init.h>
38 #include <linux/jhash.h>
39 #include <linux/ipsec.h>
40 #include <linux/times.h>
41 #include <linux/slab.h>
42
43 #include <linux/ipv6.h>
44 #include <linux/icmpv6.h>
45 #include <linux/random.h>
46
47 #include <net/tcp.h>
48 #include <net/ndisc.h>
49 #include <net/inet6_hashtables.h>
50 #include <net/inet6_connection_sock.h>
51 #include <net/ipv6.h>
52 #include <net/transp_v6.h>
53 #include <net/addrconf.h>
54 #include <net/ip6_route.h>
55 #include <net/ip6_checksum.h>
56 #include <net/inet_ecn.h>
57 #include <net/protocol.h>
58 #include <net/xfrm.h>
59 #include <net/snmp.h>
60 #include <net/dsfield.h>
61 #include <net/timewait_sock.h>
62 #include <net/netdma.h>
63 #include <net/inet_common.h>
64
65 #include <asm/uaccess.h>
66
67 #include <linux/proc_fs.h>
68 #include <linux/seq_file.h>
69
70 #include <linux/crypto.h>
71 #include <linux/scatterlist.h>
72
73 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
74 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
75 struct request_sock *req);
76
77 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
78 static void __tcp_v6_send_check(struct sk_buff *skb,
79 struct in6_addr *saddr,
80 struct in6_addr *daddr);
81
82 static const struct inet_connection_sock_af_ops ipv6_mapped;
83 static const struct inet_connection_sock_af_ops ipv6_specific;
84 #ifdef CONFIG_TCP_MD5SIG
85 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
86 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
87 #else
88 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
89 struct in6_addr *addr)
90 {
91 return NULL;
92 }
93 #endif
94
95 static void tcp_v6_hash(struct sock *sk)
96 {
97 if (sk->sk_state != TCP_CLOSE) {
98 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
99 tcp_prot.hash(sk);
100 return;
101 }
102 local_bh_disable();
103 __inet6_hash(sk, NULL);
104 local_bh_enable();
105 }
106 }
107
108 static __inline__ __sum16 tcp_v6_check(int len,
109 struct in6_addr *saddr,
110 struct in6_addr *daddr,
111 __wsum base)
112 {
113 return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
114 }
115
116 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
117 {
118 return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
119 ipv6_hdr(skb)->saddr.s6_addr32,
120 tcp_hdr(skb)->dest,
121 tcp_hdr(skb)->source);
122 }
123
124 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
125 int addr_len)
126 {
127 struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
128 struct inet_sock *inet = inet_sk(sk);
129 struct inet_connection_sock *icsk = inet_csk(sk);
130 struct ipv6_pinfo *np = inet6_sk(sk);
131 struct tcp_sock *tp = tcp_sk(sk);
132 struct in6_addr *saddr = NULL, *final_p, final;
133 struct rt6_info *rt;
134 struct flowi fl;
135 struct dst_entry *dst;
136 int addr_type;
137 int err;
138
139 if (addr_len < SIN6_LEN_RFC2133)
140 return -EINVAL;
141
142 if (usin->sin6_family != AF_INET6)
143 return -EAFNOSUPPORT;
144
145 memset(&fl, 0, sizeof(fl));
146
147 if (np->sndflow) {
148 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
149 IP6_ECN_flow_init(fl.fl6_flowlabel);
150 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
151 struct ip6_flowlabel *flowlabel;
152 flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
153 if (flowlabel == NULL)
154 return -EINVAL;
155 ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
156 fl6_sock_release(flowlabel);
157 }
158 }
159
160 /*
161 * connect() to INADDR_ANY means loopback (BSD'ism).
162 */
163
164 if(ipv6_addr_any(&usin->sin6_addr))
165 usin->sin6_addr.s6_addr[15] = 0x1;
166
167 addr_type = ipv6_addr_type(&usin->sin6_addr);
168
169 if(addr_type & IPV6_ADDR_MULTICAST)
170 return -ENETUNREACH;
171
172 if (addr_type&IPV6_ADDR_LINKLOCAL) {
173 if (addr_len >= sizeof(struct sockaddr_in6) &&
174 usin->sin6_scope_id) {
175 /* If interface is set while binding, indices
176 * must coincide.
177 */
178 if (sk->sk_bound_dev_if &&
179 sk->sk_bound_dev_if != usin->sin6_scope_id)
180 return -EINVAL;
181
182 sk->sk_bound_dev_if = usin->sin6_scope_id;
183 }
184
185 /* Connect to link-local address requires an interface */
186 if (!sk->sk_bound_dev_if)
187 return -EINVAL;
188 }
189
190 if (tp->rx_opt.ts_recent_stamp &&
191 !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
192 tp->rx_opt.ts_recent = 0;
193 tp->rx_opt.ts_recent_stamp = 0;
194 tp->write_seq = 0;
195 }
196
197 ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
198 np->flow_label = fl.fl6_flowlabel;
199
200 /*
201 * TCP over IPv4
202 */
203
204 if (addr_type == IPV6_ADDR_MAPPED) {
205 u32 exthdrlen = icsk->icsk_ext_hdr_len;
206 struct sockaddr_in sin;
207
208 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
209
210 if (__ipv6_only_sock(sk))
211 return -ENETUNREACH;
212
213 sin.sin_family = AF_INET;
214 sin.sin_port = usin->sin6_port;
215 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
216
217 icsk->icsk_af_ops = &ipv6_mapped;
218 sk->sk_backlog_rcv = tcp_v4_do_rcv;
219 #ifdef CONFIG_TCP_MD5SIG
220 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
221 #endif
222
223 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
224
225 if (err) {
226 icsk->icsk_ext_hdr_len = exthdrlen;
227 icsk->icsk_af_ops = &ipv6_specific;
228 sk->sk_backlog_rcv = tcp_v6_do_rcv;
229 #ifdef CONFIG_TCP_MD5SIG
230 tp->af_specific = &tcp_sock_ipv6_specific;
231 #endif
232 goto failure;
233 } else {
234 ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
235 ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
236 &np->rcv_saddr);
237 }
238
239 return err;
240 }
241
242 if (!ipv6_addr_any(&np->rcv_saddr))
243 saddr = &np->rcv_saddr;
244
245 fl.proto = IPPROTO_TCP;
246 ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
247 ipv6_addr_copy(&fl.fl6_src,
248 (saddr ? saddr : &np->saddr));
249 fl.oif = sk->sk_bound_dev_if;
250 fl.mark = sk->sk_mark;
251 fl.fl_ip_dport = usin->sin6_port;
252 fl.fl_ip_sport = inet->inet_sport;
253
254 final_p = fl6_update_dst(&fl, np->opt, &final);
255
256 security_sk_classify_flow(sk, &fl);
257
258 err = ip6_dst_lookup(sk, &dst, &fl);
259 if (err)
260 goto failure;
261 if (final_p)
262 ipv6_addr_copy(&fl.fl6_dst, final_p);
263
264 err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
265 if (err < 0) {
266 if (err == -EREMOTE)
267 err = ip6_dst_blackhole(sk, &dst, &fl);
268 if (err < 0)
269 goto failure;
270 }
271
272 if (saddr == NULL) {
273 saddr = &fl.fl6_src;
274 ipv6_addr_copy(&np->rcv_saddr, saddr);
275 }
276
277 /* set the source address */
278 ipv6_addr_copy(&np->saddr, saddr);
279 inet->inet_rcv_saddr = LOOPBACK4_IPV6;
280
281 sk->sk_gso_type = SKB_GSO_TCPV6;
282 __ip6_dst_store(sk, dst, NULL, NULL);
283
284 rt = (struct rt6_info *) dst;
285 if (tcp_death_row.sysctl_tw_recycle &&
286 !tp->rx_opt.ts_recent_stamp &&
287 ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
288 struct inet_peer *peer = rt6_get_peer(rt);
289 /*
290 * VJ's idea. We save last timestamp seen from
291 * the destination in peer table, when entering state
292 * TIME-WAIT * and initialize rx_opt.ts_recent from it,
293 * when trying new connection.
