SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/net.h>
  34 #include <linux/jiffies.h>
  35 #include <linux/in.h>
  36 #include <linux/in6.h>
  37 #include <linux/netdevice.h>
  38 #include <linux/init.h>
  39 #include <linux/jhash.h>
  40 #include <linux/ipsec.h>
  41 #include <linux/times.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63
  64 #include <asm/uaccess.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <linux/crypto.h>
  70 #include <linux/scatterlist.h>
  71
  72 /* Socket used for sending RSTs and ACKs */
  73 static struct socket *tcp6_socket;
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
  77 static void     tcp_v6_send_check(struct sock *sk, int len,
  78                                   struct sk_buff *skb);
  79
  80 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  81
  82 static struct inet_connection_sock_af_ops ipv6_mapped;
  83 static struct inet_connection_sock_af_ops ipv6_specific;
  84 #ifdef CONFIG_TCP_MD5SIG
  85 static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  86 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  87 #endif
  88
  89 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
  90 {
  91         return inet_csk_get_port(&tcp_hashinfo, sk, snum,
  92                                  inet6_csk_bind_conflict);
  93 }
  94
  95 static void tcp_v6_hash(struct sock *sk)
  96 {
  97         if (sk->sk_state != TCP_CLOSE) {
  98                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  99                         tcp_prot.hash(sk);
 100                         return;
 101                 }
 102                 local_bh_disable();
 103                 __inet6_hash(&tcp_hashinfo, sk);
 104                 local_bh_enable();
 105         }
 106 }
 107
 108 static __inline__ __sum16 tcp_v6_check(struct tcphdr *th, int len,
 109                                    struct in6_addr *saddr,
 110                                    struct in6_addr *daddr,
 111                                    __wsum base)
 112 {
 113         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 114 }
 115
 116 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 117 {
 118         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 119                                             ipv6_hdr(skb)->saddr.s6_addr32,
 120                                             tcp_hdr(skb)->dest,
 121                                             tcp_hdr(skb)->source);
 122 }
 123
 124 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 125                           int addr_len)
 126 {
 127         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 128         struct inet_sock *inet = inet_sk(sk);
 129         struct inet_connection_sock *icsk = inet_csk(sk);
 130         struct ipv6_pinfo *np = inet6_sk(sk);
 131         struct tcp_sock *tp = tcp_sk(sk);
 132         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 133         struct flowi fl;
 134         struct dst_entry *dst;
 135         int addr_type;
 136         int err;
 137
 138         if (addr_len < SIN6_LEN_RFC2133)
 139                 return -EINVAL;
 140
 141         if (usin->sin6_family != AF_INET6)
 142                 return(-EAFNOSUPPORT);
 143
 144         memset(&fl, 0, sizeof(fl));
 145
 146         if (np->sndflow) {
 147                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 148                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 149                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 150                         struct ip6_flowlabel *flowlabel;
 151                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 152                         if (flowlabel == NULL)
 153                                 return -EINVAL;
 154                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 155                         fl6_sock_release(flowlabel);
 156                 }
 157         }
 158
 159         /*
 160          *      connect() to INADDR_ANY means loopback (BSD'ism).
 161          */
 162
 163         if(ipv6_addr_any(&usin->sin6_addr))
 164                 usin->sin6_addr.s6_addr[15] = 0x1;
 165
 166         addr_type = ipv6_addr_type(&usin->sin6_addr);
 167
 168         if(addr_type & IPV6_ADDR_MULTICAST)
 169                 return -ENETUNREACH;
 170
 171         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 172                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 173                     usin->sin6_scope_id) {
 174                         /* If interface is set while binding, indices
 175                          * must coincide.
 176                          */
 177                         if (sk->sk_bound_dev_if &&
 178                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 179                                 return -EINVAL;
 180
 181                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 182                 }
 183
 184                 /* Connect to link-local address requires an interface */
 185                 if (!sk->sk_bound_dev_if)
 186                         return -EINVAL;
 187         }
 188
 189         if (tp->rx_opt.ts_recent_stamp &&
 190             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 191                 tp->rx_opt.ts_recent = 0;
 192                 tp->rx_opt.ts_recent_stamp = 0;
 193                 tp->write_seq = 0;
 194         }
 195
 196         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 197         np->flow_label = fl.fl6_flowlabel;
 198
 199         /*
 200          *      TCP over IPv4
 201          */
 202
 203         if (addr_type == IPV6_ADDR_MAPPED) {
 204                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 205                 struct sockaddr_in sin;
 206
 207                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 208
 209                 if (__ipv6_only_sock(sk))
 210                         return -ENETUNREACH;
 211
 212                 sin.sin_family = AF_INET;
 213                 sin.sin_port = usin->sin6_port;
 214                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 215
 216                 icsk->icsk_af_ops = &ipv6_mapped;
 217                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 218 #ifdef CONFIG_TCP_MD5SIG
 219                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 220 #endif
 221
 222                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 223
 224                 if (err) {
 225                         icsk->icsk_ext_hdr_len = exthdrlen;
 226                         icsk->icsk_af_ops = &ipv6_specific;
 227                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 228 #ifdef CONFIG_TCP_MD5SIG
 229                         tp->af_specific = &tcp_sock_ipv6_specific;
 230 #endif
 231                         goto failure;
 232                 } else {
 233                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 234                                       inet->saddr);
 235                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 236                                       inet->rcv_saddr);
 237                 }
 238
 239                 return err;
 240         }
 241
 242         if (!ipv6_addr_any(&np->rcv_saddr))
 243                 saddr = &np->rcv_saddr;
 244
 245         fl.proto = IPPROTO_TCP;
 246         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 247         ipv6_addr_copy(&fl.fl6_src,
 248                        (saddr ? saddr : &np->saddr));
 249         fl.oif = sk->sk_bound_dev_if;
 250         fl.fl_ip_dport = usin->sin6_port;
 251         fl.fl_ip_sport = inet->sport;
 252
 253         if (np->opt && np->opt->srcrt) {
 254                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 255                 ipv6_addr_copy(&final, &fl.fl6_dst);
 256                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 257                 final_p = &final;
 258         }
 259
 260         security_sk_classify_flow(sk, &fl);
 261
 262         err = ip6_dst_lookup(sk, &dst, &fl);
 263         if (err)
 264                 goto failure;
 265         if (final_p)
 266                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 267
 268         if ((err = __xfrm_lookup(&dst, &fl, sk, 1)) < 0) {
 269                 if (err == -EREMOTE)
 270                         err = ip6_dst_blackhole(sk, &dst, &fl);
 271                 if (err < 0)
 272                         goto failure;
 273         }
 274
 275         if (saddr == NULL) {
 276                 saddr = &fl.fl6_src;
 277                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 278         }
 279
 280         /* set the source address */
 281         ipv6_addr_copy(&np->saddr, saddr);
 282         inet->rcv_saddr = LOOPBACK4_IPV6;
 283
 284         sk->sk_gso_type = SKB_GSO_TCPV6;
 285         __ip6_dst_store(sk, dst, NULL, NULL);
 286
 287         icsk->icsk_ext_hdr_len = 0;
 288         if (np->opt)
 289                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 290                                           np->opt->opt_nflen);
 291
 292         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 293
 294         inet->dport = usin->sin6_port;
 295
 296         tcp_set_state(sk, TCP_SYN_SENT);
 297         err = inet6_hash_connect(&tcp_death_row, sk);
 298         if (err)
 299                 goto late_failure;
 300
 301         if (!tp->write_seq)
 302                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 303                                                              np->daddr.s6_addr32,
 304                                                              inet->sport,
 305                                                              inet->dport);
 306
 307         err = tcp_connect(sk);
 308         if (err)
 309                 goto late_failure;
 310
 311         return 0;
 312
 313 late_failure:
 314         tcp_set_state(sk, TCP_CLOSE);
 315         __sk_dst_reset(sk);
 316 failure:
 317         inet->dport = 0;
 318         sk->sk_route_caps = 0;
 319         return err;
 320 }
 321
 322 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 323                 int type, int code, int offset, __be32 info)
 324 {
 325         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 326         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 327         struct ipv6_pinfo *np;
 328         struct sock *sk;
 329         int err;
 330         struct tcp_sock *tp;
 331         __u32 seq;
 332
 333         sk = inet6_lookup(&tcp_hashinfo, &hdr->daddr, th->dest, &hdr->saddr,
 334                           th->source, skb->dev->ifindex);
 335
 336         if (sk == NULL) {
 337                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 338                 return;
 339         }
 340
 341         if (sk->sk_state == TCP_TIME_WAIT) {
 342                 inet_twsk_put(inet_twsk(sk));
 343                 return;
 344         }
 345
 346         bh_lock_sock(sk);
 347         if (sock_owned_by_user(sk))
 348                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 349
 350         if (sk->sk_state == TCP_CLOSE)
 351                 goto out;
 352
 353         tp = tcp_sk(sk);
 354         seq = ntohl(th->seq);
 355         if (sk->sk_state != TCP_LISTEN &&
 356             !between(seq, tp->snd_una, tp->snd_nxt)) {
 357                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 358                 goto out;
 359         }
 360
 361         np = inet6_sk(sk);
 362
 363         if (type == ICMPV6_PKT_TOOBIG) {
 364                 struct dst_entry *dst = NULL;
 365
 366                 if (sock_owned_by_user(sk))
 367                         goto out;
 368                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 369                         goto out;
 370
 371                 /* icmp should have updated the destination cache entry */
 372                 dst = __sk_dst_check(sk, np->dst_cookie);
 373
 374                 if (dst == NULL) {
 375                         struct inet_sock *inet = inet_sk(sk);
 376                         struct flowi fl;
 377
 378                         /* BUGGG_FUTURE: Again, it is not clear how
 379                            to handle rthdr case. Ignore this complexity
 380                            for now.
