tcp_ipv6.c 49.9 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	TCP over IPv6
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7
 *
8
 *	Based on:
L
Linus Torvalds 已提交
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
 *	linux/net/ipv4/tcp.c
 *	linux/net/ipv4/tcp_input.c
 *	linux/net/ipv4/tcp_output.c
 *
 *	Fixes:
 *	Hideaki YOSHIFUJI	:	sin6_scope_id support
 *	YOSHIFUJI Hideaki @USAGI and:	Support IPV6_V6ONLY socket option, which
 *	Alexey Kuznetsov		allow both IPv4 and IPv6 sockets to bind
 *					a single port at the same time.
 *	YOSHIFUJI Hideaki @USAGI:	convert /proc/net/tcp6 to seq_file.
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

H
Herbert Xu 已提交
26
#include <linux/bottom_half.h>
L
Linus Torvalds 已提交
27 28 29 30 31 32 33 34 35 36 37 38 39 40
#include <linux/module.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/jiffies.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/init.h>
#include <linux/jhash.h>
#include <linux/ipsec.h>
#include <linux/times.h>
41
#include <linux/slab.h>
W
Wang Yufen 已提交
42
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
43 44 45 46 47 48
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/random.h>

#include <net/tcp.h>
#include <net/ndisc.h>
49
#include <net/inet6_hashtables.h>
50
#include <net/inet6_connection_sock.h>
L
Linus Torvalds 已提交
51 52 53 54 55 56 57 58 59 60
#include <net/ipv6.h>
#include <net/transp_v6.h>
#include <net/addrconf.h>
#include <net/ip6_route.h>
#include <net/ip6_checksum.h>
#include <net/inet_ecn.h>
#include <net/protocol.h>
#include <net/xfrm.h>
#include <net/snmp.h>
#include <net/dsfield.h>
61
#include <net/timewait_sock.h>
62
#include <net/inet_common.h>
63
#include <net/secure_seq.h>
64
#include <net/busy_poll.h>
L
Linus Torvalds 已提交
65 66 67 68

#include <linux/proc_fs.h>
#include <linux/seq_file.h>

69 70 71
#include <linux/crypto.h>
#include <linux/scatterlist.h>

72 73
static void	tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
static void	tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
74
				      struct request_sock *req);
L
Linus Torvalds 已提交
75 76 77

static int	tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);

78 79
static const struct inet_connection_sock_af_ops ipv6_mapped;
static const struct inet_connection_sock_af_ops ipv6_specific;
80
#ifdef CONFIG_TCP_MD5SIG
81 82
static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
83
#else
84
static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
85
						   const struct in6_addr *addr)
86 87 88
{
	return NULL;
}
89
#endif
L
Linus Torvalds 已提交
90

91 92 93 94
static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
{
	struct dst_entry *dst = skb_dst(skb);

E
Eric Dumazet 已提交
95
	if (dst && dst_hold_safe(dst)) {
96 97 98 99
		const struct rt6_info *rt = (const struct rt6_info *)dst;

		sk->sk_rx_dst = dst;
		inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
100
		inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
101
	}
102 103
}

104
static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
L
Linus Torvalds 已提交
105
{
106 107
	return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
					    ipv6_hdr(skb)->saddr.s6_addr32,
108 109
					    tcp_hdr(skb)->dest,
					    tcp_hdr(skb)->source);
L
Linus Torvalds 已提交
110 111
}

112
static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
L
Linus Torvalds 已提交
113 114 115
			  int addr_len)
{
	struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
116
	struct inet_sock *inet = inet_sk(sk);
117
	struct inet_connection_sock *icsk = inet_csk(sk);
L
Linus Torvalds 已提交
118 119
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct tcp_sock *tp = tcp_sk(sk);
120
	struct in6_addr *saddr = NULL, *final_p, final;
121
	struct ipv6_txoptions *opt;
122
	struct flowi6 fl6;
L
Linus Torvalds 已提交
123 124 125 126
	struct dst_entry *dst;
	int addr_type;
	int err;

127
	if (addr_len < SIN6_LEN_RFC2133)
L
Linus Torvalds 已提交
128 129
		return -EINVAL;

130
	if (usin->sin6_family != AF_INET6)
E
Eric Dumazet 已提交
131
		return -EAFNOSUPPORT;
L
Linus Torvalds 已提交
132

133
	memset(&fl6, 0, sizeof(fl6));
L
Linus Torvalds 已提交
134 135

	if (np->sndflow) {
136 137 138
		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
		IP6_ECN_flow_init(fl6.flowlabel);
		if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
L
Linus Torvalds 已提交
139
			struct ip6_flowlabel *flowlabel;
140
			flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
141
			if (!flowlabel)
L
Linus Torvalds 已提交
142 143 144 145 146 147
				return -EINVAL;
			fl6_sock_release(flowlabel);
		}
	}

	/*
148 149 150
	 *	connect() to INADDR_ANY means loopback (BSD'ism).
	 */

W
Weilong Chen 已提交
151
	if (ipv6_addr_any(&usin->sin6_addr))
152
		usin->sin6_addr.s6_addr[15] = 0x1;
L
Linus Torvalds 已提交
153 154 155

	addr_type = ipv6_addr_type(&usin->sin6_addr);

W
Weilong Chen 已提交
156
	if (addr_type & IPV6_ADDR_MULTICAST)
L
Linus Torvalds 已提交
157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177
		return -ENETUNREACH;

	if (addr_type&IPV6_ADDR_LINKLOCAL) {
		if (addr_len >= sizeof(struct sockaddr_in6) &&
		    usin->sin6_scope_id) {
			/* If interface is set while binding, indices
			 * must coincide.
			 */
			if (sk->sk_bound_dev_if &&
			    sk->sk_bound_dev_if != usin->sin6_scope_id)
				return -EINVAL;

			sk->sk_bound_dev_if = usin->sin6_scope_id;
		}

		/* Connect to link-local address requires an interface */
		if (!sk->sk_bound_dev_if)
			return -EINVAL;
	}

	if (tp->rx_opt.ts_recent_stamp &&
178
	    !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
L
Linus Torvalds 已提交
179 180 181 182 183
		tp->rx_opt.ts_recent = 0;
		tp->rx_opt.ts_recent_stamp = 0;
		tp->write_seq = 0;
	}

184
	sk->sk_v6_daddr = usin->sin6_addr;
185
	np->flow_label = fl6.flowlabel;
L
Linus Torvalds 已提交
186 187 188 189 190 191

	/*
	 *	TCP over IPv4
	 */

	if (addr_type == IPV6_ADDR_MAPPED) {
192
		u32 exthdrlen = icsk->icsk_ext_hdr_len;
L
Linus Torvalds 已提交
193 194 195 196 197 198 199 200 201 202 203
		struct sockaddr_in sin;

		SOCK_DEBUG(sk, "connect: ipv4 mapped\n");

		if (__ipv6_only_sock(sk))
			return -ENETUNREACH;

		sin.sin_family = AF_INET;
		sin.sin_port = usin->sin6_port;
		sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];

204
		icsk->icsk_af_ops = &ipv6_mapped;
L
Linus Torvalds 已提交
205
		sk->sk_backlog_rcv = tcp_v4_do_rcv;
206 207 208
#ifdef CONFIG_TCP_MD5SIG
		tp->af_specific = &tcp_sock_ipv6_mapped_specific;
#endif
L
Linus Torvalds 已提交
209 210 211 212

		err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));

		if (err) {
213 214
			icsk->icsk_ext_hdr_len = exthdrlen;
			icsk->icsk_af_ops = &ipv6_specific;
L
Linus Torvalds 已提交
215
			sk->sk_backlog_rcv = tcp_v6_do_rcv;
216 217 218
#ifdef CONFIG_TCP_MD5SIG
			tp->af_specific = &tcp_sock_ipv6_specific;
#endif
L
Linus Torvalds 已提交
219 220
			goto failure;
		}
221
		np->saddr = sk->sk_v6_rcv_saddr;
L
Linus Torvalds 已提交
222 223 224 225

		return err;
	}

226 227
	if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
		saddr = &sk->sk_v6_rcv_saddr;
L
Linus Torvalds 已提交
228

229
	fl6.flowi6_proto = IPPROTO_TCP;
230
	fl6.daddr = sk->sk_v6_daddr;
A
Alexey Dobriyan 已提交
231
	fl6.saddr = saddr ? *saddr : np->saddr;
232 233
	fl6.flowi6_oif = sk->sk_bound_dev_if;
	fl6.flowi6_mark = sk->sk_mark;
234 235
	fl6.fl6_dport = usin->sin6_port;
	fl6.fl6_sport = inet->inet_sport;
L
Linus Torvalds 已提交
236

237 238
	opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
	final_p = fl6_update_dst(&fl6, opt, &final);
L
Linus Torvalds 已提交
239

240
	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
V
Venkat Yekkirala 已提交
241

242
	dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
243 244
	if (IS_ERR(dst)) {
		err = PTR_ERR(dst);
L
Linus Torvalds 已提交
245
		goto failure;
246
	}
L
Linus Torvalds 已提交
247

248
	if (!saddr) {
249
		saddr = &fl6.saddr;
250
		sk->sk_v6_rcv_saddr = *saddr;
L
Linus Torvalds 已提交
251 252 253
	}