294 */
295 if (peer) {
296 inet_peer_refcheck(peer);
297 if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
298 tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
299 tp->rx_opt.ts_recent = peer->tcp_ts;
300 }
301 }
302 }
303
304 icsk->icsk_ext_hdr_len = 0;
305 if (np->opt)
306 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
307 np->opt->opt_nflen);
308
309 tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
310
311 inet->inet_dport = usin->sin6_port;
312
313 tcp_set_state(sk, TCP_SYN_SENT);
314 err = inet6_hash_connect(&tcp_death_row, sk);
315 if (err)
316 goto late_failure;
317
318 if (!tp->write_seq)
319 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
320 np->daddr.s6_addr32,
321 inet->inet_sport,
322 inet->inet_dport);
323
324 err = tcp_connect(sk);
325 if (err)
326 goto late_failure;
327
328 return 0;
329
330 late_failure:
331 tcp_set_state(sk, TCP_CLOSE);
332 __sk_dst_reset(sk);
333 failure:
334 inet->inet_dport = 0;
335 sk->sk_route_caps = 0;
336 return err;
337 }
338
339 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
340 u8 type, u8 code, int offset, __be32 info)
341 {
342 struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
343 const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
344 struct ipv6_pinfo *np;
345 struct sock *sk;
346 int err;
347 struct tcp_sock *tp;
348 __u32 seq;
349 struct net *net = dev_net(skb->dev);
350
351 sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
352 th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
353
354 if (sk == NULL) {
355 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
356 ICMP6_MIB_INERRORS);
357 return;
358 }
359
360 if (sk->sk_state == TCP_TIME_WAIT) {
361 inet_twsk_put(inet_twsk(sk));
362 return;
363 }
364
365 bh_lock_sock(sk);
366 if (sock_owned_by_user(sk))
367 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
368
369 if (sk->sk_state == TCP_CLOSE)
370 goto out;
371
372 if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
373 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
374 goto out;
375 }
376
377 tp = tcp_sk(sk);
378 seq = ntohl(th->seq);
379 if (sk->sk_state != TCP_LISTEN &&
380 !between(seq, tp->snd_una, tp->snd_nxt)) {
381 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
382 goto out;
383 }
384
385 np = inet6_sk(sk);
386
387 if (type == ICMPV6_PKT_TOOBIG) {
388 struct dst_entry *dst = NULL;
389
390 if (sock_owned_by_user(sk))
391 goto out;
392 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
393 goto out;
394
395 /* icmp should have updated the destination cache entry */
396 dst = __sk_dst_check(sk, np->dst_cookie);
397
398 if (dst == NULL) {
399 struct inet_sock *inet = inet_sk(sk);
400 struct flowi fl;
401
402 /* BUGGG_FUTURE: Again, it is not clear how
403 to handle rthdr case. Ignore this complexity
404 for now.
405 */
406 memset(&fl, 0, sizeof(fl));
407 fl.proto = IPPROTO_TCP;
408 ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
409 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
410 fl.oif = sk->sk_bound_dev_if;
411 fl.mark = sk->sk_mark;
412 fl.fl_ip_dport = inet->inet_dport;
413 fl.fl_ip_sport = inet->inet_sport;
414 security_skb_classify_flow(skb, &fl);
415
416 if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
417 sk->sk_err_soft = -err;
418 goto out;
419 }
420
421 if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
422 sk->sk_err_soft = -err;
423 goto out;
424 }
425
426 } else
427 dst_hold(dst);
428
429 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
430 tcp_sync_mss(sk, dst_mtu(dst));
431 tcp_simple_retransmit(sk);
432 } /* else let the usual retransmit timer handle it */
433 dst_release(dst);
434 goto out;
435 }
436
437 icmpv6_err_convert(type, code, &err);
438
439 /* Might be for an request_sock */
440 switch (sk->sk_state) {
441 struct request_sock *req, **prev;
442 case TCP_LISTEN:
443 if (sock_owned_by_user(sk))
444 goto out;
445
446 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
447 &hdr->saddr, inet6_iif(skb));
448 if (!req)
449 goto out;
450
451 /* ICMPs are not backlogged, hence we cannot get
452 * an established socket here.
453 */
454 WARN_ON(req->sk != NULL);
455
456 if (seq != tcp_rsk(req)->snt_isn) {
457 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
458 goto out;
459 }
460
461 inet_csk_reqsk_queue_drop(sk, req, prev);
462 goto out;
463
464 case TCP_SYN_SENT:
465 case TCP_SYN_RECV: /* Cannot happen.
466 It can, it SYNs are crossed. --ANK */
467 if (!sock_owned_by_user(sk)) {
468 sk->sk_err = err;
469 sk->sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */
470
471 tcp_done(sk);
472 } else
473 sk->sk_err_soft = err;
474 goto out;
475 }
476
477 if (!sock_owned_by_user(sk) && np->recverr) {
478 sk->sk_err = err;
479 sk->sk_error_report(sk);
480 } else
481 sk->sk_err_soft = err;
482
483 out:
484 bh_unlock_sock(sk);
485 sock_put(sk);
486 }
487
488
489 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
490 struct request_values *rvp)
491 {
492 struct inet6_request_sock *treq = inet6_rsk(req);
493 struct ipv6_pinfo *np = inet6_sk(sk);
494 struct sk_buff * skb;
495 struct ipv6_txoptions *opt = NULL;
496 struct in6_addr * final_p, final;
497 struct flowi fl;
498 struct dst_entry *dst;
499 int err = -1;
500
501 memset(&fl, 0, sizeof(fl));
502 fl.proto = IPPROTO_TCP;
503 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
504 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
505 fl.fl6_flowlabel = 0;
506 fl.oif = treq->iif;
507 fl.mark = sk->sk_mark;
508 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
509 fl.fl_ip_sport = inet_rsk(req)->loc_port;
510 security_req_classify_flow(req, &fl);
511
512 opt = np->opt;
513 final_p = fl6_update_dst(&fl, opt, &final);
514
515 err = ip6_dst_lookup(sk, &dst, &fl);
516 if (err)
517 goto done;
518 if (final_p)
519 ipv6_addr_copy(&fl.fl6_dst, final_p);
520 if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
521 goto done;
522
523 skb = tcp_make_synack(sk, dst, req, rvp);
524 if (skb) {
525 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
526
527 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
528 err = ip6_xmit(sk, skb, &fl, opt);
529 err = net_xmit_eval(err);
530 }
531
532 done:
533 if (opt && opt != np->opt)
534 sock_kfree_s(sk, opt, opt->tot_len);
535 dst_release(dst);
536 return err;
537 }
538
539 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
540 struct request_values *rvp)
541 {
542 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
543 return tcp_v6_send_synack(sk, req, rvp);
544 }
545
546 static inline void syn_flood_warning(struct sk_buff *skb)
547 {
548 #ifdef CONFIG_SYN_COOKIES
549 if (sysctl_tcp_syncookies)
550 printk(KERN_INFO
551 "TCPv6: Possible SYN flooding on port %d. "
552 "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
553 else
554 #endif
555 printk(KERN_INFO
556 "TCPv6: Possible SYN flooding on port %d. "
557 "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
558 }
559
560 static void tcp_v6_reqsk_destructor(struct request_sock *req)
561 {
562 kfree_skb(inet6_rsk(req)->pktopts);
563 }
564
565 #ifdef CONFIG_TCP_MD5SIG
566 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
567 struct in6_addr *addr)
568 {
569 struct tcp_sock *tp = tcp_sk(sk);
570 int i;
571
572 BUG_ON(tp == NULL);
573
574 if (!tp->md5sig_info || !tp->md5sig_info->entries6)
575 return NULL;
576
577 for (i = 0; i < tp->md5sig_info->entries6; i++) {
578 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
579 return &tp->md5sig_info->keys6[i].base;
580 }
581 return NULL;
582 }
583
584 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
585 struct sock *addr_sk)
586 {
587 return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
588 }
589
590 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
591 struct request_sock *req)
592 {
593 return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
594 }
595
596 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
597 char *newkey, u8 newkeylen)
598 {
599 /* Add key to the list */
600 struct tcp_md5sig_key *key;
601 struct tcp_sock *tp = tcp_sk(sk);
602 struct tcp6_md5sig_key *keys;
603
604 key = tcp_v6_md5_do_lookup(sk, peer);
605 if (key) {
606 /* modify existing entry - just update that one */
607 kfree(key->key);
608 key->key = newkey;
609 key->keylen = newkeylen;
610 } else {
611 /* reallocate new list if current one is full. */
612 if (!tp->md5sig_info) {
613 tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
614 if (!tp->md5sig_info) {
615 kfree(newkey);
616 return -ENOMEM;
617 }
618 sk_nocaps_add(sk, NETIF_F_GSO_MASK);
619 }
620 if (tcp_alloc_md5sig_pool(sk) == NULL) {
621 kfree(newkey);
622 return -ENOMEM;
623 }
624 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
625 keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
626 (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
627
628 if (!keys) {
629 tcp_free_md5sig_pool();
630 kfree(newkey);
631 return -ENOMEM;
632 }
633
634 if (tp->md5sig_info->entries6)
635 memmove(keys, tp->md5sig_info->keys6,
636 (sizeof (tp->md5sig_info->keys6[0]) *
637 tp->md5sig_info->entries6));
638
639 kfree(tp->md5sig_info->keys6);
640 tp->md5sig_info->keys6 = keys;
641 tp->md5sig_info->alloced6++;
642 }
643
644 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
645 peer);
646 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
647 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
