tcp_ipv6.c 50.7 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	TCP over IPv6
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7
 *
8
 *	Based on:
L
Linus Torvalds 已提交
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
 *	linux/net/ipv4/tcp.c
 *	linux/net/ipv4/tcp_input.c
 *	linux/net/ipv4/tcp_output.c
 *
 *	Fixes:
 *	Hideaki YOSHIFUJI	:	sin6_scope_id support
 *	YOSHIFUJI Hideaki @USAGI and:	Support IPV6_V6ONLY socket option, which
 *	Alexey Kuznetsov		allow both IPv4 and IPv6 sockets to bind
 *					a single port at the same time.
 *	YOSHIFUJI Hideaki @USAGI:	convert /proc/net/tcp6 to seq_file.
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

H
Herbert Xu 已提交
26
#include <linux/bottom_half.h>
L
Linus Torvalds 已提交
27 28 29 30 31 32 33 34 35 36 37 38 39 40
#include <linux/module.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/jiffies.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/init.h>
#include <linux/jhash.h>
#include <linux/ipsec.h>
#include <linux/times.h>
41
#include <linux/slab.h>
W
Wang Yufen 已提交
42
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
43 44 45 46 47 48
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>

#include <net/tcp.h>
#include <net/ndisc.h>
49
#include <net/inet6_hashtables.h>
50
#include <net/inet6_connection_sock.h>
L
Linus Torvalds 已提交
51 52 53 54 55 56 57 58 59 60
#include <net/ipv6.h>
#include <net/transp_v6.h>
#include <net/addrconf.h>
#include <net/ip6_route.h>
#include <net/ip6_checksum.h>
#include <net/inet_ecn.h>
#include <net/protocol.h>
#include <net/xfrm.h>
#include <net/snmp.h>
#include <net/dsfield.h>
61
#include <net/timewait_sock.h>
62
#include <net/inet_common.h>
63
#include <net/secure_seq.h>
64
#include <net/busy_poll.h>
L
Linus Torvalds 已提交
65 66 67 68

#include <linux/proc_fs.h>
#include <linux/seq_file.h>

H
Herbert Xu 已提交
69
#include <crypto/hash.h>
70 71
#include <linux/scatterlist.h>

72 73
static void	tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
static void	tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
74
				      struct request_sock *req);
L
Linus Torvalds 已提交
75 76 77

static int	tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);

78 79
static const struct inet_connection_sock_af_ops ipv6_mapped;
static const struct inet_connection_sock_af_ops ipv6_specific;
80
#ifdef CONFIG_TCP_MD5SIG
81 82
static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
83
#else
84
static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
85
						   const struct in6_addr *addr)
86 87 88
{
	return NULL;
}
89
#endif
L
Linus Torvalds 已提交
90

91 92 93 94
static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
{
	struct dst_entry *dst = skb_dst(skb);

E
Eric Dumazet 已提交
95
	if (dst && dst_hold_safe(dst)) {
96 97 98 99
		const struct rt6_info *rt = (const struct rt6_info *)dst;

		sk->sk_rx_dst = dst;
		inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
100
		inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
101
	}
102 103
}

104
static u32 tcp_v6_init_sequence(const struct sk_buff *skb, u32 *tsoff)
L
Linus Torvalds 已提交
105
{
106 107
	return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
					    ipv6_hdr(skb)->saddr.s6_addr32,
108
					    tcp_hdr(skb)->dest,
109
					    tcp_hdr(skb)->source, tsoff);
L
Linus Torvalds 已提交
110 111
}

112
static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
L
Linus Torvalds 已提交
113 114 115
			  int addr_len)
{
	struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
116
	struct inet_sock *inet = inet_sk(sk);
117
	struct inet_connection_sock *icsk = inet_csk(sk);
L
Linus Torvalds 已提交
118 119
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct tcp_sock *tp = tcp_sk(sk);
120
	struct in6_addr *saddr = NULL, *final_p, final;
121
	struct ipv6_txoptions *opt;
122
	struct flowi6 fl6;
L
Linus Torvalds 已提交
123 124 125 126
	struct dst_entry *dst;
	int addr_type;
	int err;

127
	if (addr_len < SIN6_LEN_RFC2133)
L
Linus Torvalds 已提交
128 129
		return -EINVAL;

130
	if (usin->sin6_family != AF_INET6)
E
Eric Dumazet 已提交
131
		return -EAFNOSUPPORT;
L
Linus Torvalds 已提交
132

133
	memset(&fl6, 0, sizeof(fl6));
L
Linus Torvalds 已提交
134 135

	if (np->sndflow) {
136 137 138
		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
		IP6_ECN_flow_init(fl6.flowlabel);
		if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
L
Linus Torvalds 已提交
139
			struct ip6_flowlabel *flowlabel;
140
			flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
141
			if (!flowlabel)
L
Linus Torvalds 已提交
142 143 144 145 146 147
				return -EINVAL;
			fl6_sock_release(flowlabel);
		}
	}

	/*
148 149 150
	 *	connect() to INADDR_ANY means loopback (BSD'ism).
	 */

W
Weilong Chen 已提交
151
	if (ipv6_addr_any(&usin->sin6_addr))
152
		usin->sin6_addr.s6_addr[15] = 0x1;
L
Linus Torvalds 已提交
153 154 155

	addr_type = ipv6_addr_type(&usin->sin6_addr);

W
Weilong Chen 已提交
156
	if (addr_type & IPV6_ADDR_MULTICAST)
L
Linus Torvalds 已提交
157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177
		return -ENETUNREACH;

	if (addr_type&IPV6_ADDR_LINKLOCAL) {
		if (addr_len >= sizeof(struct sockaddr_in6) &&
		    usin->sin6_scope_id) {
			/* If interface is set while binding, indices
			 * must coincide.
			 */
			if (sk->sk_bound_dev_if &&
			    sk->sk_bound_dev_if != usin->sin6_scope_id)
				return -EINVAL;

			sk->sk_bound_dev_if = usin->sin6_scope_id;
		}

		/* Connect to link-local address requires an interface */
		if (!sk->sk_bound_dev_if)
			return -EINVAL;
	}

	if (tp->rx_opt.ts_recent_stamp &&
178
	    !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
L
Linus Torvalds 已提交
179 180 181 182 183
		tp->rx_opt.ts_recent = 0;
		tp->rx_opt.ts_recent_stamp = 0;
		tp->write_seq = 0;
	}

184
	sk->sk_v6_daddr = usin->sin6_addr;
185
	np->flow_label = fl6.flowlabel;
L
Linus Torvalds 已提交
186 187 188 189 190 191

	/*
	 *	TCP over IPv4
	 */

	if (addr_type == IPV6_ADDR_MAPPED) {
192
		u32 exthdrlen = icsk->icsk_ext_hdr_len;
L
Linus Torvalds 已提交
193 194 195 196 197 198 199 200 201 202 203
		struct sockaddr_in sin;

		SOCK_DEBUG(sk, "connect: ipv4 mapped\n");

		if (__ipv6_only_sock(sk))
			return -ENETUNREACH;

		sin.sin_family = AF_INET;
		sin.sin_port = usin->sin6_port;
		sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];

204
		icsk->icsk_af_ops = &ipv6_mapped;
L
Linus Torvalds 已提交
205
		sk->sk_backlog_rcv = tcp_v4_do_rcv;
206 207 208
#ifdef CONFIG_TCP_MD5SIG
		tp->af_specific = &tcp_sock_ipv6_mapped_specific;
#endif
L
Linus Torvalds 已提交
209 210 211 212

		err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));

		if (err) {
213 214
			icsk->icsk_ext_hdr_len = exthdrlen;
			icsk->icsk_af_ops = &ipv6_specific;
L
Linus Torvalds 已提交
215
			sk->sk_backlog_rcv = tcp_v6_do_rcv;
216 217 218
#ifdef CONFIG_TCP_MD5SIG
			tp->af_specific = &tcp_sock_ipv6_specific;
#endif
L
Linus Torvalds 已提交
219 220
			goto failure;
		}
221
		np->saddr = sk->sk_v6_rcv_saddr;
L
Linus Torvalds 已提交
222 223 224 225

		return err;
	}

226 227
	if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
		saddr = &sk->sk_v6_rcv_saddr;
L
Linus Torvalds 已提交
228

229
	fl6.flowi6_proto = IPPROTO_TCP;
230
	fl6.daddr = sk->sk_v6_daddr;
A
Alexey Dobriyan 已提交
231
	fl6.saddr = saddr ? *saddr : np->saddr;
232 233
	fl6.flowi6_oif = sk->sk_bound_dev_if;
	fl6.flowi6_mark = sk->sk_mark;
234 235
	fl6.fl6_dport = usin->sin6_port;
	fl6.fl6_sport = inet->inet_sport;
236
	fl6.flowi6_uid = sk->sk_uid;
L
Linus Torvalds 已提交
237

238
	opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
239
	final_p = fl6_update_dst(&fl6, opt, &final);
L
Linus Torvalds 已提交
240

241
	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
V
Venkat Yekkirala 已提交
242

243
	dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
244 245
	if (IS_ERR(dst)) {
		err = PTR_ERR(dst);
L
Linus Torvalds 已提交
246
		goto failure;
247
	}
L
Linus Torvalds 已提交
248

249
	if (!saddr) {
250
		saddr = &fl6.saddr;
251
		sk->sk_v6_rcv_saddr = *saddr;
L
Linus Torvalds 已提交
252 253 254
	}

	/* set the source address */
A
Alexey Dobriyan 已提交
255
	np->saddr = *saddr;
E
Eric Dumazet 已提交
256
	inet->inet_rcv_saddr = LOOPBACK4_IPV6;
L
Linus Torvalds 已提交
257