 381                          */
 382                         memset(&fl, 0, sizeof(fl));
 383                         fl.proto = IPPROTO_TCP;
 384                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 385                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 386                         fl.oif = sk->sk_bound_dev_if;
 387                         fl.fl_ip_dport = inet->dport;
 388                         fl.fl_ip_sport = inet->sport;
 389                         security_skb_classify_flow(skb, &fl);
 390
 391                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 392                                 sk->sk_err_soft = -err;
 393                                 goto out;
 394                         }
 395
 396                         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 397                                 sk->sk_err_soft = -err;
 398                                 goto out;
 399                         }
 400
 401                 } else
 402                         dst_hold(dst);
 403
 404                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 405                         tcp_sync_mss(sk, dst_mtu(dst));
 406                         tcp_simple_retransmit(sk);
 407                 } /* else let the usual retransmit timer handle it */
 408                 dst_release(dst);
 409                 goto out;
 410         }
 411
 412         icmpv6_err_convert(type, code, &err);
 413
 414         /* Might be for an request_sock */
 415         switch (sk->sk_state) {
 416                 struct request_sock *req, **prev;
 417         case TCP_LISTEN:
 418                 if (sock_owned_by_user(sk))
 419                         goto out;
 420
 421                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 422                                            &hdr->saddr, inet6_iif(skb));
 423                 if (!req)
 424                         goto out;
 425
 426                 /* ICMPs are not backlogged, hence we cannot get
 427                  * an established socket here.
 428                  */
 429                 BUG_TRAP(req->sk == NULL);
 430
 431                 if (seq != tcp_rsk(req)->snt_isn) {
 432                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 433                         goto out;
 434                 }
 435
 436                 inet_csk_reqsk_queue_drop(sk, req, prev);
 437                 goto out;
 438
 439         case TCP_SYN_SENT:
 440         case TCP_SYN_RECV:  /* Cannot happen.
 441                                It can, it SYNs are crossed. --ANK */
 442                 if (!sock_owned_by_user(sk)) {
 443                         sk->sk_err = err;
 444                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 445
 446                         tcp_done(sk);
 447                 } else
 448                         sk->sk_err_soft = err;
 449                 goto out;
 450         }
 451
 452         if (!sock_owned_by_user(sk) && np->recverr) {
 453                 sk->sk_err = err;
 454                 sk->sk_error_report(sk);
 455         } else
 456                 sk->sk_err_soft = err;
 457
 458 out:
 459         bh_unlock_sock(sk);
 460         sock_put(sk);
 461 }
 462
 463
 464 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 465                               struct dst_entry *dst)
 466 {
 467         struct inet6_request_sock *treq = inet6_rsk(req);
 468         struct ipv6_pinfo *np = inet6_sk(sk);
 469         struct sk_buff * skb;
 470         struct ipv6_txoptions *opt = NULL;
 471         struct in6_addr * final_p = NULL, final;
 472         struct flowi fl;
 473         int err = -1;
 474
 475         memset(&fl, 0, sizeof(fl));
 476         fl.proto = IPPROTO_TCP;
 477         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 478         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 479         fl.fl6_flowlabel = 0;
 480         fl.oif = treq->iif;
 481         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 482         fl.fl_ip_sport = inet_sk(sk)->sport;
 483         security_req_classify_flow(req, &fl);
 484
 485         if (dst == NULL) {
 486                 opt = np->opt;
 487                 if (opt && opt->srcrt) {
 488                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 489                         ipv6_addr_copy(&final, &fl.fl6_dst);
 490                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 491                         final_p = &final;
 492                 }
 493
 494                 err = ip6_dst_lookup(sk, &dst, &fl);
 495                 if (err)
 496                         goto done;
 497                 if (final_p)
 498                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 499                 if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 500                         goto done;
 501         }
 502
 503         skb = tcp_make_synack(sk, dst, req);
 504         if (skb) {
 505                 struct tcphdr *th = tcp_hdr(skb);
 506
 507                 th->check = tcp_v6_check(th, skb->len,
 508                                          &treq->loc_addr, &treq->rmt_addr,
 509                                          csum_partial((char *)th, skb->len, skb->csum));
 510
 511                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 512                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 513                 err = net_xmit_eval(err);
 514         }
 515
 516 done:
 517         if (opt && opt != np->opt)
 518                 sock_kfree_s(sk, opt, opt->tot_len);
 519         dst_release(dst);
 520         return err;
 521 }
 522
 523 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 524 {
 525         if (inet6_rsk(req)->pktopts)
 526                 kfree_skb(inet6_rsk(req)->pktopts);
 527 }
 528
 529 #ifdef CONFIG_TCP_MD5SIG
 530 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 531                                                    struct in6_addr *addr)
 532 {
 533         struct tcp_sock *tp = tcp_sk(sk);
 534         int i;
 535
 536         BUG_ON(tp == NULL);
 537
 538         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 539                 return NULL;
 540
 541         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 542                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, addr) == 0)
 543                         return &tp->md5sig_info->keys6[i].base;
 544         }
 545         return NULL;
 546 }
 547
 548 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 549                                                 struct sock *addr_sk)
 550 {
 551         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 552 }
 553
 554 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 555                                                       struct request_sock *req)
 556 {
 557         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 558 }
 559
 560 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 561                              char *newkey, u8 newkeylen)
 562 {
 563         /* Add key to the list */
 564         struct tcp_md5sig_key *key;
 565         struct tcp_sock *tp = tcp_sk(sk);
 566         struct tcp6_md5sig_key *keys;
 567
 568         key = tcp_v6_md5_do_lookup(sk, peer);
 569         if (key) {
 570                 /* modify existing entry - just update that one */
 571                 kfree(key->key);
 572                 key->key = newkey;
 573                 key->keylen = newkeylen;
 574         } else {
 575                 /* reallocate new list if current one is full. */
 576                 if (!tp->md5sig_info) {
 577                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 578                         if (!tp->md5sig_info) {
 579                                 kfree(newkey);
 580                                 return -ENOMEM;
 581                         }
 582                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 583                 }
 584                 if (tcp_alloc_md5sig_pool() == NULL) {
 585                         kfree(newkey);
 586                         return -ENOMEM;
 587                 }
 588                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 589                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 590                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 591
 592                         if (!keys) {
 593                                 tcp_free_md5sig_pool();
 594                                 kfree(newkey);
 595                                 return -ENOMEM;
 596                         }
 597
 598                         if (tp->md5sig_info->entries6)
 599                                 memmove(keys, tp->md5sig_info->keys6,
 600                                         (sizeof (tp->md5sig_info->keys6[0]) *
 601                                          tp->md5sig_info->entries6));
 602
 603                         kfree(tp->md5sig_info->keys6);
 604                         tp->md5sig_info->keys6 = keys;
 605                         tp->md5sig_info->alloced6++;
 606                 }
 607
 608                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 609                                peer);
 610                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 611                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 612
 613                 tp->md5sig_info->entries6++;
 614         }
 615         return 0;
 616 }
 617
 618 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 619                                u8 *newkey, __u8 newkeylen)
 620 {
 621         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 622                                  newkey, newkeylen);
 623 }
 624
 625 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
 626 {
 627         struct tcp_sock *tp = tcp_sk(sk);
 628         int i;
 629
 630         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 631                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, peer) == 0) {
 632                         /* Free the key */
 633                         kfree(tp->md5sig_info->keys6[i].base.key);
 634                         tp->md5sig_info->entries6--;
 635
 636                         if (tp->md5sig_info->entries6 == 0) {
 637                                 kfree(tp->md5sig_info->keys6);
 638                                 tp->md5sig_info->keys6 = NULL;
 639                                 tp->md5sig_info->alloced6 = 0;
 640
 641                                 tcp_free_md5sig_pool();
 642
 643                                 return 0;
 644                         } else {
 645                                 /* shrink the database */
 646                                 if (tp->md5sig_info->entries6 != i)
 647                                         memmove(&tp->md5sig_info->keys6[i],
 648                                                 &tp->md5sig_info->keys6[i+1],
 649                                                 (tp->md5sig_info->entries6 - i)