648
649 tp->md5sig_info->entries6++;
650 }
651 return 0;
652 }
653
654 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
655 u8 *newkey, __u8 newkeylen)
656 {
657 return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
658 newkey, newkeylen);
659 }
660
661 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
662 {
663 struct tcp_sock *tp = tcp_sk(sk);
664 int i;
665
666 for (i = 0; i < tp->md5sig_info->entries6; i++) {
667 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
668 /* Free the key */
669 kfree(tp->md5sig_info->keys6[i].base.key);
670 tp->md5sig_info->entries6--;
671
672 if (tp->md5sig_info->entries6 == 0) {
673 kfree(tp->md5sig_info->keys6);
674 tp->md5sig_info->keys6 = NULL;
675 tp->md5sig_info->alloced6 = 0;
676 } else {
677 /* shrink the database */
678 if (tp->md5sig_info->entries6 != i)
679 memmove(&tp->md5sig_info->keys6[i],
680 &tp->md5sig_info->keys6[i+1],
681 (tp->md5sig_info->entries6 - i)
682 * sizeof (tp->md5sig_info->keys6[0]));
683 }
684 tcp_free_md5sig_pool();
685 return 0;
686 }
687 }
688 return -ENOENT;
689 }
690
691 static void tcp_v6_clear_md5_list (struct sock *sk)
692 {
693 struct tcp_sock *tp = tcp_sk(sk);
694 int i;
695
696 if (tp->md5sig_info->entries6) {
697 for (i = 0; i < tp->md5sig_info->entries6; i++)
698 kfree(tp->md5sig_info->keys6[i].base.key);
699 tp->md5sig_info->entries6 = 0;
700 tcp_free_md5sig_pool();
701 }
702
703 kfree(tp->md5sig_info->keys6);
704 tp->md5sig_info->keys6 = NULL;
705 tp->md5sig_info->alloced6 = 0;
706
707 if (tp->md5sig_info->entries4) {
708 for (i = 0; i < tp->md5sig_info->entries4; i++)
709 kfree(tp->md5sig_info->keys4[i].base.key);
710 tp->md5sig_info->entries4 = 0;
711 tcp_free_md5sig_pool();
712 }
713
714 kfree(tp->md5sig_info->keys4);
715 tp->md5sig_info->keys4 = NULL;
716 tp->md5sig_info->alloced4 = 0;
717 }
718
719 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
720 int optlen)
721 {
722 struct tcp_md5sig cmd;
723 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
724 u8 *newkey;
725
726 if (optlen < sizeof(cmd))
727 return -EINVAL;
728
729 if (copy_from_user(&cmd, optval, sizeof(cmd)))
730 return -EFAULT;
731
732 if (sin6->sin6_family != AF_INET6)
733 return -EINVAL;
734
735 if (!cmd.tcpm_keylen) {
736 if (!tcp_sk(sk)->md5sig_info)
737 return -ENOENT;
738 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
739 return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
740 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
741 }
742
743 if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
744 return -EINVAL;
745
746 if (!tcp_sk(sk)->md5sig_info) {
747 struct tcp_sock *tp = tcp_sk(sk);
748 struct tcp_md5sig_info *p;
749
750 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
751 if (!p)
752 return -ENOMEM;
753
754 tp->md5sig_info = p;
755 sk_nocaps_add(sk, NETIF_F_GSO_MASK);
756 }
757
758 newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
759 if (!newkey)
760 return -ENOMEM;
761 if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
762 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
763 newkey, cmd.tcpm_keylen);
764 }
765 return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
766 }
767
768 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
769 struct in6_addr *daddr,
770 struct in6_addr *saddr, int nbytes)
771 {
772 struct tcp6_pseudohdr *bp;
773 struct scatterlist sg;
774
775 bp = &hp->md5_blk.ip6;
776 /* 1. TCP pseudo-header (RFC2460) */
777 ipv6_addr_copy(&bp->saddr, saddr);
778 ipv6_addr_copy(&bp->daddr, daddr);
779 bp->protocol = cpu_to_be32(IPPROTO_TCP);
780 bp->len = cpu_to_be32(nbytes);
781
782 sg_init_one(&sg, bp, sizeof(*bp));
783 return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
784 }
785
786 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
787 struct in6_addr *daddr, struct in6_addr *saddr,
788 struct tcphdr *th)
789 {
790 struct tcp_md5sig_pool *hp;
791 struct hash_desc *desc;
792
793 hp = tcp_get_md5sig_pool();
794 if (!hp)
795 goto clear_hash_noput;
796 desc = &hp->md5_desc;
797
798 if (crypto_hash_init(desc))
799 goto clear_hash;
800 if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
801 goto clear_hash;
802 if (tcp_md5_hash_header(hp, th))
803 goto clear_hash;
804 if (tcp_md5_hash_key(hp, key))
805 goto clear_hash;
806 if (crypto_hash_final(desc, md5_hash))
807 goto clear_hash;
808
809 tcp_put_md5sig_pool();
810 return 0;
811
812 clear_hash:
813 tcp_put_md5sig_pool();
814 clear_hash_noput:
815 memset(md5_hash, 0, 16);
816 return 1;
817 }
818
819 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
820 struct sock *sk, struct request_sock *req,
821 struct sk_buff *skb)
822 {
823 struct in6_addr *saddr, *daddr;
824 struct tcp_md5sig_pool *hp;
825 struct hash_desc *desc;
826 struct tcphdr *th = tcp_hdr(skb);
827
828 if (sk) {
829 saddr = &inet6_sk(sk)->saddr;
830 daddr = &inet6_sk(sk)->daddr;
831 } else if (req) {
832 saddr = &inet6_rsk(req)->loc_addr;
833 daddr = &inet6_rsk(req)->rmt_addr;
834 } else {
835 struct ipv6hdr *ip6h = ipv6_hdr(skb);
836 saddr = &ip6h->saddr;
837 daddr = &ip6h->daddr;
838 }
839
840 hp = tcp_get_md5sig_pool();
841 if (!hp)
842 goto clear_hash_noput;
843 desc = &hp->md5_desc;
844
845 if (crypto_hash_init(desc))
846 goto clear_hash;
847
848 if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
849 goto clear_hash;
850 if (tcp_md5_hash_header(hp, th))
851 goto clear_hash;
852 if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
853 goto clear_hash;
854 if (tcp_md5_hash_key(hp, key))
855 goto clear_hash;
856 if (crypto_hash_final(desc, md5_hash))
857 goto clear_hash;
858
859 tcp_put_md5sig_pool();
860 return 0;
861
862 clear_hash:
863 tcp_put_md5sig_pool();
864 clear_hash_noput:
865 memset(md5_hash, 0, 16);
866 return 1;
867 }
868
869 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
870 {
871 __u8 *hash_location = NULL;
872 struct tcp_md5sig_key *hash_expected;
873 struct ipv6hdr *ip6h = ipv6_hdr(skb);
874 struct tcphdr *th = tcp_hdr(skb);
875 int genhash;
876 u8 newhash[16];
877
878 hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
879 hash_location = tcp_parse_md5sig_option(th);
880
881 /* We've parsed the options - do we have a hash? */
882 if (!hash_expected && !hash_location)
883 return 0;
884
885 if (hash_expected && !hash_location) {
886 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
887 return 1;
888 }
889
890 if (!hash_expected && hash_location) {
891 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
892 return 1;
893 }
894
895 /* check the signature */
896 genhash = tcp_v6_md5_hash_skb(newhash,
897 hash_expected,
898 NULL, NULL, skb);
899
900 if (genhash || memcmp(hash_location, newhash, 16) != 0) {
901 if (net_ratelimit()) {
902 printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
903 genhash ? "failed" : "mismatch",
904 &ip6h->saddr, ntohs(th->source),
905 &ip6h->daddr, ntohs(th->dest));
906 }
907 return 1;
908 }
909 return 0;
910 }
911 #endif
912
913 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
914 .family = AF_INET6,
915 .obj_size = sizeof(struct tcp6_request_sock),
916 .rtx_syn_ack = tcp_v6_rtx_synack,
917 .send_ack = tcp_v6_reqsk_send_ack,
918 .destructor = tcp_v6_reqsk_destructor,
919 .send_reset = tcp_v6_send_reset,
920 .syn_ack_timeout = tcp_syn_ack_timeout,
921 };
922
923 #ifdef CONFIG_TCP_MD5SIG
924 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
925 .md5_lookup = tcp_v6_reqsk_md5_lookup,
926 .calc_md5_hash = tcp_v6_md5_hash_skb,
927 };
928 #endif
929
930 static void __tcp_v6_send_check(struct sk_buff *skb,
931 struct in6_addr *saddr, struct in6_addr *daddr)
932 {
933 struct tcphdr *th = tcp_hdr(skb);
934
935 if (skb->ip_summed == CHECKSUM_PARTIAL) {
936 th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
937 skb->csum_start = skb_transport_header(skb) - skb->head;
938 skb->csum_offset = offsetof(struct tcphdr, check);
939 } else {
940 th->check = tcp_v6_check(skb->len, saddr, daddr,
941 csum_partial(th, th->doff << 2,
942 skb->csum));
943 }
944 }
945
946 static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
947 {
948 struct ipv6_pinfo *np = inet6_sk(sk);
949
950 __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
951 }
952
953 static int tcp_v6_gso_send_check(struct sk_buff *skb)
954 {
955 struct ipv6hdr *ipv6h;
956 struct tcphdr *th;
957
958 if (!pskb_may_pull(skb, sizeof(*th)))
959 return -EINVAL;
960
961 ipv6h = ipv6_hdr(skb);
962 th = tcp_hdr(skb);
963
964 th->check = 0;
965 skb->ip_summed = CHECKSUM_PARTIAL;
966 __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
967 return 0;
968 }
969
970 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
971 struct sk_buff *skb)
972 {
973 struct ipv6hdr *iph = skb_gro_network_header(skb);
974
975 switch (skb->ip_summed) {
976 case CHECKSUM_COMPLETE:
977 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
978 skb->csum)) {
979 skb->ip_summed = CHECKSUM_UNNECESSARY;
980 break;
981 }
982
983 /* fall through */
984 case CHECKSUM_NONE:
985 NAPI_GRO_CB(skb)->flush = 1;
986 return NULL;
987 }
988
989 return tcp_gro_receive(head, skb);
990 }
991
992 static int tcp6_gro_complete(struct sk_buff *skb)
993 {
994 struct ipv6hdr *iph = ipv6_hdr(skb);
995 struct tcphdr *th = tcp_hdr(skb);
996
997 th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
998 &iph->saddr, &iph->daddr, 0);
999 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
