SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/net.h>
  34 #include <linux/jiffies.h>
  35 #include <linux/in.h>
  36 #include <linux/in6.h>
  37 #include <linux/netdevice.h>
  38 #include <linux/init.h>
  39 #include <linux/jhash.h>
  40 #include <linux/ipsec.h>
  41 #include <linux/times.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63
  64 #include <asm/uaccess.h>
  65
  66 #include <linux/proc_fs.h>
  67 #include <linux/seq_file.h>
  68
  69 #include <linux/crypto.h>
  70 #include <linux/scatterlist.h>
  71
  72 /* Socket used for sending RSTs and ACKs */
  73 static struct socket *tcp6_socket;
  74
  75 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  76 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
  77 static void     tcp_v6_send_check(struct sock *sk, int len,
  78                                   struct sk_buff *skb);
  79
  80 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  81
  82 static struct inet_connection_sock_af_ops ipv6_mapped;
  83 static struct inet_connection_sock_af_ops ipv6_specific;
  84 #ifdef CONFIG_TCP_MD5SIG
  85 static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  86 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  87 #endif
  88
  89 static void tcp_v6_hash(struct sock *sk)
  90 {
  91         if (sk->sk_state != TCP_CLOSE) {
  92                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  93                         tcp_prot.hash(sk);
  94                         return;
  95                 }
  96                 local_bh_disable();
  97                 __inet6_hash(sk);
  98                 local_bh_enable();
  99         }
 100 }
 101
 102 static __inline__ __sum16 tcp_v6_check(struct tcphdr *th, int len,
 103                                    struct in6_addr *saddr,
 104                                    struct in6_addr *daddr,
 105                                    __wsum base)
 106 {
 107         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 108 }
 109
 110 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 111 {
 112         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 113                                             ipv6_hdr(skb)->saddr.s6_addr32,
 114                                             tcp_hdr(skb)->dest,
 115                                             tcp_hdr(skb)->source);
 116 }
 117
 118 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 119                           int addr_len)
 120 {
 121         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 122         struct inet_sock *inet = inet_sk(sk);
 123         struct inet_connection_sock *icsk = inet_csk(sk);
 124         struct ipv6_pinfo *np = inet6_sk(sk);
 125         struct tcp_sock *tp = tcp_sk(sk);
 126         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 127         struct flowi fl;
 128         struct dst_entry *dst;
 129         int addr_type;
 130         int err;
 131
 132         if (addr_len < SIN6_LEN_RFC2133)
 133                 return -EINVAL;
 134
 135         if (usin->sin6_family != AF_INET6)
 136                 return(-EAFNOSUPPORT);
 137
 138         memset(&fl, 0, sizeof(fl));
 139
 140         if (np->sndflow) {
 141                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 142                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 143                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 144                         struct ip6_flowlabel *flowlabel;
 145                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 146                         if (flowlabel == NULL)
 147                                 return -EINVAL;
 148                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 149                         fl6_sock_release(flowlabel);
 150                 }
 151         }
 152
 153         /*
 154          *      connect() to INADDR_ANY means loopback (BSD'ism).
 155          */
 156
 157         if(ipv6_addr_any(&usin->sin6_addr))
 158                 usin->sin6_addr.s6_addr[15] = 0x1;
 159
 160         addr_type = ipv6_addr_type(&usin->sin6_addr);
 161
 162         if(addr_type & IPV6_ADDR_MULTICAST)
 163                 return -ENETUNREACH;
 164
 165         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 166                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 167                     usin->sin6_scope_id) {
 168                         /* If interface is set while binding, indices
 169                          * must coincide.
 170                          */
 171                         if (sk->sk_bound_dev_if &&
 172                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 173                                 return -EINVAL;
 174
 175                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 176                 }
 177
 178                 /* Connect to link-local address requires an interface */
 179                 if (!sk->sk_bound_dev_if)
 180                         return -EINVAL;
 181         }
 182
 183         if (tp->rx_opt.ts_recent_stamp &&
 184             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 185                 tp->rx_opt.ts_recent = 0;
 186                 tp->rx_opt.ts_recent_stamp = 0;
 187                 tp->write_seq = 0;
 188         }
 189
 190         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 191         np->flow_label = fl.fl6_flowlabel;
 192
 193         /*
 194          *      TCP over IPv4
 195          */
 196
 197         if (addr_type == IPV6_ADDR_MAPPED) {
 198                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 199                 struct sockaddr_in sin;
 200
 201                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 202
 203                 if (__ipv6_only_sock(sk))
 204                         return -ENETUNREACH;
 205
 206                 sin.sin_family = AF_INET;
 207                 sin.sin_port = usin->sin6_port;
 208                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 209
 210                 icsk->icsk_af_ops = &ipv6_mapped;
 211                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 212 #ifdef CONFIG_TCP_MD5SIG
 213                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 214 #endif
 215
 216                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 217
 218                 if (err) {
 219                         icsk->icsk_ext_hdr_len = exthdrlen;
 220                         icsk->icsk_af_ops = &ipv6_specific;
 221                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 222 #ifdef CONFIG_TCP_MD5SIG
 223                         tp->af_specific = &tcp_sock_ipv6_specific;
 224 #endif
 225                         goto failure;
 226                 } else {
 227                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 228                                       inet->saddr);
 229                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 230                                       inet->rcv_saddr);
 231                 }
 232
 233                 return err;
 234         }
 235
 236         if (!ipv6_addr_any(&np->rcv_saddr))
 237                 saddr = &np->rcv_saddr;
 238
 239         fl.proto = IPPROTO_TCP;
 240         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 241         ipv6_addr_copy(&fl.fl6_src,
 242                        (saddr ? saddr : &np->saddr));
 243         fl.oif = sk->sk_bound_dev_if;
 244         fl.fl_ip_dport = usin->sin6_port;
 245         fl.fl_ip_sport = inet->sport;
 246
 247         if (np->opt && np->opt->srcrt) {
 248                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 249                 ipv6_addr_copy(&final, &fl.fl6_dst);
 250                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 251                 final_p = &final;
 252         }
 253
 254         security_sk_classify_flow(sk, &fl);
 255
 256         err = ip6_dst_lookup(sk, &dst, &fl);
 257         if (err)
 258                 goto failure;
 259         if (final_p)
 260                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 261
 262         if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
 263                 if (err == -EREMOTE)
 264                         err = ip6_dst_blackhole(sk, &dst, &fl);
 265                 if (err < 0)
 266                         goto failure;
 267         }
 268
 269         if (saddr == NULL) {
 270                 saddr = &fl.fl6_src;
 271                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 272         }
 273
 274         /* set the source address */
 275         ipv6_addr_copy(&np->saddr, saddr);
 276         inet->rcv_saddr = LOOPBACK4_IPV6;
 277
 278         sk->sk_gso_type = SKB_GSO_TCPV6;
 279         __ip6_dst_store(sk, dst, NULL, NULL);
 280
 281         icsk->icsk_ext_hdr_len = 0;
 282         if (np->opt)
 283                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 284                                           np->opt->opt_nflen);
 285
 286         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 287
 288         inet->dport = usin->sin6_port;
 289
 290         tcp_set_state(sk, TCP_SYN_SENT);
 291         err = inet6_hash_connect(&tcp_death_row, sk);
 292         if (err)
 293                 goto late_failure;
 294
 295         if (!tp->write_seq)
 296                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 297                                                              np->daddr.s6_addr32,
 298                                                              inet->sport,
 299                                                              inet->dport);
 300
 301         err = tcp_connect(sk);
 302         if (err)
 303                 goto late_failure;
 304
 305         return 0;
 306
 307 late_failure:
 308         tcp_set_state(sk, TCP_CLOSE);
 309         __sk_dst_reset(sk);
 310 failure:
 311         inet->dport = 0;
 312         sk->sk_route_caps = 0;
 313         return err;
 314 }
 315
 316 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 317                 int type, int code, int offset, __be32 info)
 318 {
 319         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 320         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 321         struct ipv6_pinfo *np;
 322         struct sock *sk;
 323         int err;
 324         struct tcp_sock *tp;
 325         __u32 seq;
 326
 327         sk = inet6_lookup(skb->dev->nd_net, &tcp_hashinfo, &hdr->daddr,
 328                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 329
 330         if (sk == NULL) {
 331                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 332                 return;
 333         }
 334
 335         if (sk->sk_state == TCP_TIME_WAIT) {
 336                 inet_twsk_put(inet_twsk(sk));
 337                 return;
 338         }
 339
 340         bh_lock_sock(sk);
 341         if (sock_owned_by_user(sk))
 342                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 343
 344         if (sk->sk_state == TCP_CLOSE)
 345                 goto out;
 346
 347         tp = tcp_sk(sk);
 348         seq = ntohl(th->seq);
 349         if (sk->sk_state != TCP_LISTEN &&
 350             !between(seq, tp->snd_una, tp->snd_nxt)) {
 351                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 352                 goto out;
 353         }
 354
 355         np = inet6_sk(sk);
 356
 357         if (type == ICMPV6_PKT_TOOBIG) {
 358                 struct dst_entry *dst = NULL;
 359
 360                 if (sock_owned_by_user(sk))
 361                         goto out;
 362                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 363                         goto out;
 364
 365                 /* icmp should have updated the destination cache entry */
 366                 dst = __sk_dst_check(sk, np->dst_cookie);
 367
 368                 if (dst == NULL) {
 369                         struct inet_sock *inet = inet_sk(sk);
 370                         struct flowi fl;
 371
 372                         /* BUGGG_FUTURE: Again, it is not clear how
 373                            to handle rthdr case. Ignore this complexity
 374                            for now.