	/* set the source address */
A
Alexey Dobriyan 已提交
254
	np->saddr = *saddr;
E
Eric Dumazet 已提交
255
	inet->inet_rcv_saddr = LOOPBACK4_IPV6;
L
Linus Torvalds 已提交
256

H
Herbert Xu 已提交
257
	sk->sk_gso_type = SKB_GSO_TCPV6;
E
Eric Dumazet 已提交
258
	ip6_dst_store(sk, dst, NULL, NULL);
L
Linus Torvalds 已提交
259

260 261
	if (tcp_death_row.sysctl_tw_recycle &&
	    !tp->rx_opt.ts_recent_stamp &&
262
	    ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
263
		tcp_fetch_timewait_stamp(sk, dst);
264

265
	icsk->icsk_ext_hdr_len = 0;
266 267 268
	if (opt)
		icsk->icsk_ext_hdr_len = opt->opt_flen +
					 opt->opt_nflen;
L
Linus Torvalds 已提交
269 270 271

	tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);

E
Eric Dumazet 已提交
272
	inet->inet_dport = usin->sin6_port;
L
Linus Torvalds 已提交
273 274

	tcp_set_state(sk, TCP_SYN_SENT);
275
	err = inet6_hash_connect(&tcp_death_row, sk);
L
Linus Torvalds 已提交
276 277 278
	if (err)
		goto late_failure;

279
	sk_set_txhash(sk);
280

A
Andrey Vagin 已提交
281
	if (!tp->write_seq && likely(!tp->repair))
L
Linus Torvalds 已提交
282
		tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
283
							     sk->sk_v6_daddr.s6_addr32,
E
Eric Dumazet 已提交
284 285
							     inet->inet_sport,
							     inet->inet_dport);
L
Linus Torvalds 已提交
286 287 288 289 290 291 292 293 294 295 296

	err = tcp_connect(sk);
	if (err)
		goto late_failure;

	return 0;

late_failure:
	tcp_set_state(sk, TCP_CLOSE);
	__sk_dst_reset(sk);
failure:
E
Eric Dumazet 已提交
297
	inet->inet_dport = 0;
L
Linus Torvalds 已提交
298 299 300 301
	sk->sk_route_caps = 0;
	return err;
}

302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318
static void tcp_v6_mtu_reduced(struct sock *sk)
{
	struct dst_entry *dst;

	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
		return;

	dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
	if (!dst)
		return;

	if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
		tcp_sync_mss(sk, dst_mtu(dst));
		tcp_simple_retransmit(sk);
	}
}

L
Linus Torvalds 已提交
319
static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
320
		u8 type, u8 code, int offset, __be32 info)
L
Linus Torvalds 已提交
321
{
W
Weilong Chen 已提交
322
	const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
323
	const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
324 325
	struct net *net = dev_net(skb->dev);
	struct request_sock *fastopen;
L
Linus Torvalds 已提交
326
	struct ipv6_pinfo *np;
327
	struct tcp_sock *tp;
328
	__u32 seq, snd_una;
329
	struct sock *sk;
330
	bool fatal;
331
	int err;
L
Linus Torvalds 已提交
332

333 334 335 336
	sk = __inet6_lookup_established(net, &tcp_hashinfo,
					&hdr->daddr, th->dest,
					&hdr->saddr, ntohs(th->source),
					skb->dev->ifindex);
L
Linus Torvalds 已提交
337

338
	if (!sk) {
339 340
		ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
				   ICMP6_MIB_INERRORS);
L
Linus Torvalds 已提交
341 342 343 344
		return;
	}

	if (sk->sk_state == TCP_TIME_WAIT) {
345
		inet_twsk_put(inet_twsk(sk));
L
Linus Torvalds 已提交
346 347
		return;
	}
348
	seq = ntohl(th->seq);
349
	fatal = icmpv6_err_convert(type, code, &err);
350
	if (sk->sk_state == TCP_NEW_SYN_RECV)
351
		return tcp_req_err(sk, seq, fatal);
L
Linus Torvalds 已提交
352 353

	bh_lock_sock(sk);
354
	if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
355
		NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
L
Linus Torvalds 已提交
356 357 358 359

	if (sk->sk_state == TCP_CLOSE)
		goto out;

360 361 362 363 364
	if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
		goto out;
	}

L
Linus Torvalds 已提交
365
	tp = tcp_sk(sk);
366 367 368
	/* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
	fastopen = tp->fastopen_rsk;
	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
L
Linus Torvalds 已提交
369
	if (sk->sk_state != TCP_LISTEN &&
370
	    !between(seq, snd_una, tp->snd_nxt)) {
371
		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
L
Linus Torvalds 已提交
372 373 374 375 376
		goto out;
	}

	np = inet6_sk(sk);

377 378 379
	if (type == NDISC_REDIRECT) {
		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);

380
		if (dst)
381
			dst->ops->redirect(dst, sk, skb);
382
		goto out;
383 384
	}

L
Linus Torvalds 已提交
385
	if (type == ICMPV6_PKT_TOOBIG) {
386 387 388 389 390 391 392
		/* We are not interested in TCP_LISTEN and open_requests
		 * (SYN-ACKs send out by Linux are always <576bytes so
		 * they should go through unfragmented).
		 */
		if (sk->sk_state == TCP_LISTEN)
			goto out;

393 394 395
		if (!ip6_sk_accept_pmtu(sk))
			goto out;

396 397 398
		tp->mtu_info = ntohl(info);
		if (!sock_owned_by_user(sk))
			tcp_v6_mtu_reduced(sk);
399 400 401
		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
					   &tp->tsq_flags))
			sock_hold(sk);
L
Linus Torvalds 已提交
402 403 404 405
		goto out;
	}


406
	/* Might be for an request_sock */
L
Linus Torvalds 已提交
407 408
	switch (sk->sk_state) {
	case TCP_SYN_SENT:
409 410 411 412
	case TCP_SYN_RECV:
		/* Only in fast or simultaneous open. If a fast open socket is
		 * is already accepted it is treated as a connected one below.
		 */
413
		if (fastopen && !fastopen->sk)
414 415
			break;

L
Linus Torvalds 已提交
416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437
		if (!sock_owned_by_user(sk)) {
			sk->sk_err = err;
			sk->sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */

			tcp_done(sk);
		} else
			sk->sk_err_soft = err;
		goto out;
	}

	if (!sock_owned_by_user(sk) && np->recverr) {
		sk->sk_err = err;
		sk->sk_error_report(sk);
	} else
		sk->sk_err_soft = err;

out:
	bh_unlock_sock(sk);
	sock_put(sk);
}


438
static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
439
			      struct flowi *fl,
440
			      struct request_sock *req,
441 442
			      struct tcp_fastopen_cookie *foc,
			      bool attach_req)
L
Linus Torvalds 已提交
443
{
444
	struct inet_request_sock *ireq = inet_rsk(req);
L
Linus Torvalds 已提交
445
	struct ipv6_pinfo *np = inet6_sk(sk);
446
	struct flowi6 *fl6 = &fl->u.ip6;
W
Weilong Chen 已提交
447
	struct sk_buff *skb;
448
	int err = -ENOMEM;
L
Linus Torvalds 已提交
449

450
	/* First, grab a route. */
451 452
	if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
					       IPPROTO_TCP)) == NULL)
453
		goto done;
454

455
	skb = tcp_make_synack(sk, dst, req, foc, attach_req);
456

L
Linus Torvalds 已提交
457
	if (skb) {
458 459
		__tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
				    &ireq->ir_v6_rmt_addr);
L
Linus Torvalds 已提交
460

461
		fl6->daddr = ireq->ir_v6_rmt_addr;
462
		if (np->repflow && ireq->pktopts)
463 464
			fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));

465
		rcu_read_lock();
466 467
		err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
			       np->tclass);
468
		rcu_read_unlock();
469
		err = net_xmit_eval(err);
L
Linus Torvalds 已提交
470 471 472 473 474 475
	}

done:
	return err;
}

476

477
static void tcp_v6_reqsk_destructor(struct request_sock *req)
L
Linus Torvalds 已提交
478
{
479
	kfree_skb(inet_rsk(req)->pktopts);
L
Linus Torvalds 已提交
480 481
}

482
#ifdef CONFIG_TCP_MD5SIG
483
static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
484
						   const struct in6_addr *addr)
485
{
E
Eric Dumazet 已提交
486
	return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
487 488
}

489
static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
490
						const struct sock *addr_sk)
491
{
492
	return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
493 494
}

W
Wang Yufen 已提交
495 496
static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
				 int optlen)
497 498 499 500 501 502 503 504 505 506 507 508 509 510
{
	struct tcp_md5sig cmd;
	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;

	if (optlen < sizeof(cmd))
		return -EINVAL;

	if (copy_from_user(&cmd, optval, sizeof(cmd)))
		return -EFAULT;

	if (sin6->sin6_family != AF_INET6)
		return -EINVAL;

	if (!cmd.tcpm_keylen) {
B
Brian Haley 已提交
511
		if (ipv6_addr_v4mapped(&sin6->sin6_addr))
E
Eric Dumazet 已提交
512 513 514 515
			return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
					      AF_INET);
		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
				      AF_INET6);
516 517 518 519 520
	}

	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
		return -EINVAL;

E
Eric Dumazet 已提交
521 522 523
	if (ipv6_addr_v4mapped(&sin6->sin6_addr))
		return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
				      AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
524

E
Eric Dumazet 已提交
525 526
	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
			      AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
527 528
}

