xref: /openbmc/linux/net/ipv6/tcp_ipv6.c (revision a8fe58ce)
1 /*
2  *	TCP over IPv6
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *
8  *	Based on:
9  *	linux/net/ipv4/tcp.c
10  *	linux/net/ipv4/tcp_input.c
11  *	linux/net/ipv4/tcp_output.c
12  *
13  *	Fixes:
14  *	Hideaki YOSHIFUJI	:	sin6_scope_id support
15  *	YOSHIFUJI Hideaki @USAGI and:	Support IPV6_V6ONLY socket option, which
16  *	Alexey Kuznetsov		allow both IPv4 and IPv6 sockets to bind
17  *					a single port at the same time.
18  *	YOSHIFUJI Hideaki @USAGI:	convert /proc/net/tcp6 to seq_file.
19  *
20  *	This program is free software; you can redistribute it and/or
21  *      modify it under the terms of the GNU General Public License
22  *      as published by the Free Software Foundation; either version
23  *      2 of the License, or (at your option) any later version.
24  */
25 
26 #include <linux/bottom_half.h>
27 #include <linux/module.h>
28 #include <linux/errno.h>
29 #include <linux/types.h>
30 #include <linux/socket.h>
31 #include <linux/sockios.h>
32 #include <linux/net.h>
33 #include <linux/jiffies.h>
34 #include <linux/in.h>
35 #include <linux/in6.h>
36 #include <linux/netdevice.h>
37 #include <linux/init.h>
38 #include <linux/jhash.h>
39 #include <linux/ipsec.h>
40 #include <linux/times.h>
41 #include <linux/slab.h>
42 #include <linux/uaccess.h>
43 #include <linux/ipv6.h>
44 #include <linux/icmpv6.h>
45 #include <linux/random.h>
46 
47 #include <net/tcp.h>
48 #include <net/ndisc.h>
49 #include <net/inet6_hashtables.h>
50 #include <net/inet6_connection_sock.h>
51 #include <net/ipv6.h>
52 #include <net/transp_v6.h>
53 #include <net/addrconf.h>
54 #include <net/ip6_route.h>
55 #include <net/ip6_checksum.h>
56 #include <net/inet_ecn.h>
57 #include <net/protocol.h>
58 #include <net/xfrm.h>
59 #include <net/snmp.h>
60 #include <net/dsfield.h>
61 #include <net/timewait_sock.h>
62 #include <net/inet_common.h>
63 #include <net/secure_seq.h>
64 #include <net/busy_poll.h>
65 
66 #include <linux/proc_fs.h>
67 #include <linux/seq_file.h>
68 
69 #include <linux/crypto.h>
70 #include <linux/scatterlist.h>
71 
72 static void	tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
73 static void	tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
74 				      struct request_sock *req);
75 
76 static int	tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
77 
78 static const struct inet_connection_sock_af_ops ipv6_mapped;
79 static const struct inet_connection_sock_af_ops ipv6_specific;
80 #ifdef CONFIG_TCP_MD5SIG
81 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
82 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
83 #else
84 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
85 						   const struct in6_addr *addr)
86 {
87 	return NULL;
88 }
89 #endif
90 
91 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
92 {
93 	struct dst_entry *dst = skb_dst(skb);
94 
95 	if (dst && dst_hold_safe(dst)) {
96 		const struct rt6_info *rt = (const struct rt6_info *)dst;
97 
98 		sk->sk_rx_dst = dst;
99 		inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
100 		inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
101 	}
102 }
103 
104 static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
105 {
106 	return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
107 					    ipv6_hdr(skb)->saddr.s6_addr32,
108 					    tcp_hdr(skb)->dest,
109 					    tcp_hdr(skb)->source);
110 }
111 
112 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
113 			  int addr_len)
114 {
115 	struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
116 	struct inet_sock *inet = inet_sk(sk);
117 	struct inet_connection_sock *icsk = inet_csk(sk);
118 	struct ipv6_pinfo *np = inet6_sk(sk);
119 	struct tcp_sock *tp = tcp_sk(sk);
120 	struct in6_addr *saddr = NULL, *final_p, final;
121 	struct ipv6_txoptions *opt;
122 	struct flowi6 fl6;
123 	struct dst_entry *dst;
124 	int addr_type;
125 	int err;
126 
127 	if (addr_len < SIN6_LEN_RFC2133)
128 		return -EINVAL;
129 
130 	if (usin->sin6_family != AF_INET6)
131 		return -EAFNOSUPPORT;
132 
133 	memset(&fl6, 0, sizeof(fl6));
134 
135 	if (np->sndflow) {
136 		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
137 		IP6_ECN_flow_init(fl6.flowlabel);
138 		if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
139 			struct ip6_flowlabel *flowlabel;
140 			flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
141 			if (!flowlabel)
142 				return -EINVAL;
143 			fl6_sock_release(flowlabel);
144 		}
145 	}
146 
147 	/*
148 	 *	connect() to INADDR_ANY means loopback (BSD'ism).