 650                                                 * sizeof (tp->md5sig_info->keys6[0]));
 651                         }
 652                 }
 653         }
 654         return -ENOENT;
 655 }
 656
 657 static void tcp_v6_clear_md5_list (struct sock *sk)
 658 {
 659         struct tcp_sock *tp = tcp_sk(sk);
 660         int i;
 661
 662         if (tp->md5sig_info->entries6) {
 663                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 664                         kfree(tp->md5sig_info->keys6[i].base.key);
 665                 tp->md5sig_info->entries6 = 0;
 666                 tcp_free_md5sig_pool();
 667         }
 668
 669         kfree(tp->md5sig_info->keys6);
 670         tp->md5sig_info->keys6 = NULL;
 671         tp->md5sig_info->alloced6 = 0;
 672
 673         if (tp->md5sig_info->entries4) {
 674                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 675                         kfree(tp->md5sig_info->keys4[i].base.key);
 676                 tp->md5sig_info->entries4 = 0;
 677                 tcp_free_md5sig_pool();
 678         }
 679
 680         kfree(tp->md5sig_info->keys4);
 681         tp->md5sig_info->keys4 = NULL;
 682         tp->md5sig_info->alloced4 = 0;
 683 }
 684
 685 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 686                                   int optlen)
 687 {
 688         struct tcp_md5sig cmd;
 689         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 690         u8 *newkey;
 691
 692         if (optlen < sizeof(cmd))
 693                 return -EINVAL;
 694
 695         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 696                 return -EFAULT;
 697
 698         if (sin6->sin6_family != AF_INET6)
 699                 return -EINVAL;
 700
 701         if (!cmd.tcpm_keylen) {
 702                 if (!tcp_sk(sk)->md5sig_info)
 703                         return -ENOENT;
 704                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 705                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 706                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 707         }
 708
 709         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 710                 return -EINVAL;
 711
 712         if (!tcp_sk(sk)->md5sig_info) {
 713                 struct tcp_sock *tp = tcp_sk(sk);
 714                 struct tcp_md5sig_info *p;
 715
 716                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 717                 if (!p)
 718                         return -ENOMEM;
 719
 720                 tp->md5sig_info = p;
 721                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 722         }
 723
 724         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 725         if (!newkey)
 726                 return -ENOMEM;
 727         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 728                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 729                                          newkey, cmd.tcpm_keylen);
 730         }
 731         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 732 }
 733
 734 static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 735                                    struct in6_addr *saddr,
 736                                    struct in6_addr *daddr,
 737                                    struct tcphdr *th, int protocol,
 738                                    int tcplen)
 739 {
 740         struct scatterlist sg[4];
 741         __u16 data_len;
 742         int block = 0;
 743         __sum16 cksum;
 744         struct tcp_md5sig_pool *hp;
 745         struct tcp6_pseudohdr *bp;
 746         struct hash_desc *desc;
 747         int err;
 748         unsigned int nbytes = 0;
 749
 750         hp = tcp_get_md5sig_pool();
 751         if (!hp) {
 752                 printk(KERN_WARNING "%s(): hash pool not found...\n", __FUNCTION__);
 753                 goto clear_hash_noput;
 754         }
 755         bp = &hp->md5_blk.ip6;
 756         desc = &hp->md5_desc;
 757
 758         /* 1. TCP pseudo-header (RFC2460) */
 759         ipv6_addr_copy(&bp->saddr, saddr);
 760         ipv6_addr_copy(&bp->daddr, daddr);
 761         bp->len = htonl(tcplen);
 762         bp->protocol = htonl(protocol);
 763
 764         sg_init_table(sg, 4);
 765
 766         sg_set_buf(&sg[block++], bp, sizeof(*bp));
 767         nbytes += sizeof(*bp);
 768
 769         /* 2. TCP header, excluding options */
 770         cksum = th->check;
 771         th->check = 0;
 772         sg_set_buf(&sg[block++], th, sizeof(*th));
 773         nbytes += sizeof(*th);
 774
 775         /* 3. TCP segment data (if any) */
 776         data_len = tcplen - (th->doff << 2);
 777         if (data_len > 0) {
 778                 u8 *data = (u8 *)th + (th->doff << 2);
 779                 sg_set_buf(&sg[block++], data, data_len);
 780                 nbytes += data_len;
 781         }
 782
 783         /* 4. shared key */
 784         sg_set_buf(&sg[block++], key->key, key->keylen);
 785         nbytes += key->keylen;
 786
 787         sg_mark_end(&sg[block - 1]);
 788
 789         /* Now store the hash into the packet */
 790         err = crypto_hash_init(desc);
 791         if (err) {
 792                 printk(KERN_WARNING "%s(): hash_init failed\n", __FUNCTION__);
 793                 goto clear_hash;
 794         }
 795         err = crypto_hash_update(desc, sg, nbytes);
 796         if (err) {
 797                 printk(KERN_WARNING "%s(): hash_update failed\n", __FUNCTION__);
 798                 goto clear_hash;
 799         }
 800         err = crypto_hash_final(desc, md5_hash);
 801         if (err) {
 802                 printk(KERN_WARNING "%s(): hash_final failed\n", __FUNCTION__);
 803                 goto clear_hash;
 804         }
 805
 806         /* Reset header, and free up the crypto */
 807         tcp_put_md5sig_pool();
 808         th->check = cksum;
 809 out:
 810         return 0;
 811 clear_hash:
 812         tcp_put_md5sig_pool();
 813 clear_hash_noput:
 814         memset(md5_hash, 0, 16);
 815         goto out;
 816 }
 817
 818 static int tcp_v6_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 819                                 struct sock *sk,
 820                                 struct dst_entry *dst,
 821                                 struct request_sock *req,
 822                                 struct tcphdr *th, int protocol,
 823                                 int tcplen)
 824 {
 825         struct in6_addr *saddr, *daddr;
 826
 827         if (sk) {
 828                 saddr = &inet6_sk(sk)->saddr;
 829                 daddr = &inet6_sk(sk)->daddr;
 830         } else {
 831                 saddr = &inet6_rsk(req)->loc_addr;
 832                 daddr = &inet6_rsk(req)->rmt_addr;
 833         }
 834         return tcp_v6_do_calc_md5_hash(md5_hash, key,
 835                                        saddr, daddr,
 836                                        th, protocol, tcplen);
 837 }
 838
 839 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 840 {
 841         __u8 *hash_location = NULL;
 842         struct tcp_md5sig_key *hash_expected;
 843         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 844         struct tcphdr *th = tcp_hdr(skb);
 845         int length = (th->doff << 2) - sizeof (*th);
 846         int genhash;
 847         u8 *ptr;
 848         u8 newhash[16];
 849
 850         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 851
 852         /* If the TCP option is too short, we can short cut */
 853         if (length < TCPOLEN_MD5SIG)
 854                 return hash_expected ? 1 : 0;
 855
 856         /* parse options */
 857         ptr = (u8*)(th + 1);
 858         while (length > 0) {
 859                 int opcode = *ptr++;
 860                 int opsize;
 861
 862                 switch(opcode) {
 863                 case TCPOPT_EOL:
 864                         goto done_opts;
 865                 case TCPOPT_NOP:
 866                         length--;
 867                         continue;
 868                 default:
 869                         opsize = *ptr++;
 870                         if (opsize < 2 || opsize > length)
 871                                 goto done_opts;
 872                         if (opcode == TCPOPT_MD5SIG) {
 873                                 hash_location = ptr;
 874                                 goto done_opts;
 875                         }
 876                 }
 877                 ptr += opsize - 2;
 878                 length -= opsize;
 879         }
 880
 881 done_opts:
 882         /* do we have a hash as expected? */
 883         if (!hash_expected) {
 884                 if (!hash_location)
 885                         return 0;
 886                 if (net_ratelimit()) {
 887                         printk(KERN_INFO "MD5 Hash NOT expected but found "
 888                                "(" NIP6_FMT ", %u)->"
 889                                "(" NIP6_FMT ", %u)\n",
 890                                NIP6(ip6h->saddr), ntohs(th->source),
 891                                NIP6(ip6h->daddr), ntohs(th->dest));
 892                 }
 893                 return 1;
 894         }
 895
 896         if (!hash_location) {
 897                 if (net_ratelimit()) {
 898                         printk(KERN_INFO "MD5 Hash expected but NOT found "
 899                                "(" NIP6_FMT ", %u)->"
 900                                "(" NIP6_FMT ", %u)\n",
 901                                NIP6(ip6h->saddr), ntohs(th->source),
 902                                NIP6(ip6h->daddr), ntohs(th->dest));
 903                 }
 904                 return 1;
 905         }
 906
 907         /* check the signature */
 908         genhash = tcp_v6_do_calc_md5_hash(newhash,
 909                                           hash_expected,
 910                                           &ip6h->saddr, &ip6h->daddr,
 911                                           th, sk->sk_protocol,
 912                                           skb->len);
 913         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 914                 if (net_ratelimit()) {
 915                         printk(KERN_INFO "MD5 Hash %s for "
 916                                "(" NIP6_FMT ", %u)->"
 917                                "(" NIP6_FMT ", %u)\n",
 918                                genhash ? "failed" : "mismatch",
 919                                NIP6(ip6h->saddr), ntohs(th->source),
 920                                NIP6(ip6h->daddr), ntohs(th->dest));
 921                 }
 922                 return 1;
 923         }
 924         return 0;
 925 }
 926 #endif
 927
 928 static struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 929         .family         =       AF_INET6,
 930         .obj_size       =       sizeof(struct tcp6_request_sock),
 931         .rtx_syn_ack    =       tcp_v6_send_synack,
 932         .send_ack       =       tcp_v6_reqsk_send_ack,
 933         .destructor     =       tcp_v6_reqsk_destructor,
 934         .send_reset     =       tcp_v6_send_reset
 935 };
 936