H
Herbert Xu 已提交
258
	sk->sk_gso_type = SKB_GSO_TCPV6;
E
Eric Dumazet 已提交
259
	ip6_dst_store(sk, dst, NULL, NULL);
L
Linus Torvalds 已提交
260

261 262
	if (tcp_death_row.sysctl_tw_recycle &&
	    !tp->rx_opt.ts_recent_stamp &&
263
	    ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
264
		tcp_fetch_timewait_stamp(sk, dst);
265

266
	icsk->icsk_ext_hdr_len = 0;
267 268 269
	if (opt)
		icsk->icsk_ext_hdr_len = opt->opt_flen +
					 opt->opt_nflen;
L
Linus Torvalds 已提交
270 271 272

	tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);

E
Eric Dumazet 已提交
273
	inet->inet_dport = usin->sin6_port;
L
Linus Torvalds 已提交
274 275

	tcp_set_state(sk, TCP_SYN_SENT);
276
	err = inet6_hash_connect(&tcp_death_row, sk);
L
Linus Torvalds 已提交
277 278 279
	if (err)
		goto late_failure;

280
	sk_set_txhash(sk);
281

A
Andrey Vagin 已提交
282
	if (!tp->write_seq && likely(!tp->repair))
L
Linus Torvalds 已提交
283
		tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
284
							     sk->sk_v6_daddr.s6_addr32,
E
Eric Dumazet 已提交
285
							     inet->inet_sport,
286 287
							     inet->inet_dport,
							     &tp->tsoffset);
L
Linus Torvalds 已提交
288 289 290 291 292 293 294 295 296 297 298

	err = tcp_connect(sk);
	if (err)
		goto late_failure;

	return 0;

late_failure:
	tcp_set_state(sk, TCP_CLOSE);
	__sk_dst_reset(sk);
failure:
E
Eric Dumazet 已提交
299
	inet->inet_dport = 0;
L
Linus Torvalds 已提交
300 301 302 303
	sk->sk_route_caps = 0;
	return err;
}

304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320
static void tcp_v6_mtu_reduced(struct sock *sk)
{
	struct dst_entry *dst;

	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
		return;

	dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
	if (!dst)
		return;

	if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
		tcp_sync_mss(sk, dst_mtu(dst));
		tcp_simple_retransmit(sk);
	}
}

L
Linus Torvalds 已提交
321
static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
322
		u8 type, u8 code, int offset, __be32 info)
L
Linus Torvalds 已提交
323
{
W
Weilong Chen 已提交
324
	const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
325
	const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
326 327
	struct net *net = dev_net(skb->dev);
	struct request_sock *fastopen;
L
Linus Torvalds 已提交
328
	struct ipv6_pinfo *np;
329
	struct tcp_sock *tp;
330
	__u32 seq, snd_una;
331
	struct sock *sk;
332
	bool fatal;
333
	int err;
L
Linus Torvalds 已提交
334

335 336 337 338
	sk = __inet6_lookup_established(net, &tcp_hashinfo,
					&hdr->daddr, th->dest,
					&hdr->saddr, ntohs(th->source),
					skb->dev->ifindex);
L
Linus Torvalds 已提交
339

340
	if (!sk) {
E
Eric Dumazet 已提交
341 342
		__ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
				  ICMP6_MIB_INERRORS);
L
Linus Torvalds 已提交
343 344 345 346
		return;
	}

	if (sk->sk_state == TCP_TIME_WAIT) {
347
		inet_twsk_put(inet_twsk(sk));
L
Linus Torvalds 已提交
348 349
		return;
	}
350
	seq = ntohl(th->seq);
351
	fatal = icmpv6_err_convert(type, code, &err);
352
	if (sk->sk_state == TCP_NEW_SYN_RECV)
353
		return tcp_req_err(sk, seq, fatal);
L
Linus Torvalds 已提交
354 355

	bh_lock_sock(sk);
356
	if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
357
		__NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
L
Linus Torvalds 已提交
358 359 360 361

	if (sk->sk_state == TCP_CLOSE)
		goto out;

362
	if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
363
		__NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
364 365 366
		goto out;
	}

L
Linus Torvalds 已提交
367
	tp = tcp_sk(sk);
368 369 370
	/* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
	fastopen = tp->fastopen_rsk;
	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
L
Linus Torvalds 已提交
371
	if (sk->sk_state != TCP_LISTEN &&
372
	    !between(seq, snd_una, tp->snd_nxt)) {
373
		__NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
L
Linus Torvalds 已提交
374 375 376 377 378
		goto out;
	}

	np = inet6_sk(sk);

379 380 381
	if (type == NDISC_REDIRECT) {
		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);

382
		if (dst)
383
			dst->ops->redirect(dst, sk, skb);
384
		goto out;
385 386
	}

L
Linus Torvalds 已提交
387
	if (type == ICMPV6_PKT_TOOBIG) {
388 389 390 391 392 393 394
		/* We are not interested in TCP_LISTEN and open_requests
		 * (SYN-ACKs send out by Linux are always <576bytes so
		 * they should go through unfragmented).
		 */
		if (sk->sk_state == TCP_LISTEN)
			goto out;

395 396 397
		if (!ip6_sk_accept_pmtu(sk))
			goto out;

398 399 400
		tp->mtu_info = ntohl(info);
		if (!sock_owned_by_user(sk))
			tcp_v6_mtu_reduced(sk);
401
		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
402
					   &sk->sk_tsq_flags))
403
			sock_hold(sk);
L
Linus Torvalds 已提交
404 405 406 407
		goto out;
	}


408
	/* Might be for an request_sock */
L
Linus Torvalds 已提交
409 410
	switch (sk->sk_state) {
	case TCP_SYN_SENT:
411 412 413 414
	case TCP_SYN_RECV:
		/* Only in fast or simultaneous open. If a fast open socket is
		 * is already accepted it is treated as a connected one below.
		 */
415
		if (fastopen && !fastopen->sk)
416 417
			break;

L
Linus Torvalds 已提交
418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439
		if (!sock_owned_by_user(sk)) {
			sk->sk_err = err;
			sk->sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */

			tcp_done(sk);
		} else
			sk->sk_err_soft = err;
		goto out;
	}

	if (!sock_owned_by_user(sk) && np->recverr) {
		sk->sk_err = err;
		sk->sk_error_report(sk);
	} else
		sk->sk_err_soft = err;

out:
	bh_unlock_sock(sk);
	sock_put(sk);
}


440
static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
441
			      struct flowi *fl,
442
			      struct request_sock *req,
443
			      struct tcp_fastopen_cookie *foc,
444
			      enum tcp_synack_type synack_type)
L
Linus Torvalds 已提交
445
{
446
	struct inet_request_sock *ireq = inet_rsk(req);
L
Linus Torvalds 已提交
447
	struct ipv6_pinfo *np = inet6_sk(sk);
448
	struct ipv6_txoptions *opt;
449
	struct flowi6 *fl6 = &fl->u.ip6;
W
Weilong Chen 已提交
450
	struct sk_buff *skb;
451
	int err = -ENOMEM;
L
Linus Torvalds 已提交
452

453
	/* First, grab a route. */
454 455
	if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
					       IPPROTO_TCP)) == NULL)
456
		goto done;
457

458
	skb = tcp_make_synack(sk, dst, req, foc, synack_type);
459

L
Linus Torvalds 已提交
460
	if (skb) {
461 462
		__tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
				    &ireq->ir_v6_rmt_addr);
L
Linus Torvalds 已提交
463

464
		fl6->daddr = ireq->ir_v6_rmt_addr;
465
		if (np->repflow && ireq->pktopts)
466 467
			fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));

468
		rcu_read_lock();
469 470 471
		opt = ireq->ipv6_opt;
		if (!opt)
			opt = rcu_dereference(np->opt);
472
		err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
473
		rcu_read_unlock();
474
		err = net_xmit_eval(err);
L
Linus Torvalds 已提交
475 476 477 478 479 480
	}

done:
	return err;
}

481

482
static void tcp_v6_reqsk_destructor(struct request_sock *req)
L
Linus Torvalds 已提交
483
{
484
	kfree(inet_rsk(req)->ipv6_opt);
485
	kfree_skb(inet_rsk(req)->pktopts);
L
Linus Torvalds 已提交
486 487
}

488
#ifdef CONFIG_TCP_MD5SIG
489
static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
490
						   const struct in6_addr *addr)
491
{
E
Eric Dumazet 已提交
492
	return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
493 494
}

495
static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
496
						const struct sock *addr_sk)
497
{
498
	return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
499 500
}

W
Wang Yufen 已提交
501 502
static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
				 int optlen)
503 504 505 506 507 508 509 510 511 512 513 514 515 516
{
	struct tcp_md5sig cmd;
	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;

	if (optlen < sizeof(cmd))
		return -EINVAL;

	if (copy_from_user(&cmd, optval, sizeof(cmd)))
		return -EFAULT;

	if (sin6->sin6_family != AF_INET6)
		return -EINVAL;

	if (!cmd.tcpm_keylen) {
B
Brian Haley 已提交
517
		if (ipv6_addr_v4mapped(&sin6->sin6_addr))
E
Eric Dumazet 已提交
518 519 520 521
			return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
					      AF_INET);
		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
				      AF_INET6);
522 523 524 525 526
	}

	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
		return -EINVAL;

E
Eric Dumazet 已提交
527 528 529
	if (ipv6_addr_v4mapped(&sin6->sin6_addr))
		return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
				      AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
530

E
Eric Dumazet 已提交
531 532
	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
			      AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
533 534
}