149 	 */
150 
151 	if (ipv6_addr_any(&usin->sin6_addr))
152 		usin->sin6_addr.s6_addr[15] = 0x1;
153 
154 	addr_type = ipv6_addr_type(&usin->sin6_addr);
155 
156 	if (addr_type & IPV6_ADDR_MULTICAST)
157 		return -ENETUNREACH;
158 
159 	if (addr_type&IPV6_ADDR_LINKLOCAL) {
160 		if (addr_len >= sizeof(struct sockaddr_in6) &&
161 		    usin->sin6_scope_id) {
162 			/* If interface is set while binding, indices
163 			 * must coincide.
164 			 */
165 			if (sk->sk_bound_dev_if &&
166 			    sk->sk_bound_dev_if != usin->sin6_scope_id)
167 				return -EINVAL;
168 
169 			sk->sk_bound_dev_if = usin->sin6_scope_id;
170 		}
171 
172 		/* Connect to link-local address requires an interface */
173 		if (!sk->sk_bound_dev_if)
174 			return -EINVAL;
175 	}
176 
177 	if (tp->rx_opt.ts_recent_stamp &&
178 	    !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
179 		tp->rx_opt.ts_recent = 0;
180 		tp->rx_opt.ts_recent_stamp = 0;
181 		tp->write_seq = 0;
182 	}
183 
184 	sk->sk_v6_daddr = usin->sin6_addr;
185 	np->flow_label = fl6.flowlabel;
186 
187 	/*
188 	 *	TCP over IPv4
189 	 */
190 
191 	if (addr_type == IPV6_ADDR_MAPPED) {
192 		u32 exthdrlen = icsk->icsk_ext_hdr_len;
193 		struct sockaddr_in sin;
194 
195 		SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
196 
197 		if (__ipv6_only_sock(sk))
198 			return -ENETUNREACH;
199 
200 		sin.sin_family = AF_INET;
201 		sin.sin_port = usin->sin6_port;
202 		sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
203 
204 		icsk->icsk_af_ops = &ipv6_mapped;
205 		sk->sk_backlog_rcv = tcp_v4_do_rcv;
206 #ifdef CONFIG_TCP_MD5SIG
207 		tp->af_specific = &tcp_sock_ipv6_mapped_specific;
208 #endif
209 
210 		err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
211 
212 		if (err) {
213 			icsk->icsk_ext_hdr_len = exthdrlen;
214 			icsk->icsk_af_ops = &ipv6_specific;
215 			sk->sk_backlog_rcv = tcp_v6_do_rcv;
216 #ifdef CONFIG_TCP_MD5SIG
217 			tp->af_specific = &tcp_sock_ipv6_specific;
218 #endif
219 			goto failure;
220 		}
221 		np->saddr = sk->sk_v6_rcv_saddr;
222 
223 		return err;
224 	}
225 
226 	if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
227 		saddr = &sk->sk_v6_rcv_saddr;
228 
229 	fl6.flowi6_proto = IPPROTO_TCP;
230 	fl6.daddr = sk->sk_v6_daddr;
231 	fl6.saddr = saddr ? *saddr : np->saddr;
232 	fl6.flowi6_oif = sk->sk_bound_dev_if;
233 	fl6.flowi6_mark = sk->sk_mark;
234 	fl6.fl6_dport = usin->sin6_port;
235 	fl6.fl6_sport = inet->inet_sport;
236 
237 	opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
238 	final_p = fl6_update_dst(&fl6, opt, &final);
239 
240 	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
241 
242 	dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
243 	if (IS_ERR(dst)) {
244 		err = PTR_ERR(dst);
245 		goto failure;
246 	}
247 
248 	if (!saddr) {
249 		saddr = &fl6.saddr;
250 		sk->sk_v6_rcv_saddr = *saddr;
251 	}
252 
253 	/* set the source address */
254 	np->saddr = *saddr;
255 	inet->inet_rcv_saddr = LOOPBACK4_IPV6;
256 
257 	sk->sk_gso_type = SKB_GSO_TCPV6;
258 	ip6_dst_store(sk, dst, NULL, NULL);
259 
260 	if (tcp_death_row.sysctl_tw_recycle &&
261 	    !tp->rx_opt.ts_recent_stamp &&
262 	    ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr))
263 		tcp_fetch_timewait_stamp(sk, dst);
264 
265 	icsk->icsk_ext_hdr_len = 0;
266 	if (opt)
267 		icsk->icsk_ext_hdr_len = opt->opt_flen +
268 					 opt->opt_nflen;
269 
270 	tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
271 
272 	inet->inet_dport = usin->sin6_port;
273 
274 	tcp_set_state(sk, TCP_SYN_SENT);
275 	err = inet6_hash_connect(&tcp_death_row, sk);
276 	if (err)
277 		goto late_failure;
278 
279 	sk_set_txhash(sk);