 937 #ifdef CONFIG_TCP_MD5SIG
 938 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 939         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 940 };
 941 #endif
 942
 943 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 944         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 945         .twsk_unique    = tcp_twsk_unique,
 946         .twsk_destructor= tcp_twsk_destructor,
 947 };
 948
 949 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 950 {
 951         struct ipv6_pinfo *np = inet6_sk(sk);
 952         struct tcphdr *th = tcp_hdr(skb);
 953
 954         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 955                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 956                 skb->csum_start = skb_transport_header(skb) - skb->head;
 957                 skb->csum_offset = offsetof(struct tcphdr, check);
 958         } else {
 959                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 960                                             csum_partial((char *)th, th->doff<<2,
 961                                                          skb->csum));
 962         }
 963 }
 964
 965 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 966 {
 967         struct ipv6hdr *ipv6h;
 968         struct tcphdr *th;
 969
 970         if (!pskb_may_pull(skb, sizeof(*th)))
 971                 return -EINVAL;
 972
 973         ipv6h = ipv6_hdr(skb);
 974         th = tcp_hdr(skb);
 975
 976         th->check = 0;
 977         th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
 978                                      IPPROTO_TCP, 0);
 979         skb->csum_start = skb_transport_header(skb) - skb->head;
 980         skb->csum_offset = offsetof(struct tcphdr, check);
 981         skb->ip_summed = CHECKSUM_PARTIAL;
 982         return 0;
 983 }
 984
 985 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 986 {
 987         struct tcphdr *th = tcp_hdr(skb), *t1;
 988         struct sk_buff *buff;
 989         struct flowi fl;
 990         int tot_len = sizeof(*th);
 991 #ifdef CONFIG_TCP_MD5SIG
 992         struct tcp_md5sig_key *key;
 993 #endif
 994
 995         if (th->rst)
 996                 return;
 997
 998         if (!ipv6_unicast_destination(skb))
 999                 return;
1000
1001 #ifdef CONFIG_TCP_MD5SIG
1002         if (sk)
1003                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1004         else
1005                 key = NULL;
1006
1007         if (key)
1008                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1009 #endif
1010
1011         /*
1012          * We need to grab some memory, and put together an RST,
1013          * and then put it into the queue to be sent.
1014          */
1015
1016         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1017                          GFP_ATOMIC);
1018         if (buff == NULL)
1019                 return;
1020
1021         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1022
1023         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1024
1025         /* Swap the send and the receive. */
1026         memset(t1, 0, sizeof(*t1));
1027         t1->dest = th->source;
1028         t1->source = th->dest;
1029         t1->doff = tot_len / 4;
1030         t1->rst = 1;
1031
1032         if(th->ack) {
1033                 t1->seq = th->ack_seq;
1034         } else {
1035                 t1->ack = 1;
1036                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
1037                                     + skb->len - (th->doff<<2));
1038         }
1039
1040 #ifdef CONFIG_TCP_MD5SIG
1041         if (key) {
1042                 __be32 *opt = (__be32*)(t1 + 1);
1043                 opt[0] = htonl((TCPOPT_NOP << 24) |
1044                                (TCPOPT_NOP << 16) |
1045                                (TCPOPT_MD5SIG << 8) |
1046                                TCPOLEN_MD5SIG);
1047                 tcp_v6_do_calc_md5_hash((__u8 *)&opt[1], key,
1048                                         &ipv6_hdr(skb)->daddr,
1049                                         &ipv6_hdr(skb)->saddr,
1050                                         t1, IPPROTO_TCP, tot_len);
1051         }
1052 #endif
1053
1054         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
1055
1056         memset(&fl, 0, sizeof(fl));
1057         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1058         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1059
1060         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1061                                     sizeof(*t1), IPPROTO_TCP,
1062                                     buff->csum);
1063
1064         fl.proto = IPPROTO_TCP;
1065         fl.oif = inet6_iif(skb);
1066         fl.fl_ip_dport = t1->dest;
1067         fl.fl_ip_sport = t1->source;
1068         security_skb_classify_flow(skb, &fl);
1069
1070         /* sk = NULL, but it is safe for now. RST socket required. */
1071         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1072
1073                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1074                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1075                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1076                         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
1077                         return;
1078                 }
1079         }
1080
1081         kfree_skb(buff);
1082 }
1083
1084 static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
1085                             struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
1086 {
1087         struct tcphdr *th = tcp_hdr(skb), *t1;
1088         struct sk_buff *buff;
1089         struct flowi fl;
1090         int tot_len = sizeof(struct tcphdr);
1091         __be32 *topt;
1092 #ifdef CONFIG_TCP_MD5SIG
1093         struct tcp_md5sig_key *key;
1094         struct tcp_md5sig_key tw_key;
1095 #endif
1096
1097 #ifdef CONFIG_TCP_MD5SIG
1098         if (!tw && skb->sk) {
1099                 key = tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr);
1100         } else if (tw && tw->tw_md5_keylen) {
1101                 tw_key.key = tw->tw_md5_key;
1102                 tw_key.keylen = tw->tw_md5_keylen;
1103                 key = &tw_key;
1104         } else {
1105                 key = NULL;
1106         }
1107 #endif
1108
1109         if (ts)
1110                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
1111 #ifdef CONFIG_TCP_MD5SIG
1112         if (key)
1113                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1114 #endif
1115
1116         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1117                          GFP_ATOMIC);
1118         if (buff == NULL)
1119                 return;
1120
1121         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1122
1123         t1 = (struct tcphdr *) skb_push(buff,tot_len);
1124
1125         /* Swap the send and the receive. */
1126         memset(t1, 0, sizeof(*t1));
1127         t1->dest = th->source;
1128         t1->source = th->dest;
1129         t1->doff = tot_len/4;
1130         t1->seq = htonl(seq);
1131         t1->ack_seq = htonl(ack);
1132         t1->ack = 1;
1133         t1->window = htons(win);
1134
1135         topt = (__be32 *)(t1 + 1);
1136
1137         if (ts) {
1138                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1139                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1140                 *topt++ = htonl(tcp_time_stamp);
1141                 *topt = htonl(ts);
1142         }
1143
1144 #ifdef CONFIG_TCP_MD5SIG
1145         if (key) {
1146                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1147                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1148                 tcp_v6_do_calc_md5_hash((__u8 *)topt, key,
1149                                         &ipv6_hdr(skb)->daddr,
1150                                         &ipv6_hdr(skb)->saddr,
1151                                         t1, IPPROTO_TCP, tot_len);
1152         }
1153 #endif
1154
1155         buff->csum = csum_partial((char *)t1, tot_len, 0);
1156
1157         memset(&fl, 0, sizeof(fl));
1158         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1159         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1160
1161         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1162                                     tot_len, IPPROTO_TCP,
1163                                     buff->csum);
1164
1165         fl.proto = IPPROTO_TCP;
1166         fl.oif = inet6_iif(skb);
1167         fl.fl_ip_dport = t1->dest;
1168         fl.fl_ip_sport = t1->source;
1169         security_skb_classify_flow(skb, &fl);
1170
1171         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1172                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1173                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1174                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1175                         return;
1176                 }
1177         }
1178
1179         kfree_skb(buff);
1180 }
1181
1182 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1183 {
1184         struct inet_timewait_sock *tw = inet_twsk(sk);
1185         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1186
1187         tcp_v6_send_ack(tcptw, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1188                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1189                         tcptw->tw_ts_recent);
1190
1191         inet_twsk_put(tw);
1192 }
1193
1194 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
1195 {
1196         tcp_v6_send_ack(NULL, skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
1197 }
1198
1199
1200 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1201 {
1202         struct request_sock *req, **prev;
1203         const struct tcphdr *th = tcp_hdr(skb);
1204         struct sock *nsk;
1205
1206         /* Find possible connection requests. */
1207         req = inet6_csk_search_req(sk, &prev, th->source,
1208                                    &ipv6_hdr(skb)->saddr,
1209                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1210         if (req)
1211                 return tcp_check_req(sk, skb, req, prev);
1212
1213         nsk = __inet6_lookup_established(&tcp_hashinfo, &ipv6_hdr(skb)->saddr,
1214                                          th->source, &ipv6_hdr(skb)->daddr,
1215                                          ntohs(th->dest), inet6_iif(skb));
1216
1217         if (nsk) {
1218                 if (nsk->sk_state != TCP_TIME_WAIT) {
1219                         bh_lock_sock(nsk);
1220                         return nsk;
1221                 }
1222                 inet_twsk_put(inet_twsk(nsk));
1223                 return NULL;
1224         }
1225
1226 #if 0 /*def CONFIG_SYN_COOKIES*/
1227         if (!th->rst && !th->syn && th->ack)
1228                 sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
1229 #endif
1230         return sk;
1231 }
1232
1233 /* FIXME: this is substantially similar to the ipv4 code.