535 536 537 538
static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
				   const struct in6_addr *daddr,
				   const struct in6_addr *saddr,
				   const struct tcphdr *th, int nbytes)
539 540
{
	struct tcp6_pseudohdr *bp;
541
	struct scatterlist sg;
542
	struct tcphdr *_th;
543

544
	bp = hp->scratch;
545
	/* 1. TCP pseudo-header (RFC2460) */
A
Alexey Dobriyan 已提交
546 547
	bp->saddr = *saddr;
	bp->daddr = *daddr;
548
	bp->protocol = cpu_to_be32(IPPROTO_TCP);
A
Adam Langley 已提交
549
	bp->len = cpu_to_be32(nbytes);
550

551 552 553 554 555 556 557
	_th = (struct tcphdr *)(bp + 1);
	memcpy(_th, th, sizeof(*th));
	_th->check = 0;

	sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
	ahash_request_set_crypt(hp->md5_req, &sg, NULL,
				sizeof(*bp) + sizeof(*th));
H
Herbert Xu 已提交
558
	return crypto_ahash_update(hp->md5_req);
559
}
560

561
static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
562
			       const struct in6_addr *daddr, struct in6_addr *saddr,
E
Eric Dumazet 已提交
563
			       const struct tcphdr *th)
564 565
{
	struct tcp_md5sig_pool *hp;
H
Herbert Xu 已提交
566
	struct ahash_request *req;
567 568 569 570

	hp = tcp_get_md5sig_pool();
	if (!hp)
		goto clear_hash_noput;
H
Herbert Xu 已提交
571
	req = hp->md5_req;
572

H
Herbert Xu 已提交
573
	if (crypto_ahash_init(req))
574
		goto clear_hash;
575
	if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
576 577 578
		goto clear_hash;
	if (tcp_md5_hash_key(hp, key))
		goto clear_hash;
H
Herbert Xu 已提交
579 580
	ahash_request_set_crypt(req, NULL, md5_hash, 0);
	if (crypto_ahash_final(req))
581 582 583 584
		goto clear_hash;

	tcp_put_md5sig_pool();
	return 0;
585

586 587 588 589
clear_hash:
	tcp_put_md5sig_pool();
clear_hash_noput:
	memset(md5_hash, 0, 16);
590
	return 1;
591 592
}

593 594
static int tcp_v6_md5_hash_skb(char *md5_hash,
			       const struct tcp_md5sig_key *key,
E
Eric Dumazet 已提交
595 596
			       const struct sock *sk,
			       const struct sk_buff *skb)
597
{
598
	const struct in6_addr *saddr, *daddr;
599
	struct tcp_md5sig_pool *hp;
H
Herbert Xu 已提交
600
	struct ahash_request *req;
E
Eric Dumazet 已提交
601
	const struct tcphdr *th = tcp_hdr(skb);
602

603 604
	if (sk) { /* valid for establish/request sockets */
		saddr = &sk->sk_v6_rcv_saddr;
605
		daddr = &sk->sk_v6_daddr;
606
	} else {
607
		const struct ipv6hdr *ip6h = ipv6_hdr(skb);
608 609
		saddr = &ip6h->saddr;
		daddr = &ip6h->daddr;
610
	}
611 612 613 614

	hp = tcp_get_md5sig_pool();
	if (!hp)
		goto clear_hash_noput;
H
Herbert Xu 已提交
615
	req = hp->md5_req;
616

H
Herbert Xu 已提交
617
	if (crypto_ahash_init(req))
618 619
		goto clear_hash;

620
	if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
621 622 623 624 625
		goto clear_hash;
	if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
		goto clear_hash;
	if (tcp_md5_hash_key(hp, key))
		goto clear_hash;
H
Herbert Xu 已提交
626 627
	ahash_request_set_crypt(req, NULL, md5_hash, 0);
	if (crypto_ahash_final(req))
628 629 630 631 632 633 634 635 636 637
		goto clear_hash;

	tcp_put_md5sig_pool();
	return 0;

clear_hash:
	tcp_put_md5sig_pool();
clear_hash_noput:
	memset(md5_hash, 0, 16);
	return 1;
638 639
}

640 641 642 643
#endif

static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
				    const struct sk_buff *skb)
644
{
645
#ifdef CONFIG_TCP_MD5SIG
646
	const __u8 *hash_location = NULL;
647
	struct tcp_md5sig_key *hash_expected;
648
	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
E
Eric Dumazet 已提交
649
	const struct tcphdr *th = tcp_hdr(skb);
650 651 652 653
	int genhash;
	u8 newhash[16];

	hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
654
	hash_location = tcp_parse_md5sig_option(th);
655

656 657
	/* We've parsed the options - do we have a hash? */
	if (!hash_expected && !hash_location)
658
		return false;
659 660

	if (hash_expected && !hash_location) {
661
		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
662
		return true;
663 664
	}

665
	if (!hash_expected && hash_location) {
666
		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
667
		return true;
668 669 670
	}

	/* check the signature */
671 672
	genhash = tcp_v6_md5_hash_skb(newhash,
				      hash_expected,
673
				      NULL, skb);
674

675
	if (genhash || memcmp(hash_location, newhash, 16) != 0) {
676
		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
677 678 679 680
		net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
				     genhash ? "failed" : "mismatch",
				     &ip6h->saddr, ntohs(th->source),
				     &ip6h->daddr, ntohs(th->dest));
681
		return true;
682
	}
683
#endif
684
	return false;
685 686
}

687 688
static void tcp_v6_init_req(struct request_sock *req,
			    const struct sock *sk_listener,
689 690 691
			    struct sk_buff *skb)
{
	struct inet_request_sock *ireq = inet_rsk(req);
692
	const struct ipv6_pinfo *np = inet6_sk(sk_listener);
693 694 695 696 697

	ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;

	/* So that link locals have meaning */
698
	if (!sk_listener->sk_bound_dev_if &&
699
	    ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
E
Eric Dumazet 已提交
700
		ireq->ir_iif = tcp_v6_iif(skb);
701

702
	if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
703
	    (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
704
	     np->rxopt.bits.rxinfo ||
705 706 707 708 709 710 711
	     np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
	     np->rxopt.bits.rxohlim || np->repflow)) {
		atomic_inc(&skb->users);
		ireq->pktopts = skb;
	}
}

712 713
static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
					  struct flowi *fl,
714 715 716 717 718
					  const struct request_sock *req,
					  bool *strict)
{
	if (strict)
		*strict = true;
719
	return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
720 721
}

722
struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
L
Linus Torvalds 已提交
723
	.family		=	AF_INET6,
724
	.obj_size	=	sizeof(struct tcp6_request_sock),
725
	.rtx_syn_ack	=	tcp_rtx_synack,
726 727
	.send_ack	=	tcp_v6_reqsk_send_ack,
	.destructor	=	tcp_v6_reqsk_destructor,
728
	.send_reset	=	tcp_v6_send_reset,
W
Wang Yufen 已提交
729
	.syn_ack_timeout =	tcp_syn_ack_timeout,
L
Linus Torvalds 已提交
730 731
};

732
static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
733 734
	.mss_clamp	=	IPV6_MIN_MTU - sizeof(struct tcphdr) -
				sizeof(struct ipv6hdr),
735
#ifdef CONFIG_TCP_MD5SIG
736
	.req_md5_lookup	=	tcp_v6_md5_lookup,
737
	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
738
#endif
739
	.init_req	=	tcp_v6_init_req,
740 741 742
#ifdef CONFIG_SYN_COOKIES
	.cookie_init_seq =	cookie_v6_init_sequence,
#endif
743
	.route_req	=	tcp_v6_route_req,
744
	.init_seq	=	tcp_v6_init_sequence,
745
	.send_synack	=	tcp_v6_send_synack,
746
};
747

748
static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
749 750
				 u32 ack, u32 win, u32 tsval, u32 tsecr,
				 int oif, struct tcp_md5sig_key *key, int rst,
751
				 u8 tclass, __be32 label)
L
Linus Torvalds 已提交
752
{
753 754
	const struct tcphdr *th = tcp_hdr(skb);
	struct tcphdr *t1;
L
Linus Torvalds 已提交
755
	struct sk_buff *buff;
756
	struct flowi6 fl6;
757
	struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
758
	struct sock *ctl_sk = net->ipv6.tcp_sk;
759
	unsigned int tot_len = sizeof(struct tcphdr);
E
Eric Dumazet 已提交
760
	struct dst_entry *dst;
761
	__be32 *topt;
L
Linus Torvalds 已提交
762

763
	if (tsecr)
764
		tot_len += TCPOLEN_TSTAMP_ALIGNED;
765 766 767 768 769 770
#ifdef CONFIG_TCP_MD5SIG
	if (key)
		tot_len += TCPOLEN_MD5SIG_ALIGNED;
#endif

	buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
L
Linus Torvalds 已提交
771
			 GFP_ATOMIC);
772
	if (!buff)
773
		return;
L
Linus Torvalds 已提交
774

775
	skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
L
Linus Torvalds 已提交
776

777
	t1 = (struct tcphdr *) skb_push(buff, tot_len);
778
	skb_reset_transport_header(buff);
L
Linus Torvalds 已提交
779 780 781 782 783

	/* Swap the send and the receive. */
	memset(t1, 0, sizeof(*t1));
	t1->dest = th->source;
	t1->source = th->dest;
784
	t1->doff = tot_len / 4;
785 786 787 788 789
	t1->seq = htonl(seq);
	t1->ack_seq = htonl(ack);
	t1->ack = !rst || !th->ack;
	t1->rst = rst;
	t1->window = htons(win);
L
Linus Torvalds 已提交
790

791 792
	topt = (__be32 *)(t1 + 1);