 375                          */
 376                         memset(&fl, 0, sizeof(fl));
 377                         fl.proto = IPPROTO_TCP;
 378                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 379                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 380                         fl.oif = sk->sk_bound_dev_if;
 381                         fl.fl_ip_dport = inet->dport;
 382                         fl.fl_ip_sport = inet->sport;
 383                         security_skb_classify_flow(skb, &fl);
 384
 385                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 386                                 sk->sk_err_soft = -err;
 387                                 goto out;
 388                         }
 389
 390                         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 391                                 sk->sk_err_soft = -err;
 392                                 goto out;
 393                         }
 394
 395                 } else
 396                         dst_hold(dst);
 397
 398                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 399                         tcp_sync_mss(sk, dst_mtu(dst));
 400                         tcp_simple_retransmit(sk);
 401                 } /* else let the usual retransmit timer handle it */
 402                 dst_release(dst);
 403                 goto out;
 404         }
 405
 406         icmpv6_err_convert(type, code, &err);
 407
 408         /* Might be for an request_sock */
 409         switch (sk->sk_state) {
 410                 struct request_sock *req, **prev;
 411         case TCP_LISTEN:
 412                 if (sock_owned_by_user(sk))
 413                         goto out;
 414
 415                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 416                                            &hdr->saddr, inet6_iif(skb));
 417                 if (!req)
 418                         goto out;
 419
 420                 /* ICMPs are not backlogged, hence we cannot get
 421                  * an established socket here.
 422                  */
 423                 BUG_TRAP(req->sk == NULL);
 424
 425                 if (seq != tcp_rsk(req)->snt_isn) {
 426                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 427                         goto out;
 428                 }
 429
 430                 inet_csk_reqsk_queue_drop(sk, req, prev);
 431                 goto out;
 432
 433         case TCP_SYN_SENT:
 434         case TCP_SYN_RECV:  /* Cannot happen.
 435                                It can, it SYNs are crossed. --ANK */
 436                 if (!sock_owned_by_user(sk)) {
 437                         sk->sk_err = err;
 438                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 439
 440                         tcp_done(sk);
 441                 } else
 442                         sk->sk_err_soft = err;
 443                 goto out;
 444         }
 445
 446         if (!sock_owned_by_user(sk) && np->recverr) {
 447                 sk->sk_err = err;
 448                 sk->sk_error_report(sk);
 449         } else
 450                 sk->sk_err_soft = err;
 451
 452 out:
 453         bh_unlock_sock(sk);
 454         sock_put(sk);
 455 }
 456
 457
 458 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
 459 {
 460         struct inet6_request_sock *treq = inet6_rsk(req);
 461         struct ipv6_pinfo *np = inet6_sk(sk);
 462         struct sk_buff * skb;
 463         struct ipv6_txoptions *opt = NULL;
 464         struct in6_addr * final_p = NULL, final;
 465         struct flowi fl;
 466         struct dst_entry *dst;
 467         int err = -1;
 468
 469         memset(&fl, 0, sizeof(fl));
 470         fl.proto = IPPROTO_TCP;
 471         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 472         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 473         fl.fl6_flowlabel = 0;
 474         fl.oif = treq->iif;
 475         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 476         fl.fl_ip_sport = inet_sk(sk)->sport;
 477         security_req_classify_flow(req, &fl);
 478
 479         opt = np->opt;
 480         if (opt && opt->srcrt) {
 481                 struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 482                 ipv6_addr_copy(&final, &fl.fl6_dst);
 483                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 484                 final_p = &final;
 485         }
 486
 487         err = ip6_dst_lookup(sk, &dst, &fl);
 488         if (err)
 489                 goto done;
 490         if (final_p)
 491                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 492         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 493                 goto done;
 494
 495         skb = tcp_make_synack(sk, dst, req);
 496         if (skb) {
 497                 struct tcphdr *th = tcp_hdr(skb);
 498
 499                 th->check = tcp_v6_check(th, skb->len,
 500                                          &treq->loc_addr, &treq->rmt_addr,
 501                                          csum_partial((char *)th, skb->len, skb->csum));
 502
 503                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 504                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 505                 err = net_xmit_eval(err);
 506         }
 507
 508 done:
 509         if (opt && opt != np->opt)
 510                 sock_kfree_s(sk, opt, opt->tot_len);
 511         dst_release(dst);
 512         return err;
 513 }
 514
 515 static inline void syn_flood_warning(struct sk_buff *skb)
 516 {
 517 #ifdef CONFIG_SYN_COOKIES
 518         if (sysctl_tcp_syncookies)
 519                 printk(KERN_INFO
 520                        "TCPv6: Possible SYN flooding on port %d. "
 521                        "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
 522         else
 523 #endif
 524                 printk(KERN_INFO
 525                        "TCPv6: Possible SYN flooding on port %d. "
 526                        "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
 527 }
 528
 529 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 530 {
 531         if (inet6_rsk(req)->pktopts)
 532                 kfree_skb(inet6_rsk(req)->pktopts);
 533 }
 534
 535 #ifdef CONFIG_TCP_MD5SIG
 536 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 537                                                    struct in6_addr *addr)
 538 {
 539         struct tcp_sock *tp = tcp_sk(sk);
 540         int i;
 541
 542         BUG_ON(tp == NULL);
 543
 544         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 545                 return NULL;
 546
 547         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 548                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, addr) == 0)
 549                         return &tp->md5sig_info->keys6[i].base;
 550         }
 551         return NULL;
 552 }
 553
 554 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 555                                                 struct sock *addr_sk)
 556 {
 557         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 558 }
 559
 560 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 561                                                       struct request_sock *req)
 562 {
 563         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 564 }
 565
 566 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 567                              char *newkey, u8 newkeylen)
 568 {
 569         /* Add key to the list */
 570         struct tcp_md5sig_key *key;
 571         struct tcp_sock *tp = tcp_sk(sk);
 572         struct tcp6_md5sig_key *keys;
 573
 574         key = tcp_v6_md5_do_lookup(sk, peer);
 575         if (key) {
 576                 /* modify existing entry - just update that one */
 577                 kfree(key->key);
 578                 key->key = newkey;
 579                 key->keylen = newkeylen;
 580         } else {
 581                 /* reallocate new list if current one is full. */
 582                 if (!tp->md5sig_info) {
 583                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 584                         if (!tp->md5sig_info) {
 585                                 kfree(newkey);
 586                                 return -ENOMEM;
 587                         }
 588                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 589                 }
 590                 if (tcp_alloc_md5sig_pool() == NULL) {
 591                         kfree(newkey);
 592                         return -ENOMEM;
 593                 }
 594                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 595                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 596                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 597
 598                         if (!keys) {
 599                                 tcp_free_md5sig_pool();
 600                                 kfree(newkey);
 601                                 return -ENOMEM;
 602                         }
 603
 604                         if (tp->md5sig_info->entries6)
 605                                 memmove(keys, tp->md5sig_info->keys6,
 606                                         (sizeof (tp->md5sig_info->keys6[0]) *
 607                                          tp->md5sig_info->entries6));
 608
 609                         kfree(tp->md5sig_info->keys6);
 610                         tp->md5sig_info->keys6 = keys;
 611                         tp->md5sig_info->alloced6++;
 612                 }
 613
 614                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 615                                peer);
 616                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 617                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 618
 619                 tp->md5sig_info->entries6++;
 620         }
 621         return 0;
 622 }
 623
 624 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 625                                u8 *newkey, __u8 newkeylen)
 626 {
 627         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 628                                  newkey, newkeylen);
 629 }
 630
 631 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
 632 {
 633         struct tcp_sock *tp = tcp_sk(sk);
 634         int i;
 635
 636         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 637                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, peer) == 0) {
 638                         /* Free the key */
 639                         kfree(tp->md5sig_info->keys6[i].base.key);
 640                         tp->md5sig_info->entries6--;
 641
 642                         if (tp->md5sig_info->entries6 == 0) {
 643                                 kfree(tp->md5sig_info->keys6);
 644                                 tp->md5sig_info->keys6 = NULL;
 645                                 tp->md5sig_info->alloced6 = 0;
 646                         } else {
 647                                 /* shrink the database */
 648                                 if (tp->md5sig_info->entries6 != i)
 649                                         memmove(&tp->md5sig_info->keys6[i],
 650                                                 &tp->md5sig_info->keys6[i+1],