1000
1001 return tcp_gro_complete(skb);
1002 }
1003
1004 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
1005 u32 ts, struct tcp_md5sig_key *key, int rst)
1006 {
1007 struct tcphdr *th = tcp_hdr(skb), *t1;
1008 struct sk_buff *buff;
1009 struct flowi fl;
1010 struct net *net = dev_net(skb_dst(skb)->dev);
1011 struct sock *ctl_sk = net->ipv6.tcp_sk;
1012 unsigned int tot_len = sizeof(struct tcphdr);
1013 struct dst_entry *dst;
1014 __be32 *topt;
1015
1016 if (ts)
1017 tot_len += TCPOLEN_TSTAMP_ALIGNED;
1018 #ifdef CONFIG_TCP_MD5SIG
1019 if (key)
1020 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1021 #endif
1022
1023 buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1024 GFP_ATOMIC);
1025 if (buff == NULL)
1026 return;
1027
1028 skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1029
1030 t1 = (struct tcphdr *) skb_push(buff, tot_len);
1031 skb_reset_transport_header(buff);
1032
1033 /* Swap the send and the receive. */
1034 memset(t1, 0, sizeof(*t1));
1035 t1->dest = th->source;
1036 t1->source = th->dest;
1037 t1->doff = tot_len / 4;
1038 t1->seq = htonl(seq);
1039 t1->ack_seq = htonl(ack);
1040 t1->ack = !rst || !th->ack;
1041 t1->rst = rst;
1042 t1->window = htons(win);
1043
1044 topt = (__be32 *)(t1 + 1);
1045
1046 if (ts) {
1047 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1048 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1049 *topt++ = htonl(tcp_time_stamp);
1050 *topt++ = htonl(ts);
1051 }
1052
1053 #ifdef CONFIG_TCP_MD5SIG
1054 if (key) {
1055 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1056 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1057 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
1058 &ipv6_hdr(skb)->saddr,
1059 &ipv6_hdr(skb)->daddr, t1);
1060 }
1061 #endif
1062
1063 memset(&fl, 0, sizeof(fl));
1064 ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1065 ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1066
1067 buff->ip_summed = CHECKSUM_PARTIAL;
1068 buff->csum = 0;
1069
1070 __tcp_v6_send_check(buff, &fl.fl6_src, &fl.fl6_dst);
1071
1072 fl.proto = IPPROTO_TCP;
1073 fl.oif = inet6_iif(skb);
1074 fl.fl_ip_dport = t1->dest;
1075 fl.fl_ip_sport = t1->source;
1076 security_skb_classify_flow(skb, &fl);
1077
1078 /* Pass a socket to ip6_dst_lookup either it is for RST
1079 * Underlying function will use this to retrieve the network
1080 * namespace
1081 */
1082 if (!ip6_dst_lookup(ctl_sk, &dst, &fl)) {
1083 if (xfrm_lookup(net, &dst, &fl, NULL, 0) >= 0) {
1084 skb_dst_set(buff, dst);
1085 ip6_xmit(ctl_sk, buff, &fl, NULL);
1086 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
1087 if (rst)
1088 TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
1089 return;
1090 }
1091 }
1092
1093 kfree_skb(buff);
1094 }
1095
1096 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
1097 {
1098 struct tcphdr *th = tcp_hdr(skb);
1099 u32 seq = 0, ack_seq = 0;
1100 struct tcp_md5sig_key *key = NULL;
1101
1102 if (th->rst)
1103 return;
1104
1105 if (!ipv6_unicast_destination(skb))
1106 return;
1107
1108 #ifdef CONFIG_TCP_MD5SIG
1109 if (sk)
1110 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1111 #endif
1112
1113 if (th->ack)
1114 seq = ntohl(th->ack_seq);
1115 else
1116 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
1117 (th->doff << 2);
1118
1119 tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1);
1120 }
1121
1122 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
1123 struct tcp_md5sig_key *key)
1124 {
1125 tcp_v6_send_response(skb, seq, ack, win, ts, key, 0);
1126 }
1127
1128 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1129 {
1130 struct inet_timewait_sock *tw = inet_twsk(sk);
1131 struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1132
1133 tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1134 tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1135 tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw));
1136
1137 inet_twsk_put(tw);
1138 }
1139
1140 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1141 struct request_sock *req)
1142 {
1143 tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1144 tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
1145 }
1146
1147
1148 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1149 {
1150 struct request_sock *req, **prev;
1151 const struct tcphdr *th = tcp_hdr(skb);
1152 struct sock *nsk;
1153
1154 /* Find possible connection requests. */
1155 req = inet6_csk_search_req(sk, &prev, th->source,
1156 &ipv6_hdr(skb)->saddr,
1157 &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1158 if (req)
1159 return tcp_check_req(sk, skb, req, prev);
1160
1161 nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1162 &ipv6_hdr(skb)->saddr, th->source,
1163 &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1164
1165 if (nsk) {
1166 if (nsk->sk_state != TCP_TIME_WAIT) {
1167 bh_lock_sock(nsk);
1168 return nsk;
1169 }
1170 inet_twsk_put(inet_twsk(nsk));
1171 return NULL;
1172 }
1173
1174 #ifdef CONFIG_SYN_COOKIES
1175 if (!th->syn)
1176 sk = cookie_v6_check(sk, skb);
1177 #endif
1178 return sk;
1179 }
1180
1181 /* FIXME: this is substantially similar to the ipv4 code.
1182 * Can some kind of merge be done? -- erics
1183 */
1184 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1185 {
1186 struct tcp_extend_values tmp_ext;
1187 struct tcp_options_received tmp_opt;
1188 u8 *hash_location;
1189 struct request_sock *req;
1190 struct inet6_request_sock *treq;
1191 struct ipv6_pinfo *np = inet6_sk(sk);
1192 struct tcp_sock *tp = tcp_sk(sk);
1193 __u32 isn = TCP_SKB_CB(skb)->when;
1194 struct dst_entry *dst = NULL;
1195 #ifdef CONFIG_SYN_COOKIES
1196 int want_cookie = 0;
1197 #else
1198 #define want_cookie 0
1199 #endif
1200
1201 if (skb->protocol == htons(ETH_P_IP))
1202 return tcp_v4_conn_request(sk, skb);
1203
1204 if (!ipv6_unicast_destination(skb))
1205 goto drop;
1206
1207 if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1208 if (net_ratelimit())
1209 syn_flood_warning(skb);
1210 #ifdef CONFIG_SYN_COOKIES
1211 if (sysctl_tcp_syncookies)
1212 want_cookie = 1;
1213 else
1214 #endif
1215 goto drop;
1216 }
1217
1218 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1219 goto drop;
1220
1221 req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1222 if (req == NULL)
1223 goto drop;
1224
1225 #ifdef CONFIG_TCP_MD5SIG
1226 tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1227 #endif
1228
1229 tcp_clear_options(&tmp_opt);
1230 tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1231 tmp_opt.user_mss = tp->rx_opt.user_mss;
1232 tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1233
1234 if (tmp_opt.cookie_plus > 0 &&
1235 tmp_opt.saw_tstamp &&
1236 !tp->rx_opt.cookie_out_never &&
1237 (sysctl_tcp_cookie_size > 0 ||
1238 (tp->cookie_values != NULL &&
1239 tp->cookie_values->cookie_desired > 0))) {
1240 u8 *c;
1241 u32 *d;
1242 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1243 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1244
1245 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1246 goto drop_and_free;
1247
1248 /* Secret recipe starts with IP addresses */
1249 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1250 *mess++ ^= *d++;
1251 *mess++ ^= *d++;
1252 *mess++ ^= *d++;
1253 *mess++ ^= *d++;
1254 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1255 *mess++ ^= *d++;
1256 *mess++ ^= *d++;
1257 *mess++ ^= *d++;
1258 *mess++ ^= *d++;
1259
1260 /* plus variable length Initiator Cookie */
1261 c = (u8 *)mess;
1262 while (l-- > 0)
1263 *c++ ^= *hash_location++;
1264
1265 #ifdef CONFIG_SYN_COOKIES
1266 want_cookie = 0; /* not our kind of cookie */
1267 #endif
1268 tmp_ext.cookie_out_never = 0; /* false */
1269 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1270 } else if (!tp->rx_opt.cookie_in_always) {
1271 /* redundant indications, but ensure initialization. */
1272 tmp_ext.cookie_out_never = 1; /* true */
1273 tmp_ext.cookie_plus = 0;
1274 } else {
1275 goto drop_and_free;
1276 }
1277 tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1278
1279 if (want_cookie && !tmp_opt.saw_tstamp)
1280 tcp_clear_options(&tmp_opt);
1281
1282 tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1283 tcp_openreq_init(req, &tmp_opt, skb);
1284
1285 treq = inet6_rsk(req);
1286 ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1287 ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1288 if (!want_cookie || tmp_opt.tstamp_ok)
1289 TCP_ECN_create_request(req, tcp_hdr(skb));
1290
1291 if (!isn) {
1292 struct inet_peer *peer = NULL;
1293
1294 if (ipv6_opt_accepted(sk, skb) ||
1295 np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1296 np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1297 atomic_inc(&skb->users);
1298 treq->pktopts = skb;
1299 }
1300 treq->iif = sk->sk_bound_dev_if;
1301
1302 /* So that link locals have meaning */
1303 if (!sk->sk_bound_dev_if &&
1304 ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1305 treq->iif = inet6_iif(skb);
1306
1307 if (want_cookie) {
1308 isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1309 req->cookie_ts = tmp_opt.tstamp_ok;
1310 goto have_isn;
1311 }
1312
1313 /* VJ's idea. We save last timestamp seen
1314 * from the destination in peer table, when entering
1315 * state TIME-WAIT, and check against it before
1316 * accepting new connection request.