280 
281 	if (!tp->write_seq && likely(!tp->repair))
282 		tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
283 							     sk->sk_v6_daddr.s6_addr32,
284 							     inet->inet_sport,
285 							     inet->inet_dport);
286 
287 	err = tcp_connect(sk);
288 	if (err)
289 		goto late_failure;
290 
291 	return 0;
292 
293 late_failure:
294 	tcp_set_state(sk, TCP_CLOSE);
295 	__sk_dst_reset(sk);
296 failure:
297 	inet->inet_dport = 0;
298 	sk->sk_route_caps = 0;
299 	return err;
300 }
301 
302 static void tcp_v6_mtu_reduced(struct sock *sk)
303 {
304 	struct dst_entry *dst;
305 
306 	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
307 		return;
308 
309 	dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
310 	if (!dst)
311 		return;
312 
313 	if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
314 		tcp_sync_mss(sk, dst_mtu(dst));
315 		tcp_simple_retransmit(sk);
316 	}
317 }
318 
319 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
320 		u8 type, u8 code, int offset, __be32 info)
321 {
322 	const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
323 	const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
324 	struct net *net = dev_net(skb->dev);
325 	struct request_sock *fastopen;
326 	struct ipv6_pinfo *np;
327 	struct tcp_sock *tp;
328 	__u32 seq, snd_una;
329 	struct sock *sk;
330 	int err;
331 
332 	sk = __inet6_lookup_established(net, &tcp_hashinfo,
333 					&hdr->daddr, th->dest,
334 					&hdr->saddr, ntohs(th->source),
335 					skb->dev->ifindex);
336 
337 	if (!sk) {
338 		ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
339 				   ICMP6_MIB_INERRORS);
340 		return;
341 	}
342 
343 	if (sk->sk_state == TCP_TIME_WAIT) {
344 		inet_twsk_put(inet_twsk(sk));
345 		return;
346 	}
347 	seq = ntohl(th->seq);
348 	if (sk->sk_state == TCP_NEW_SYN_RECV)
349 		return tcp_req_err(sk, seq);
350 
351 	bh_lock_sock(sk);
352 	if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
353 		NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
354 
355 	if (sk->sk_state == TCP_CLOSE)
356 		goto out;
357 
358 	if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
359 		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
360 		goto out;
361 	}
362 
363 	tp = tcp_sk(sk);
364 	/* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
365 	fastopen = tp->fastopen_rsk;
366 	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
367 	if (sk->sk_state != TCP_LISTEN &&
368 	    !between(seq, snd_una, tp->snd_nxt)) {
369 		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
370 		goto out;
371 	}
372 
373 	np = inet6_sk(sk);
374 
375 	if (type == NDISC_REDIRECT) {
376 		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
377 
378 		if (dst)
379 			dst->ops->redirect(dst, sk, skb);
380 		goto out;
381 	}
382 
383 	if (type == ICMPV6_PKT_TOOBIG) {
384 		/* We are not interested in TCP_LISTEN and open_requests
385 		 * (SYN-ACKs send out by Linux are always <576bytes so
386 		 * they should go through unfragmented).
387 		 */
388 		if (sk->sk_state == TCP_LISTEN)
389 			goto out;
390 
391 		if (!ip6_sk_accept_pmtu(sk))
392 			goto out;
393 
394 		tp->mtu_info = ntohl(info);
395 		if (!sock_owned_by_user(sk))
396 			tcp_v6_mtu_reduced(sk);
397 		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
398 					   &tp->tsq_flags))
399 			sock_hold(sk);
400 		goto out;
401 	}
402 
403 	icmpv6_err_convert(type, code, &err);
404 
405 	/* Might be for an request_sock */
406 	switch (sk->sk_state) {
407 	case TCP_SYN_SENT:
408 	case TCP_SYN_RECV:
409 		/* Only in fast or simultaneous open. If a fast open socket is
410 		 * is already accepted it is treated as a connected one below.