 651                                                 (tp->md5sig_info->entries6 - i)
 652                                                 * sizeof (tp->md5sig_info->keys6[0]));
 653                         }
 654                         tcp_free_md5sig_pool();
 655                         return 0;
 656                 }
 657         }
 658         return -ENOENT;
 659 }
 660
 661 static void tcp_v6_clear_md5_list (struct sock *sk)
 662 {
 663         struct tcp_sock *tp = tcp_sk(sk);
 664         int i;
 665
 666         if (tp->md5sig_info->entries6) {
 667                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 668                         kfree(tp->md5sig_info->keys6[i].base.key);
 669                 tp->md5sig_info->entries6 = 0;
 670                 tcp_free_md5sig_pool();
 671         }
 672
 673         kfree(tp->md5sig_info->keys6);
 674         tp->md5sig_info->keys6 = NULL;
 675         tp->md5sig_info->alloced6 = 0;
 676
 677         if (tp->md5sig_info->entries4) {
 678                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 679                         kfree(tp->md5sig_info->keys4[i].base.key);
 680                 tp->md5sig_info->entries4 = 0;
 681                 tcp_free_md5sig_pool();
 682         }
 683
 684         kfree(tp->md5sig_info->keys4);
 685         tp->md5sig_info->keys4 = NULL;
 686         tp->md5sig_info->alloced4 = 0;
 687 }
 688
 689 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 690                                   int optlen)
 691 {
 692         struct tcp_md5sig cmd;
 693         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 694         u8 *newkey;
 695
 696         if (optlen < sizeof(cmd))
 697                 return -EINVAL;
 698
 699         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 700                 return -EFAULT;
 701
 702         if (sin6->sin6_family != AF_INET6)
 703                 return -EINVAL;
 704
 705         if (!cmd.tcpm_keylen) {
 706                 if (!tcp_sk(sk)->md5sig_info)
 707                         return -ENOENT;
 708                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 709                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 710                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 711         }
 712
 713         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 714                 return -EINVAL;
 715
 716         if (!tcp_sk(sk)->md5sig_info) {
 717                 struct tcp_sock *tp = tcp_sk(sk);
 718                 struct tcp_md5sig_info *p;
 719
 720                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 721                 if (!p)
 722                         return -ENOMEM;
 723
 724                 tp->md5sig_info = p;
 725                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 726         }
 727
 728         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 729         if (!newkey)
 730                 return -ENOMEM;
 731         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 732                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 733                                          newkey, cmd.tcpm_keylen);
 734         }
 735         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 736 }
 737
 738 static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 739                                    struct in6_addr *saddr,
 740                                    struct in6_addr *daddr,
 741                                    struct tcphdr *th, int protocol,
 742                                    unsigned int tcplen)
 743 {
 744         struct scatterlist sg[4];
 745         __u16 data_len;
 746         int block = 0;
 747         __sum16 cksum;
 748         struct tcp_md5sig_pool *hp;
 749         struct tcp6_pseudohdr *bp;
 750         struct hash_desc *desc;
 751         int err;
 752         unsigned int nbytes = 0;
 753
 754         hp = tcp_get_md5sig_pool();
 755         if (!hp) {
 756                 printk(KERN_WARNING "%s(): hash pool not found...\n", __FUNCTION__);
 757                 goto clear_hash_noput;
 758         }
 759         bp = &hp->md5_blk.ip6;
 760         desc = &hp->md5_desc;
 761
 762         /* 1. TCP pseudo-header (RFC2460) */
 763         ipv6_addr_copy(&bp->saddr, saddr);
 764         ipv6_addr_copy(&bp->daddr, daddr);
 765         bp->len = htonl(tcplen);
 766         bp->protocol = htonl(protocol);
 767
 768         sg_init_table(sg, 4);
 769
 770         sg_set_buf(&sg[block++], bp, sizeof(*bp));
 771         nbytes += sizeof(*bp);
 772
 773         /* 2. TCP header, excluding options */
 774         cksum = th->check;
 775         th->check = 0;
 776         sg_set_buf(&sg[block++], th, sizeof(*th));
 777         nbytes += sizeof(*th);
 778
 779         /* 3. TCP segment data (if any) */
 780         data_len = tcplen - (th->doff << 2);
 781         if (data_len > 0) {
 782                 u8 *data = (u8 *)th + (th->doff << 2);
 783                 sg_set_buf(&sg[block++], data, data_len);
 784                 nbytes += data_len;
 785         }
 786
 787         /* 4. shared key */
 788         sg_set_buf(&sg[block++], key->key, key->keylen);
 789         nbytes += key->keylen;
 790
 791         sg_mark_end(&sg[block - 1]);
 792
 793         /* Now store the hash into the packet */
 794         err = crypto_hash_init(desc);
 795         if (err) {
 796                 printk(KERN_WARNING "%s(): hash_init failed\n", __FUNCTION__);
 797                 goto clear_hash;
 798         }
 799         err = crypto_hash_update(desc, sg, nbytes);
 800         if (err) {
 801                 printk(KERN_WARNING "%s(): hash_update failed\n", __FUNCTION__);
 802                 goto clear_hash;
 803         }
 804         err = crypto_hash_final(desc, md5_hash);
 805         if (err) {
 806                 printk(KERN_WARNING "%s(): hash_final failed\n", __FUNCTION__);
 807                 goto clear_hash;
 808         }
 809
 810         /* Reset header, and free up the crypto */
 811         tcp_put_md5sig_pool();
 812         th->check = cksum;
 813 out:
 814         return 0;
 815 clear_hash:
 816         tcp_put_md5sig_pool();
 817 clear_hash_noput:
 818         memset(md5_hash, 0, 16);
 819         goto out;
 820 }
 821
 822 static int tcp_v6_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 823                                 struct sock *sk,
 824                                 struct dst_entry *dst,
 825                                 struct request_sock *req,
 826                                 struct tcphdr *th, int protocol,
 827                                 unsigned int tcplen)
 828 {
 829         struct in6_addr *saddr, *daddr;
 830
 831         if (sk) {
 832                 saddr = &inet6_sk(sk)->saddr;
 833                 daddr = &inet6_sk(sk)->daddr;
 834         } else {
 835                 saddr = &inet6_rsk(req)->loc_addr;
 836                 daddr = &inet6_rsk(req)->rmt_addr;
 837         }
 838         return tcp_v6_do_calc_md5_hash(md5_hash, key,
 839                                        saddr, daddr,
 840                                        th, protocol, tcplen);
 841 }
 842
 843 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 844 {
 845         __u8 *hash_location = NULL;
 846         struct tcp_md5sig_key *hash_expected;
 847         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 848         struct tcphdr *th = tcp_hdr(skb);
 849         int length = (th->doff << 2) - sizeof (*th);
 850         int genhash;
 851         u8 *ptr;
 852         u8 newhash[16];
 853
 854         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 855
 856         /* If the TCP option is too short, we can short cut */
 857         if (length < TCPOLEN_MD5SIG)
 858                 return hash_expected ? 1 : 0;
 859
 860         /* parse options */
 861         ptr = (u8*)(th + 1);
 862         while (length > 0) {
 863                 int opcode = *ptr++;
 864                 int opsize;
 865
 866                 switch(opcode) {
 867                 case TCPOPT_EOL:
 868                         goto done_opts;
 869                 case TCPOPT_NOP:
 870                         length--;
 871                         continue;
 872                 default:
 873                         opsize = *ptr++;
 874                         if (opsize < 2 || opsize > length)
 875                                 goto done_opts;
 876                         if (opcode == TCPOPT_MD5SIG) {
 877                                 hash_location = ptr;
 878                                 goto done_opts;
 879                         }
 880                 }
 881                 ptr += opsize - 2;
 882                 length -= opsize;
 883         }
 884
 885 done_opts:
 886         /* do we have a hash as expected? */
 887         if (!hash_expected) {
 888                 if (!hash_location)
 889                         return 0;
 890                 if (net_ratelimit()) {
 891                         printk(KERN_INFO "MD5 Hash NOT expected but found "
 892                                "(" NIP6_FMT ", %u)->"
 893                                "(" NIP6_FMT ", %u)\n",
 894                                NIP6(ip6h->saddr), ntohs(th->source),
 895                                NIP6(ip6h->daddr), ntohs(th->dest));
 896                 }
 897                 return 1;
 898         }
 899
 900         if (!hash_location) {
 901                 if (net_ratelimit()) {
 902                         printk(KERN_INFO "MD5 Hash expected but NOT found "
 903                                "(" NIP6_FMT ", %u)->"
 904                                "(" NIP6_FMT ", %u)\n",
 905                                NIP6(ip6h->saddr), ntohs(th->source),
 906                                NIP6(ip6h->daddr), ntohs(th->dest));
 907                 }
 908                 return 1;
 909         }
 910
 911         /* check the signature */
 912         genhash = tcp_v6_do_calc_md5_hash(newhash,
 913                                           hash_expected,
 914                                           &ip6h->saddr, &ip6h->daddr,
 915                                           th, sk->sk_protocol,
 916                                           skb->len);
 917         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 918                 if (net_ratelimit()) {
 919                         printk(KERN_INFO "MD5 Hash %s for "
 920                                "(" NIP6_FMT ", %u)->"
 921                                "(" NIP6_FMT ", %u)\n",
 922                                genhash ? "failed" : "mismatch",
 923                                NIP6(ip6h->saddr), ntohs(th->source),
 924                                NIP6(ip6h->daddr), ntohs(th->dest));
 925                 }
 926                 return 1;
 927         }
 928         return 0;
 929 }
 930 #endif
 931
 932 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 933         .family         =       AF_INET6,
 934         .obj_size       =       sizeof(struct tcp6_request_sock),
 935         .rtx_syn_ack    =       tcp_v6_send_synack,
 936         .send_ack       =       tcp_v6_reqsk_send_ack,
 937         .destructor     =       tcp_v6_reqsk_destructor,