1234  * Can some kind of merge be done? -- erics
1235  */
1236 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1237 {
1238         struct inet6_request_sock *treq;
1239         struct ipv6_pinfo *np = inet6_sk(sk);
1240         struct tcp_options_received tmp_opt;
1241         struct tcp_sock *tp = tcp_sk(sk);
1242         struct request_sock *req = NULL;
1243         __u32 isn = TCP_SKB_CB(skb)->when;
1244
1245         if (skb->protocol == htons(ETH_P_IP))
1246                 return tcp_v4_conn_request(sk, skb);
1247
1248         if (!ipv6_unicast_destination(skb))
1249                 goto drop;
1250
1251         /*
1252          *      There are no SYN attacks on IPv6, yet...
1253          */
1254         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1255                 if (net_ratelimit())
1256                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
1257                 goto drop;
1258         }
1259
1260         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1261                 goto drop;
1262
1263         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1264         if (req == NULL)
1265                 goto drop;
1266
1267 #ifdef CONFIG_TCP_MD5SIG
1268         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1269 #endif
1270
1271         tcp_clear_options(&tmp_opt);
1272         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1273         tmp_opt.user_mss = tp->rx_opt.user_mss;
1274
1275         tcp_parse_options(skb, &tmp_opt, 0);
1276
1277         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1278         tcp_openreq_init(req, &tmp_opt, skb);
1279
1280         treq = inet6_rsk(req);
1281         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1282         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1283         TCP_ECN_create_request(req, tcp_hdr(skb));
1284         treq->pktopts = NULL;
1285         if (ipv6_opt_accepted(sk, skb) ||
1286             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1287             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1288                 atomic_inc(&skb->users);
1289                 treq->pktopts = skb;
1290         }
1291         treq->iif = sk->sk_bound_dev_if;
1292
1293         /* So that link locals have meaning */
1294         if (!sk->sk_bound_dev_if &&
1295             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1296                 treq->iif = inet6_iif(skb);
1297
1298         if (isn == 0)
1299                 isn = tcp_v6_init_sequence(skb);
1300
1301         tcp_rsk(req)->snt_isn = isn;
1302
1303         security_inet_conn_request(sk, skb, req);
1304
1305         if (tcp_v6_send_synack(sk, req, NULL))
1306                 goto drop;
1307
1308         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1309         return 0;
1310
1311 drop:
1312         if (req)
1313                 reqsk_free(req);
1314
1315         return 0; /* don't send reset */
1316 }
1317
1318 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1319                                           struct request_sock *req,
1320                                           struct dst_entry *dst)
1321 {
1322         struct inet6_request_sock *treq = inet6_rsk(req);
1323         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1324         struct tcp6_sock *newtcp6sk;
1325         struct inet_sock *newinet;
1326         struct tcp_sock *newtp;
1327         struct sock *newsk;
1328         struct ipv6_txoptions *opt;
1329 #ifdef CONFIG_TCP_MD5SIG
1330         struct tcp_md5sig_key *key;
1331 #endif
1332
1333         if (skb->protocol == htons(ETH_P_IP)) {
1334                 /*
1335                  *      v6 mapped
1336                  */
1337
1338                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1339
1340                 if (newsk == NULL)
1341                         return NULL;
1342
1343                 newtcp6sk = (struct tcp6_sock *)newsk;
1344                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1345
1346                 newinet = inet_sk(newsk);
1347                 newnp = inet6_sk(newsk);
1348                 newtp = tcp_sk(newsk);
1349
1350                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1351
1352                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
1353                               newinet->daddr);
1354
1355                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
1356                               newinet->saddr);
1357
1358                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1359
1360                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1361                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1362 #ifdef CONFIG_TCP_MD5SIG
1363                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1364 #endif
1365
1366                 newnp->pktoptions  = NULL;
1367                 newnp->opt         = NULL;
1368                 newnp->mcast_oif   = inet6_iif(skb);
1369                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1370
1371                 /*
1372                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1373                  * here, tcp_create_openreq_child now does this for us, see the comment in
1374                  * that function for the gory details. -acme
1375                  */
1376
1377                 /* It is tricky place. Until this moment IPv4 tcp
1378                    worked with IPv6 icsk.icsk_af_ops.
1379                    Sync it now.
1380                  */
1381                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1382
1383                 return newsk;
1384         }
1385
1386         opt = np->opt;
1387
1388         if (sk_acceptq_is_full(sk))
1389                 goto out_overflow;
1390
1391         if (dst == NULL) {
1392                 struct in6_addr *final_p = NULL, final;
1393                 struct flowi fl;
1394
1395                 memset(&fl, 0, sizeof(fl));
1396                 fl.proto = IPPROTO_TCP;
1397                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
1398                 if (opt && opt->srcrt) {
1399                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
1400                         ipv6_addr_copy(&final, &fl.fl6_dst);
1401                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1402                         final_p = &final;
1403                 }
1404                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
1405                 fl.oif = sk->sk_bound_dev_if;
1406                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
1407                 fl.fl_ip_sport = inet_sk(sk)->sport;
1408                 security_req_classify_flow(req, &fl);
1409
1410                 if (ip6_dst_lookup(sk, &dst, &fl))
1411                         goto out;
1412
1413                 if (final_p)
1414                         ipv6_addr_copy(&fl.fl6_dst, final_p);
1415
1416                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
1417                         goto out;
1418         }
1419
1420         newsk = tcp_create_openreq_child(sk, req, skb);
1421         if (newsk == NULL)
1422                 goto out;
1423
1424         /*
1425          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1426          * count here, tcp_create_openreq_child now does this for us, see the
1427          * comment in that function for the gory details. -acme
1428          */
1429
1430         newsk->sk_gso_type = SKB_GSO_TCPV6;
1431         __ip6_dst_store(newsk, dst, NULL, NULL);
1432
1433         newtcp6sk = (struct tcp6_sock *)newsk;
1434         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1435
1436         newtp = tcp_sk(newsk);
1437         newinet = inet_sk(newsk);
1438         newnp = inet6_sk(newsk);
1439
1440         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1441
1442         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1443         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1444         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1445         newsk->sk_bound_dev_if = treq->iif;
1446
1447         /* Now IPv6 options...