1317 *
1318 * If "isn" is not zero, this request hit alive
1319 * timewait bucket, so that all the necessary checks
1320 * are made in the function processing timewait state.
1321 */
1322 if (tmp_opt.saw_tstamp &&
1323 tcp_death_row.sysctl_tw_recycle &&
1324 (dst = inet6_csk_route_req(sk, req)) != NULL &&
1325 (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
1326 ipv6_addr_equal((struct in6_addr *)peer->daddr.a6,
1327 &treq->rmt_addr)) {
1328 inet_peer_refcheck(peer);
1329 if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1330 (s32)(peer->tcp_ts - req->ts_recent) >
1331 TCP_PAWS_WINDOW) {
1332 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1333 goto drop_and_release;
1334 }
1335 }
1336 /* Kill the following clause, if you dislike this way. */
1337 else if (!sysctl_tcp_syncookies &&
1338 (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1339 (sysctl_max_syn_backlog >> 2)) &&
1340 (!peer || !peer->tcp_ts_stamp) &&
1341 (!dst || !dst_metric(dst, RTAX_RTT))) {
1342 /* Without syncookies last quarter of
1343 * backlog is filled with destinations,
1344 * proven to be alive.
1345 * It means that we continue to communicate
1346 * to destinations, already remembered
1347 * to the moment of synflood.
1348 */
1349 LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1350 &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1351 goto drop_and_release;
1352 }
1353
1354 isn = tcp_v6_init_sequence(skb);
1355 }
1356 have_isn:
1357 tcp_rsk(req)->snt_isn = isn;
1358
1359 security_inet_conn_request(sk, skb, req);
1360
1361 if (tcp_v6_send_synack(sk, req,
1362 (struct request_values *)&tmp_ext) ||
1363 want_cookie)
1364 goto drop_and_free;
1365
1366 inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1367 return 0;
1368
1369 drop_and_release:
1370 dst_release(dst);
1371 drop_and_free:
1372 reqsk_free(req);
1373 drop:
1374 return 0; /* don't send reset */
1375 }
1376
1377 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1378 struct request_sock *req,
1379 struct dst_entry *dst)
1380 {
1381 struct inet6_request_sock *treq;
1382 struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1383 struct tcp6_sock *newtcp6sk;
1384 struct inet_sock *newinet;
1385 struct tcp_sock *newtp;
1386 struct sock *newsk;
1387 struct ipv6_txoptions *opt;
1388 #ifdef CONFIG_TCP_MD5SIG
1389 struct tcp_md5sig_key *key;
1390 #endif
1391
1392 if (skb->protocol == htons(ETH_P_IP)) {
1393 /*
1394 * v6 mapped
1395 */
1396
1397 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1398
1399 if (newsk == NULL)
1400 return NULL;
1401
1402 newtcp6sk = (struct tcp6_sock *)newsk;
1403 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1404
1405 newinet = inet_sk(newsk);
1406 newnp = inet6_sk(newsk);
1407 newtp = tcp_sk(newsk);
1408
1409 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1410
1411 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1412
1413 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1414
1415 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1416
1417 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1418 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1419 #ifdef CONFIG_TCP_MD5SIG
1420 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1421 #endif
1422
1423 newnp->pktoptions = NULL;
1424 newnp->opt = NULL;
1425 newnp->mcast_oif = inet6_iif(skb);
1426 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1427
1428 /*
1429 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1430 * here, tcp_create_openreq_child now does this for us, see the comment in
1431 * that function for the gory details. -acme
1432 */
1433
1434 /* It is tricky place. Until this moment IPv4 tcp
1435 worked with IPv6 icsk.icsk_af_ops.
1436 Sync it now.
1437 */
1438 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1439
1440 return newsk;
1441 }
1442
1443 treq = inet6_rsk(req);
1444 opt = np->opt;
1445
1446 if (sk_acceptq_is_full(sk))
1447 goto out_overflow;
1448
1449 if (!dst) {
1450 dst = inet6_csk_route_req(sk, req);
1451 if (!dst)
1452 goto out;
1453 }
1454
1455 newsk = tcp_create_openreq_child(sk, req, skb);
1456 if (newsk == NULL)
1457 goto out_nonewsk;
1458
1459 /*
1460 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1461 * count here, tcp_create_openreq_child now does this for us, see the
1462 * comment in that function for the gory details. -acme
1463 */
1464
1465 newsk->sk_gso_type = SKB_GSO_TCPV6;
1466 __ip6_dst_store(newsk, dst, NULL, NULL);
1467
1468 newtcp6sk = (struct tcp6_sock *)newsk;
1469 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1470
1471 newtp = tcp_sk(newsk);
1472 newinet = inet_sk(newsk);
1473 newnp = inet6_sk(newsk);
1474
1475 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1476
1477 ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1478 ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1479 ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1480 newsk->sk_bound_dev_if = treq->iif;
1481
1482 /* Now IPv6 options...
1483
1484 First: no IPv4 options.
1485 */
1486 newinet->opt = NULL;
1487 newnp->ipv6_fl_list = NULL;
1488
1489 /* Clone RX bits */
1490 newnp->rxopt.all = np->rxopt.all;
1491
1492 /* Clone pktoptions received with SYN */
1493 newnp->pktoptions = NULL;
1494 if (treq->pktopts != NULL) {
1495 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1496 kfree_skb(treq->pktopts);
1497 treq->pktopts = NULL;
1498 if (newnp->pktoptions)
1499 skb_set_owner_r(newnp->pktoptions, newsk);
1500 }
1501 newnp->opt = NULL;
1502 newnp->mcast_oif = inet6_iif(skb);
1503 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1504
1505 /* Clone native IPv6 options from listening socket (if any)
1506
1507 Yes, keeping reference count would be much more clever,
1508 but we make one more one thing there: reattach optmem
1509 to newsk.
1510 */
1511 if (opt) {
1512 newnp->opt = ipv6_dup_options(newsk, opt);
1513 if (opt != np->opt)
1514 sock_kfree_s(sk, opt, opt->tot_len);
1515 }
1516
1517 inet_csk(newsk)->icsk_ext_hdr_len = 0;
1518 if (newnp->opt)
1519 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1520 newnp->opt->opt_flen);
1521
1522 tcp_mtup_init(newsk);
1523 tcp_sync_mss(newsk, dst_mtu(dst));
1524 newtp->advmss = dst_metric_advmss(dst);
1525 tcp_initialize_rcv_mss(newsk);
1526
1527 newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1528 newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1529
1530 #ifdef CONFIG_TCP_MD5SIG
1531 /* Copy over the MD5 key from the original socket */
1532 if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1533 /* We're using one, so create a matching key
1534 * on the newsk structure. If we fail to get
1535 * memory, then we end up not copying the key
1536 * across. Shucks.