529
static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
530 531
					const struct in6_addr *daddr,
					const struct in6_addr *saddr, int nbytes)
532 533
{
	struct tcp6_pseudohdr *bp;
534
	struct scatterlist sg;
535

536 537
	bp = &hp->md5_blk.ip6;
	/* 1. TCP pseudo-header (RFC2460) */
A
Alexey Dobriyan 已提交
538 539
	bp->saddr = *saddr;
	bp->daddr = *daddr;
540
	bp->protocol = cpu_to_be32(IPPROTO_TCP);
A
Adam Langley 已提交
541
	bp->len = cpu_to_be32(nbytes);
542

543 544 545
	sg_init_one(&sg, bp, sizeof(*bp));
	return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
}
546

547
static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
548
			       const struct in6_addr *daddr, struct in6_addr *saddr,
E
Eric Dumazet 已提交
549
			       const struct tcphdr *th)
550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567
{
	struct tcp_md5sig_pool *hp;
	struct hash_desc *desc;

	hp = tcp_get_md5sig_pool();
	if (!hp)
		goto clear_hash_noput;
	desc = &hp->md5_desc;

	if (crypto_hash_init(desc))
		goto clear_hash;
	if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
		goto clear_hash;
	if (tcp_md5_hash_header(hp, th))
		goto clear_hash;
	if (tcp_md5_hash_key(hp, key))
		goto clear_hash;
	if (crypto_hash_final(desc, md5_hash))
568 569 570 571
		goto clear_hash;

	tcp_put_md5sig_pool();
	return 0;
572

573 574 575 576
clear_hash:
	tcp_put_md5sig_pool();
clear_hash_noput:
	memset(md5_hash, 0, 16);
577
	return 1;
578 579
}

580 581
static int tcp_v6_md5_hash_skb(char *md5_hash,
			       const struct tcp_md5sig_key *key,
E
Eric Dumazet 已提交
582 583
			       const struct sock *sk,
			       const struct sk_buff *skb)
584
{
585
	const struct in6_addr *saddr, *daddr;
586 587
	struct tcp_md5sig_pool *hp;
	struct hash_desc *desc;
E
Eric Dumazet 已提交
588
	const struct tcphdr *th = tcp_hdr(skb);
589

590 591
	if (sk) { /* valid for establish/request sockets */
		saddr = &sk->sk_v6_rcv_saddr;
592
		daddr = &sk->sk_v6_daddr;
593
	} else {
594
		const struct ipv6hdr *ip6h = ipv6_hdr(skb);
595 596
		saddr = &ip6h->saddr;
		daddr = &ip6h->daddr;
597
	}
598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625

	hp = tcp_get_md5sig_pool();
	if (!hp)
		goto clear_hash_noput;
	desc = &hp->md5_desc;

	if (crypto_hash_init(desc))
		goto clear_hash;

	if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
		goto clear_hash;
	if (tcp_md5_hash_header(hp, th))
		goto clear_hash;
	if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
		goto clear_hash;
	if (tcp_md5_hash_key(hp, key))
		goto clear_hash;
	if (crypto_hash_final(desc, md5_hash))
		goto clear_hash;

	tcp_put_md5sig_pool();
	return 0;

clear_hash:
	tcp_put_md5sig_pool();
clear_hash_noput:
	memset(md5_hash, 0, 16);
	return 1;
626 627
}

628 629 630 631
#endif

static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
				    const struct sk_buff *skb)
632
{
633
#ifdef CONFIG_TCP_MD5SIG
634
	const __u8 *hash_location = NULL;
635
	struct tcp_md5sig_key *hash_expected;
636
	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
E
Eric Dumazet 已提交
637
	const struct tcphdr *th = tcp_hdr(skb);
638 639 640 641
	int genhash;
	u8 newhash[16];

	hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
642
	hash_location = tcp_parse_md5sig_option(th);
643

644 645
	/* We've parsed the options - do we have a hash? */
	if (!hash_expected && !hash_location)
646
		return false;
647 648 649

	if (hash_expected && !hash_location) {
		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
650
		return true;
651 652
	}

653 654
	if (!hash_expected && hash_location) {
		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
655
		return true;
656 657 658
	}

	/* check the signature */
659 660
	genhash = tcp_v6_md5_hash_skb(newhash,
				      hash_expected,
661
				      NULL, skb);
662

663
	if (genhash || memcmp(hash_location, newhash, 16) != 0) {
664 665 666 667
		net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
				     genhash ? "failed" : "mismatch",
				     &ip6h->saddr, ntohs(th->source),
				     &ip6h->daddr, ntohs(th->dest));
668
		return true;
669
	}
670
#endif
671
	return false;
672 673
}

674 675
static void tcp_v6_init_req(struct request_sock *req,
			    const struct sock *sk_listener,
676 677 678
			    struct sk_buff *skb)
{
	struct inet_request_sock *ireq = inet_rsk(req);
679
	const struct ipv6_pinfo *np = inet6_sk(sk_listener);
680 681 682 683 684

	ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;

	/* So that link locals have meaning */
685
	if (!sk_listener->sk_bound_dev_if &&
686
	    ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
E
Eric Dumazet 已提交
687
		ireq->ir_iif = tcp_v6_iif(skb);
688

689
	if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
690
	    (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
691
	     np->rxopt.bits.rxinfo ||
692 693 694 695 696 697 698
	     np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
	     np->rxopt.bits.rxohlim || np->repflow)) {
		atomic_inc(&skb->users);
		ireq->pktopts = skb;
	}
}

699 700
static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
					  struct flowi *fl,
701 702 703 704 705
					  const struct request_sock *req,
					  bool *strict)
{
	if (strict)
		*strict = true;
706
	return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
707 708
}

709
struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
L
Linus Torvalds 已提交
710
	.family		=	AF_INET6,
711
	.obj_size	=	sizeof(struct tcp6_request_sock),
712
	.rtx_syn_ack	=	tcp_rtx_synack,
713 714
	.send_ack	=	tcp_v6_reqsk_send_ack,
	.destructor	=	tcp_v6_reqsk_destructor,
715
	.send_reset	=	tcp_v6_send_reset,
W
Wang Yufen 已提交
716
	.syn_ack_timeout =	tcp_syn_ack_timeout,
L
Linus Torvalds 已提交
717 718
};

719
static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
720 721
	.mss_clamp	=	IPV6_MIN_MTU - sizeof(struct tcphdr) -
				sizeof(struct ipv6hdr),
722
#ifdef CONFIG_TCP_MD5SIG
723
	.req_md5_lookup	=	tcp_v6_md5_lookup,
724
	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
725
#endif
726
	.init_req	=	tcp_v6_init_req,
727 728 729
#ifdef CONFIG_SYN_COOKIES
	.cookie_init_seq =	cookie_v6_init_sequence,
#endif
730
	.route_req	=	tcp_v6_route_req,
731
	.init_seq	=	tcp_v6_init_sequence,
732
	.send_synack	=	tcp_v6_send_synack,
733
};
734

735
static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
736 737 738
				 u32 ack, u32 win, u32 tsval, u32 tsecr,
				 int oif, struct tcp_md5sig_key *key, int rst,
				 u8 tclass, u32 label)
L
Linus Torvalds 已提交
739
{
740 741
	const struct tcphdr *th = tcp_hdr(skb);
	struct tcphdr *t1;
L
Linus Torvalds 已提交
742
	struct sk_buff *buff;
743
	struct flowi6 fl6;
744
	struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
745
	struct sock *ctl_sk = net->ipv6.tcp_sk;
746
	unsigned int tot_len = sizeof(struct tcphdr);
E
Eric Dumazet 已提交
747
	struct dst_entry *dst;
748
	__be32 *topt;
L
Linus Torvalds 已提交
749

750
	if (tsecr)
751
		tot_len += TCPOLEN_TSTAMP_ALIGNED;
752 753 754 755 756 757
#ifdef CONFIG_TCP_MD5SIG
	if (key)
		tot_len += TCPOLEN_MD5SIG_ALIGNED;
#endif

	buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
L
Linus Torvalds 已提交
758
			 GFP_ATOMIC);
759
	if (!buff)
760
		return;
L
Linus Torvalds 已提交
761

762
	skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
L
Linus Torvalds 已提交
763

764
	t1 = (struct tcphdr *) skb_push(buff, tot_len);
765
	skb_reset_transport_header(buff);
L
Linus Torvalds 已提交
766 767 768 769 770

	/* Swap the send and the receive. */
	memset(t1, 0, sizeof(*t1));
	t1->dest = th->source;
	t1->source = th->dest;
771
	t1->doff = tot_len / 4;
772 773 774 775 776
	t1->seq = htonl(seq);
	t1->ack_seq = htonl(ack);
	t1->ack = !rst || !th->ack;
	t1->rst = rst;
	t1->window = htons(win);
L
Linus Torvalds 已提交
777

778 779
	topt = (__be32 *)(t1 + 1);

780
	if (tsecr) {
781 782
		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
				(TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
783 784
		*topt++ = htonl(tsval);
		*topt++ = htonl(tsecr);
785 786
	}

787 788
#ifdef CONFIG_TCP_MD5SIG
	if (key) {
789 790 791
		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
				(TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
		tcp_v6_md5_hash_hdr((__u8 *)topt, key,
792 793
				    &ipv6_hdr(skb)->saddr,
				    &ipv6_hdr(skb)->daddr, t1);
794 795 796
	}
#endif