1448
1449            First: no IPv4 options.
1450          */
1451         newinet->opt = NULL;
1452         newnp->ipv6_fl_list = NULL;
1453
1454         /* Clone RX bits */
1455         newnp->rxopt.all = np->rxopt.all;
1456
1457         /* Clone pktoptions received with SYN */
1458         newnp->pktoptions = NULL;
1459         if (treq->pktopts != NULL) {
1460                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1461                 kfree_skb(treq->pktopts);
1462                 treq->pktopts = NULL;
1463                 if (newnp->pktoptions)
1464                         skb_set_owner_r(newnp->pktoptions, newsk);
1465         }
1466         newnp->opt        = NULL;
1467         newnp->mcast_oif  = inet6_iif(skb);
1468         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1469
1470         /* Clone native IPv6 options from listening socket (if any)
1471
1472            Yes, keeping reference count would be much more clever,
1473            but we make one more one thing there: reattach optmem
1474            to newsk.
1475          */
1476         if (opt) {
1477                 newnp->opt = ipv6_dup_options(newsk, opt);
1478                 if (opt != np->opt)
1479                         sock_kfree_s(sk, opt, opt->tot_len);
1480         }
1481
1482         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1483         if (newnp->opt)
1484                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1485                                                      newnp->opt->opt_flen);
1486
1487         tcp_mtup_init(newsk);
1488         tcp_sync_mss(newsk, dst_mtu(dst));
1489         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
1490         tcp_initialize_rcv_mss(newsk);
1491
1492         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
1493
1494 #ifdef CONFIG_TCP_MD5SIG
1495         /* Copy over the MD5 key from the original socket */
1496         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1497                 /* We're using one, so create a matching key
1498                  * on the newsk structure. If we fail to get
1499                  * memory, then we end up not copying the key
1500                  * across. Shucks.
1501                  */
1502                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1503                 if (newkey != NULL)
1504                         tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
1505                                           newkey, key->keylen);
1506         }
1507 #endif
1508
1509         __inet6_hash(&tcp_hashinfo, newsk);
1510         inet_inherit_port(&tcp_hashinfo, sk, newsk);
1511
1512         return newsk;
1513
1514 out_overflow:
1515         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
1516 out:
1517         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
1518         if (opt && opt != np->opt)
1519                 sock_kfree_s(sk, opt, opt->tot_len);
1520         dst_release(dst);
1521         return NULL;
1522 }
1523
1524 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1525 {
1526         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1527                 if (!tcp_v6_check(tcp_hdr(skb), skb->len, &ipv6_hdr(skb)->saddr,
1528                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1529                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1530                         return 0;
1531                 }
1532         }
1533
1534         skb->csum = ~csum_unfold(tcp_v6_check(tcp_hdr(skb), skb->len,
1535                                               &ipv6_hdr(skb)->saddr,
1536                                               &ipv6_hdr(skb)->daddr, 0));
1537
1538         if (skb->len <= 76) {
1539                 return __skb_checksum_complete(skb);
1540         }
1541         return 0;
1542 }
1543
1544 /* The socket must have it's spinlock held when we get
1545  * here.
1546  *
1547  * We have a potential double-lock case here, so even when
1548  * doing backlog processing we use the BH locking scheme.
1549  * This is because we cannot sleep with the original spinlock
1550  * held.
1551  */
1552 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1553 {
1554         struct ipv6_pinfo *np = inet6_sk(sk);
1555         struct tcp_sock *tp;
1556         struct sk_buff *opt_skb = NULL;
1557
1558         /* Imagine: socket is IPv6. IPv4 packet arrives,
1559            goes to IPv4 receive handler and backlogged.
1560            From backlog it always goes here. Kerboom...
1561            Fortunately, tcp_rcv_established and rcv_established
1562            handle them correctly, but it is not case with
1563            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1564          */
1565
1566         if (skb->protocol == htons(ETH_P_IP))
1567                 return tcp_v4_do_rcv(sk, skb);
1568
1569 #ifdef CONFIG_TCP_MD5SIG
1570         if (tcp_v6_inbound_md5_hash (sk, skb))
1571                 goto discard;
1572 #endif
1573
1574         if (sk_filter(sk, skb))
1575                 goto discard;
1576
1577         /*
1578          *      socket locking is here for SMP purposes as backlog rcv
1579          *      is currently called with bh processing disabled.
1580          */
1581
1582         /* Do Stevens' IPV6_PKTOPTIONS.
1583
1584            Yes, guys, it is the only place in our code, where we
1585            may make it not affecting IPv4.
1586            The rest of code is protocol independent,
1587            and I do not like idea to uglify IPv4.
1588
1589            Actually, all the idea behind IPV6_PKTOPTIONS
1590            looks not very well thought. For now we latch
1591            options, received in the last packet, enqueued
1592            by tcp. Feel free to propose better solution.
1593                                                --ANK (980728)
1594          */
1595         if (np->rxopt.all)
1596                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1597
1598         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1599                 TCP_CHECK_TIMER(sk);
1600                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1601                         goto reset;
1602                 TCP_CHECK_TIMER(sk);
1603                 if (opt_skb)
1604                         goto ipv6_pktoptions;
1605                 return 0;
1606         }
1607
1608         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1609                 goto csum_err;
1610
1611         if (sk->sk_state == TCP_LISTEN) {
1612                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1613                 if (!nsk)
1614                         goto discard;
1615
1616                 /*
1617                  * Queue it on the new socket if the new socket is active,
1618                  * otherwise we just shortcircuit this and continue with
1619                  * the new socket..
1620                  */
1621                 if(nsk != sk) {
1622                         if (tcp_child_process(sk, nsk, skb))
1623                                 goto reset;
1624                         if (opt_skb)
1625                                 __kfree_skb(opt_skb);
1626                         return 0;
1627                 }
1628         }
1629
1630         TCP_CHECK_TIMER(sk);
1631         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1632                 goto reset;
1633         TCP_CHECK_TIMER(sk);
1634         if (opt_skb)
1635                 goto ipv6_pktoptions;
1636         return 0;
1637
1638 reset:
1639         tcp_v6_send_reset(sk, skb);
1640 discard:
1641         if (opt_skb)
1642                 __kfree_skb(opt_skb);
1643         kfree_skb(skb);
1644         return 0;
1645 csum_err:
1646         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1647         goto discard;
1648
1649
1650 ipv6_pktoptions:
1651         /* Do you ask, what is it?
1652
1653            1. skb was enqueued by tcp.
1654            2. skb is added to tail of read queue, rather than out of order.
1655            3. socket is not in passive state.
1656            4. Finally, it really contains options, which user wants to receive.
1657          */
1658         tp = tcp_sk(sk);
1659         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1660             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1661                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1662                         np->mcast_oif = inet6_iif(opt_skb);
1663                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1664                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1665                 if (ipv6_opt_accepted(sk, opt_skb)) {
1666                         skb_set_owner_r(opt_skb, sk);
1667                         opt_skb = xchg(&np->pktoptions, opt_skb);
1668                 } else {
1669                         __kfree_skb(opt_skb);
1670                         opt_skb = xchg(&np->pktoptions, NULL);
1671                 }
1672         }
1673
1674         if (opt_skb)
1675                 kfree_skb(opt_skb);
1676         return 0;
1677 }
1678
1679 static int tcp_v6_rcv(struct sk_buff *skb)
1680 {
1681         struct tcphdr *th;
1682         struct sock *sk;
1683         int ret;
1684
1685         if (skb->pkt_type != PACKET_HOST)
1686                 goto discard_it;
1687
1688         /*
1689          *      Count it even if it's bad.