411 		 */
412 		if (fastopen && !fastopen->sk)
413 			break;
414 
415 		if (!sock_owned_by_user(sk)) {
416 			sk->sk_err = err;
417 			sk->sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */
418 
419 			tcp_done(sk);
420 		} else
421 			sk->sk_err_soft = err;
422 		goto out;
423 	}
424 
425 	if (!sock_owned_by_user(sk) && np->recverr) {
426 		sk->sk_err = err;
427 		sk->sk_error_report(sk);
428 	} else
429 		sk->sk_err_soft = err;
430 
431 out:
432 	bh_unlock_sock(sk);
433 	sock_put(sk);
434 }
435 
436 
437 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
438 			      struct flowi *fl,
439 			      struct request_sock *req,
440 			      struct tcp_fastopen_cookie *foc,
441 			      bool attach_req)
442 {
443 	struct inet_request_sock *ireq = inet_rsk(req);
444 	struct ipv6_pinfo *np = inet6_sk(sk);
445 	struct flowi6 *fl6 = &fl->u.ip6;
446 	struct sk_buff *skb;
447 	int err = -ENOMEM;
448 
449 	/* First, grab a route. */
450 	if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
451 					       IPPROTO_TCP)) == NULL)
452 		goto done;
453 
454 	skb = tcp_make_synack(sk, dst, req, foc, attach_req);
455 
456 	if (skb) {
457 		__tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
458 				    &ireq->ir_v6_rmt_addr);
459 
460 		fl6->daddr = ireq->ir_v6_rmt_addr;
461 		if (np->repflow && ireq->pktopts)
462 			fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
463 
464 		rcu_read_lock();
465 		err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
466 			       np->tclass);
467 		rcu_read_unlock();
468 		err = net_xmit_eval(err);
469 	}
470 
471 done:
472 	return err;
473 }
474 
475 
476 static void tcp_v6_reqsk_destructor(struct request_sock *req)
477 {
478 	kfree_skb(inet_rsk(req)->pktopts);
479 }
480 
481 #ifdef CONFIG_TCP_MD5SIG
482 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
483 						   const struct in6_addr *addr)
484 {
485 	return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
486 }
487 
488 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
489 						const struct sock *addr_sk)
490 {
491 	return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
492 }
493 
494 static int tcp_v6_parse_md5_keys(struct sock *sk, char __user *optval,
495 				 int optlen)
496 {
497 	struct tcp_md5sig cmd;
498 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
499 
500 	if (optlen < sizeof(cmd))
501 		return -EINVAL;
502 
503 	if (copy_from_user(&cmd, optval, sizeof(cmd)))
504 		return -EFAULT;
505 
506 	if (sin6->sin6_family != AF_INET6)
507 		return -EINVAL;
508 
509 	if (!cmd.tcpm_keylen) {
510 		if (ipv6_addr_v4mapped(&sin6->sin6_addr))
511 			return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
512 					      AF_INET);
513 		return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
514 				      AF_INET6);
515 	}
516 
517 	if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
518 		return -EINVAL;
519 
520 	if (ipv6_addr_v4mapped(&sin6->sin6_addr))
521 		return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
522 				      AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
523 
524 	return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
525 			      AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
526 }
527 
528 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
529 					const struct in6_addr *daddr,
530 					const struct in6_addr *saddr, int nbytes)
531 {
532 	struct tcp6_pseudohdr *bp;
533 	struct scatterlist sg;
534 
535 	bp = &hp->md5_blk.ip6;
536 	/* 1. TCP pseudo-header (RFC2460) */
537 	bp->saddr = *saddr;
538 	bp->daddr = *daddr;
539 	bp->protocol = cpu_to_be32(IPPROTO_TCP);
540 	bp->len = cpu_to_be32(nbytes);
541 
542 	sg_init_one(&sg, bp, sizeof(*bp));
543 	return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
544 }
545 
546 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
547 			       const struct in6_addr *daddr, struct in6_addr *saddr,
548 			       const struct tcphdr *th)
549 {
550 	struct tcp_md5sig_pool *hp;
551 	struct hash_desc *desc;
552 
553 	hp = tcp_get_md5sig_pool();
554 	if (!hp)
555 		goto clear_hash_noput;
556 	desc = &hp->md5_desc;
557 
558 	if (crypto_hash_init(desc))
559 		goto clear_hash;
560 	if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
561 		goto clear_hash;
562 	if (tcp_md5_hash_header(hp, th))