797
	memset(&fl6, 0, sizeof(fl6));
A
Alexey Dobriyan 已提交
798 799
	fl6.daddr = ipv6_hdr(skb)->saddr;
	fl6.saddr = ipv6_hdr(skb)->daddr;
800
	fl6.flowlabel = label;
L
Linus Torvalds 已提交
801

802 803 804
	buff->ip_summed = CHECKSUM_PARTIAL;
	buff->csum = 0;

805
	__tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
L
Linus Torvalds 已提交
806

807
	fl6.flowi6_proto = IPPROTO_TCP;
808
	if (rt6_need_strict(&fl6.daddr) && !oif)
E
Eric Dumazet 已提交
809
		fl6.flowi6_oif = tcp_v6_iif(skb);
W
Wang Yufen 已提交
810 811
	else
		fl6.flowi6_oif = oif;
812
	fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
813 814
	fl6.fl6_dport = t1->dest;
	fl6.fl6_sport = t1->source;
815
	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
L
Linus Torvalds 已提交
816

817 818 819 820
	/* Pass a socket to ip6_dst_lookup either it is for RST
	 * Underlying function will use this to retrieve the network
	 * namespace
	 */
821
	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
822 823
	if (!IS_ERR(dst)) {
		skb_dst_set(buff, dst);
824
		ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
825 826 827 828
		TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
		if (rst)
			TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
		return;
L
Linus Torvalds 已提交
829 830 831 832 833
	}

	kfree_skb(buff);
}

834
static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
835
{
836
	const struct tcphdr *th = tcp_hdr(skb);
837
	u32 seq = 0, ack_seq = 0;
838
	struct tcp_md5sig_key *key = NULL;
839 840 841 842 843 844 845
#ifdef CONFIG_TCP_MD5SIG
	const __u8 *hash_location = NULL;
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
	unsigned char newhash[16];
	int genhash;
	struct sock *sk1 = NULL;
#endif
W
Wang Yufen 已提交
846
	int oif;
L
Linus Torvalds 已提交
847

848
	if (th->rst)
L
Linus Torvalds 已提交
849 850
		return;

851 852 853 854
	/* If sk not NULL, it means we did a successful lookup and incoming
	 * route had to be correct. prequeue might have dropped our dst.
	 */
	if (!sk && !ipv6_unicast_destination(skb))
855
		return;
L
Linus Torvalds 已提交
856

857
#ifdef CONFIG_TCP_MD5SIG
858
	hash_location = tcp_parse_md5sig_option(th);
859
	if (sk && sk_fullsock(sk)) {
860 861
		key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
	} else if (hash_location) {
862 863 864 865 866 867 868 869
		/*
		 * active side is lost. Try to find listening socket through
		 * source port, and then find md5 key through listening socket.
		 * we are not loose security here:
		 * Incoming packet is checked with md5 hash with finding key,
		 * no RST generated if md5 hash doesn't match.
		 */
		sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
870 871
					   &tcp_hashinfo, &ipv6h->saddr,
					   th->source, &ipv6h->daddr,
E
Eric Dumazet 已提交
872
					   ntohs(th->source), tcp_v6_iif(skb));
873 874 875 876 877 878 879 880
		if (!sk1)
			return;

		rcu_read_lock();
		key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
		if (!key)
			goto release_sk1;

881
		genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
882 883 884
		if (genhash || memcmp(hash_location, newhash, 16) != 0)
			goto release_sk1;
	}
885 886
#endif

887 888 889 890 891
	if (th->ack)
		seq = ntohl(th->ack_seq);
	else
		ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
			  (th->doff << 2);
L
Linus Torvalds 已提交
892

W
Wang Yufen 已提交
893
	oif = sk ? sk->sk_bound_dev_if : 0;
894
	tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
895 896 897 898 899 900 901 902

#ifdef CONFIG_TCP_MD5SIG
release_sk1:
	if (sk1) {
		rcu_read_unlock();
		sock_put(sk1);
	}
#endif
903
}
L
Linus Torvalds 已提交
904

905
static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
906
			    u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
907 908
			    struct tcp_md5sig_key *key, u8 tclass,
			    u32 label)
909
{
910 911
	tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
			     tclass, label);
L
Linus Torvalds 已提交
912 913 914 915
}

static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
{
916
	struct inet_timewait_sock *tw = inet_twsk(sk);
917
	struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
L
Linus Torvalds 已提交
918

919
	tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
920
			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
921
			tcp_time_stamp + tcptw->tw_ts_offset,
W
Wang Yufen 已提交
922
			tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
923
			tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
L
Linus Torvalds 已提交
924

925
	inet_twsk_put(tw);
L
Linus Torvalds 已提交
926 927
}

928
static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
929
				  struct request_sock *req)
L
Linus Torvalds 已提交
930
{
931 932 933
	/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
	 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
	 */
934
	tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
935
			tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
936
			tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
937
			tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
938 939
			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
			0, 0);
L
Linus Torvalds 已提交
940 941 942
}


943
static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
944
{
945
#ifdef CONFIG_SYN_COOKIES
946
	const struct tcphdr *th = tcp_hdr(skb);
L
Linus Torvalds 已提交
947

948
	if (!th->syn)
949
		sk = cookie_v6_check(sk, skb);
L
Linus Torvalds 已提交
950 951 952 953 954 955 956 957 958 959
#endif
	return sk;
}

static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
{
	if (skb->protocol == htons(ETH_P_IP))
		return tcp_v4_conn_request(sk, skb);

	if (!ipv6_unicast_destination(skb))
960
		goto drop;
L
Linus Torvalds 已提交
961

O
Octavian Purdila 已提交
962 963
	return tcp_conn_request(&tcp6_request_sock_ops,
				&tcp_request_sock_ipv6_ops, sk, skb);
L
Linus Torvalds 已提交
964 965

drop:
966
	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
L
Linus Torvalds 已提交
967 968 969
	return 0; /* don't send reset */
}

970
static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
W
Weilong Chen 已提交
971
					 struct request_sock *req,
972 973 974
					 struct dst_entry *dst,
					 struct request_sock *req_unhash,
					 bool *own_req)
L
Linus Torvalds 已提交
975
{
976
	struct inet_request_sock *ireq;
977 978
	struct ipv6_pinfo *newnp;
	const struct ipv6_pinfo *np = inet6_sk(sk);
979
	struct ipv6_txoptions *opt;
L
Linus Torvalds 已提交
980 981 982 983
	struct tcp6_sock *newtcp6sk;
	struct inet_sock *newinet;
	struct tcp_sock *newtp;
	struct sock *newsk;
984 985 986
#ifdef CONFIG_TCP_MD5SIG
	struct tcp_md5sig_key *key;
#endif
987
	struct flowi6 fl6;
L
Linus Torvalds 已提交
988 989 990 991 992 993

	if (skb->protocol == htons(ETH_P_IP)) {
		/*
		 *	v6 mapped
		 */

994 995
		newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
					     req_unhash, own_req);
L
Linus Torvalds 已提交
996

997
		if (!newsk)
L
Linus Torvalds 已提交
998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008
			return NULL;

		newtcp6sk = (struct tcp6_sock *)newsk;
		inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;

		newinet = inet_sk(newsk);
		newnp = inet6_sk(newsk);
		newtp = tcp_sk(newsk);

		memcpy(newnp, np, sizeof(struct ipv6_pinfo));

1009
		newnp->saddr = newsk->sk_v6_rcv_saddr;
L
Linus Torvalds 已提交
1010

1011
		inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
L
Linus Torvalds 已提交
1012
		newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1013 1014 1015 1016
#ifdef CONFIG_TCP_MD5SIG
		newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
#endif

1017 1018
		newnp->ipv6_ac_list = NULL;
		newnp->ipv6_fl_list = NULL;
L
Linus Torvalds 已提交
1019 1020
		newnp->pktoptions  = NULL;
		newnp->opt	   = NULL;
E
Eric Dumazet 已提交
1021
		newnp->mcast_oif   = tcp_v6_iif(skb);
1022
		newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1023
		newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1024 1025
		if (np->repflow)
			newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
L
Linus Torvalds 已提交
1026

1027 1028 1029 1030
		/*
		 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
		 * here, tcp_create_openreq_child now does this for us, see the comment in
		 * that function for the gory details. -acme
L
Linus Torvalds 已提交
1031 1032 1033
		 */

		/* It is tricky place. Until this moment IPv4 tcp
1034
		   worked with IPv6 icsk.icsk_af_ops.
L
Linus Torvalds 已提交
1035 1036
		   Sync it now.
		 */
1037
		tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
L
Linus Torvalds 已提交
1038 1039 1040 1041

		return newsk;
	}

1042
	ireq = inet_rsk(req);
L
Linus Torvalds 已提交
1043 1044 1045 1046

	if (sk_acceptq_is_full(sk))
		goto out_overflow;

1047
	if (!dst) {
1048
		dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1049
		if (!dst)
L
Linus Torvalds 已提交
1050
			goto out;
1051
	}
L
Linus Torvalds 已提交
1052 1053

	newsk = tcp_create_openreq_child(sk, req, skb);
1054
	if (!newsk)
1055
		goto out_nonewsk;
L
Linus Torvalds 已提交
1056