1690          */
1691         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1692
1693         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1694                 goto discard_it;
1695
1696         th = tcp_hdr(skb);
1697
1698         if (th->doff < sizeof(struct tcphdr)/4)
1699                 goto bad_packet;
1700         if (!pskb_may_pull(skb, th->doff*4))
1701                 goto discard_it;
1702
1703         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1704                 goto bad_packet;
1705
1706         th = tcp_hdr(skb);
1707         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1708         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1709                                     skb->len - th->doff*4);
1710         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1711         TCP_SKB_CB(skb)->when = 0;
1712         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
1713         TCP_SKB_CB(skb)->sacked = 0;
1714
1715         sk = __inet6_lookup(&tcp_hashinfo, &ipv6_hdr(skb)->saddr, th->source,
1716                             &ipv6_hdr(skb)->daddr, ntohs(th->dest),
1717                             inet6_iif(skb));
1718
1719         if (!sk)
1720                 goto no_tcp_socket;
1721
1722 process:
1723         if (sk->sk_state == TCP_TIME_WAIT)
1724                 goto do_time_wait;
1725
1726         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1727                 goto discard_and_relse;
1728
1729         if (sk_filter(sk, skb))
1730                 goto discard_and_relse;
1731
1732         skb->dev = NULL;
1733
1734         bh_lock_sock_nested(sk);
1735         ret = 0;
1736         if (!sock_owned_by_user(sk)) {
1737 #ifdef CONFIG_NET_DMA
1738                 struct tcp_sock *tp = tcp_sk(sk);
1739                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1740                         tp->ucopy.dma_chan = get_softnet_dma();
1741                 if (tp->ucopy.dma_chan)
1742                         ret = tcp_v6_do_rcv(sk, skb);
1743                 else
1744 #endif
1745                 {
1746                         if (!tcp_prequeue(sk, skb))
1747                                 ret = tcp_v6_do_rcv(sk, skb);
1748                 }
1749         } else
1750                 sk_add_backlog(sk, skb);
1751         bh_unlock_sock(sk);
1752
1753         sock_put(sk);
1754         return ret ? -1 : 0;
1755
1756 no_tcp_socket:
1757         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1758                 goto discard_it;
1759
1760         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1761 bad_packet:
1762                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1763         } else {
1764                 tcp_v6_send_reset(NULL, skb);
1765         }
1766
1767 discard_it:
1768
1769         /*
1770          *      Discard frame
1771          */
1772
1773         kfree_skb(skb);
1774         return 0;
1775
1776 discard_and_relse:
1777         sock_put(sk);
1778         goto discard_it;
1779
1780 do_time_wait:
1781         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1782                 inet_twsk_put(inet_twsk(sk));
1783                 goto discard_it;
1784         }
1785
1786         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1787                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1788                 inet_twsk_put(inet_twsk(sk));
1789                 goto discard_it;
1790         }
1791
1792         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1793         case TCP_TW_SYN:
1794         {
1795                 struct sock *sk2;
1796
1797                 sk2 = inet6_lookup_listener(&tcp_hashinfo,
1798                                             &ipv6_hdr(skb)->daddr,
1799                                             ntohs(th->dest), inet6_iif(skb));
1800                 if (sk2 != NULL) {
1801                         struct inet_timewait_sock *tw = inet_twsk(sk);
1802                         inet_twsk_deschedule(tw, &tcp_death_row);
1803                         inet_twsk_put(tw);
1804                         sk = sk2;
1805                         goto process;
1806                 }
1807                 /* Fall through to ACK */
1808         }
1809         case TCP_TW_ACK:
1810                 tcp_v6_timewait_ack(sk, skb);
1811                 break;
1812         case TCP_TW_RST:
1813                 goto no_tcp_socket;
1814         case TCP_TW_SUCCESS:;
1815         }
1816         goto discard_it;
1817 }
1818
1819 static int tcp_v6_remember_stamp(struct sock *sk)
1820 {
1821         /* Alas, not yet... */
1822         return 0;
1823 }
1824
1825 static struct inet_connection_sock_af_ops ipv6_specific = {
1826         .queue_xmit        = inet6_csk_xmit,
1827         .send_check        = tcp_v6_send_check,
1828         .rebuild_header    = inet6_sk_rebuild_header,
1829         .conn_request      = tcp_v6_conn_request,
1830         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1831         .remember_stamp    = tcp_v6_remember_stamp,
1832         .net_header_len    = sizeof(struct ipv6hdr),
1833         .setsockopt        = ipv6_setsockopt,
1834         .getsockopt        = ipv6_getsockopt,
1835         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1836         .sockaddr_len      = sizeof(struct sockaddr_in6),
1837 #ifdef CONFIG_COMPAT
1838         .compat_setsockopt = compat_ipv6_setsockopt,
1839         .compat_getsockopt = compat_ipv6_getsockopt,
1840 #endif
1841 };
1842
1843 #ifdef CONFIG_TCP_MD5SIG
1844 static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1845         .md5_lookup     =       tcp_v6_md5_lookup,
1846         .calc_md5_hash  =       tcp_v6_calc_md5_hash,
1847         .md5_add        =       tcp_v6_md5_add_func,
1848         .md5_parse      =       tcp_v6_parse_md5_keys,
1849 };
1850 #endif
1851
1852 /*
1853  *      TCP over IPv4 via INET6 API
1854  */
1855
1856 static struct inet_connection_sock_af_ops ipv6_mapped = {
1857         .queue_xmit        = ip_queue_xmit,
1858         .send_check        = tcp_v4_send_check,
1859         .rebuild_header    = inet_sk_rebuild_header,
1860         .conn_request      = tcp_v6_conn_request,
1861         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1862         .remember_stamp    = tcp_v4_remember_stamp,
1863         .net_header_len    = sizeof(struct iphdr),
1864         .setsockopt        = ipv6_setsockopt,
1865         .getsockopt        = ipv6_getsockopt,
1866         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1867         .sockaddr_len      = sizeof(struct sockaddr_in6),
1868 #ifdef CONFIG_COMPAT
1869         .compat_setsockopt = compat_ipv6_setsockopt,
1870         .compat_getsockopt = compat_ipv6_getsockopt,
1871 #endif
1872 };
1873
1874 #ifdef CONFIG_TCP_MD5SIG
1875 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1876         .md5_lookup     =       tcp_v4_md5_lookup,
1877         .calc_md5_hash  =       tcp_v4_calc_md5_hash,
1878         .md5_add        =       tcp_v6_md5_add_func,
1879         .md5_parse      =       tcp_v6_parse_md5_keys,
1880 };
1881 #endif
1882
1883 /* NOTE: A lot of things set to zero explicitly by call to
1884  *       sk_alloc() so need not be done here.
1885  */
1886 static int tcp_v6_init_sock(struct sock *sk)
1887 {
1888         struct inet_connection_sock *icsk = inet_csk(sk);
1889         struct tcp_sock *tp = tcp_sk(sk);
1890
1891         skb_queue_head_init(&tp->out_of_order_queue);
1892         tcp_init_xmit_timers(sk);
1893         tcp_prequeue_init(tp);
1894
1895         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1896         tp->mdev = TCP_TIMEOUT_INIT;
1897
1898         /* So many TCP implementations out there (incorrectly) count the
1899          * initial SYN frame in their delayed-ACK and congestion control
1900          * algorithms that we must have the following bandaid to talk
1901          * efficiently to them.  -DaveM
1902          */
1903         tp->snd_cwnd = 2;
1904
1905         /* See draft-stevens-tcpca-spec-01 for discussion of the
1906          * initialization of these values.