 938         .send_reset     =       tcp_v6_send_reset
 939 };
 940
 941 #ifdef CONFIG_TCP_MD5SIG
 942 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 943         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 944 };
 945 #endif
 946
 947 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 948         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 949         .twsk_unique    = tcp_twsk_unique,
 950         .twsk_destructor= tcp_twsk_destructor,
 951 };
 952
 953 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 954 {
 955         struct ipv6_pinfo *np = inet6_sk(sk);
 956         struct tcphdr *th = tcp_hdr(skb);
 957
 958         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 959                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 960                 skb->csum_start = skb_transport_header(skb) - skb->head;
 961                 skb->csum_offset = offsetof(struct tcphdr, check);
 962         } else {
 963                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 964                                             csum_partial((char *)th, th->doff<<2,
 965                                                          skb->csum));
 966         }
 967 }
 968
 969 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 970 {
 971         struct ipv6hdr *ipv6h;
 972         struct tcphdr *th;
 973
 974         if (!pskb_may_pull(skb, sizeof(*th)))
 975                 return -EINVAL;
 976
 977         ipv6h = ipv6_hdr(skb);
 978         th = tcp_hdr(skb);
 979
 980         th->check = 0;
 981         th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
 982                                      IPPROTO_TCP, 0);
 983         skb->csum_start = skb_transport_header(skb) - skb->head;
 984         skb->csum_offset = offsetof(struct tcphdr, check);
 985         skb->ip_summed = CHECKSUM_PARTIAL;
 986         return 0;
 987 }
 988
 989 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 990 {
 991         struct tcphdr *th = tcp_hdr(skb), *t1;
 992         struct sk_buff *buff;
 993         struct flowi fl;
 994         unsigned int tot_len = sizeof(*th);
 995 #ifdef CONFIG_TCP_MD5SIG
 996         struct tcp_md5sig_key *key;
 997 #endif
 998
 999         if (th->rst)
1000                 return;
1001
1002         if (!ipv6_unicast_destination(skb))
1003                 return;
1004
1005 #ifdef CONFIG_TCP_MD5SIG
1006         if (sk)
1007                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1008         else
1009                 key = NULL;
1010
1011         if (key)
1012                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1013 #endif
1014
1015         /*
1016          * We need to grab some memory, and put together an RST,
1017          * and then put it into the queue to be sent.
1018          */
1019
1020         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1021                          GFP_ATOMIC);
1022         if (buff == NULL)
1023                 return;
1024
1025         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1026
1027         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1028
1029         /* Swap the send and the receive. */
1030         memset(t1, 0, sizeof(*t1));
1031         t1->dest = th->source;
1032         t1->source = th->dest;
1033         t1->doff = tot_len / 4;
1034         t1->rst = 1;
1035
1036         if(th->ack) {
1037                 t1->seq = th->ack_seq;
1038         } else {
1039                 t1->ack = 1;
1040                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
1041                                     + skb->len - (th->doff<<2));
1042         }
1043
1044 #ifdef CONFIG_TCP_MD5SIG
1045         if (key) {
1046                 __be32 *opt = (__be32*)(t1 + 1);
1047                 opt[0] = htonl((TCPOPT_NOP << 24) |
1048                                (TCPOPT_NOP << 16) |
1049                                (TCPOPT_MD5SIG << 8) |
1050                                TCPOLEN_MD5SIG);
1051                 tcp_v6_do_calc_md5_hash((__u8 *)&opt[1], key,
1052                                         &ipv6_hdr(skb)->daddr,
1053                                         &ipv6_hdr(skb)->saddr,
1054                                         t1, IPPROTO_TCP, tot_len);
1055         }
1056 #endif
1057
1058         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
1059
1060         memset(&fl, 0, sizeof(fl));
1061         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1062         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1063
1064         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1065                                     sizeof(*t1), IPPROTO_TCP,
1066                                     buff->csum);
1067
1068         fl.proto = IPPROTO_TCP;
1069         fl.oif = inet6_iif(skb);
1070         fl.fl_ip_dport = t1->dest;
1071         fl.fl_ip_sport = t1->source;
1072         security_skb_classify_flow(skb, &fl);
1073
1074         /* Pass a socket to ip6_dst_lookup either it is for RST
1075          * Underlying function will use this to retrieve the network
1076          * namespace
1077          */
1078         if (!ip6_dst_lookup(tcp6_socket->sk, &buff->dst, &fl)) {
1079
1080                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1081                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1082                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1083                         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
1084                         return;
1085                 }
1086         }
1087
1088         kfree_skb(buff);
1089 }
1090
1091 static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
1092                             struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
1093 {
1094         struct tcphdr *th = tcp_hdr(skb), *t1;
1095         struct sk_buff *buff;
1096         struct flowi fl;
1097         unsigned int tot_len = sizeof(struct tcphdr);
1098         __be32 *topt;
1099 #ifdef CONFIG_TCP_MD5SIG
1100         struct tcp_md5sig_key *key;
1101         struct tcp_md5sig_key tw_key;
1102 #endif
1103
1104 #ifdef CONFIG_TCP_MD5SIG
1105         if (!tw && skb->sk) {
1106                 key = tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr);
1107         } else if (tw && tw->tw_md5_keylen) {
1108                 tw_key.key = tw->tw_md5_key;
1109                 tw_key.keylen = tw->tw_md5_keylen;
1110                 key = &tw_key;
1111         } else {
1112                 key = NULL;
1113         }
1114 #endif
1115
1116         if (ts)
1117                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
1118 #ifdef CONFIG_TCP_MD5SIG
1119         if (key)
1120                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1121 #endif
1122
1123         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1124                          GFP_ATOMIC);
1125         if (buff == NULL)
1126                 return;
1127
1128         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1129
1130         t1 = (struct tcphdr *) skb_push(buff,tot_len);
1131
1132         /* Swap the send and the receive. */
1133         memset(t1, 0, sizeof(*t1));
1134         t1->dest = th->source;
1135         t1->source = th->dest;
1136         t1->doff = tot_len/4;
1137         t1->seq = htonl(seq);
1138         t1->ack_seq = htonl(ack);
1139         t1->ack = 1;
1140         t1->window = htons(win);
1141
1142         topt = (__be32 *)(t1 + 1);
1143
1144         if (ts) {
1145                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1146                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1147                 *topt++ = htonl(tcp_time_stamp);
1148                 *topt = htonl(ts);
1149         }
1150
1151 #ifdef CONFIG_TCP_MD5SIG
1152         if (key) {
1153                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1154                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1155                 tcp_v6_do_calc_md5_hash((__u8 *)topt, key,
1156                                         &ipv6_hdr(skb)->daddr,
1157                                         &ipv6_hdr(skb)->saddr,
1158                                         t1, IPPROTO_TCP, tot_len);
1159         }
1160 #endif
1161
1162         buff->csum = csum_partial((char *)t1, tot_len, 0);
1163
1164         memset(&fl, 0, sizeof(fl));
1165         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1166         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1167
1168         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1169                                     tot_len, IPPROTO_TCP,
1170                                     buff->csum);
1171
1172         fl.proto = IPPROTO_TCP;
1173         fl.oif = inet6_iif(skb);
1174         fl.fl_ip_dport = t1->dest;
1175         fl.fl_ip_sport = t1->source;
1176         security_skb_classify_flow(skb, &fl);
1177
1178         if (!ip6_dst_lookup(tcp6_socket->sk, &buff->dst, &fl)) {
1179                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1180                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1181                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1182                         return;
1183                 }
1184         }
1185
1186         kfree_skb(buff);
1187 }
1188
1189 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1190 {
1191         struct inet_timewait_sock *tw = inet_twsk(sk);
1192         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1193
1194         tcp_v6_send_ack(tcptw, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1195                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1196                         tcptw->tw_ts_recent);
1197
1198         inet_twsk_put(tw);
1199 }
1200
1201 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
1202 {
1203         tcp_v6_send_ack(NULL, skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
1204 }
1205
1206
1207 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1208 {
1209         struct request_sock *req, **prev;
1210         const struct tcphdr *th = tcp_hdr(skb);
1211         struct sock *nsk;
1212
1213         /* Find possible connection requests. */
1214         req = inet6_csk_search_req(sk, &prev, th->source,
1215                                    &ipv6_hdr(skb)->saddr,
1216                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1217         if (req)
1218                 return tcp_check_req(sk, skb, req, prev);
1219
1220         nsk = __inet6_lookup_established(sk->sk_net, &tcp_hashinfo,
1221                         &ipv6_hdr(skb)->saddr, th->source,
1222                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1223
1224         if (nsk) {
1225                 if (nsk->sk_state != TCP_TIME_WAIT) {
1226                         bh_lock_sock(nsk);
1227                         return nsk;
1228                 }
1229                 inet_twsk_put(inet_twsk(nsk));
1230                 return NULL;
1231         }
1232
1233 #ifdef CONFIG_SYN_COOKIES
1234         if (!th->rst && !th->syn && th->ack)
1235                 sk = cookie_v6_check(sk, skb);
1236 #endif
1237         return sk;
1238 }
1239
1240 /* FIXME: this is substantially similar to the ipv4 code.