1057 1058 1059 1060 1061
	/*
	 * No need to charge this sock to the relevant IPv6 refcnt debug socks
	 * count here, tcp_create_openreq_child now does this for us, see the
	 * comment in that function for the gory details. -acme
	 */
L
Linus Torvalds 已提交
1062

1063
	newsk->sk_gso_type = SKB_GSO_TCPV6;
E
Eric Dumazet 已提交
1064
	ip6_dst_store(newsk, dst, NULL, NULL);
1065
	inet6_sk_rx_dst_set(newsk, skb);
L
Linus Torvalds 已提交
1066 1067 1068 1069 1070 1071 1072 1073 1074 1075

	newtcp6sk = (struct tcp6_sock *)newsk;
	inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;

	newtp = tcp_sk(newsk);
	newinet = inet_sk(newsk);
	newnp = inet6_sk(newsk);

	memcpy(newnp, np, sizeof(struct ipv6_pinfo));

1076 1077 1078 1079
	newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
	newnp->saddr = ireq->ir_v6_loc_addr;
	newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
	newsk->sk_bound_dev_if = ireq->ir_iif;
L
Linus Torvalds 已提交
1080

1081
	/* Now IPv6 options...
L
Linus Torvalds 已提交
1082 1083 1084

	   First: no IPv4 options.
	 */
1085
	newinet->inet_opt = NULL;
1086
	newnp->ipv6_ac_list = NULL;
1087
	newnp->ipv6_fl_list = NULL;
L
Linus Torvalds 已提交
1088 1089 1090 1091 1092 1093

	/* Clone RX bits */
	newnp->rxopt.all = np->rxopt.all;

	newnp->pktoptions = NULL;
	newnp->opt	  = NULL;
E
Eric Dumazet 已提交
1094
	newnp->mcast_oif  = tcp_v6_iif(skb);
1095
	newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1096
	newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1097 1098
	if (np->repflow)
		newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
L
Linus Torvalds 已提交
1099 1100 1101 1102 1103 1104 1105

	/* Clone native IPv6 options from listening socket (if any)

	   Yes, keeping reference count would be much more clever,
	   but we make one more one thing there: reattach optmem
	   to newsk.
	 */
1106 1107 1108 1109 1110
	opt = rcu_dereference(np->opt);
	if (opt) {
		opt = ipv6_dup_options(newsk, opt);
		RCU_INIT_POINTER(newnp->opt, opt);
	}
1111
	inet_csk(newsk)->icsk_ext_hdr_len = 0;
1112 1113 1114
	if (opt)
		inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
						    opt->opt_flen;
L
Linus Torvalds 已提交
1115

1116 1117
	tcp_ca_openreq_child(newsk, dst);

L
Linus Torvalds 已提交
1118
	tcp_sync_mss(newsk, dst_mtu(dst));
1119
	newtp->advmss = dst_metric_advmss(dst);
1120 1121 1122 1123
	if (tcp_sk(sk)->rx_opt.user_mss &&
	    tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
		newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;

L
Linus Torvalds 已提交
1124 1125
	tcp_initialize_rcv_mss(newsk);

E
Eric Dumazet 已提交
1126 1127
	newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
	newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
L
Linus Torvalds 已提交
1128

1129 1130
#ifdef CONFIG_TCP_MD5SIG
	/* Copy over the MD5 key from the original socket */
W
Wang Yufen 已提交
1131
	key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1132
	if (key) {
1133 1134 1135 1136 1137
		/* We're using one, so create a matching key
		 * on the newsk structure. If we fail to get
		 * memory, then we end up not copying the key
		 * across. Shucks.
		 */
1138
		tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1139
			       AF_INET6, key->key, key->keylen,
1140
			       sk_gfp_mask(sk, GFP_ATOMIC));
1141 1142 1143
	}
#endif

1144
	if (__inet_inherit_port(sk, newsk) < 0) {
1145 1146
		inet_csk_prepare_forced_close(newsk);
		tcp_done(newsk);
1147 1148
		goto out;
	}
1149
	*own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
E
Eric Dumazet 已提交
1150
	if (*own_req) {
1151
		tcp_move_syn(newtp, req);
E
Eric Dumazet 已提交
1152 1153 1154 1155

		/* Clone pktoptions received with SYN, if we own the req */
		if (ireq->pktopts) {
			newnp->pktoptions = skb_clone(ireq->pktopts,
1156
						      sk_gfp_mask(sk, GFP_ATOMIC));
E
Eric Dumazet 已提交
1157 1158 1159 1160 1161
			consume_skb(ireq->pktopts);
			ireq->pktopts = NULL;
			if (newnp->pktoptions)
				skb_set_owner_r(newnp->pktoptions, newsk);
		}
E
Eric Dumazet 已提交
1162
	}
L
Linus Torvalds 已提交
1163 1164 1165 1166

	return newsk;

out_overflow:
1167
	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1168
out_nonewsk:
L
Linus Torvalds 已提交
1169
	dst_release(dst);
1170 1171
out:
	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
L
Linus Torvalds 已提交
1172 1173 1174 1175
	return NULL;
}

/* The socket must have it's spinlock held when we get
1176
 * here, unless it is a TCP_LISTEN socket.
L
Linus Torvalds 已提交
1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199
 *
 * We have a potential double-lock case here, so even when
 * doing backlog processing we use the BH locking scheme.
 * This is because we cannot sleep with the original spinlock
 * held.
 */
static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct tcp_sock *tp;
	struct sk_buff *opt_skb = NULL;

	/* Imagine: socket is IPv6. IPv4 packet arrives,
	   goes to IPv4 receive handler and backlogged.
	   From backlog it always goes here. Kerboom...
	   Fortunately, tcp_rcv_established and rcv_established
	   handle them correctly, but it is not case with
	   tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
	 */

	if (skb->protocol == htons(ETH_P_IP))
		return tcp_v4_do_rcv(sk, skb);

1200
	if (sk_filter(sk, skb))
L
Linus Torvalds 已提交
1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218
		goto discard;

	/*
	 *	socket locking is here for SMP purposes as backlog rcv
	 *	is currently called with bh processing disabled.
	 */

	/* Do Stevens' IPV6_PKTOPTIONS.

	   Yes, guys, it is the only place in our code, where we
	   may make it not affecting IPv4.
	   The rest of code is protocol independent,
	   and I do not like idea to uglify IPv4.

	   Actually, all the idea behind IPV6_PKTOPTIONS
	   looks not very well thought. For now we latch
	   options, received in the last packet, enqueued
	   by tcp. Feel free to propose better solution.
1219
					       --ANK (980728)
L
Linus Torvalds 已提交
1220 1221
	 */
	if (np->rxopt.all)
1222
		opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
L
Linus Torvalds 已提交
1223 1224

	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
E
Eric Dumazet 已提交
1225 1226
		struct dst_entry *dst = sk->sk_rx_dst;

1227
		sock_rps_save_rxhash(sk, skb);
1228
		sk_mark_napi_id(sk, skb);
E
Eric Dumazet 已提交
1229 1230 1231 1232 1233 1234 1235 1236
		if (dst) {
			if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
			    dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
				dst_release(dst);
				sk->sk_rx_dst = NULL;
			}
		}

1237
		tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
L
Linus Torvalds 已提交
1238 1239 1240 1241 1242
		if (opt_skb)
			goto ipv6_pktoptions;
		return 0;
	}

E
Eric Dumazet 已提交
1243
	if (tcp_checksum_complete(skb))
L
Linus Torvalds 已提交
1244 1245
		goto csum_err;

1246
	if (sk->sk_state == TCP_LISTEN) {
1247 1248
		struct sock *nsk = tcp_v6_cookie_check(sk, skb);

L
Linus Torvalds 已提交
1249 1250 1251
		if (!nsk)
			goto discard;

W
Weilong Chen 已提交
1252
		if (nsk != sk) {
1253
			sock_rps_save_rxhash(nsk, skb);
1254
			sk_mark_napi_id(nsk, skb);
L
Linus Torvalds 已提交
1255 1256 1257 1258 1259 1260
			if (tcp_child_process(sk, nsk, skb))
				goto reset;
			if (opt_skb)
				__kfree_skb(opt_skb);
			return 0;
		}
1261
	} else
1262
		sock_rps_save_rxhash(sk, skb);
L
Linus Torvalds 已提交
1263

1264
	if (tcp_rcv_state_process(sk, skb))
L
Linus Torvalds 已提交
1265 1266 1267 1268 1269 1270
		goto reset;
	if (opt_skb)
		goto ipv6_pktoptions;
	return 0;

reset:
1271
	tcp_v6_send_reset(sk, skb);
L
Linus Torvalds 已提交
1272 1273 1274 1275 1276 1277
discard:
	if (opt_skb)
		__kfree_skb(opt_skb);
	kfree_skb(skb);
	return 0;
csum_err:
1278
	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1279
	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
L
Linus Torvalds 已提交
1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293
	goto discard;


ipv6_pktoptions:
	/* Do you ask, what is it?