793
	if (tsecr) {
794 795
		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
				(TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
796 797
		*topt++ = htonl(tsval);
		*topt++ = htonl(tsecr);
798 799
	}

800 801
#ifdef CONFIG_TCP_MD5SIG
	if (key) {
802 803 804
		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
				(TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
		tcp_v6_md5_hash_hdr((__u8 *)topt, key,
805 806
				    &ipv6_hdr(skb)->saddr,
				    &ipv6_hdr(skb)->daddr, t1);
807 808 809
	}
#endif

810
	memset(&fl6, 0, sizeof(fl6));
A
Alexey Dobriyan 已提交
811 812
	fl6.daddr = ipv6_hdr(skb)->saddr;
	fl6.saddr = ipv6_hdr(skb)->daddr;
813
	fl6.flowlabel = label;
L
Linus Torvalds 已提交
814

815 816 817
	buff->ip_summed = CHECKSUM_PARTIAL;
	buff->csum = 0;

818
	__tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
L
Linus Torvalds 已提交
819

820
	fl6.flowi6_proto = IPPROTO_TCP;
821
	if (rt6_need_strict(&fl6.daddr) && !oif)
E
Eric Dumazet 已提交
822
		fl6.flowi6_oif = tcp_v6_iif(skb);
823 824 825 826 827 828
	else {
		if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
			oif = skb->skb_iif;

		fl6.flowi6_oif = oif;
	}
829

830
	fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
831 832
	fl6.fl6_dport = t1->dest;
	fl6.fl6_sport = t1->source;
833
	fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
834
	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
L
Linus Torvalds 已提交
835

836 837 838 839
	/* Pass a socket to ip6_dst_lookup either it is for RST
	 * Underlying function will use this to retrieve the network
	 * namespace
	 */
840
	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
841 842
	if (!IS_ERR(dst)) {
		skb_dst_set(buff, dst);
843
		ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
844
		TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
845
		if (rst)
846
			TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
847
		return;
L
Linus Torvalds 已提交
848 849 850 851 852
	}

	kfree_skb(buff);
}

853
static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
854
{
855
	const struct tcphdr *th = tcp_hdr(skb);
856
	u32 seq = 0, ack_seq = 0;
857
	struct tcp_md5sig_key *key = NULL;
858 859 860 861 862 863 864
#ifdef CONFIG_TCP_MD5SIG
	const __u8 *hash_location = NULL;
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
	unsigned char newhash[16];
	int genhash;
	struct sock *sk1 = NULL;
#endif
W
Wang Yufen 已提交
865
	int oif;
L
Linus Torvalds 已提交
866

867
	if (th->rst)
L
Linus Torvalds 已提交
868 869
		return;

870 871 872 873
	/* If sk not NULL, it means we did a successful lookup and incoming
	 * route had to be correct. prequeue might have dropped our dst.
	 */
	if (!sk && !ipv6_unicast_destination(skb))
874
		return;
L
Linus Torvalds 已提交
875

876
#ifdef CONFIG_TCP_MD5SIG
877
	rcu_read_lock();
878
	hash_location = tcp_parse_md5sig_option(th);
879
	if (sk && sk_fullsock(sk)) {
880 881
		key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
	} else if (hash_location) {
882 883 884 885 886 887 888 889
		/*
		 * active side is lost. Try to find listening socket through
		 * source port, and then find md5 key through listening socket.
		 * we are not loose security here:
		 * Incoming packet is checked with md5 hash with finding key,
		 * no RST generated if md5 hash doesn't match.
		 */
		sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
890 891
					   &tcp_hashinfo, NULL, 0,
					   &ipv6h->saddr,
892
					   th->source, &ipv6h->daddr,
E
Eric Dumazet 已提交
893
					   ntohs(th->source), tcp_v6_iif(skb));
894
		if (!sk1)
895
			goto out;
896 897 898

		key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
		if (!key)
899
			goto out;
900

901
		genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
902
		if (genhash || memcmp(hash_location, newhash, 16) != 0)
903
			goto out;
904
	}
905 906
#endif

907 908 909 910 911
	if (th->ack)
		seq = ntohl(th->ack_seq);
	else
		ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
			  (th->doff << 2);
L
Linus Torvalds 已提交
912

W
Wang Yufen 已提交
913
	oif = sk ? sk->sk_bound_dev_if : 0;
914
	tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
915 916

#ifdef CONFIG_TCP_MD5SIG
917 918
out:
	rcu_read_unlock();
919
#endif
920
}
L
Linus Torvalds 已提交
921

922
static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
923
			    u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
924
			    struct tcp_md5sig_key *key, u8 tclass,
925
			    __be32 label)
926
{
927 928
	tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
			     tclass, label);
L
Linus Torvalds 已提交
929 930 931 932
}

static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
{
933
	struct inet_timewait_sock *tw = inet_twsk(sk);
934
	struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
L
Linus Torvalds 已提交
935

936
	tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
937
			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
938
			tcp_time_stamp + tcptw->tw_ts_offset,
W
Wang Yufen 已提交
939
			tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
940
			tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
L
Linus Torvalds 已提交
941

942
	inet_twsk_put(tw);
L
Linus Torvalds 已提交
943 944
}

945
static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
946
				  struct request_sock *req)
L
Linus Torvalds 已提交
947
{
948 949 950
	/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
	 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
	 */
951 952 953 954 955
	/* RFC 7323 2.3
	 * The window field (SEG.WND) of every outgoing segment, with the
	 * exception of <SYN> segments, MUST be right-shifted by
	 * Rcv.Wind.Shift bits:
	 */
956
	tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
957
			tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
958 959
			tcp_rsk(req)->rcv_nxt,
			req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
960 961
			tcp_time_stamp + tcp_rsk(req)->ts_off,
			req->ts_recent, sk->sk_bound_dev_if,
962 963
			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
			0, 0);
L
Linus Torvalds 已提交
964 965 966
}


967
static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
968
{
969
#ifdef CONFIG_SYN_COOKIES
970
	const struct tcphdr *th = tcp_hdr(skb);
L
Linus Torvalds 已提交
971

972
	if (!th->syn)
973
		sk = cookie_v6_check(sk, skb);
L
Linus Torvalds 已提交
974 975 976 977 978 979 980 981 982 983
#endif
	return sk;
}

static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
{
	if (skb->protocol == htons(ETH_P_IP))
		return tcp_v4_conn_request(sk, skb);

	if (!ipv6_unicast_destination(skb))
984
		goto drop;
L
Linus Torvalds 已提交
985

O
Octavian Purdila 已提交
986 987
	return tcp_conn_request(&tcp6_request_sock_ops,
				&tcp_request_sock_ipv6_ops, sk, skb);
L
Linus Torvalds 已提交
988 989

drop:
990
	tcp_listendrop(sk);
L
Linus Torvalds 已提交
991 992 993
	return 0; /* don't send reset */
}

994
static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
W
Weilong Chen 已提交
995
					 struct request_sock *req,
996 997 998
					 struct dst_entry *dst,
					 struct request_sock *req_unhash,
					 bool *own_req)
L
Linus Torvalds 已提交
999
{
1000
	struct inet_request_sock *ireq;
1001 1002
	struct ipv6_pinfo *newnp;
	const struct ipv6_pinfo *np = inet6_sk(sk);
1003
	struct ipv6_txoptions *opt;
L
Linus Torvalds 已提交
1004 1005 1006 1007
	struct tcp6_sock *newtcp6sk;
	struct inet_sock *newinet;
	struct tcp_sock *newtp;
	struct sock *newsk;
1008 1009 1010
#ifdef CONFIG_TCP_MD5SIG
	struct tcp_md5sig_key *key;
#endif
1011
	struct flowi6 fl6;
L
Linus Torvalds 已提交
1012 1013 1014 1015 1016 1017

	if (skb->protocol == htons(ETH_P_IP)) {
		/*
		 *	v6 mapped
		 */

1018 1019
		newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
					     req_unhash, own_req);
L
Linus Torvalds 已提交
1020

1021
		if (!newsk)
L
Linus Torvalds 已提交
1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032
			return NULL;

		newtcp6sk = (struct tcp6_sock *)newsk;
		inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;

		newinet = inet_sk(newsk);
		newnp = inet6_sk(newsk);
		newtp = tcp_sk(newsk);

		memcpy(newnp, np, sizeof(struct ipv6_pinfo));

1033
		newnp->saddr = newsk->sk_v6_rcv_saddr;
L
Linus Torvalds 已提交
1034

1035
		inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
L
Linus Torvalds 已提交
1036
		newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1037 1038 1039 1040
#ifdef CONFIG_TCP_MD5SIG
		newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
#endif

1041 1042
		newnp->ipv6_ac_list = NULL;
		newnp->ipv6_fl_list = NULL;
L
Linus Torvalds 已提交
1043 1044
		newnp->pktoptions  = NULL;
		newnp->opt	   = NULL;
E
Eric Dumazet 已提交
1045
		newnp->mcast_oif   = tcp_v6_iif(skb);
1046
		newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1047
		newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1048 1049
		if (np->repflow)
			newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
L
Linus Torvalds 已提交
1050

1051 1052 1053 1054
		/*
		 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
		 * here, tcp_create_openreq_child now does this for us, see the comment in
		 * that function for the gory details. -acme
L
Linus Torvalds 已提交
1055 1056 1057
		 */

		/* It is tricky place. Until this moment IPv4 tcp
1058
		   worked with IPv6 icsk.icsk_af_ops.
L
Linus Torvalds 已提交
1059 1060
		   Sync it now.
		 */
1061
		tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
L
Linus Torvalds 已提交
1062 1063 1064 1065

		return newsk;
	}

1066
	ireq = inet_rsk(req);
L
Linus Torvalds 已提交
1067 1068 1069 1070

	if (sk_acceptq_is_full(sk))
		goto out_overflow;