1537 */
1538 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1539 if (newkey != NULL)
1540 tcp_v6_md5_do_add(newsk, &newnp->daddr,
1541 newkey, key->keylen);
1542 }
1543 #endif
1544
1545 if (__inet_inherit_port(sk, newsk) < 0) {
1546 sock_put(newsk);
1547 goto out;
1548 }
1549 __inet6_hash(newsk, NULL);
1550
1551 return newsk;
1552
1553 out_overflow:
1554 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1555 out_nonewsk:
1556 if (opt && opt != np->opt)
1557 sock_kfree_s(sk, opt, opt->tot_len);
1558 dst_release(dst);
1559 out:
1560 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1561 return NULL;
1562 }
1563
1564 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1565 {
1566 if (skb->ip_summed == CHECKSUM_COMPLETE) {
1567 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1568 &ipv6_hdr(skb)->daddr, skb->csum)) {
1569 skb->ip_summed = CHECKSUM_UNNECESSARY;
1570 return 0;
1571 }
1572 }
1573
1574 skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1575 &ipv6_hdr(skb)->saddr,
1576 &ipv6_hdr(skb)->daddr, 0));
1577
1578 if (skb->len <= 76) {
1579 return __skb_checksum_complete(skb);
1580 }
1581 return 0;
1582 }
1583
1584 /* The socket must have it's spinlock held when we get
1585 * here.
1586 *
1587 * We have a potential double-lock case here, so even when
1588 * doing backlog processing we use the BH locking scheme.
1589 * This is because we cannot sleep with the original spinlock
1590 * held.
1591 */
1592 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1593 {
1594 struct ipv6_pinfo *np = inet6_sk(sk);
1595 struct tcp_sock *tp;
1596 struct sk_buff *opt_skb = NULL;
1597
1598 /* Imagine: socket is IPv6. IPv4 packet arrives,
1599 goes to IPv4 receive handler and backlogged.
1600 From backlog it always goes here. Kerboom...
1601 Fortunately, tcp_rcv_established and rcv_established
1602 handle them correctly, but it is not case with
1603 tcp_v6_hnd_req and tcp_v6_send_reset(). --ANK
1604 */
1605
1606 if (skb->protocol == htons(ETH_P_IP))
1607 return tcp_v4_do_rcv(sk, skb);
1608
1609 #ifdef CONFIG_TCP_MD5SIG
1610 if (tcp_v6_inbound_md5_hash (sk, skb))
1611 goto discard;
1612 #endif
1613
1614 if (sk_filter(sk, skb))
1615 goto discard;
1616
1617 /*
1618 * socket locking is here for SMP purposes as backlog rcv
1619 * is currently called with bh processing disabled.
1620 */
1621
1622 /* Do Stevens' IPV6_PKTOPTIONS.
1623
1624 Yes, guys, it is the only place in our code, where we
1625 may make it not affecting IPv4.
1626 The rest of code is protocol independent,
1627 and I do not like idea to uglify IPv4.
1628
1629 Actually, all the idea behind IPV6_PKTOPTIONS
1630 looks not very well thought. For now we latch
1631 options, received in the last packet, enqueued
1632 by tcp. Feel free to propose better solution.
1633 --ANK (980728)
1634 */
1635 if (np->rxopt.all)
1636 opt_skb = skb_clone(skb, GFP_ATOMIC);
1637
1638 if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1639 TCP_CHECK_TIMER(sk);
1640 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1641 goto reset;
1642 TCP_CHECK_TIMER(sk);
1643 if (opt_skb)
1644 goto ipv6_pktoptions;
1645 return 0;
1646 }
1647
1648 if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1649 goto csum_err;
1650
1651 if (sk->sk_state == TCP_LISTEN) {
1652 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1653 if (!nsk)
1654 goto discard;
1655
1656 /*
1657 * Queue it on the new socket if the new socket is active,
1658 * otherwise we just shortcircuit this and continue with
1659 * the new socket..
1660 */
1661 if(nsk != sk) {
1662 if (tcp_child_process(sk, nsk, skb))
1663 goto reset;
1664 if (opt_skb)
1665 __kfree_skb(opt_skb);
1666 return 0;
1667 }
1668 }
1669
1670 TCP_CHECK_TIMER(sk);
1671 if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1672 goto reset;
1673 TCP_CHECK_TIMER(sk);
1674 if (opt_skb)
1675 goto ipv6_pktoptions;
1676 return 0;
1677
1678 reset:
1679 tcp_v6_send_reset(sk, skb);
1680 discard:
1681 if (opt_skb)
1682 __kfree_skb(opt_skb);
1683 kfree_skb(skb);
1684 return 0;
1685 csum_err:
1686 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1687 goto discard;
1688
1689
1690 ipv6_pktoptions:
1691 /* Do you ask, what is it?
1692
1693 1. skb was enqueued by tcp.
1694 2. skb is added to tail of read queue, rather than out of order.
1695 3. socket is not in passive state.
1696 4. Finally, it really contains options, which user wants to receive.
1697 */
1698 tp = tcp_sk(sk);
1699 if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1700 !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1701 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1702 np->mcast_oif = inet6_iif(opt_skb);
1703 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1704 np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1705 if (ipv6_opt_accepted(sk, opt_skb)) {
1706 skb_set_owner_r(opt_skb, sk);
1707 opt_skb = xchg(&np->pktoptions, opt_skb);
1708 } else {
1709 __kfree_skb(opt_skb);
1710 opt_skb = xchg(&np->pktoptions, NULL);
1711 }
1712 }
1713
1714 kfree_skb(opt_skb);
1715 return 0;
1716 }
1717
1718 static int tcp_v6_rcv(struct sk_buff *skb)
1719 {
1720 struct tcphdr *th;
1721 struct ipv6hdr *hdr;
1722 struct sock *sk;
1723 int ret;
1724 struct net *net = dev_net(skb->dev);
1725
1726 if (skb->pkt_type != PACKET_HOST)
1727 goto discard_it;
1728
1729 /*
1730 * Count it even if it's bad.
1731 */
1732 TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1733
1734 if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1735 goto discard_it;
1736
1737 th = tcp_hdr(skb);
1738
1739 if (th->doff < sizeof(struct tcphdr)/4)
1740 goto bad_packet;
1741 if (!pskb_may_pull(skb, th->doff*4))
1742 goto discard_it;
1743
1744 if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1745 goto bad_packet;
1746
1747 th = tcp_hdr(skb);
1748 hdr = ipv6_hdr(skb);
1749 TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1750 TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1751 skb->len - th->doff*4);
1752 TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1753 TCP_SKB_CB(skb)->when = 0;
1754 TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
1755 TCP_SKB_CB(skb)->sacked = 0;
1756
1757 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1758 if (!sk)
1759 goto no_tcp_socket;
1760
1761 process:
1762 if (sk->sk_state == TCP_TIME_WAIT)
1763 goto do_time_wait;
1764
1765 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1766 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1767 goto discard_and_relse;
1768 }
1769
1770 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1771 goto discard_and_relse;
1772
1773 if (sk_filter(sk, skb))
1774 goto discard_and_relse;
1775
1776 skb->dev = NULL;
1777
1778 bh_lock_sock_nested(sk);
1779 ret = 0;
1780 if (!sock_owned_by_user(sk)) {
1781 #ifdef CONFIG_NET_DMA
1782 struct tcp_sock *tp = tcp_sk(sk);
1783 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1784 tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
1785 if (tp->ucopy.dma_chan)
1786 ret = tcp_v6_do_rcv(sk, skb);
1787 else
1788 #endif
1789 {
1790 if (!tcp_prequeue(sk, skb))
1791 ret = tcp_v6_do_rcv(sk, skb);
1792 }
1793 } else if (unlikely(sk_add_backlog(sk, skb))) {
1794 bh_unlock_sock(sk);
1795 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1796 goto discard_and_relse;
1797 }
1798 bh_unlock_sock(sk);
1799
1800 sock_put(sk);
1801 return ret ? -1 : 0;
1802
1803 no_tcp_socket:
1804 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1805 goto discard_it;
1806
1807 if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1808 bad_packet:
1809 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1810 } else {