	   1. skb was enqueued by tcp.
	   2. skb is added to tail of read queue, rather than out of order.
	   3. socket is not in passive state.
	   4. Finally, it really contains options, which user wants to receive.
	 */
	tp = tcp_sk(sk);
	if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
	    !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1294
		if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
E
Eric Dumazet 已提交
1295
			np->mcast_oif = tcp_v6_iif(opt_skb);
1296
		if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1297
			np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1298
		if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1299
			np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1300 1301
		if (np->repflow)
			np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1302
		if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
L
Linus Torvalds 已提交
1303 1304 1305 1306 1307 1308 1309 1310
			skb_set_owner_r(opt_skb, sk);
			opt_skb = xchg(&np->pktoptions, opt_skb);
		} else {
			__kfree_skb(opt_skb);
			opt_skb = xchg(&np->pktoptions, NULL);
		}
	}

1311
	kfree_skb(opt_skb);
L
Linus Torvalds 已提交
1312 1313 1314
	return 0;
}

1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336
static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
			   const struct tcphdr *th)
{
	/* This is tricky: we move IP6CB at its correct location into
	 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
	 * _decode_session6() uses IP6CB().
	 * barrier() makes sure compiler won't play aliasing games.
	 */
	memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
		sizeof(struct inet6_skb_parm));
	barrier();

	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
				    skb->len - th->doff*4);
	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
	TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
	TCP_SKB_CB(skb)->tcp_tw_isn = 0;
	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
	TCP_SKB_CB(skb)->sacked = 0;
}

1337 1338 1339 1340 1341 1342 1343 1344 1345
static void tcp_v6_restore_cb(struct sk_buff *skb)
{
	/* We need to move header back to the beginning if xfrm6_policy_check()
	 * and tcp_v6_fill_cb() are going to be called again.
	 */
	memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
		sizeof(struct inet6_skb_parm));
}

1346
static int tcp_v6_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
1347
{
1348
	const struct tcphdr *th;
1349
	const struct ipv6hdr *hdr;
L
Linus Torvalds 已提交
1350 1351
	struct sock *sk;
	int ret;
1352
	struct net *net = dev_net(skb->dev);
L
Linus Torvalds 已提交
1353 1354 1355 1356 1357 1358 1359

	if (skb->pkt_type != PACKET_HOST)
		goto discard_it;

	/*
	 *	Count it even if it's bad.
	 */
1360
	TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
L
Linus Torvalds 已提交
1361 1362 1363 1364

	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
		goto discard_it;

1365
	th = tcp_hdr(skb);
L
Linus Torvalds 已提交
1366 1367 1368 1369 1370 1371

	if (th->doff < sizeof(struct tcphdr)/4)
		goto bad_packet;
	if (!pskb_may_pull(skb, th->doff*4))
		goto discard_it;

1372
	if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1373
		goto csum_error;
L
Linus Torvalds 已提交
1374

1375
	th = tcp_hdr(skb);
1376
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
1377

1378
lookup:
E
Eric Dumazet 已提交
1379
	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1380
				inet6_iif(skb));
L
Linus Torvalds 已提交
1381 1382 1383 1384 1385 1386 1387
	if (!sk)
		goto no_tcp_socket;

process:
	if (sk->sk_state == TCP_TIME_WAIT)
		goto do_time_wait;

1388 1389
	if (sk->sk_state == TCP_NEW_SYN_RECV) {
		struct request_sock *req = inet_reqsk(sk);
1390
		struct sock *nsk;
1391 1392 1393 1394 1395 1396 1397

		sk = req->rsk_listener;
		tcp_v6_fill_cb(skb, hdr, th);
		if (tcp_v6_inbound_md5_hash(sk, skb)) {
			reqsk_put(req);
			goto discard_it;
		}
1398
		if (unlikely(sk->sk_state != TCP_LISTEN)) {
1399
			inet_csk_reqsk_queue_drop_and_put(sk, req);
1400 1401
			goto lookup;
		}
1402 1403
		sock_hold(sk);
		nsk = tcp_check_req(sk, skb, req, false);
1404 1405
		if (!nsk) {
			reqsk_put(req);
1406
			goto discard_and_relse;
1407 1408 1409 1410 1411 1412
		}
		if (nsk == sk) {
			reqsk_put(req);
			tcp_v6_restore_cb(skb);
		} else if (tcp_child_process(sk, nsk, skb)) {
			tcp_v6_send_reset(nsk, skb);
1413
			goto discard_and_relse;
1414
		} else {
1415
			sock_put(sk);
1416 1417 1418
			return 0;
		}
	}
1419 1420 1421 1422 1423
	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
		goto discard_and_relse;
	}

L
Linus Torvalds 已提交
1424 1425 1426
	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
		goto discard_and_relse;

1427 1428
	tcp_v6_fill_cb(skb, hdr, th);

1429 1430 1431
	if (tcp_v6_inbound_md5_hash(sk, skb))
		goto discard_and_relse;

1432
	if (sk_filter(sk, skb))
L
Linus Torvalds 已提交
1433 1434 1435 1436
		goto discard_and_relse;

	skb->dev = NULL;

1437 1438 1439 1440 1441 1442 1443
	if (sk->sk_state == TCP_LISTEN) {
		ret = tcp_v6_do_rcv(sk, skb);
		goto put_and_return;
	}

	sk_incoming_cpu_update(sk);

1444
	bh_lock_sock_nested(sk);
1445
	tcp_sk(sk)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
L
Linus Torvalds 已提交
1446 1447
	ret = 0;
	if (!sock_owned_by_user(sk)) {
D
Dan Williams 已提交
1448
		if (!tcp_prequeue(sk, skb))
1449
			ret = tcp_v6_do_rcv(sk, skb);
1450 1451
	} else if (unlikely(sk_add_backlog(sk, skb,
					   sk->sk_rcvbuf + sk->sk_sndbuf))) {
Z
Zhu Yi 已提交
1452
		bh_unlock_sock(sk);
1453
		NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
Z
Zhu Yi 已提交
1454 1455
		goto discard_and_relse;
	}
L
Linus Torvalds 已提交
1456 1457
	bh_unlock_sock(sk);

1458
put_and_return:
L
Linus Torvalds 已提交
1459 1460 1461 1462 1463 1464 1465
	sock_put(sk);
	return ret ? -1 : 0;

no_tcp_socket:
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
		goto discard_it;

1466 1467
	tcp_v6_fill_cb(skb, hdr, th);

E
Eric Dumazet 已提交
1468
	if (tcp_checksum_complete(skb)) {
1469 1470
csum_error:
		TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
L
Linus Torvalds 已提交
1471
bad_packet:
1472
		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
L
Linus Torvalds 已提交
1473
	} else {
1474
		tcp_v6_send_reset(NULL, skb);
L
Linus Torvalds 已提交
1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486
	}

discard_it:
	kfree_skb(skb);
	return 0;

discard_and_relse:
	sock_put(sk);
	goto discard_it;

do_time_wait:
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1487
		inet_twsk_put(inet_twsk(sk));
L
Linus Torvalds 已提交
1488 1489 1490
		goto discard_it;
	}

1491 1492
	tcp_v6_fill_cb(skb, hdr, th);

1493 1494 1495
	if (tcp_checksum_complete(skb)) {
		inet_twsk_put(inet_twsk(sk));
		goto csum_error;
L
Linus Torvalds 已提交
1496 1497
	}

1498
	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
L
Linus Torvalds 已提交
1499 1500 1501 1502
	case TCP_TW_SYN:
	{
		struct sock *sk2;

1503
		sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1504
					    &ipv6_hdr(skb)->saddr, th->source,
1505
					    &ipv6_hdr(skb)->daddr,
E
Eric Dumazet 已提交
1506
					    ntohs(th->dest), tcp_v6_iif(skb));
1507
		if (sk2) {
1508
			struct inet_timewait_sock *tw = inet_twsk(sk);
1509
			inet_twsk_deschedule_put(tw);
L
Linus Torvalds 已提交
1510
			sk = sk2;
1511
			tcp_v6_restore_cb(skb);
L
Linus Torvalds 已提交
1512 1513 1514 1515 1516 1517 1518 1519
			goto process;
		}
		/* Fall through to ACK */
	}
	case TCP_TW_ACK:
		tcp_v6_timewait_ack(sk, skb);
		break;
	case TCP_TW_RST:
1520
		tcp_v6_restore_cb(skb);
1521 1522 1523
		tcp_v6_send_reset(sk, skb);
		inet_twsk_deschedule_put(inet_twsk(sk));
		goto discard_it;
W
Wang Yufen 已提交
1524 1525
	case TCP_TW_SUCCESS:
		;
L
Linus Torvalds 已提交
1526 1527 1528 1529
	}
	goto discard_it;
}

E
Eric Dumazet 已提交
1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547
static void tcp_v6_early_demux(struct sk_buff *skb)
{
	const struct ipv6hdr *hdr;
	const struct tcphdr *th;
	struct sock *sk;

	if (skb->pkt_type != PACKET_HOST)
		return;

	if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
		return;

	hdr = ipv6_hdr(skb);
	th = tcp_hdr(skb);

	if (th->doff < sizeof(struct tcphdr) / 4)
		return;

E
Eric Dumazet 已提交
1548
	/* Note : We use inet6_iif() here, not tcp_v6_iif() */
E
Eric Dumazet 已提交
1549 1550 1551 1552 1553 1554 1555
	sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
					&hdr->saddr, th->source,
					&hdr->daddr, ntohs(th->dest),
					inet6_iif(skb));
	if (sk) {
		skb->sk = sk;
		skb->destructor = sock_edemux;
1556
		if (sk_fullsock(sk)) {
1557
			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1558