1907          */
1908         tp->snd_ssthresh = 0x7fffffff;
1909         tp->snd_cwnd_clamp = ~0;
1910         tp->mss_cache = 536;
1911
1912         tp->reordering = sysctl_tcp_reordering;
1913
1914         sk->sk_state = TCP_CLOSE;
1915
1916         icsk->icsk_af_ops = &ipv6_specific;
1917         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1918         icsk->icsk_sync_mss = tcp_sync_mss;
1919         sk->sk_write_space = sk_stream_write_space;
1920         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1921
1922 #ifdef CONFIG_TCP_MD5SIG
1923         tp->af_specific = &tcp_sock_ipv6_specific;
1924 #endif
1925
1926         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1927         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1928
1929         atomic_inc(&tcp_sockets_allocated);
1930
1931         return 0;
1932 }
1933
1934 static int tcp_v6_destroy_sock(struct sock *sk)
1935 {
1936 #ifdef CONFIG_TCP_MD5SIG
1937         /* Clean up the MD5 key list */
1938         if (tcp_sk(sk)->md5sig_info)
1939                 tcp_v6_clear_md5_list(sk);
1940 #endif
1941         tcp_v4_destroy_sock(sk);
1942         return inet6_destroy_sock(sk);
1943 }
1944
1945 #ifdef CONFIG_PROC_FS
1946 /* Proc filesystem TCPv6 sock list dumping. */
1947 static void get_openreq6(struct seq_file *seq,
1948                          struct sock *sk, struct request_sock *req, int i, int uid)
1949 {
1950         int ttd = req->expires - jiffies;
1951         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1952         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1953
1954         if (ttd < 0)
1955                 ttd = 0;
1956
1957         seq_printf(seq,
1958                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1959                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1960                    i,
1961                    src->s6_addr32[0], src->s6_addr32[1],
1962                    src->s6_addr32[2], src->s6_addr32[3],
1963                    ntohs(inet_sk(sk)->sport),
1964                    dest->s6_addr32[0], dest->s6_addr32[1],
1965                    dest->s6_addr32[2], dest->s6_addr32[3],
1966                    ntohs(inet_rsk(req)->rmt_port),
1967                    TCP_SYN_RECV,
1968                    0,0, /* could print option size, but that is af dependent. */
1969                    1,   /* timers active (only the expire timer) */
1970                    jiffies_to_clock_t(ttd),
1971                    req->retrans,
1972                    uid,
1973                    0,  /* non standard timer */
1974                    0, /* open_requests have no inode */
1975                    0, req);
1976 }
1977
1978 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1979 {
1980         struct in6_addr *dest, *src;
1981         __u16 destp, srcp;
1982         int timer_active;
1983         unsigned long timer_expires;
1984         struct inet_sock *inet = inet_sk(sp);
1985         struct tcp_sock *tp = tcp_sk(sp);
1986         const struct inet_connection_sock *icsk = inet_csk(sp);
1987         struct ipv6_pinfo *np = inet6_sk(sp);
1988
1989         dest  = &np->daddr;
1990         src   = &np->rcv_saddr;
1991         destp = ntohs(inet->dport);
1992         srcp  = ntohs(inet->sport);
1993
1994         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1995                 timer_active    = 1;
1996                 timer_expires   = icsk->icsk_timeout;
1997         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1998                 timer_active    = 4;
1999                 timer_expires   = icsk->icsk_timeout;
2000         } else if (timer_pending(&sp->sk_timer)) {
2001                 timer_active    = 2;
2002                 timer_expires   = sp->sk_timer.expires;
2003         } else {
2004                 timer_active    = 0;
2005                 timer_expires = jiffies;
2006         }
2007
2008         seq_printf(seq,
2009                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2010                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
2011                    i,
2012                    src->s6_addr32[0], src->s6_addr32[1],
2013                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2014                    dest->s6_addr32[0], dest->s6_addr32[1],
2015                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2016                    sp->sk_state,
2017                    tp->write_seq-tp->snd_una,
2018                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2019                    timer_active,
2020                    jiffies_to_clock_t(timer_expires - jiffies),
2021                    icsk->icsk_retransmits,
2022                    sock_i_uid(sp),
2023                    icsk->icsk_probes_out,
2024                    sock_i_ino(sp),
2025                    atomic_read(&sp->sk_refcnt), sp,
2026                    icsk->icsk_rto,
2027                    icsk->icsk_ack.ato,
2028                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2029                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
2030                    );
2031 }
2032
2033 static void get_timewait6_sock(struct seq_file *seq,
2034                                struct inet_timewait_sock *tw, int i)
2035 {
2036         struct in6_addr *dest, *src;
2037         __u16 destp, srcp;
2038         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2039         int ttd = tw->tw_ttd - jiffies;
2040
2041         if (ttd < 0)
2042                 ttd = 0;
2043
2044         dest = &tw6->tw_v6_daddr;
2045         src  = &tw6->tw_v6_rcv_saddr;
2046         destp = ntohs(tw->tw_dport);
2047         srcp  = ntohs(tw->tw_sport);
2048
2049         seq_printf(seq,
2050                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2051                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2052                    i,
2053                    src->s6_addr32[0], src->s6_addr32[1],
2054                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2055                    dest->s6_addr32[0], dest->s6_addr32[1],
2056                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2057                    tw->tw_substate, 0, 0,
2058                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2059                    atomic_read(&tw->tw_refcnt), tw);
2060 }
2061
2062 static int tcp6_seq_show(struct seq_file *seq, void *v)
2063 {
2064         struct tcp_iter_state *st;
2065
2066         if (v == SEQ_START_TOKEN) {
2067                 seq_puts(seq,
2068                          "  sl  "
2069                          "local_address                         "
2070                          "remote_address                        "
2071                          "st tx_queue rx_queue tr tm->when retrnsmt"
2072                          "   uid  timeout inode\n");
2073                 goto out;
2074         }
2075         st = seq->private;
2076
2077         switch (st->state) {
2078         case TCP_SEQ_STATE_LISTENING:
2079         case TCP_SEQ_STATE_ESTABLISHED:
2080                 get_tcp6_sock(seq, v, st->num);
2081                 break;
2082         case TCP_SEQ_STATE_OPENREQ:
2083                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2084                 break;
2085         case TCP_SEQ_STATE_TIME_WAIT:
2086                 get_timewait6_sock(seq, v, st->num);
2087                 break;
2088         }
2089 out:
2090         return 0;
2091 }
2092
2093 static struct file_operations tcp6_seq_fops;
2094 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2095         .owner          = THIS_MODULE,
2096         .name           = "tcp6",
2097         .family         = AF_INET6,
2098         .seq_show       = tcp6_seq_show,
2099         .seq_fops       = &tcp6_seq_fops,
2100 };
2101
2102 int __init tcp6_proc_init(void)
2103 {
2104         return tcp_proc_register(&tcp6_seq_afinfo);
2105 }
2106
2107 void tcp6_proc_exit(void)
2108 {
2109         tcp_proc_unregister(&tcp6_seq_afinfo);
2110 }
2111 #endif
2112
2113 DEFINE_PROTO_INUSE(tcpv6)
2114
2115 struct proto tcpv6_prot = {
2116         .name                   = "TCPv6",
2117         .owner                  = THIS_MODULE,
2118         .close                  = tcp_close,
2119         .connect                = tcp_v6_connect,
2120         .disconnect             = tcp_disconnect,
2121         .accept                 = inet_csk_accept,
2122         .ioctl                  = tcp_ioctl,
2123         .init                   = tcp_v6_init_sock,
2124         .destroy                = tcp_v6_destroy_sock,
2125         .shutdown               = tcp_shutdown,
2126         .setsockopt             = tcp_setsockopt,
2127         .getsockopt             = tcp_getsockopt,
2128         .recvmsg                = tcp_recvmsg,
2129         .backlog_rcv            = tcp_v6_do_rcv,
2130         .hash                   = tcp_v6_hash,
2131         .unhash                 = tcp_unhash,
2132         .get_port               = tcp_v6_get_port,
2133         .enter_memory_pressure  = tcp_enter_memory_pressure,
2134         .sockets_allocated      = &tcp_sockets_allocated,
2135         .memory_allocated       = &tcp_memory_allocated,
2136         .memory_pressure        = &tcp_memory_pressure,
2137         .orphan_count           = &tcp_orphan_count,
2138         .sysctl_mem             = sysctl_tcp_mem,
2139         .sysctl_wmem            = sysctl_tcp_wmem,
2140         .sysctl_rmem            = sysctl_tcp_rmem,
2141         .max_header             = MAX_TCP_HEADER,
2142         .obj_size               = sizeof(struct tcp6_sock),
2143         .twsk_prot              = &tcp6_timewait_sock_ops,
2144         .rsk_prot               = &tcp6_request_sock_ops,
2145 #ifdef CONFIG_COMPAT
2146         .compat_setsockopt      = compat_tcp_setsockopt,
2147         .compat_getsockopt      = compat_tcp_getsockopt,
2148 #endif
2149         REF_PROTO_INUSE(tcpv6)
2150 };
2151
2152 static struct inet6_protocol tcpv6_protocol = {
2153         .handler        =       tcp_v6_rcv,
2154         .err_handler    =       tcp_v6_err,
2155         .gso_send_check =       tcp_v6_gso_send_check,
2156         .gso_segment    =       tcp_tso_segment,
2157         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2158 };
2159
2160 static struct inet_protosw tcpv6_protosw = {
2161         .type           =       SOCK_STREAM,
2162         .protocol       =       IPPROTO_TCP,
2163         .prot           =       &tcpv6_prot,
2164         .ops            =       &inet6_stream_ops,
2165         .capability     =       -1,
2166         .no_check       =       0,
2167         .flags          =       INET_PROTOSW_PERMANENT |
2168                                 INET_PROTOSW_ICSK,
2169 };
2170
2171 void __init tcpv6_init(void)
2172 {
2173         /* register inet6 protocol */
2174         if (inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP) < 0)
2175                 printk(KERN_ERR "tcpv6_init: Could not register protocol\n");
2176         inet6_register_protosw(&tcpv6_protosw);
2177
2178         if (inet_csk_ctl_sock_create(&tcp6_socket, PF_INET6, SOCK_RAW,
2179                                      IPPROTO_TCP) < 0)
2180                 panic("Failed to create the TCPv6 control socket.\n");
2181 }