1811 tcp_v6_send_reset(NULL, skb);
1812 }
1813
1814 discard_it:
1815
1816 /*
1817 * Discard frame
1818 */
1819
1820 kfree_skb(skb);
1821 return 0;
1822
1823 discard_and_relse:
1824 sock_put(sk);
1825 goto discard_it;
1826
1827 do_time_wait:
1828 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1829 inet_twsk_put(inet_twsk(sk));
1830 goto discard_it;
1831 }
1832
1833 if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1834 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1835 inet_twsk_put(inet_twsk(sk));
1836 goto discard_it;
1837 }
1838
1839 switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1840 case TCP_TW_SYN:
1841 {
1842 struct sock *sk2;
1843
1844 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1845 &ipv6_hdr(skb)->daddr,
1846 ntohs(th->dest), inet6_iif(skb));
1847 if (sk2 != NULL) {
1848 struct inet_timewait_sock *tw = inet_twsk(sk);
1849 inet_twsk_deschedule(tw, &tcp_death_row);
1850 inet_twsk_put(tw);
1851 sk = sk2;
1852 goto process;
1853 }
1854 /* Fall through to ACK */
1855 }
1856 case TCP_TW_ACK:
1857 tcp_v6_timewait_ack(sk, skb);
1858 break;
1859 case TCP_TW_RST:
1860 goto no_tcp_socket;
1861 case TCP_TW_SUCCESS:;
1862 }
1863 goto discard_it;
1864 }
1865
1866 static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
1867 {
1868 struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
1869 struct ipv6_pinfo *np = inet6_sk(sk);
1870 struct inet_peer *peer;
1871
1872 if (!rt ||
1873 !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
1874 peer = inet_getpeer_v6(&np->daddr, 1);
1875 *release_it = true;
1876 } else {
1877 if (!rt->rt6i_peer)
1878 rt6_bind_peer(rt, 1);
1879 peer = rt->rt6i_peer;
1880 *release_it = false;
1881 }
1882
1883 return peer;
1884 }
1885
1886 static void *tcp_v6_tw_get_peer(struct sock *sk)
1887 {
1888 struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
1889 struct inet_timewait_sock *tw = inet_twsk(sk);
1890
1891 if (tw->tw_family == AF_INET)
1892 return tcp_v4_tw_get_peer(sk);
1893
1894 return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
1895 }
1896
1897 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1898 .twsk_obj_size = sizeof(struct tcp6_timewait_sock),
1899 .twsk_unique = tcp_twsk_unique,
1900 .twsk_destructor= tcp_twsk_destructor,
1901 .twsk_getpeer = tcp_v6_tw_get_peer,
1902 };
1903
1904 static const struct inet_connection_sock_af_ops ipv6_specific = {
1905 .queue_xmit = inet6_csk_xmit,
1906 .send_check = tcp_v6_send_check,
1907 .rebuild_header = inet6_sk_rebuild_header,
1908 .conn_request = tcp_v6_conn_request,
1909 .syn_recv_sock = tcp_v6_syn_recv_sock,
1910 .get_peer = tcp_v6_get_peer,
1911 .net_header_len = sizeof(struct ipv6hdr),
1912 .setsockopt = ipv6_setsockopt,
1913 .getsockopt = ipv6_getsockopt,
1914 .addr2sockaddr = inet6_csk_addr2sockaddr,
1915 .sockaddr_len = sizeof(struct sockaddr_in6),
1916 .bind_conflict = inet6_csk_bind_conflict,
1917 #ifdef CONFIG_COMPAT
1918 .compat_setsockopt = compat_ipv6_setsockopt,
1919 .compat_getsockopt = compat_ipv6_getsockopt,
1920 #endif
1921 };
1922
1923 #ifdef CONFIG_TCP_MD5SIG
1924 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1925 .md5_lookup = tcp_v6_md5_lookup,
1926 .calc_md5_hash = tcp_v6_md5_hash_skb,
1927 .md5_add = tcp_v6_md5_add_func,
1928 .md5_parse = tcp_v6_parse_md5_keys,
1929 };
1930 #endif
1931
1932 /*
1933 * TCP over IPv4 via INET6 API
1934 */
1935
1936 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1937 .queue_xmit = ip_queue_xmit,
1938 .send_check = tcp_v4_send_check,
1939 .rebuild_header = inet_sk_rebuild_header,
1940 .conn_request = tcp_v6_conn_request,
1941 .syn_recv_sock = tcp_v6_syn_recv_sock,
1942 .get_peer = tcp_v4_get_peer,
1943 .net_header_len = sizeof(struct iphdr),
1944 .setsockopt = ipv6_setsockopt,
1945 .getsockopt = ipv6_getsockopt,
1946 .addr2sockaddr = inet6_csk_addr2sockaddr,
1947 .sockaddr_len = sizeof(struct sockaddr_in6),
1948 .bind_conflict = inet6_csk_bind_conflict,
1949 #ifdef CONFIG_COMPAT
1950 .compat_setsockopt = compat_ipv6_setsockopt,
1951 .compat_getsockopt = compat_ipv6_getsockopt,
1952 #endif
1953 };
1954
1955 #ifdef CONFIG_TCP_MD5SIG
1956 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1957 .md5_lookup = tcp_v4_md5_lookup,
1958 .calc_md5_hash = tcp_v4_md5_hash_skb,
1959 .md5_add = tcp_v6_md5_add_func,
1960 .md5_parse = tcp_v6_parse_md5_keys,
1961 };
1962 #endif
1963
1964 /* NOTE: A lot of things set to zero explicitly by call to
1965 * sk_alloc() so need not be done here.
1966 */
1967 static int tcp_v6_init_sock(struct sock *sk)
1968 {
1969 struct inet_connection_sock *icsk = inet_csk(sk);
1970 struct tcp_sock *tp = tcp_sk(sk);
1971
1972 skb_queue_head_init(&tp->out_of_order_queue);
1973 tcp_init_xmit_timers(sk);
1974 tcp_prequeue_init(tp);
1975
1976 icsk->icsk_rto = TCP_TIMEOUT_INIT;
1977 tp->mdev = TCP_TIMEOUT_INIT;
1978
1979 /* So many TCP implementations out there (incorrectly) count the
1980 * initial SYN frame in their delayed-ACK and congestion control
1981 * algorithms that we must have the following bandaid to talk
1982 * efficiently to them. -DaveM
1983 */
1984 tp->snd_cwnd = 2;
1985
1986 /* See draft-stevens-tcpca-spec-01 for discussion of the
1987 * initialization of these values.
1988 */
1989 tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
1990 tp->snd_cwnd_clamp = ~0;
1991 tp->mss_cache = TCP_MSS_DEFAULT;
1992
1993 tp->reordering = sysctl_tcp_reordering;
1994
1995 sk->sk_state = TCP_CLOSE;
1996
1997 icsk->icsk_af_ops = &ipv6_specific;
1998 icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1999 icsk->icsk_sync_mss = tcp_sync_mss;
2000 sk->sk_write_space = sk_stream_write_space;
2001 sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
2002
2003 #ifdef CONFIG_TCP_MD5SIG
2004 tp->af_specific = &tcp_sock_ipv6_specific;
2005 #endif
2006
2007 /* TCP Cookie Transactions */
2008 if (sysctl_tcp_cookie_size > 0) {
2009 /* Default, cookies without s_data_payload. */
2010 tp->cookie_values =
2011 kzalloc(sizeof(*tp->cookie_values),
2012 sk->sk_allocation);
2013 if (tp->cookie_values != NULL)
2014 kref_init(&tp->cookie_values->kref);
2015 }
2016 /* Presumed zeroed, in order of appearance:
2017 * cookie_in_always, cookie_out_never,
2018 * s_data_constant, s_data_in, s_data_out
2019 */
2020 sk->sk_sndbuf = sysctl_tcp_wmem[1];
2021 sk->sk_rcvbuf = sysctl_tcp_rmem[1];
2022
2023 local_bh_disable();
2024 percpu_counter_inc(&tcp_sockets_allocated);
2025 local_bh_enable();
2026
2027 return 0;
2028 }
2029
2030 static void tcp_v6_destroy_sock(struct sock *sk)
2031 {
2032 #ifdef CONFIG_TCP_MD5SIG
2033 /* Clean up the MD5 key list */
2034 if (tcp_sk(sk)->md5sig_info)
2035 tcp_v6_clear_md5_list(sk);
2036 #endif
2037 tcp_v4_destroy_sock(sk);
2038 inet6_destroy_sock(sk);
2039 }
2040
2041 #ifdef CONFIG_PROC_FS
2042 /* Proc filesystem TCPv6 sock list dumping. */
2043 static void get_openreq6(struct seq_file *seq,
2044 struct sock *sk, struct request_sock *req, int i, int uid)
2045 {
2046 int ttd = req->expires - jiffies;
2047 struct in6_addr *src = &inet6_rsk(req)->loc_addr;
2048 struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
2049
2050 if (ttd < 0)
2051 ttd = 0;
2052
2053 seq_printf(seq,
2054 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2055 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2056 i,
2057 src->s6_addr32[0], src->s6_addr32[1],
2058 src->s6_addr32[2], src->s6_addr32[3],
2059 ntohs(inet_rsk(req)->loc_port),
2060 dest->s6_addr32[0], dest->s6_addr32[1],
2061 dest->s6_addr32[2], dest->s6_addr32[3],
2062 ntohs(inet_rsk(req)->rmt_port),
2063 TCP_SYN_RECV,
2064 0,0, /* could print option size, but that is af dependent. */