E
Eric Dumazet 已提交
1559
			if (dst)
E
Eric Dumazet 已提交
1560
				dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
E
Eric Dumazet 已提交
1561
			if (dst &&
1562
			    inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
E
Eric Dumazet 已提交
1563 1564 1565 1566 1567
				skb_dst_set_noref(skb, dst);
		}
	}
}

1568 1569 1570
static struct timewait_sock_ops tcp6_timewait_sock_ops = {
	.twsk_obj_size	= sizeof(struct tcp6_timewait_sock),
	.twsk_unique	= tcp_twsk_unique,
W
Wang Yufen 已提交
1571
	.twsk_destructor = tcp_twsk_destructor,
1572 1573
};

1574
static const struct inet_connection_sock_af_ops ipv6_specific = {
1575 1576 1577
	.queue_xmit	   = inet6_csk_xmit,
	.send_check	   = tcp_v6_send_check,
	.rebuild_header	   = inet6_sk_rebuild_header,
E
Eric Dumazet 已提交
1578
	.sk_rx_dst_set	   = inet6_sk_rx_dst_set,
1579 1580 1581
	.conn_request	   = tcp_v6_conn_request,
	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
	.net_header_len	   = sizeof(struct ipv6hdr),
1582
	.net_frag_header_len = sizeof(struct frag_hdr),
1583 1584 1585 1586
	.setsockopt	   = ipv6_setsockopt,
	.getsockopt	   = ipv6_getsockopt,
	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1587
	.bind_conflict	   = inet6_csk_bind_conflict,
1588
#ifdef CONFIG_COMPAT
1589 1590
	.compat_setsockopt = compat_ipv6_setsockopt,
	.compat_getsockopt = compat_ipv6_getsockopt,
1591
#endif
1592
	.mtu_reduced	   = tcp_v6_mtu_reduced,
L
Linus Torvalds 已提交
1593 1594
};

1595
#ifdef CONFIG_TCP_MD5SIG
1596
static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1597
	.md5_lookup	=	tcp_v6_md5_lookup,
1598
	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
1599 1600
	.md5_parse	=	tcp_v6_parse_md5_keys,
};
1601
#endif
1602

L
Linus Torvalds 已提交
1603 1604 1605
/*
 *	TCP over IPv4 via INET6 API
 */
1606
static const struct inet_connection_sock_af_ops ipv6_mapped = {
1607 1608 1609
	.queue_xmit	   = ip_queue_xmit,
	.send_check	   = tcp_v4_send_check,
	.rebuild_header	   = inet_sk_rebuild_header,
1610
	.sk_rx_dst_set	   = inet_sk_rx_dst_set,
1611 1612 1613 1614 1615 1616 1617
	.conn_request	   = tcp_v6_conn_request,
	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
	.net_header_len	   = sizeof(struct iphdr),
	.setsockopt	   = ipv6_setsockopt,
	.getsockopt	   = ipv6_getsockopt,
	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1618
	.bind_conflict	   = inet6_csk_bind_conflict,
1619
#ifdef CONFIG_COMPAT
1620 1621
	.compat_setsockopt = compat_ipv6_setsockopt,
	.compat_getsockopt = compat_ipv6_getsockopt,
1622
#endif
1623
	.mtu_reduced	   = tcp_v4_mtu_reduced,
L
Linus Torvalds 已提交
1624 1625
};

1626
#ifdef CONFIG_TCP_MD5SIG
1627
static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1628
	.md5_lookup	=	tcp_v4_md5_lookup,
1629
	.calc_md5_hash	=	tcp_v4_md5_hash_skb,
1630 1631
	.md5_parse	=	tcp_v6_parse_md5_keys,
};
1632
#endif
1633

L
Linus Torvalds 已提交
1634 1635 1636 1637 1638
/* NOTE: A lot of things set to zero explicitly by call to
 *       sk_alloc() so need not be done here.
 */
static int tcp_v6_init_sock(struct sock *sk)
{
1639
	struct inet_connection_sock *icsk = inet_csk(sk);
L
Linus Torvalds 已提交
1640

1641
	tcp_init_sock(sk);
L
Linus Torvalds 已提交
1642

1643
	icsk->icsk_af_ops = &ipv6_specific;
L
Linus Torvalds 已提交
1644

1645
#ifdef CONFIG_TCP_MD5SIG
1646
	tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1647 1648
#endif

L
Linus Torvalds 已提交
1649 1650 1651
	return 0;
}

1652
static void tcp_v6_destroy_sock(struct sock *sk)
L
Linus Torvalds 已提交
1653 1654
{
	tcp_v4_destroy_sock(sk);
1655
	inet6_destroy_sock(sk);
L
Linus Torvalds 已提交
1656 1657
}

1658
#ifdef CONFIG_PROC_FS
L
Linus Torvalds 已提交
1659
/* Proc filesystem TCPv6 sock list dumping. */
1660
static void get_openreq6(struct seq_file *seq,
E
Eric Dumazet 已提交
1661
			 const struct request_sock *req, int i)
L
Linus Torvalds 已提交
1662
{
1663
	long ttd = req->rsk_timer.expires - jiffies;
1664 1665
	const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
	const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
L
Linus Torvalds 已提交
1666 1667 1668 1669 1670 1671

	if (ttd < 0)
		ttd = 0;

	seq_printf(seq,
		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1672
		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
L
Linus Torvalds 已提交
1673 1674 1675
		   i,
		   src->s6_addr32[0], src->s6_addr32[1],
		   src->s6_addr32[2], src->s6_addr32[3],
E
Eric Dumazet 已提交
1676
		   inet_rsk(req)->ir_num,
L
Linus Torvalds 已提交
1677 1678
		   dest->s6_addr32[0], dest->s6_addr32[1],
		   dest->s6_addr32[2], dest->s6_addr32[3],
1679
		   ntohs(inet_rsk(req)->ir_rmt_port),
L
Linus Torvalds 已提交
1680
		   TCP_SYN_RECV,
W
Weilong Chen 已提交
1681
		   0, 0, /* could print option size, but that is af dependent. */
1682 1683
		   1,   /* timers active (only the expire timer) */
		   jiffies_to_clock_t(ttd),
1684
		   req->num_timeout,
E
Eric Dumazet 已提交
1685 1686
		   from_kuid_munged(seq_user_ns(seq),
				    sock_i_uid(req->rsk_listener)),
1687
		   0,  /* non standard timer */
L
Linus Torvalds 已提交
1688 1689 1690 1691 1692 1693
		   0, /* open_requests have no inode */
		   0, req);
}

static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
{
1694
	const struct in6_addr *dest, *src;
L
Linus Torvalds 已提交
1695 1696 1697
	__u16 destp, srcp;
	int timer_active;
	unsigned long timer_expires;
1698 1699
	const struct inet_sock *inet = inet_sk(sp);
	const struct tcp_sock *tp = tcp_sk(sp);
1700
	const struct inet_connection_sock *icsk = inet_csk(sp);
1701
	const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1702 1703
	int rx_queue;
	int state;
L
Linus Torvalds 已提交
1704

1705 1706
	dest  = &sp->sk_v6_daddr;
	src   = &sp->sk_v6_rcv_saddr;
E
Eric Dumazet 已提交
1707 1708
	destp = ntohs(inet->inet_dport);
	srcp  = ntohs(inet->inet_sport);
1709 1710

	if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
L
Linus Torvalds 已提交
1711
		timer_active	= 1;
1712 1713
		timer_expires	= icsk->icsk_timeout;
	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
L
Linus Torvalds 已提交
1714
		timer_active	= 4;
1715
		timer_expires	= icsk->icsk_timeout;
L
Linus Torvalds 已提交
1716 1717 1718 1719 1720 1721 1722 1723
	} else if (timer_pending(&sp->sk_timer)) {
		timer_active	= 2;
		timer_expires	= sp->sk_timer.expires;
	} else {
		timer_active	= 0;
		timer_expires = jiffies;
	}

1724 1725 1726 1727 1728 1729 1730 1731 1732
	state = sk_state_load(sp);
	if (state == TCP_LISTEN)
		rx_queue = sp->sk_ack_backlog;
	else
		/* Because we don't lock the socket,
		 * we might find a transient negative value.
		 */
		rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);

L
Linus Torvalds 已提交
1733 1734
	seq_printf(seq,
		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1735
		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
L
Linus Torvalds 已提交
1736 1737 1738 1739 1740
		   i,
		   src->s6_addr32[0], src->s6_addr32[1],
		   src->s6_addr32[2], src->s6_addr32[3], srcp,
		   dest->s6_addr32[0], dest->s6_addr32[1],
		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1741 1742 1743
		   state,
		   tp->write_seq - tp->snd_una,
		   rx_queue,
L
Linus Torvalds 已提交
1744
		   timer_active,
1745
		   jiffies_delta_to_clock_t(timer_expires - jiffies),
1746
		   icsk->icsk_retransmits,
1747
		   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1748
		   icsk->icsk_probes_out,
L
Linus Torvalds 已提交
1749 1750
		   sock_i_ino(sp),
		   atomic_read(&sp->sk_refcnt), sp,
1751 1752
		   jiffies_to_clock_t(icsk->icsk_rto),
		   jiffies_to_clock_t(icsk->icsk_ack.ato),
W
Weilong Chen 已提交
1753
		   (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
I
Ilpo Järvinen 已提交
1754
		   tp->snd_cwnd,
1755
		   state == TCP_LISTEN ?
1756
			fastopenq->max_qlen :
1757
			(tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
L
Linus Torvalds 已提交
1758 1759 1760
		   );
}