1241  * Can some kind of merge be done? -- erics
1242  */
1243 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1244 {
1245         struct inet6_request_sock *treq;
1246         struct ipv6_pinfo *np = inet6_sk(sk);
1247         struct tcp_options_received tmp_opt;
1248         struct tcp_sock *tp = tcp_sk(sk);
1249         struct request_sock *req = NULL;
1250         __u32 isn = TCP_SKB_CB(skb)->when;
1251 #ifdef CONFIG_SYN_COOKIES
1252         int want_cookie = 0;
1253 #else
1254 #define want_cookie 0
1255 #endif
1256
1257         if (skb->protocol == htons(ETH_P_IP))
1258                 return tcp_v4_conn_request(sk, skb);
1259
1260         if (!ipv6_unicast_destination(skb))
1261                 goto drop;
1262
1263         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1264                 if (net_ratelimit())
1265                         syn_flood_warning(skb);
1266 #ifdef CONFIG_SYN_COOKIES
1267                 if (sysctl_tcp_syncookies)
1268                         want_cookie = 1;
1269                 else
1270 #endif
1271                 goto drop;
1272         }
1273
1274         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1275                 goto drop;
1276
1277         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1278         if (req == NULL)
1279                 goto drop;
1280
1281 #ifdef CONFIG_TCP_MD5SIG
1282         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1283 #endif
1284
1285         tcp_clear_options(&tmp_opt);
1286         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1287         tmp_opt.user_mss = tp->rx_opt.user_mss;
1288
1289         tcp_parse_options(skb, &tmp_opt, 0);
1290
1291         if (want_cookie) {
1292                 tcp_clear_options(&tmp_opt);
1293                 tmp_opt.saw_tstamp = 0;
1294         }
1295
1296         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1297         tcp_openreq_init(req, &tmp_opt, skb);
1298
1299         treq = inet6_rsk(req);
1300         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1301         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1302         treq->pktopts = NULL;
1303         if (!want_cookie)
1304                 TCP_ECN_create_request(req, tcp_hdr(skb));
1305
1306         if (want_cookie) {
1307                 isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1308         } else if (!isn) {
1309                 if (ipv6_opt_accepted(sk, skb) ||
1310                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1311                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1312                         atomic_inc(&skb->users);
1313                         treq->pktopts = skb;
1314                 }
1315                 treq->iif = sk->sk_bound_dev_if;
1316
1317                 /* So that link locals have meaning */
1318                 if (!sk->sk_bound_dev_if &&
1319                     ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1320                         treq->iif = inet6_iif(skb);
1321
1322                 isn = tcp_v6_init_sequence(skb);
1323         }
1324
1325         tcp_rsk(req)->snt_isn = isn;
1326
1327         security_inet_conn_request(sk, skb, req);
1328
1329         if (tcp_v6_send_synack(sk, req))
1330                 goto drop;
1331
1332         if (!want_cookie) {
1333                 inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1334                 return 0;
1335         }
1336
1337 drop:
1338         if (req)
1339                 reqsk_free(req);
1340
1341         return 0; /* don't send reset */
1342 }
1343
1344 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1345                                           struct request_sock *req,
1346                                           struct dst_entry *dst)
1347 {
1348         struct inet6_request_sock *treq = inet6_rsk(req);
1349         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1350         struct tcp6_sock *newtcp6sk;
1351         struct inet_sock *newinet;
1352         struct tcp_sock *newtp;
1353         struct sock *newsk;
1354         struct ipv6_txoptions *opt;
1355 #ifdef CONFIG_TCP_MD5SIG
1356         struct tcp_md5sig_key *key;
1357 #endif
1358
1359         if (skb->protocol == htons(ETH_P_IP)) {
1360                 /*
1361                  *      v6 mapped
1362                  */
1363
1364                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1365
1366                 if (newsk == NULL)
1367                         return NULL;
1368
1369                 newtcp6sk = (struct tcp6_sock *)newsk;
1370                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1371
1372                 newinet = inet_sk(newsk);
1373                 newnp = inet6_sk(newsk);
1374                 newtp = tcp_sk(newsk);
1375
1376                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1377
1378                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
1379                               newinet->daddr);
1380
1381                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
1382                               newinet->saddr);
1383
1384                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1385
1386                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1387                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1388 #ifdef CONFIG_TCP_MD5SIG
1389                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1390 #endif
1391
1392                 newnp->pktoptions  = NULL;
1393                 newnp->opt         = NULL;
1394                 newnp->mcast_oif   = inet6_iif(skb);
1395                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1396
1397                 /*
1398                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1399                  * here, tcp_create_openreq_child now does this for us, see the comment in
1400                  * that function for the gory details. -acme
1401                  */
1402
1403                 /* It is tricky place. Until this moment IPv4 tcp
1404                    worked with IPv6 icsk.icsk_af_ops.
1405                    Sync it now.
1406                  */
1407                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1408
1409                 return newsk;
1410         }
1411
1412         opt = np->opt;
1413
1414         if (sk_acceptq_is_full(sk))
1415                 goto out_overflow;
1416
1417         if (dst == NULL) {
1418                 struct in6_addr *final_p = NULL, final;
1419                 struct flowi fl;
1420
1421                 memset(&fl, 0, sizeof(fl));
1422                 fl.proto = IPPROTO_TCP;
1423                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
1424                 if (opt && opt->srcrt) {
1425                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
1426                         ipv6_addr_copy(&final, &fl.fl6_dst);
1427                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1428                         final_p = &final;
1429                 }
1430                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
1431                 fl.oif = sk->sk_bound_dev_if;
1432                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
1433                 fl.fl_ip_sport = inet_sk(sk)->sport;
1434                 security_req_classify_flow(req, &fl);
1435
1436                 if (ip6_dst_lookup(sk, &dst, &fl))
1437                         goto out;
1438
1439                 if (final_p)
1440                         ipv6_addr_copy(&fl.fl6_dst, final_p);
1441
1442                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
1443                         goto out;
1444         }
1445
1446         newsk = tcp_create_openreq_child(sk, req, skb);
1447         if (newsk == NULL)
1448                 goto out;
1449
1450         /*
1451          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1452          * count here, tcp_create_openreq_child now does this for us, see the
1453          * comment in that function for the gory details. -acme
1454          */
1455
1456         newsk->sk_gso_type = SKB_GSO_TCPV6;
1457         __ip6_dst_store(newsk, dst, NULL, NULL);
1458
1459         newtcp6sk = (struct tcp6_sock *)newsk;
1460         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1461
1462         newtp = tcp_sk(newsk);
1463         newinet = inet_sk(newsk);
1464         newnp = inet6_sk(newsk);
1465
1466         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1467
1468         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1469         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1470         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1471         newsk->sk_bound_dev_if = treq->iif;
1472
1473         /* Now IPv6 options...