1071
	if (!dst) {
1072
		dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1073
		if (!dst)
L
Linus Torvalds 已提交
1074
			goto out;
1075
	}
L
Linus Torvalds 已提交
1076 1077

	newsk = tcp_create_openreq_child(sk, req, skb);
1078
	if (!newsk)
1079
		goto out_nonewsk;
L
Linus Torvalds 已提交
1080

1081 1082 1083 1084 1085
	/*
	 * No need to charge this sock to the relevant IPv6 refcnt debug socks
	 * count here, tcp_create_openreq_child now does this for us, see the
	 * comment in that function for the gory details. -acme
	 */
L
Linus Torvalds 已提交
1086

1087
	newsk->sk_gso_type = SKB_GSO_TCPV6;
E
Eric Dumazet 已提交
1088
	ip6_dst_store(newsk, dst, NULL, NULL);
1089
	inet6_sk_rx_dst_set(newsk, skb);
L
Linus Torvalds 已提交
1090 1091 1092 1093 1094 1095 1096 1097 1098 1099

	newtcp6sk = (struct tcp6_sock *)newsk;
	inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;

	newtp = tcp_sk(newsk);
	newinet = inet_sk(newsk);
	newnp = inet6_sk(newsk);

	memcpy(newnp, np, sizeof(struct ipv6_pinfo));

1100 1101 1102 1103
	newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
	newnp->saddr = ireq->ir_v6_loc_addr;
	newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
	newsk->sk_bound_dev_if = ireq->ir_iif;
L
Linus Torvalds 已提交
1104

1105
	/* Now IPv6 options...
L
Linus Torvalds 已提交
1106 1107 1108

	   First: no IPv4 options.
	 */
1109
	newinet->inet_opt = NULL;
1110
	newnp->ipv6_ac_list = NULL;
1111
	newnp->ipv6_fl_list = NULL;
L
Linus Torvalds 已提交
1112 1113 1114 1115 1116 1117

	/* Clone RX bits */
	newnp->rxopt.all = np->rxopt.all;

	newnp->pktoptions = NULL;
	newnp->opt	  = NULL;
E
Eric Dumazet 已提交
1118
	newnp->mcast_oif  = tcp_v6_iif(skb);
1119
	newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1120
	newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1121 1122
	if (np->repflow)
		newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
L
Linus Torvalds 已提交
1123 1124 1125 1126 1127 1128 1129

	/* Clone native IPv6 options from listening socket (if any)

	   Yes, keeping reference count would be much more clever,
	   but we make one more one thing there: reattach optmem
	   to newsk.
	 */
1130 1131 1132
	opt = ireq->ipv6_opt;
	if (!opt)
		opt = rcu_dereference(np->opt);
1133 1134 1135 1136
	if (opt) {
		opt = ipv6_dup_options(newsk, opt);
		RCU_INIT_POINTER(newnp->opt, opt);
	}
1137
	inet_csk(newsk)->icsk_ext_hdr_len = 0;
1138 1139 1140
	if (opt)
		inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
						    opt->opt_flen;
L
Linus Torvalds 已提交
1141

1142 1143
	tcp_ca_openreq_child(newsk, dst);

L
Linus Torvalds 已提交
1144
	tcp_sync_mss(newsk, dst_mtu(dst));
1145
	newtp->advmss = dst_metric_advmss(dst);
1146 1147 1148 1149
	if (tcp_sk(sk)->rx_opt.user_mss &&
	    tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
		newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;

L
Linus Torvalds 已提交
1150 1151
	tcp_initialize_rcv_mss(newsk);

E
Eric Dumazet 已提交
1152 1153
	newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
	newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
L
Linus Torvalds 已提交
1154

1155 1156
#ifdef CONFIG_TCP_MD5SIG
	/* Copy over the MD5 key from the original socket */
W
Wang Yufen 已提交
1157
	key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1158
	if (key) {
1159 1160 1161 1162 1163
		/* We're using one, so create a matching key
		 * on the newsk structure. If we fail to get
		 * memory, then we end up not copying the key
		 * across. Shucks.
		 */
1164
		tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1165
			       AF_INET6, key->key, key->keylen,
1166
			       sk_gfp_mask(sk, GFP_ATOMIC));
1167 1168 1169
	}
#endif

1170
	if (__inet_inherit_port(sk, newsk) < 0) {
1171 1172
		inet_csk_prepare_forced_close(newsk);
		tcp_done(newsk);
1173 1174
		goto out;
	}
1175
	*own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
E
Eric Dumazet 已提交
1176
	if (*own_req) {
1177
		tcp_move_syn(newtp, req);
E
Eric Dumazet 已提交
1178 1179 1180 1181

		/* Clone pktoptions received with SYN, if we own the req */
		if (ireq->pktopts) {
			newnp->pktoptions = skb_clone(ireq->pktopts,
1182
						      sk_gfp_mask(sk, GFP_ATOMIC));
E
Eric Dumazet 已提交
1183 1184 1185 1186 1187
			consume_skb(ireq->pktopts);
			ireq->pktopts = NULL;
			if (newnp->pktoptions)
				skb_set_owner_r(newnp->pktoptions, newsk);
		}
E
Eric Dumazet 已提交
1188
	}
L
Linus Torvalds 已提交
1189 1190 1191 1192

	return newsk;

out_overflow:
1193
	__NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1194
out_nonewsk:
L
Linus Torvalds 已提交
1195
	dst_release(dst);
1196
out:
1197
	tcp_listendrop(sk);
L
Linus Torvalds 已提交
1198 1199 1200
	return NULL;
}

1201 1202 1203 1204 1205 1206 1207 1208 1209 1210
static void tcp_v6_restore_cb(struct sk_buff *skb)
{
	/* We need to move header back to the beginning if xfrm6_policy_check()
	 * and tcp_v6_fill_cb() are going to be called again.
	 * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
	 */
	memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
		sizeof(struct inet6_skb_parm));
}

L
Linus Torvalds 已提交
1211
/* The socket must have it's spinlock held when we get
1212
 * here, unless it is a TCP_LISTEN socket.
L
Linus Torvalds 已提交
1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235
 *
 * We have a potential double-lock case here, so even when
 * doing backlog processing we use the BH locking scheme.
 * This is because we cannot sleep with the original spinlock
 * held.
 */
static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct tcp_sock *tp;
	struct sk_buff *opt_skb = NULL;

	/* Imagine: socket is IPv6. IPv4 packet arrives,
	   goes to IPv4 receive handler and backlogged.
	   From backlog it always goes here. Kerboom...
	   Fortunately, tcp_rcv_established and rcv_established
	   handle them correctly, but it is not case with
	   tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
	 */

	if (skb->protocol == htons(ETH_P_IP))
		return tcp_v4_do_rcv(sk, skb);

1236
	if (tcp_filter(sk, skb))
L
Linus Torvalds 已提交
1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254
		goto discard;

	/*
	 *	socket locking is here for SMP purposes as backlog rcv
	 *	is currently called with bh processing disabled.
	 */

	/* Do Stevens' IPV6_PKTOPTIONS.

	   Yes, guys, it is the only place in our code, where we
	   may make it not affecting IPv4.
	   The rest of code is protocol independent,
	   and I do not like idea to uglify IPv4.

	   Actually, all the idea behind IPV6_PKTOPTIONS
	   looks not very well thought. For now we latch
	   options, received in the last packet, enqueued
	   by tcp. Feel free to propose better solution.
1255
					       --ANK (980728)
L
Linus Torvalds 已提交
1256 1257
	 */
	if (np->rxopt.all)
1258
		opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
L
Linus Torvalds 已提交
1259 1260

	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
E
Eric Dumazet 已提交
1261 1262
		struct dst_entry *dst = sk->sk_rx_dst;

1263
		sock_rps_save_rxhash(sk, skb);
1264
		sk_mark_napi_id(sk, skb);
E
Eric Dumazet 已提交
1265 1266 1267 1268 1269 1270 1271 1272
		if (dst) {
			if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
			    dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
				dst_release(dst);
				sk->sk_rx_dst = NULL;
			}
		}

1273
		tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
L
Linus Torvalds 已提交
1274 1275 1276 1277 1278
		if (opt_skb)
			goto ipv6_pktoptions;
		return 0;
	}

E
Eric Dumazet 已提交
1279
	if (tcp_checksum_complete(skb))
L
Linus Torvalds 已提交
1280 1281
		goto csum_err;

1282
	if (sk->sk_state == TCP_LISTEN) {
1283 1284
		struct sock *nsk = tcp_v6_cookie_check(sk, skb);

L
Linus Torvalds 已提交
1285 1286 1287
		if (!nsk)
			goto discard;

W
Weilong Chen 已提交
1288
		if (nsk != sk) {
1289
			sock_rps_save_rxhash(nsk, skb);
1290
			sk_mark_napi_id(nsk, skb);
L
Linus Torvalds 已提交
1291 1292 1293 1294 1295 1296
			if (tcp_child_process(sk, nsk, skb))
				goto reset;
			if (opt_skb)
				__kfree_skb(opt_skb);
			return 0;
		}
1297
	} else
1298
		sock_rps_save_rxhash(sk, skb);
L
Linus Torvalds 已提交
1299

1300
	if (tcp_rcv_state_process(sk, skb))
L
Linus Torvalds 已提交
1301 1302 1303 1304 1305 1306
		goto reset;
	if (opt_skb)
		goto ipv6_pktoptions;
	return 0;

reset:
1307
	tcp_v6_send_reset(sk, skb);
L
Linus Torvalds 已提交
1308 1309 1310 1311 1312 1313
discard:
	if (opt_skb)
		__kfree_skb(opt_skb);
	kfree_skb(skb);
	return 0;
csum_err:
1314 1315
	TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
	TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
L
Linus Torvalds 已提交
1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329
	goto discard;


ipv6_pktoptions:
	/* Do you ask, what is it?