1761
static void get_timewait6_sock(struct seq_file *seq,
1762
			       struct inet_timewait_sock *tw, int i)
L
Linus Torvalds 已提交
1763
{
1764
	long delta = tw->tw_timer.expires - jiffies;
1765
	const struct in6_addr *dest, *src;
L
Linus Torvalds 已提交
1766 1767
	__u16 destp, srcp;

1768 1769
	dest = &tw->tw_v6_daddr;
	src  = &tw->tw_v6_rcv_saddr;
L
Linus Torvalds 已提交
1770 1771 1772 1773 1774
	destp = ntohs(tw->tw_dport);
	srcp  = ntohs(tw->tw_sport);

	seq_printf(seq,
		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
D
Dan Rosenberg 已提交
1775
		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
L
Linus Torvalds 已提交
1776 1777 1778 1779 1780 1781
		   i,
		   src->s6_addr32[0], src->s6_addr32[1],
		   src->s6_addr32[2], src->s6_addr32[3], srcp,
		   dest->s6_addr32[0], dest->s6_addr32[1],
		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
		   tw->tw_substate, 0, 0,
1782
		   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
L
Linus Torvalds 已提交
1783 1784 1785 1786 1787 1788
		   atomic_read(&tw->tw_refcnt), tw);
}

static int tcp6_seq_show(struct seq_file *seq, void *v)
{
	struct tcp_iter_state *st;
E
Eric Dumazet 已提交
1789
	struct sock *sk = v;
L
Linus Torvalds 已提交
1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801

	if (v == SEQ_START_TOKEN) {
		seq_puts(seq,
			 "  sl  "
			 "local_address                         "
			 "remote_address                        "
			 "st tx_queue rx_queue tr tm->when retrnsmt"
			 "   uid  timeout inode\n");
		goto out;
	}
	st = seq->private;

1802 1803 1804
	if (sk->sk_state == TCP_TIME_WAIT)
		get_timewait6_sock(seq, v, st->num);
	else if (sk->sk_state == TCP_NEW_SYN_RECV)
E
Eric Dumazet 已提交
1805
		get_openreq6(seq, v, st->num);
1806 1807
	else
		get_tcp6_sock(seq, v, st->num);
L
Linus Torvalds 已提交
1808 1809 1810 1811
out:
	return 0;
}

1812 1813 1814 1815 1816 1817 1818 1819
static const struct file_operations tcp6_afinfo_seq_fops = {
	.owner   = THIS_MODULE,
	.open    = tcp_seq_open,
	.read    = seq_read,
	.llseek  = seq_lseek,
	.release = seq_release_net
};

L
Linus Torvalds 已提交
1820 1821 1822
static struct tcp_seq_afinfo tcp6_seq_afinfo = {
	.name		= "tcp6",
	.family		= AF_INET6,
1823
	.seq_fops	= &tcp6_afinfo_seq_fops,
1824 1825 1826
	.seq_ops	= {
		.show		= tcp6_seq_show,
	},
L
Linus Torvalds 已提交
1827 1828
};

1829
int __net_init tcp6_proc_init(struct net *net)
L
Linus Torvalds 已提交
1830
{
1831
	return tcp_proc_register(net, &tcp6_seq_afinfo);
L
Linus Torvalds 已提交
1832 1833
}

1834
void tcp6_proc_exit(struct net *net)
L
Linus Torvalds 已提交
1835
{
1836
	tcp_proc_unregister(net, &tcp6_seq_afinfo);
L
Linus Torvalds 已提交
1837 1838 1839
}
#endif

E
Eric Dumazet 已提交
1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850
static void tcp_v6_clear_sk(struct sock *sk, int size)
{
	struct inet_sock *inet = inet_sk(sk);

	/* we do not want to clear pinet6 field, because of RCU lookups */
	sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));

	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
	memset(&inet->pinet6 + 1, 0, size);
}

L
Linus Torvalds 已提交
1851 1852 1853 1854 1855 1856
struct proto tcpv6_prot = {
	.name			= "TCPv6",
	.owner			= THIS_MODULE,
	.close			= tcp_close,
	.connect		= tcp_v6_connect,
	.disconnect		= tcp_disconnect,
1857
	.accept			= inet_csk_accept,
L
Linus Torvalds 已提交
1858 1859 1860 1861 1862 1863 1864
	.ioctl			= tcp_ioctl,
	.init			= tcp_v6_init_sock,
	.destroy		= tcp_v6_destroy_sock,
	.shutdown		= tcp_shutdown,
	.setsockopt		= tcp_setsockopt,
	.getsockopt		= tcp_getsockopt,
	.recvmsg		= tcp_recvmsg,
1865 1866
	.sendmsg		= tcp_sendmsg,
	.sendpage		= tcp_sendpage,
L
Linus Torvalds 已提交
1867
	.backlog_rcv		= tcp_v6_do_rcv,
E
Eric Dumazet 已提交
1868
	.release_cb		= tcp_release_cb,
E
Eric Dumazet 已提交
1869
	.hash			= inet_hash,
1870 1871
	.unhash			= inet_unhash,
	.get_port		= inet_csk_get_port,
L
Linus Torvalds 已提交
1872
	.enter_memory_pressure	= tcp_enter_memory_pressure,
1873
	.stream_memory_free	= tcp_stream_memory_free,
L
Linus Torvalds 已提交
1874 1875 1876
	.sockets_allocated	= &tcp_sockets_allocated,
	.memory_allocated	= &tcp_memory_allocated,
	.memory_pressure	= &tcp_memory_pressure,
1877
	.orphan_count		= &tcp_orphan_count,
1878
	.sysctl_mem		= sysctl_tcp_mem,
L
Linus Torvalds 已提交
1879 1880 1881 1882
	.sysctl_wmem		= sysctl_tcp_wmem,
	.sysctl_rmem		= sysctl_tcp_rmem,
	.max_header		= MAX_TCP_HEADER,
	.obj_size		= sizeof(struct tcp6_sock),
1883
	.slab_flags		= SLAB_DESTROY_BY_RCU,
1884
	.twsk_prot		= &tcp6_timewait_sock_ops,
1885
	.rsk_prot		= &tcp6_request_sock_ops,
1886
	.h.hashinfo		= &tcp_hashinfo,
1887
	.no_autobind		= true,
1888 1889 1890
#ifdef CONFIG_COMPAT
	.compat_setsockopt	= compat_tcp_setsockopt,
	.compat_getsockopt	= compat_tcp_getsockopt,
G
Glauber Costa 已提交
1891
#endif
E
Eric Dumazet 已提交
1892
	.clear_sk		= tcp_v6_clear_sk,
1893
	.diag_destroy		= tcp_abort,
L
Linus Torvalds 已提交
1894 1895
};

1896
static const struct inet6_protocol tcpv6_protocol = {
E
Eric Dumazet 已提交
1897
	.early_demux	=	tcp_v6_early_demux,
L
Linus Torvalds 已提交
1898 1899 1900 1901 1902 1903 1904 1905 1906 1907
	.handler	=	tcp_v6_rcv,
	.err_handler	=	tcp_v6_err,
	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
};

static struct inet_protosw tcpv6_protosw = {
	.type		=	SOCK_STREAM,
	.protocol	=	IPPROTO_TCP,
	.prot		=	&tcpv6_prot,
	.ops		=	&inet6_stream_ops,
1908 1909
	.flags		=	INET_PROTOSW_PERMANENT |
				INET_PROTOSW_ICSK,
L
Linus Torvalds 已提交
1910 1911
};

1912
static int __net_init tcpv6_net_init(struct net *net)
1913
{
1914 1915
	return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
				    SOCK_RAW, IPPROTO_TCP, net);
1916 1917
}

1918
static void __net_exit tcpv6_net_exit(struct net *net)
1919
{
1920
	inet_ctl_sock_destroy(net->ipv6.tcp_sk);
E
Eric W. Biederman 已提交
1921 1922
}

1923
static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
E
Eric W. Biederman 已提交
1924 1925
{
	inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1926 1927 1928
}

static struct pernet_operations tcpv6_net_ops = {
E
Eric W. Biederman 已提交
1929 1930 1931
	.init	    = tcpv6_net_init,
	.exit	    = tcpv6_net_exit,
	.exit_batch = tcpv6_net_exit_batch,
1932 1933
};

1934
int __init tcpv6_init(void)
L
Linus Torvalds 已提交
1935
{
1936 1937
	int ret;

1938 1939
	ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
	if (ret)
1940
		goto out;
1941

L
Linus Torvalds 已提交
1942
	/* register inet6 protocol */
1943 1944 1945 1946
	ret = inet6_register_protosw(&tcpv6_protosw);
	if (ret)
		goto out_tcpv6_protocol;

1947
	ret = register_pernet_subsys(&tcpv6_net_ops);
1948 1949 1950 1951
	if (ret)
		goto out_tcpv6_protosw;
out:
	return ret;
1952

1953 1954
out_tcpv6_protosw:
	inet6_unregister_protosw(&tcpv6_protosw);
1955 1956
out_tcpv6_protocol:
	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1957 1958 1959
	goto out;
}

1960
void tcpv6_exit(void)
1961
{
1962
	unregister_pernet_subsys(&tcpv6_net_ops);
1963 1964
	inet6_unregister_protosw(&tcpv6_protosw);
	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
L
Linus Torvalds 已提交
1965
}