1474
1475            First: no IPv4 options.
1476          */
1477         newinet->opt = NULL;
1478         newnp->ipv6_fl_list = NULL;
1479
1480         /* Clone RX bits */
1481         newnp->rxopt.all = np->rxopt.all;
1482
1483         /* Clone pktoptions received with SYN */
1484         newnp->pktoptions = NULL;
1485         if (treq->pktopts != NULL) {
1486                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1487                 kfree_skb(treq->pktopts);
1488                 treq->pktopts = NULL;
1489                 if (newnp->pktoptions)
1490                         skb_set_owner_r(newnp->pktoptions, newsk);
1491         }
1492         newnp->opt        = NULL;
1493         newnp->mcast_oif  = inet6_iif(skb);
1494         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1495
1496         /* Clone native IPv6 options from listening socket (if any)
1497
1498            Yes, keeping reference count would be much more clever,
1499            but we make one more one thing there: reattach optmem
1500            to newsk.
1501          */
1502         if (opt) {
1503                 newnp->opt = ipv6_dup_options(newsk, opt);
1504                 if (opt != np->opt)
1505                         sock_kfree_s(sk, opt, opt->tot_len);
1506         }
1507
1508         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1509         if (newnp->opt)
1510                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1511                                                      newnp->opt->opt_flen);
1512
1513         tcp_mtup_init(newsk);
1514         tcp_sync_mss(newsk, dst_mtu(dst));
1515         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
1516         tcp_initialize_rcv_mss(newsk);
1517
1518         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
1519
1520 #ifdef CONFIG_TCP_MD5SIG
1521         /* Copy over the MD5 key from the original socket */
1522         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1523                 /* We're using one, so create a matching key
1524                  * on the newsk structure. If we fail to get
1525                  * memory, then we end up not copying the key
1526                  * across. Shucks.
1527                  */
1528                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1529                 if (newkey != NULL)
1530                         tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
1531                                           newkey, key->keylen);
1532         }
1533 #endif
1534
1535         __inet6_hash(newsk);
1536         inet_inherit_port(sk, newsk);
1537
1538         return newsk;
1539
1540 out_overflow:
1541         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
1542 out:
1543         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
1544         if (opt && opt != np->opt)
1545                 sock_kfree_s(sk, opt, opt->tot_len);
1546         dst_release(dst);
1547         return NULL;
1548 }
1549
1550 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1551 {
1552         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1553                 if (!tcp_v6_check(tcp_hdr(skb), skb->len, &ipv6_hdr(skb)->saddr,
1554                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1555                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1556                         return 0;
1557                 }
1558         }
1559
1560         skb->csum = ~csum_unfold(tcp_v6_check(tcp_hdr(skb), skb->len,
1561                                               &ipv6_hdr(skb)->saddr,
1562                                               &ipv6_hdr(skb)->daddr, 0));
1563
1564         if (skb->len <= 76) {
1565                 return __skb_checksum_complete(skb);
1566         }
1567         return 0;
1568 }
1569
1570 /* The socket must have it's spinlock held when we get
1571  * here.
1572  *
1573  * We have a potential double-lock case here, so even when
1574  * doing backlog processing we use the BH locking scheme.
1575  * This is because we cannot sleep with the original spinlock
1576  * held.
1577  */
1578 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1579 {
1580         struct ipv6_pinfo *np = inet6_sk(sk);
1581         struct tcp_sock *tp;
1582         struct sk_buff *opt_skb = NULL;
1583
1584         /* Imagine: socket is IPv6. IPv4 packet arrives,
1585            goes to IPv4 receive handler and backlogged.
1586            From backlog it always goes here. Kerboom...
1587            Fortunately, tcp_rcv_established and rcv_established
1588            handle them correctly, but it is not case with
1589            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1590          */
1591
1592         if (skb->protocol == htons(ETH_P_IP))
1593                 return tcp_v4_do_rcv(sk, skb);
1594
1595 #ifdef CONFIG_TCP_MD5SIG
1596         if (tcp_v6_inbound_md5_hash (sk, skb))
1597                 goto discard;
1598 #endif
1599
1600         if (sk_filter(sk, skb))
1601                 goto discard;
1602
1603         /*
1604          *      socket locking is here for SMP purposes as backlog rcv
1605          *      is currently called with bh processing disabled.
1606          */
1607
1608         /* Do Stevens' IPV6_PKTOPTIONS.
1609
1610            Yes, guys, it is the only place in our code, where we
1611            may make it not affecting IPv4.
1612            The rest of code is protocol independent,
1613            and I do not like idea to uglify IPv4.
1614
1615            Actually, all the idea behind IPV6_PKTOPTIONS
1616            looks not very well thought. For now we latch
1617            options, received in the last packet, enqueued
1618            by tcp. Feel free to propose better solution.
1619                                                --ANK (980728)
1620          */
1621         if (np->rxopt.all)
1622                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1623
1624         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1625                 TCP_CHECK_TIMER(sk);
1626                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1627                         goto reset;
1628                 TCP_CHECK_TIMER(sk);
1629                 if (opt_skb)
1630                         goto ipv6_pktoptions;
1631                 return 0;
1632         }
1633
1634         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1635                 goto csum_err;
1636
1637         if (sk->sk_state == TCP_LISTEN) {
1638                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1639                 if (!nsk)
1640                         goto discard;
1641
1642                 /*
1643                  * Queue it on the new socket if the new socket is active,
1644                  * otherwise we just shortcircuit this and continue with
1645                  * the new socket..
1646                  */
1647                 if(nsk != sk) {
1648                         if (tcp_child_process(sk, nsk, skb))
1649                                 goto reset;
1650                         if (opt_skb)
1651                                 __kfree_skb(opt_skb);
1652                         return 0;
1653                 }
1654         }
1655
1656         TCP_CHECK_TIMER(sk);
1657         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1658                 goto reset;
1659         TCP_CHECK_TIMER(sk);
1660         if (opt_skb)
1661                 goto ipv6_pktoptions;
1662         return 0;
1663
1664 reset:
1665         tcp_v6_send_reset(sk, skb);
1666 discard:
1667         if (opt_skb)
1668                 __kfree_skb(opt_skb);
1669         kfree_skb(skb);
1670         return 0;
1671 csum_err:
1672         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1673         goto discard;
1674
1675
1676 ipv6_pktoptions:
1677         /* Do you ask, what is it?
1678
1679            1. skb was enqueued by tcp.
1680            2. skb is added to tail of read queue, rather than out of order.
1681            3. socket is not in passive state.
1682            4. Finally, it really contains options, which user wants to receive.
1683          */
1684         tp = tcp_sk(sk);
1685         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1686             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1687                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1688                         np->mcast_oif = inet6_iif(opt_skb);
1689                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1690                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1691                 if (ipv6_opt_accepted(sk, opt_skb)) {
1692                         skb_set_owner_r(opt_skb, sk);
1693                         opt_skb = xchg(&np->pktoptions, opt_skb);
1694                 } else {
1695                         __kfree_skb(opt_skb);
1696                         opt_skb = xchg(&np->pktoptions, NULL);
1697                 }
1698         }
1699
1700         if (opt_skb)
1701                 kfree_skb(opt_skb);
1702         return 0;
1703 }
1704
1705 static int tcp_v6_rcv(struct sk_buff *skb)
1706 {
1707         struct tcphdr *th;
1708         struct sock *sk;
1709         int ret;
1710
1711         if (skb->pkt_type != PACKET_HOST)
1712                 goto discard_it;
1713
1714         /*
1715          *      Count it even if it's bad.