	   1. skb was enqueued by tcp.
	   2. skb is added to tail of read queue, rather than out of order.
	   3. socket is not in passive state.
	   4. Finally, it really contains options, which user wants to receive.
	 */
	tp = tcp_sk(sk);
	if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
	    !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1330
		if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
E
Eric Dumazet 已提交
1331
			np->mcast_oif = tcp_v6_iif(opt_skb);
1332
		if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1333
			np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1334
		if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1335
			np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1336 1337
		if (np->repflow)
			np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1338
		if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
L
Linus Torvalds 已提交
1339
			skb_set_owner_r(opt_skb, sk);
1340
			tcp_v6_restore_cb(opt_skb);
L
Linus Torvalds 已提交
1341 1342 1343 1344 1345 1346 1347
			opt_skb = xchg(&np->pktoptions, opt_skb);
		} else {
			__kfree_skb(opt_skb);
			opt_skb = xchg(&np->pktoptions, NULL);
		}
	}

1348
	kfree_skb(opt_skb);
L
Linus Torvalds 已提交
1349 1350 1351
	return 0;
}

1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373
static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
			   const struct tcphdr *th)
{
	/* This is tricky: we move IP6CB at its correct location into
	 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
	 * _decode_session6() uses IP6CB().
	 * barrier() makes sure compiler won't play aliasing games.
	 */
	memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
		sizeof(struct inet6_skb_parm));
	barrier();

	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
				    skb->len - th->doff*4);
	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
	TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
	TCP_SKB_CB(skb)->tcp_tw_isn = 0;
	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
	TCP_SKB_CB(skb)->sacked = 0;
}

1374
static int tcp_v6_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
1375
{
1376
	const struct tcphdr *th;
1377
	const struct ipv6hdr *hdr;
1378
	bool refcounted;
L
Linus Torvalds 已提交
1379 1380
	struct sock *sk;
	int ret;
1381
	struct net *net = dev_net(skb->dev);
L
Linus Torvalds 已提交
1382 1383 1384 1385 1386 1387 1388

	if (skb->pkt_type != PACKET_HOST)
		goto discard_it;

	/*
	 *	Count it even if it's bad.
	 */
E
Eric Dumazet 已提交
1389
	__TCP_INC_STATS(net, TCP_MIB_INSEGS);
L
Linus Torvalds 已提交
1390 1391 1392 1393

	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
		goto discard_it;

1394
	th = (const struct tcphdr *)skb->data;
L
Linus Torvalds 已提交
1395

1396
	if (unlikely(th->doff < sizeof(struct tcphdr)/4))
L
Linus Torvalds 已提交
1397 1398 1399 1400
		goto bad_packet;
	if (!pskb_may_pull(skb, th->doff*4))
		goto discard_it;

1401
	if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1402
		goto csum_error;
L
Linus Torvalds 已提交
1403

1404
	th = (const struct tcphdr *)skb->data;
1405
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
1406

1407
lookup:
1408
	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1409 1410
				th->source, th->dest, inet6_iif(skb),
				&refcounted);
L
Linus Torvalds 已提交
1411 1412 1413 1414 1415 1416 1417
	if (!sk)
		goto no_tcp_socket;

process:
	if (sk->sk_state == TCP_TIME_WAIT)
		goto do_time_wait;

1418 1419
	if (sk->sk_state == TCP_NEW_SYN_RECV) {
		struct request_sock *req = inet_reqsk(sk);
1420
		struct sock *nsk;
1421 1422 1423 1424

		sk = req->rsk_listener;
		tcp_v6_fill_cb(skb, hdr, th);
		if (tcp_v6_inbound_md5_hash(sk, skb)) {
1425
			sk_drops_add(sk, skb);
1426 1427 1428
			reqsk_put(req);
			goto discard_it;
		}
1429
		if (unlikely(sk->sk_state != TCP_LISTEN)) {
1430
			inet_csk_reqsk_queue_drop_and_put(sk, req);
1431 1432
			goto lookup;
		}
1433
		sock_hold(sk);
1434
		refcounted = true;
1435
		nsk = tcp_check_req(sk, skb, req, false);
1436 1437
		if (!nsk) {
			reqsk_put(req);
1438
			goto discard_and_relse;
1439 1440 1441 1442 1443 1444
		}
		if (nsk == sk) {
			reqsk_put(req);
			tcp_v6_restore_cb(skb);
		} else if (tcp_child_process(sk, nsk, skb)) {
			tcp_v6_send_reset(nsk, skb);
1445
			goto discard_and_relse;
1446
		} else {
1447
			sock_put(sk);
1448 1449 1450
			return 0;
		}
	}
1451
	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1452
		__NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1453 1454 1455
		goto discard_and_relse;
	}

L
Linus Torvalds 已提交
1456 1457 1458
	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
		goto discard_and_relse;

1459 1460
	tcp_v6_fill_cb(skb, hdr, th);

1461 1462 1463
	if (tcp_v6_inbound_md5_hash(sk, skb))
		goto discard_and_relse;

1464
	if (tcp_filter(sk, skb))
L
Linus Torvalds 已提交
1465
		goto discard_and_relse;
1466 1467
	th = (const struct tcphdr *)skb->data;
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
1468 1469 1470

	skb->dev = NULL;

1471 1472 1473 1474 1475 1476 1477
	if (sk->sk_state == TCP_LISTEN) {
		ret = tcp_v6_do_rcv(sk, skb);
		goto put_and_return;
	}

	sk_incoming_cpu_update(sk);

1478
	bh_lock_sock_nested(sk);
1479
	tcp_segs_in(tcp_sk(sk), skb);
L
Linus Torvalds 已提交
1480 1481
	ret = 0;
	if (!sock_owned_by_user(sk)) {
D
Dan Williams 已提交
1482
		if (!tcp_prequeue(sk, skb))
1483
			ret = tcp_v6_do_rcv(sk, skb);
E
Eric Dumazet 已提交
1484
	} else if (tcp_add_backlog(sk, skb)) {
Z
Zhu Yi 已提交
1485 1486
		goto discard_and_relse;
	}
L
Linus Torvalds 已提交
1487 1488
	bh_unlock_sock(sk);

1489
put_and_return:
1490 1491
	if (refcounted)
		sock_put(sk);
L
Linus Torvalds 已提交
1492 1493 1494 1495 1496 1497
	return ret ? -1 : 0;

no_tcp_socket:
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
		goto discard_it;

1498 1499
	tcp_v6_fill_cb(skb, hdr, th);

E
Eric Dumazet 已提交
1500
	if (tcp_checksum_complete(skb)) {
1501
csum_error:
E
Eric Dumazet 已提交
1502
		__TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
L
Linus Torvalds 已提交
1503
bad_packet:
E
Eric Dumazet 已提交
1504
		__TCP_INC_STATS(net, TCP_MIB_INERRS);
L
Linus Torvalds 已提交
1505
	} else {
1506
		tcp_v6_send_reset(NULL, skb);
L
Linus Torvalds 已提交
1507 1508 1509 1510 1511 1512 1513
	}

discard_it:
	kfree_skb(skb);
	return 0;

discard_and_relse:
1514
	sk_drops_add(sk, skb);
1515 1516
	if (refcounted)
		sock_put(sk);
L
Linus Torvalds 已提交
1517 1518 1519 1520
	goto discard_it;

do_time_wait:
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1521
		inet_twsk_put(inet_twsk(sk));
L
Linus Torvalds 已提交
1522 1523 1524
		goto discard_it;
	}

1525 1526
	tcp_v6_fill_cb(skb, hdr, th);

1527 1528 1529
	if (tcp_checksum_complete(skb)) {
		inet_twsk_put(inet_twsk(sk));
		goto csum_error;
L
Linus Torvalds 已提交
1530 1531
	}

1532
	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
L
Linus Torvalds 已提交
1533 1534 1535 1536
	case TCP_TW_SYN:
	{
		struct sock *sk2;

1537
		sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1538
					    skb, __tcp_hdrlen(th),
1539
					    &ipv6_hdr(skb)->saddr, th->source,
1540
					    &ipv6_hdr(skb)->daddr,
E
Eric Dumazet 已提交
1541
					    ntohs(th->dest), tcp_v6_iif(skb));
1542
		if (sk2) {
1543
			struct inet_timewait_sock *tw = inet_twsk(sk);
1544
			inet_twsk_deschedule_put(tw);
L
Linus Torvalds 已提交
1545
			sk = sk2;
1546
			tcp_v6_restore_cb(skb);
1547
			refcounted = false;
L
Linus Torvalds 已提交
1548 1549 1550 1551 1552 1553 1554 1555
			goto process;
		}
		/* Fall through to ACK */
	}
	case TCP_TW_ACK:
		tcp_v6_timewait_ack(sk, skb);
		break;
	case TCP_TW_RST:
1556
		tcp_v6_restore_cb(skb);
1557 1558 1559
		tcp_v6_send_reset(sk, skb);
		inet_twsk_deschedule_put(inet_twsk(sk));
		goto discard_it;
W
Wang Yufen 已提交
1560 1561
	case TCP_TW_SUCCESS:
		;
L
Linus Torvalds 已提交
1562 1563 1564 1565
	}
	goto discard_it;
}