2065 1, /* timers active (only the expire timer) */
2066 jiffies_to_clock_t(ttd),
2067 req->retrans,
2068 uid,
2069 0, /* non standard timer */
2070 0, /* open_requests have no inode */
2071 0, req);
2072 }
2073
2074 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
2075 {
2076 struct in6_addr *dest, *src;
2077 __u16 destp, srcp;
2078 int timer_active;
2079 unsigned long timer_expires;
2080 struct inet_sock *inet = inet_sk(sp);
2081 struct tcp_sock *tp = tcp_sk(sp);
2082 const struct inet_connection_sock *icsk = inet_csk(sp);
2083 struct ipv6_pinfo *np = inet6_sk(sp);
2084
2085 dest = &np->daddr;
2086 src = &np->rcv_saddr;
2087 destp = ntohs(inet->inet_dport);
2088 srcp = ntohs(inet->inet_sport);
2089
2090 if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2091 timer_active = 1;
2092 timer_expires = icsk->icsk_timeout;
2093 } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2094 timer_active = 4;
2095 timer_expires = icsk->icsk_timeout;
2096 } else if (timer_pending(&sp->sk_timer)) {
2097 timer_active = 2;
2098 timer_expires = sp->sk_timer.expires;
2099 } else {
2100 timer_active = 0;
2101 timer_expires = jiffies;
2102 }
2103
2104 seq_printf(seq,
2105 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2106 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
2107 i,
2108 src->s6_addr32[0], src->s6_addr32[1],
2109 src->s6_addr32[2], src->s6_addr32[3], srcp,
2110 dest->s6_addr32[0], dest->s6_addr32[1],
2111 dest->s6_addr32[2], dest->s6_addr32[3], destp,
2112 sp->sk_state,
2113 tp->write_seq-tp->snd_una,
2114 (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2115 timer_active,
2116 jiffies_to_clock_t(timer_expires - jiffies),
2117 icsk->icsk_retransmits,
2118 sock_i_uid(sp),
2119 icsk->icsk_probes_out,
2120 sock_i_ino(sp),
2121 atomic_read(&sp->sk_refcnt), sp,
2122 jiffies_to_clock_t(icsk->icsk_rto),
2123 jiffies_to_clock_t(icsk->icsk_ack.ato),
2124 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2125 tp->snd_cwnd,
2126 tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
2127 );
2128 }
2129
2130 static void get_timewait6_sock(struct seq_file *seq,
2131 struct inet_timewait_sock *tw, int i)
2132 {
2133 struct in6_addr *dest, *src;
2134 __u16 destp, srcp;
2135 struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2136 int ttd = tw->tw_ttd - jiffies;
2137
2138 if (ttd < 0)
2139 ttd = 0;
2140
2141 dest = &tw6->tw_v6_daddr;
2142 src = &tw6->tw_v6_rcv_saddr;
2143 destp = ntohs(tw->tw_dport);
2144 srcp = ntohs(tw->tw_sport);
2145
2146 seq_printf(seq,
2147 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2148 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2149 i,
2150 src->s6_addr32[0], src->s6_addr32[1],
2151 src->s6_addr32[2], src->s6_addr32[3], srcp,
2152 dest->s6_addr32[0], dest->s6_addr32[1],
2153 dest->s6_addr32[2], dest->s6_addr32[3], destp,
2154 tw->tw_substate, 0, 0,
2155 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2156 atomic_read(&tw->tw_refcnt), tw);
2157 }
2158
2159 static int tcp6_seq_show(struct seq_file *seq, void *v)
2160 {
2161 struct tcp_iter_state *st;
2162
2163 if (v == SEQ_START_TOKEN) {
2164 seq_puts(seq,
2165 " sl "
2166 "local_address "
2167 "remote_address "
2168 "st tx_queue rx_queue tr tm->when retrnsmt"
2169 " uid timeout inode\n");
2170 goto out;
2171 }
2172 st = seq->private;
2173
2174 switch (st->state) {
2175 case TCP_SEQ_STATE_LISTENING:
2176 case TCP_SEQ_STATE_ESTABLISHED:
2177 get_tcp6_sock(seq, v, st->num);
2178 break;
2179 case TCP_SEQ_STATE_OPENREQ:
2180 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2181 break;
2182 case TCP_SEQ_STATE_TIME_WAIT:
2183 get_timewait6_sock(seq, v, st->num);
2184 break;
2185 }
2186 out:
2187 return 0;
2188 }
2189
2190 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2191 .name = "tcp6",
2192 .family = AF_INET6,
2193 .seq_fops = {
2194 .owner = THIS_MODULE,
2195 },
2196 .seq_ops = {
2197 .show = tcp6_seq_show,
2198 },
2199 };
2200
2201 int __net_init tcp6_proc_init(struct net *net)
2202 {
2203 return tcp_proc_register(net, &tcp6_seq_afinfo);
2204 }
2205
2206 void tcp6_proc_exit(struct net *net)
2207 {
2208 tcp_proc_unregister(net, &tcp6_seq_afinfo);
2209 }
2210 #endif
2211
2212 struct proto tcpv6_prot = {
2213 .name = "TCPv6",
2214 .owner = THIS_MODULE,
2215 .close = tcp_close,
2216 .connect = tcp_v6_connect,
2217 .disconnect = tcp_disconnect,
2218 .accept = inet_csk_accept,
2219 .ioctl = tcp_ioctl,
2220 .init = tcp_v6_init_sock,
2221 .destroy = tcp_v6_destroy_sock,
2222 .shutdown = tcp_shutdown,
2223 .setsockopt = tcp_setsockopt,
2224 .getsockopt = tcp_getsockopt,
2225 .recvmsg = tcp_recvmsg,
2226 .sendmsg = tcp_sendmsg,
2227 .sendpage = tcp_sendpage,
2228 .backlog_rcv = tcp_v6_do_rcv,
2229 .hash = tcp_v6_hash,
2230 .unhash = inet_unhash,
2231 .get_port = inet_csk_get_port,
2232 .enter_memory_pressure = tcp_enter_memory_pressure,
2233 .sockets_allocated = &tcp_sockets_allocated,
2234 .memory_allocated = &tcp_memory_allocated,
2235 .memory_pressure = &tcp_memory_pressure,
2236 .orphan_count = &tcp_orphan_count,
2237 .sysctl_mem = sysctl_tcp_mem,
2238 .sysctl_wmem = sysctl_tcp_wmem,
2239 .sysctl_rmem = sysctl_tcp_rmem,
2240 .max_header = MAX_TCP_HEADER,
2241 .obj_size = sizeof(struct tcp6_sock),
2242 .slab_flags = SLAB_DESTROY_BY_RCU,
2243 .twsk_prot = &tcp6_timewait_sock_ops,
2244 .rsk_prot = &tcp6_request_sock_ops,
2245 .h.hashinfo = &tcp_hashinfo,
2246 .no_autobind = true,
2247 #ifdef CONFIG_COMPAT
2248 .compat_setsockopt = compat_tcp_setsockopt,
2249 .compat_getsockopt = compat_tcp_getsockopt,
2250 #endif
2251 };
2252
2253 static const struct inet6_protocol tcpv6_protocol = {
2254 .handler = tcp_v6_rcv,
2255 .err_handler = tcp_v6_err,
2256 .gso_send_check = tcp_v6_gso_send_check,
2257 .gso_segment = tcp_tso_segment,
2258 .gro_receive = tcp6_gro_receive,
2259 .gro_complete = tcp6_gro_complete,
2260 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2261 };
2262
2263 static struct inet_protosw tcpv6_protosw = {
2264 .type = SOCK_STREAM,
2265 .protocol = IPPROTO_TCP,
2266 .prot = &tcpv6_prot,
2267 .ops = &inet6_stream_ops,
2268 .no_check = 0,
2269 .flags = INET_PROTOSW_PERMANENT |
2270 INET_PROTOSW_ICSK,
2271 };
2272
2273 static int __net_init tcpv6_net_init(struct net *net)
2274 {
2275 return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2276 SOCK_RAW, IPPROTO_TCP, net);
2277 }
2278
2279 static void __net_exit tcpv6_net_exit(struct net *net)
2280 {
2281 inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2282 }
2283
2284 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2285 {
2286 inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2287 }
2288
2289 static struct pernet_operations tcpv6_net_ops = {
2290 .init = tcpv6_net_init,
2291 .exit = tcpv6_net_exit,
2292 .exit_batch = tcpv6_net_exit_batch,
2293 };
2294
2295 int __init tcpv6_init(void)
2296 {
2297 int ret;
2298
2299 ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2300 if (ret)
2301 goto out;
2302
2303 /* register inet6 protocol */
2304 ret = inet6_register_protosw(&tcpv6_protosw);
2305 if (ret)
2306 goto out_tcpv6_protocol;
2307
2308 ret = register_pernet_subsys(&tcpv6_net_ops);
2309 if (ret)
2310 goto out_tcpv6_protosw;
2311 out:
2312 return ret;
2313
2314 out_tcpv6_protocol:
2315 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2316 out_tcpv6_protosw:
2317 inet6_unregister_protosw(&tcpv6_protosw);
2318 goto out;
2319 }
2320
2321 void tcpv6_exit(void)
2322 {
2323 unregister_pernet_subsys(&tcpv6_net_ops);
2324 inet6_unregister_protosw(&tcpv6_protosw);
2325 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2326 }