1716          */
1717         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1718
1719         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1720                 goto discard_it;
1721
1722         th = tcp_hdr(skb);
1723
1724         if (th->doff < sizeof(struct tcphdr)/4)
1725                 goto bad_packet;
1726         if (!pskb_may_pull(skb, th->doff*4))
1727                 goto discard_it;
1728
1729         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1730                 goto bad_packet;
1731
1732         th = tcp_hdr(skb);
1733         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1734         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1735                                     skb->len - th->doff*4);
1736         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1737         TCP_SKB_CB(skb)->when = 0;
1738         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
1739         TCP_SKB_CB(skb)->sacked = 0;
1740
1741         sk = __inet6_lookup(skb->dev->nd_net, &tcp_hashinfo,
1742                         &ipv6_hdr(skb)->saddr, th->source,
1743                         &ipv6_hdr(skb)->daddr, ntohs(th->dest),
1744                         inet6_iif(skb));
1745
1746         if (!sk)
1747                 goto no_tcp_socket;
1748
1749 process:
1750         if (sk->sk_state == TCP_TIME_WAIT)
1751                 goto do_time_wait;
1752
1753         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1754                 goto discard_and_relse;
1755
1756         if (sk_filter(sk, skb))
1757                 goto discard_and_relse;
1758
1759         skb->dev = NULL;
1760
1761         bh_lock_sock_nested(sk);
1762         ret = 0;
1763         if (!sock_owned_by_user(sk)) {
1764 #ifdef CONFIG_NET_DMA
1765                 struct tcp_sock *tp = tcp_sk(sk);
1766                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1767                         tp->ucopy.dma_chan = get_softnet_dma();
1768                 if (tp->ucopy.dma_chan)
1769                         ret = tcp_v6_do_rcv(sk, skb);
1770                 else
1771 #endif
1772                 {
1773                         if (!tcp_prequeue(sk, skb))
1774                                 ret = tcp_v6_do_rcv(sk, skb);
1775                 }
1776         } else
1777                 sk_add_backlog(sk, skb);
1778         bh_unlock_sock(sk);
1779
1780         sock_put(sk);
1781         return ret ? -1 : 0;
1782
1783 no_tcp_socket:
1784         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1785                 goto discard_it;
1786
1787         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1788 bad_packet:
1789                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1790         } else {
1791                 tcp_v6_send_reset(NULL, skb);
1792         }
1793
1794 discard_it:
1795
1796         /*
1797          *      Discard frame
1798          */
1799
1800         kfree_skb(skb);
1801         return 0;
1802
1803 discard_and_relse:
1804         sock_put(sk);
1805         goto discard_it;
1806
1807 do_time_wait:
1808         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1809                 inet_twsk_put(inet_twsk(sk));
1810                 goto discard_it;
1811         }
1812
1813         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1814                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1815                 inet_twsk_put(inet_twsk(sk));
1816                 goto discard_it;
1817         }
1818
1819         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1820         case TCP_TW_SYN:
1821         {
1822                 struct sock *sk2;
1823
1824                 sk2 = inet6_lookup_listener(skb->dev->nd_net, &tcp_hashinfo,
1825                                             &ipv6_hdr(skb)->daddr,
1826                                             ntohs(th->dest), inet6_iif(skb));
1827                 if (sk2 != NULL) {
1828                         struct inet_timewait_sock *tw = inet_twsk(sk);
1829                         inet_twsk_deschedule(tw, &tcp_death_row);
1830                         inet_twsk_put(tw);
1831                         sk = sk2;
1832                         goto process;
1833                 }
1834                 /* Fall through to ACK */
1835         }
1836         case TCP_TW_ACK:
1837                 tcp_v6_timewait_ack(sk, skb);
1838                 break;
1839         case TCP_TW_RST:
1840                 goto no_tcp_socket;
1841         case TCP_TW_SUCCESS:;
1842         }
1843         goto discard_it;
1844 }
1845
1846 static int tcp_v6_remember_stamp(struct sock *sk)
1847 {
1848         /* Alas, not yet... */
1849         return 0;
1850 }
1851
1852 static struct inet_connection_sock_af_ops ipv6_specific = {
1853         .queue_xmit        = inet6_csk_xmit,
1854         .send_check        = tcp_v6_send_check,
1855         .rebuild_header    = inet6_sk_rebuild_header,
1856         .conn_request      = tcp_v6_conn_request,
1857         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1858         .remember_stamp    = tcp_v6_remember_stamp,
1859         .net_header_len    = sizeof(struct ipv6hdr),
1860         .setsockopt        = ipv6_setsockopt,
1861         .getsockopt        = ipv6_getsockopt,
1862         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1863         .sockaddr_len      = sizeof(struct sockaddr_in6),
1864         .bind_conflict     = inet6_csk_bind_conflict,
1865 #ifdef CONFIG_COMPAT
1866         .compat_setsockopt = compat_ipv6_setsockopt,
1867         .compat_getsockopt = compat_ipv6_getsockopt,
1868 #endif
1869 };
1870
1871 #ifdef CONFIG_TCP_MD5SIG
1872 static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1873         .md5_lookup     =       tcp_v6_md5_lookup,
1874         .calc_md5_hash  =       tcp_v6_calc_md5_hash,
1875         .md5_add        =       tcp_v6_md5_add_func,
1876         .md5_parse      =       tcp_v6_parse_md5_keys,
1877 };
1878 #endif
1879
1880 /*
1881  *      TCP over IPv4 via INET6 API
1882  */
1883
1884 static struct inet_connection_sock_af_ops ipv6_mapped = {
1885         .queue_xmit        = ip_queue_xmit,
1886         .send_check        = tcp_v4_send_check,
1887         .rebuild_header    = inet_sk_rebuild_header,
1888         .conn_request      = tcp_v6_conn_request,
1889         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1890         .remember_stamp    = tcp_v4_remember_stamp,
1891         .net_header_len    = sizeof(struct iphdr),
1892         .setsockopt        = ipv6_setsockopt,
1893         .getsockopt        = ipv6_getsockopt,
1894         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1895         .sockaddr_len      = sizeof(struct sockaddr_in6),
1896         .bind_conflict     = inet6_csk_bind_conflict,
1897 #ifdef CONFIG_COMPAT
1898         .compat_setsockopt = compat_ipv6_setsockopt,
1899         .compat_getsockopt = compat_ipv6_getsockopt,
1900 #endif
1901 };
1902
1903 #ifdef CONFIG_TCP_MD5SIG
1904 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1905         .md5_lookup     =       tcp_v4_md5_lookup,
1906         .calc_md5_hash  =       tcp_v4_calc_md5_hash,
1907         .md5_add        =       tcp_v6_md5_add_func,
1908         .md5_parse      =       tcp_v6_parse_md5_keys,
1909 };
1910 #endif
1911
1912 /* NOTE: A lot of things set to zero explicitly by call to
1913  *       sk_alloc() so need not be done here.
1914  */
1915 static int tcp_v6_init_sock(struct sock *sk)
1916 {
1917         struct inet_connection_sock *icsk = inet_csk(sk);
1918         struct tcp_sock *tp = tcp_sk(sk);
1919
1920         skb_queue_head_init(&tp->out_of_order_queue);
1921         tcp_init_xmit_timers(sk);
1922         tcp_prequeue_init(tp);
1923
1924         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1925         tp->mdev = TCP_TIMEOUT_INIT;
1926
1927         /* So many TCP implementations out there (incorrectly) count the
1928          * initial SYN frame in their delayed-ACK and congestion control
1929          * algorithms that we must have the following bandaid to talk
1930          * efficiently to them.  -DaveM
1931          */
1932         tp->snd_cwnd = 2;
1933
1934         /* See draft-stevens-tcpca-spec-01 for discussion of the
1935          * initialization of these values.