E
Eric Dumazet 已提交
1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583
static void tcp_v6_early_demux(struct sk_buff *skb)
{
	const struct ipv6hdr *hdr;
	const struct tcphdr *th;
	struct sock *sk;

	if (skb->pkt_type != PACKET_HOST)
		return;

	if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
		return;

	hdr = ipv6_hdr(skb);
	th = tcp_hdr(skb);

	if (th->doff < sizeof(struct tcphdr) / 4)
		return;

E
Eric Dumazet 已提交
1584
	/* Note : We use inet6_iif() here, not tcp_v6_iif() */
E
Eric Dumazet 已提交
1585 1586 1587 1588 1589 1590 1591
	sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
					&hdr->saddr, th->source,
					&hdr->daddr, ntohs(th->dest),
					inet6_iif(skb));
	if (sk) {
		skb->sk = sk;
		skb->destructor = sock_edemux;
1592
		if (sk_fullsock(sk)) {
1593
			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1594

E
Eric Dumazet 已提交
1595
			if (dst)
E
Eric Dumazet 已提交
1596
				dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
E
Eric Dumazet 已提交
1597
			if (dst &&
1598
			    inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
E
Eric Dumazet 已提交
1599 1600 1601 1602 1603
				skb_dst_set_noref(skb, dst);
		}
	}
}

1604 1605 1606
static struct timewait_sock_ops tcp6_timewait_sock_ops = {
	.twsk_obj_size	= sizeof(struct tcp6_timewait_sock),
	.twsk_unique	= tcp_twsk_unique,
W
Wang Yufen 已提交
1607
	.twsk_destructor = tcp_twsk_destructor,
1608 1609
};

1610
static const struct inet_connection_sock_af_ops ipv6_specific = {
1611 1612 1613
	.queue_xmit	   = inet6_csk_xmit,
	.send_check	   = tcp_v6_send_check,
	.rebuild_header	   = inet6_sk_rebuild_header,
E
Eric Dumazet 已提交
1614
	.sk_rx_dst_set	   = inet6_sk_rx_dst_set,
1615 1616 1617
	.conn_request	   = tcp_v6_conn_request,
	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
	.net_header_len	   = sizeof(struct ipv6hdr),
1618
	.net_frag_header_len = sizeof(struct frag_hdr),
1619 1620 1621 1622
	.setsockopt	   = ipv6_setsockopt,
	.getsockopt	   = ipv6_getsockopt,
	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1623
	.bind_conflict	   = inet6_csk_bind_conflict,
1624
#ifdef CONFIG_COMPAT
1625 1626
	.compat_setsockopt = compat_ipv6_setsockopt,
	.compat_getsockopt = compat_ipv6_getsockopt,
1627
#endif
1628
	.mtu_reduced	   = tcp_v6_mtu_reduced,
L
Linus Torvalds 已提交
1629 1630
};

1631
#ifdef CONFIG_TCP_MD5SIG
1632
static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1633
	.md5_lookup	=	tcp_v6_md5_lookup,
1634
	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
1635 1636
	.md5_parse	=	tcp_v6_parse_md5_keys,
};
1637
#endif
1638

L
Linus Torvalds 已提交
1639 1640 1641
/*
 *	TCP over IPv4 via INET6 API
 */
1642
static const struct inet_connection_sock_af_ops ipv6_mapped = {
1643 1644 1645
	.queue_xmit	   = ip_queue_xmit,
	.send_check	   = tcp_v4_send_check,
	.rebuild_header	   = inet_sk_rebuild_header,
1646
	.sk_rx_dst_set	   = inet_sk_rx_dst_set,
1647 1648 1649 1650 1651 1652 1653
	.conn_request	   = tcp_v6_conn_request,
	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
	.net_header_len	   = sizeof(struct iphdr),
	.setsockopt	   = ipv6_setsockopt,
	.getsockopt	   = ipv6_getsockopt,
	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1654
	.bind_conflict	   = inet6_csk_bind_conflict,
1655
#ifdef CONFIG_COMPAT
1656 1657
	.compat_setsockopt = compat_ipv6_setsockopt,
	.compat_getsockopt = compat_ipv6_getsockopt,
1658
#endif
1659
	.mtu_reduced	   = tcp_v4_mtu_reduced,
L
Linus Torvalds 已提交
1660 1661
};

1662
#ifdef CONFIG_TCP_MD5SIG
1663
static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1664
	.md5_lookup	=	tcp_v4_md5_lookup,
1665
	.calc_md5_hash	=	tcp_v4_md5_hash_skb,
1666 1667
	.md5_parse	=	tcp_v6_parse_md5_keys,
};
1668
#endif
1669

L
Linus Torvalds 已提交
1670 1671 1672 1673 1674
/* NOTE: A lot of things set to zero explicitly by call to
 *       sk_alloc() so need not be done here.
 */
static int tcp_v6_init_sock(struct sock *sk)
{
1675
	struct inet_connection_sock *icsk = inet_csk(sk);
L
Linus Torvalds 已提交
1676

1677
	tcp_init_sock(sk);
L
Linus Torvalds 已提交
1678

1679
	icsk->icsk_af_ops = &ipv6_specific;
L
Linus Torvalds 已提交
1680

1681
#ifdef CONFIG_TCP_MD5SIG
1682
	tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1683 1684
#endif

L
Linus Torvalds 已提交
1685 1686 1687
	return 0;
}

1688
static void tcp_v6_destroy_sock(struct sock *sk)
L
Linus Torvalds 已提交
1689 1690
{
	tcp_v4_destroy_sock(sk);
1691
	inet6_destroy_sock(sk);
L
Linus Torvalds 已提交
1692 1693
}

1694
#ifdef CONFIG_PROC_FS
L
Linus Torvalds 已提交
1695
/* Proc filesystem TCPv6 sock list dumping. */
1696
static void get_openreq6(struct seq_file *seq,
E
Eric Dumazet 已提交
1697
			 const struct request_sock *req, int i)
L
Linus Torvalds 已提交
1698
{
1699
	long ttd = req->rsk_timer.expires - jiffies;
1700 1701
	const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
	const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
L
Linus Torvalds 已提交
1702 1703 1704 1705 1706 1707

	if (ttd < 0)
		ttd = 0;

	seq_printf(seq,
		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1708
		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
L
Linus Torvalds 已提交
1709 1710 1711
		   i,
		   src->s6_addr32[0], src->s6_addr32[1],
		   src->s6_addr32[2], src->s6_addr32[3],
E
Eric Dumazet 已提交
1712
		   inet_rsk(req)->ir_num,
L
Linus Torvalds 已提交
1713 1714
		   dest->s6_addr32[0], dest->s6_addr32[1],
		   dest->s6_addr32[2], dest->s6_addr32[3],
1715
		   ntohs(inet_rsk(req)->ir_rmt_port),
L
Linus Torvalds 已提交
1716
		   TCP_SYN_RECV,
W
Weilong Chen 已提交
1717
		   0, 0, /* could print option size, but that is af dependent. */
1718 1719
		   1,   /* timers active (only the expire timer) */
		   jiffies_to_clock_t(ttd),
1720
		   req->num_timeout,
E
Eric Dumazet 已提交
1721 1722
		   from_kuid_munged(seq_user_ns(seq),
				    sock_i_uid(req->rsk_listener)),
1723
		   0,  /* non standard timer */
L
Linus Torvalds 已提交
1724 1725 1726 1727 1728 1729
		   0, /* open_requests have no inode */
		   0, req);
}

static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
{
1730
	const struct in6_addr *dest, *src;
L
Linus Torvalds 已提交
1731 1732 1733
	__u16 destp, srcp;
	int timer_active;
	unsigned long timer_expires;
1734 1735
	const struct inet_sock *inet = inet_sk(sp);
	const struct tcp_sock *tp = tcp_sk(sp);
1736
	const struct inet_connection_sock *icsk = inet_csk(sp);
1737
	const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1738 1739
	int rx_queue;
	int state;
L
Linus Torvalds 已提交
1740

1741 1742
	dest  = &sp->sk_v6_daddr;
	src   = &sp->sk_v6_rcv_saddr;
E
Eric Dumazet 已提交
1743 1744
	destp = ntohs(inet->inet_dport);
	srcp  = ntohs(inet->inet_sport);
1745

1746 1747 1748
	if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
	    icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
	    icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
L
Linus Torvalds 已提交
1749
		timer_active	= 1;
1750 1751
		timer_expires	= icsk->icsk_timeout;
	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
L
Linus Torvalds 已提交
1752
		timer_active	= 4;
1753
		timer_expires	= icsk->icsk_timeout;
L
Linus Torvalds 已提交
1754 1755 1756 1757 1758 1759 1760 1761
	} else if (timer_pending(&sp->sk_timer)) {
		timer_active	= 2;
		timer_expires	= sp->sk_timer.expires;
	} else {
		timer_active	= 0;
		timer_expires = jiffies;
	}

1762 1763 1764 1765 1766 1767 1768 1769 1770
	state = sk_state_load(sp);
	if (state == TCP_LISTEN)
		rx_queue = sp->sk_ack_backlog;
	else
		/* Because we don't lock the socket,
		 * we might find a transient negative value.
		 */
		rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);