1936          */
1937         tp->snd_ssthresh = 0x7fffffff;
1938         tp->snd_cwnd_clamp = ~0;
1939         tp->mss_cache = 536;
1940
1941         tp->reordering = sysctl_tcp_reordering;
1942
1943         sk->sk_state = TCP_CLOSE;
1944
1945         icsk->icsk_af_ops = &ipv6_specific;
1946         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1947         icsk->icsk_sync_mss = tcp_sync_mss;
1948         sk->sk_write_space = sk_stream_write_space;
1949         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1950
1951 #ifdef CONFIG_TCP_MD5SIG
1952         tp->af_specific = &tcp_sock_ipv6_specific;
1953 #endif
1954
1955         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1956         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1957
1958         atomic_inc(&tcp_sockets_allocated);
1959
1960         return 0;
1961 }
1962
1963 static int tcp_v6_destroy_sock(struct sock *sk)
1964 {
1965 #ifdef CONFIG_TCP_MD5SIG
1966         /* Clean up the MD5 key list */
1967         if (tcp_sk(sk)->md5sig_info)
1968                 tcp_v6_clear_md5_list(sk);
1969 #endif
1970         tcp_v4_destroy_sock(sk);
1971         return inet6_destroy_sock(sk);
1972 }
1973
1974 #ifdef CONFIG_PROC_FS
1975 /* Proc filesystem TCPv6 sock list dumping. */
1976 static void get_openreq6(struct seq_file *seq,
1977                          struct sock *sk, struct request_sock *req, int i, int uid)
1978 {
1979         int ttd = req->expires - jiffies;
1980         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1981         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1982
1983         if (ttd < 0)
1984                 ttd = 0;
1985
1986         seq_printf(seq,
1987                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1988                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1989                    i,
1990                    src->s6_addr32[0], src->s6_addr32[1],
1991                    src->s6_addr32[2], src->s6_addr32[3],
1992                    ntohs(inet_sk(sk)->sport),
1993                    dest->s6_addr32[0], dest->s6_addr32[1],
1994                    dest->s6_addr32[2], dest->s6_addr32[3],
1995                    ntohs(inet_rsk(req)->rmt_port),
1996                    TCP_SYN_RECV,
1997                    0,0, /* could print option size, but that is af dependent. */
1998                    1,   /* timers active (only the expire timer) */
1999                    jiffies_to_clock_t(ttd),
2000                    req->retrans,
2001                    uid,
2002                    0,  /* non standard timer */
2003                    0, /* open_requests have no inode */
2004                    0, req);
2005 }
2006
2007 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
2008 {
2009         struct in6_addr *dest, *src;
2010         __u16 destp, srcp;
2011         int timer_active;
2012         unsigned long timer_expires;
2013         struct inet_sock *inet = inet_sk(sp);
2014         struct tcp_sock *tp = tcp_sk(sp);
2015         const struct inet_connection_sock *icsk = inet_csk(sp);
2016         struct ipv6_pinfo *np = inet6_sk(sp);
2017
2018         dest  = &np->daddr;
2019         src   = &np->rcv_saddr;
2020         destp = ntohs(inet->dport);
2021         srcp  = ntohs(inet->sport);
2022
2023         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2024                 timer_active    = 1;
2025                 timer_expires   = icsk->icsk_timeout;
2026         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2027                 timer_active    = 4;
2028                 timer_expires   = icsk->icsk_timeout;
2029         } else if (timer_pending(&sp->sk_timer)) {
2030                 timer_active    = 2;
2031                 timer_expires   = sp->sk_timer.expires;
2032         } else {
2033                 timer_active    = 0;
2034                 timer_expires = jiffies;
2035         }
2036
2037         seq_printf(seq,
2038                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2039                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
2040                    i,
2041                    src->s6_addr32[0], src->s6_addr32[1],
2042                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2043                    dest->s6_addr32[0], dest->s6_addr32[1],
2044                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2045                    sp->sk_state,
2046                    tp->write_seq-tp->snd_una,
2047                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2048                    timer_active,
2049                    jiffies_to_clock_t(timer_expires - jiffies),
2050                    icsk->icsk_retransmits,
2051                    sock_i_uid(sp),
2052                    icsk->icsk_probes_out,
2053                    sock_i_ino(sp),
2054                    atomic_read(&sp->sk_refcnt), sp,
2055                    icsk->icsk_rto,
2056                    icsk->icsk_ack.ato,
2057                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2058                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
2059                    );
2060 }
2061
2062 static void get_timewait6_sock(struct seq_file *seq,
2063                                struct inet_timewait_sock *tw, int i)
2064 {
2065         struct in6_addr *dest, *src;
2066         __u16 destp, srcp;
2067         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2068         int ttd = tw->tw_ttd - jiffies;
2069
2070         if (ttd < 0)
2071                 ttd = 0;
2072
2073         dest = &tw6->tw_v6_daddr;
2074         src  = &tw6->tw_v6_rcv_saddr;
2075         destp = ntohs(tw->tw_dport);
2076         srcp  = ntohs(tw->tw_sport);
2077
2078         seq_printf(seq,
2079                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2080                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2081                    i,
2082                    src->s6_addr32[0], src->s6_addr32[1],
2083                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2084                    dest->s6_addr32[0], dest->s6_addr32[1],
2085                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2086                    tw->tw_substate, 0, 0,
2087                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2088                    atomic_read(&tw->tw_refcnt), tw);
2089 }
2090
2091 static int tcp6_seq_show(struct seq_file *seq, void *v)
2092 {
2093         struct tcp_iter_state *st;
2094
2095         if (v == SEQ_START_TOKEN) {
2096                 seq_puts(seq,
2097                          "  sl  "
2098                          "local_address                         "
2099                          "remote_address                        "
2100                          "st tx_queue rx_queue tr tm->when retrnsmt"
2101                          "   uid  timeout inode\n");
2102                 goto out;
2103         }
2104         st = seq->private;
2105
2106         switch (st->state) {
2107         case TCP_SEQ_STATE_LISTENING:
2108         case TCP_SEQ_STATE_ESTABLISHED:
2109                 get_tcp6_sock(seq, v, st->num);
2110                 break;
2111         case TCP_SEQ_STATE_OPENREQ:
2112                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2113                 break;
2114         case TCP_SEQ_STATE_TIME_WAIT:
2115                 get_timewait6_sock(seq, v, st->num);
2116                 break;
2117         }
2118 out:
2119         return 0;
2120 }
2121
2122 static struct file_operations tcp6_seq_fops;
2123 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2124         .owner          = THIS_MODULE,
2125         .name           = "tcp6",
2126         .family         = AF_INET6,
2127         .seq_show       = tcp6_seq_show,
2128         .seq_fops       = &tcp6_seq_fops,
2129 };
2130
2131 int __init tcp6_proc_init(void)
2132 {
2133         return tcp_proc_register(&tcp6_seq_afinfo);
2134 }
2135
2136 void tcp6_proc_exit(void)
2137 {
2138         tcp_proc_unregister(&tcp6_seq_afinfo);
2139 }
2140 #endif
2141
2142 DEFINE_PROTO_INUSE(tcpv6)
2143
2144 struct proto tcpv6_prot = {
2145         .name                   = "TCPv6",
2146         .owner                  = THIS_MODULE,
2147         .close                  = tcp_close,
2148         .connect                = tcp_v6_connect,
2149         .disconnect             = tcp_disconnect,
2150         .accept                 = inet_csk_accept,
2151         .ioctl                  = tcp_ioctl,
2152         .init                   = tcp_v6_init_sock,
2153         .destroy                = tcp_v6_destroy_sock,
2154         .shutdown               = tcp_shutdown,
2155         .setsockopt             = tcp_setsockopt,
2156         .getsockopt             = tcp_getsockopt,
2157         .recvmsg                = tcp_recvmsg,
2158         .backlog_rcv            = tcp_v6_do_rcv,
2159         .hash                   = tcp_v6_hash,
2160         .unhash                 = inet_unhash,
2161         .get_port               = inet_csk_get_port,
2162         .enter_memory_pressure  = tcp_enter_memory_pressure,
2163         .sockets_allocated      = &tcp_sockets_allocated,
2164         .memory_allocated       = &tcp_memory_allocated,
2165         .memory_pressure        = &tcp_memory_pressure,
2166         .orphan_count           = &tcp_orphan_count,
2167         .sysctl_mem             = sysctl_tcp_mem,
2168         .sysctl_wmem            = sysctl_tcp_wmem,
2169         .sysctl_rmem            = sysctl_tcp_rmem,
2170         .max_header             = MAX_TCP_HEADER,
2171         .obj_size               = sizeof(struct tcp6_sock),
2172         .twsk_prot              = &tcp6_timewait_sock_ops,
2173         .rsk_prot               = &tcp6_request_sock_ops,
2174         .hashinfo               = &tcp_hashinfo,
2175 #ifdef CONFIG_COMPAT
2176         .compat_setsockopt      = compat_tcp_setsockopt,
2177         .compat_getsockopt      = compat_tcp_getsockopt,
2178 #endif
2179         REF_PROTO_INUSE(tcpv6)
2180 };
2181
2182 static struct inet6_protocol tcpv6_protocol = {
2183         .handler        =       tcp_v6_rcv,
2184         .err_handler    =       tcp_v6_err,
2185         .gso_send_check =       tcp_v6_gso_send_check,
2186         .gso_segment    =       tcp_tso_segment,
2187         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2188 };
2189
2190 static struct inet_protosw tcpv6_protosw = {
2191         .type           =       SOCK_STREAM,
2192         .protocol       =       IPPROTO_TCP,
2193         .prot           =       &tcpv6_prot,
2194         .ops            =       &inet6_stream_ops,
2195         .capability     =       -1,
2196         .no_check       =       0,
2197         .flags          =       INET_PROTOSW_PERMANENT |
2198                                 INET_PROTOSW_ICSK,
2199 };
2200
2201 int __init tcpv6_init(void)
2202 {
2203         int ret;
2204
2205         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2206         if (ret)
2207                 goto out;
2208
2209         /* register inet6 protocol */
2210         ret = inet6_register_protosw(&tcpv6_protosw);
2211         if (ret)
2212                 goto out_tcpv6_protocol;
2213
2214         ret = inet_csk_ctl_sock_create(&tcp6_socket, PF_INET6,
2215                                        SOCK_RAW, IPPROTO_TCP);
2216         if (ret)
2217                 goto out_tcpv6_protosw;
2218 out:
2219         return ret;
2220
2221 out_tcpv6_protocol:
2222         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2223 out_tcpv6_protosw:
2224         inet6_unregister_protosw(&tcpv6_protosw);
2225         goto out;
2226 }
2227
2228 void tcpv6_exit(void)
2229 {
2230         sock_release(tcp6_socket);
2231         inet6_unregister_protosw(&tcpv6_protosw);
2232         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2233 }