L
Linus Torvalds 已提交
1771 1772
	seq_printf(seq,
		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1773
		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
L
Linus Torvalds 已提交
1774 1775 1776 1777 1778
		   i,
		   src->s6_addr32[0], src->s6_addr32[1],
		   src->s6_addr32[2], src->s6_addr32[3], srcp,
		   dest->s6_addr32[0], dest->s6_addr32[1],
		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1779 1780 1781
		   state,
		   tp->write_seq - tp->snd_una,
		   rx_queue,
L
Linus Torvalds 已提交
1782
		   timer_active,
1783
		   jiffies_delta_to_clock_t(timer_expires - jiffies),
1784
		   icsk->icsk_retransmits,
1785
		   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1786
		   icsk->icsk_probes_out,
L
Linus Torvalds 已提交
1787 1788
		   sock_i_ino(sp),
		   atomic_read(&sp->sk_refcnt), sp,
1789 1790
		   jiffies_to_clock_t(icsk->icsk_rto),
		   jiffies_to_clock_t(icsk->icsk_ack.ato),
W
Weilong Chen 已提交
1791
		   (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
I
Ilpo Järvinen 已提交
1792
		   tp->snd_cwnd,
1793
		   state == TCP_LISTEN ?
1794
			fastopenq->max_qlen :
1795
			(tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
L
Linus Torvalds 已提交
1796 1797 1798
		   );
}

1799
static void get_timewait6_sock(struct seq_file *seq,
1800
			       struct inet_timewait_sock *tw, int i)
L
Linus Torvalds 已提交
1801
{
1802
	long delta = tw->tw_timer.expires - jiffies;
1803
	const struct in6_addr *dest, *src;
L
Linus Torvalds 已提交
1804 1805
	__u16 destp, srcp;

1806 1807
	dest = &tw->tw_v6_daddr;
	src  = &tw->tw_v6_rcv_saddr;
L
Linus Torvalds 已提交
1808 1809 1810 1811 1812
	destp = ntohs(tw->tw_dport);
	srcp  = ntohs(tw->tw_sport);

	seq_printf(seq,
		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
D
Dan Rosenberg 已提交
1813
		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
L
Linus Torvalds 已提交
1814 1815 1816 1817 1818 1819
		   i,
		   src->s6_addr32[0], src->s6_addr32[1],
		   src->s6_addr32[2], src->s6_addr32[3], srcp,
		   dest->s6_addr32[0], dest->s6_addr32[1],
		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
		   tw->tw_substate, 0, 0,
1820
		   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
L
Linus Torvalds 已提交
1821 1822 1823 1824 1825 1826
		   atomic_read(&tw->tw_refcnt), tw);
}

static int tcp6_seq_show(struct seq_file *seq, void *v)
{
	struct tcp_iter_state *st;
E
Eric Dumazet 已提交
1827
	struct sock *sk = v;
L
Linus Torvalds 已提交
1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839

	if (v == SEQ_START_TOKEN) {
		seq_puts(seq,
			 "  sl  "
			 "local_address                         "
			 "remote_address                        "
			 "st tx_queue rx_queue tr tm->when retrnsmt"
			 "   uid  timeout inode\n");
		goto out;
	}
	st = seq->private;

1840 1841 1842
	if (sk->sk_state == TCP_TIME_WAIT)
		get_timewait6_sock(seq, v, st->num);
	else if (sk->sk_state == TCP_NEW_SYN_RECV)
E
Eric Dumazet 已提交
1843
		get_openreq6(seq, v, st->num);
1844 1845
	else
		get_tcp6_sock(seq, v, st->num);
L
Linus Torvalds 已提交
1846 1847 1848 1849
out:
	return 0;
}

1850 1851 1852 1853 1854 1855 1856 1857
static const struct file_operations tcp6_afinfo_seq_fops = {
	.owner   = THIS_MODULE,
	.open    = tcp_seq_open,
	.read    = seq_read,
	.llseek  = seq_lseek,
	.release = seq_release_net
};

L
Linus Torvalds 已提交
1858 1859 1860
static struct tcp_seq_afinfo tcp6_seq_afinfo = {
	.name		= "tcp6",
	.family		= AF_INET6,
1861
	.seq_fops	= &tcp6_afinfo_seq_fops,
1862 1863 1864
	.seq_ops	= {
		.show		= tcp6_seq_show,
	},
L
Linus Torvalds 已提交
1865 1866
};

1867
int __net_init tcp6_proc_init(struct net *net)
L
Linus Torvalds 已提交
1868
{
1869
	return tcp_proc_register(net, &tcp6_seq_afinfo);
L
Linus Torvalds 已提交
1870 1871
}

1872
void tcp6_proc_exit(struct net *net)
L
Linus Torvalds 已提交
1873
{
1874
	tcp_proc_unregister(net, &tcp6_seq_afinfo);
L
Linus Torvalds 已提交
1875 1876 1877 1878 1879 1880 1881 1882 1883
}
#endif

struct proto tcpv6_prot = {
	.name			= "TCPv6",
	.owner			= THIS_MODULE,
	.close			= tcp_close,
	.connect		= tcp_v6_connect,
	.disconnect		= tcp_disconnect,
1884
	.accept			= inet_csk_accept,
L
Linus Torvalds 已提交
1885 1886 1887 1888 1889 1890 1891
	.ioctl			= tcp_ioctl,
	.init			= tcp_v6_init_sock,
	.destroy		= tcp_v6_destroy_sock,
	.shutdown		= tcp_shutdown,
	.setsockopt		= tcp_setsockopt,
	.getsockopt		= tcp_getsockopt,
	.recvmsg		= tcp_recvmsg,
1892 1893
	.sendmsg		= tcp_sendmsg,
	.sendpage		= tcp_sendpage,
L
Linus Torvalds 已提交
1894
	.backlog_rcv		= tcp_v6_do_rcv,
E
Eric Dumazet 已提交
1895
	.release_cb		= tcp_release_cb,
1896
	.hash			= inet6_hash,
1897 1898
	.unhash			= inet_unhash,
	.get_port		= inet_csk_get_port,
L
Linus Torvalds 已提交
1899
	.enter_memory_pressure	= tcp_enter_memory_pressure,
1900
	.stream_memory_free	= tcp_stream_memory_free,
L
Linus Torvalds 已提交
1901 1902 1903
	.sockets_allocated	= &tcp_sockets_allocated,
	.memory_allocated	= &tcp_memory_allocated,
	.memory_pressure	= &tcp_memory_pressure,
1904
	.orphan_count		= &tcp_orphan_count,
1905
	.sysctl_mem		= sysctl_tcp_mem,
L
Linus Torvalds 已提交
1906 1907 1908 1909
	.sysctl_wmem		= sysctl_tcp_wmem,
	.sysctl_rmem		= sysctl_tcp_rmem,
	.max_header		= MAX_TCP_HEADER,
	.obj_size		= sizeof(struct tcp6_sock),
1910
	.slab_flags		= SLAB_DESTROY_BY_RCU,
1911
	.twsk_prot		= &tcp6_timewait_sock_ops,
1912
	.rsk_prot		= &tcp6_request_sock_ops,
1913
	.h.hashinfo		= &tcp_hashinfo,
1914
	.no_autobind		= true,
1915 1916 1917
#ifdef CONFIG_COMPAT
	.compat_setsockopt	= compat_tcp_setsockopt,
	.compat_getsockopt	= compat_tcp_getsockopt,
G
Glauber Costa 已提交
1918
#endif
1919
	.diag_destroy		= tcp_abort,
L
Linus Torvalds 已提交
1920 1921
};

1922
static const struct inet6_protocol tcpv6_protocol = {
E
Eric Dumazet 已提交
1923
	.early_demux	=	tcp_v6_early_demux,
L
Linus Torvalds 已提交
1924 1925 1926 1927 1928 1929 1930 1931 1932 1933
	.handler	=	tcp_v6_rcv,
	.err_handler	=	tcp_v6_err,
	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
};

static struct inet_protosw tcpv6_protosw = {
	.type		=	SOCK_STREAM,
	.protocol	=	IPPROTO_TCP,
	.prot		=	&tcpv6_prot,
	.ops		=	&inet6_stream_ops,
1934 1935
	.flags		=	INET_PROTOSW_PERMANENT |
				INET_PROTOSW_ICSK,
L
Linus Torvalds 已提交
1936 1937
};

1938
static int __net_init tcpv6_net_init(struct net *net)
1939
{
1940 1941
	return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
				    SOCK_RAW, IPPROTO_TCP, net);
1942 1943
}

1944
static void __net_exit tcpv6_net_exit(struct net *net)
1945
{
1946
	inet_ctl_sock_destroy(net->ipv6.tcp_sk);
E
Eric W. Biederman 已提交
1947 1948
}

1949
static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
E
Eric W. Biederman 已提交
1950 1951
{
	inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1952 1953 1954
}

static struct pernet_operations tcpv6_net_ops = {
E
Eric W. Biederman 已提交
1955 1956 1957
	.init	    = tcpv6_net_init,
	.exit	    = tcpv6_net_exit,
	.exit_batch = tcpv6_net_exit_batch,
1958 1959
};

1960
int __init tcpv6_init(void)
L
Linus Torvalds 已提交
1961
{
1962 1963
	int ret;

1964 1965
	ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
	if (ret)
1966
		goto out;
1967

L
Linus Torvalds 已提交
1968
	/* register inet6 protocol */
1969 1970 1971 1972
	ret = inet6_register_protosw(&tcpv6_protosw);
	if (ret)
		goto out_tcpv6_protocol;

1973
	ret = register_pernet_subsys(&tcpv6_net_ops);
1974 1975 1976 1977
	if (ret)
		goto out_tcpv6_protosw;
out:
	return ret;
1978

1979 1980
out_tcpv6_protosw:
	inet6_unregister_protosw(&tcpv6_protosw);
1981 1982
out_tcpv6_protocol:
	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1983 1984 1985
	goto out;
}

1986
void tcpv6_exit(void)
1987
{
1988
	unregister_pernet_subsys(&tcpv6_net_ops);
1989 1990
	inet6_unregister_protosw(&tcpv6_protosw);
	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
L
Linus Torvalds 已提交
1991
}