563 		goto clear_hash;
564 	if (tcp_md5_hash_key(hp, key))
565 		goto clear_hash;
566 	if (crypto_hash_final(desc, md5_hash))
567 		goto clear_hash;
568 
569 	tcp_put_md5sig_pool();
570 	return 0;
571 
572 clear_hash:
573 	tcp_put_md5sig_pool();
574 clear_hash_noput:
575 	memset(md5_hash, 0, 16);
576 	return 1;
577 }
578 
579 static int tcp_v6_md5_hash_skb(char *md5_hash,
580 			       const struct tcp_md5sig_key *key,
581 			       const struct sock *sk,
582 			       const struct sk_buff *skb)
583 {
584 	const struct in6_addr *saddr, *daddr;
585 	struct tcp_md5sig_pool *hp;
586 	struct hash_desc *desc;
587 	const struct tcphdr *th = tcp_hdr(skb);
588 
589 	if (sk) { /* valid for establish/request sockets */
590 		saddr = &sk->sk_v6_rcv_saddr;
591 		daddr = &sk->sk_v6_daddr;
592 	} else {
593 		const struct ipv6hdr *ip6h = ipv6_hdr(skb);
594 		saddr = &ip6h->saddr;
595 		daddr = &ip6h->daddr;
596 	}
597 
598 	hp = tcp_get_md5sig_pool();
599 	if (!hp)
600 		goto clear_hash_noput;
601 	desc = &hp->md5_desc;
602 
603 	if (crypto_hash_init(desc))
604 		goto clear_hash;
605 
606 	if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
607 		goto clear_hash;
608 	if (tcp_md5_hash_header(hp, th))
609 		goto clear_hash;
610 	if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
611 		goto clear_hash;
612 	if (tcp_md5_hash_key(hp, key))
613 		goto clear_hash;
614 	if (crypto_hash_final(desc, md5_hash))
615 		goto clear_hash;
616 
617 	tcp_put_md5sig_pool();
618 	return 0;
619 
620 clear_hash:
621 	tcp_put_md5sig_pool();
622 clear_hash_noput:
623 	memset(md5_hash, 0, 16);
624 	return 1;
625 }
626 
627 #endif
628 
629 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
630 				    const struct sk_buff *skb)
631 {
632 #ifdef CONFIG_TCP_MD5SIG
633 	const __u8 *hash_location = NULL;
634 	struct tcp_md5sig_key *hash_expected;
635 	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
636 	const struct tcphdr *th = tcp_hdr(skb);
637 	int genhash;
638 	u8 newhash[16];
639 
640 	hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
641 	hash_location = tcp_parse_md5sig_option(th);
642 
643 	/* We've parsed the options - do we have a hash? */
644 	if (!hash_expected && !hash_location)
645 		return false;
646 
647 	if (hash_expected && !hash_location) {
648 		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
649 		return true;
650 	}
651 
652 	if (!hash_expected && hash_location) {
653 		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
654 		return true;
655 	}
656 
657 	/* check the signature */
658 	genhash = tcp_v6_md5_hash_skb(newhash,
659 				      hash_expected,
660 				      NULL, skb);
661 
662 	if (genhash || memcmp(hash_location, newhash, 16) != 0) {
663 		net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
664 				     genhash ? "failed" : "mismatch",
665 				     &ip6h->saddr, ntohs(th->source),
666 				     &ip6h->daddr, ntohs(th->dest));
667 		return true;
668 	}
669 #endif
670 	return false;
671 }
672 
673 static void tcp_v6_init_req(struct request_sock *req,
674 			    const struct sock *sk_listener,
675 			    struct sk_buff *skb)
676 {
677 	struct inet_request_sock *ireq = inet_rsk(req);
678 	const struct ipv6_pinfo *np = inet6_sk(sk_listener);
679 
680 	ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
681 	ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
682 
683 	/* So that link locals have meaning */
684 	if (!sk_listener->sk_bound_dev_if &&
685 	    ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
686 		ireq->ir_iif = tcp_v6_iif(skb);
687 
688 	if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
689 	    (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
690 	     np->rxopt.bits.rxinfo ||
691 	     np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
692 	     np->rxopt.bits.rxohlim || np->repflow)) {
693 		atomic_inc(&skb->users);
694 		ireq->pktopts = skb;
695 	}
696 }
697 
698 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
699 					  struct flowi *fl,
700 					  const struct request_sock *req,
701 					  bool *strict)
702 {
703 	if (strict)
704 		*strict = true;
705 	return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
706 }
707 
708 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
709 	.family		=	AF_INET6,
710 	.obj_size	=	sizeof(struct tcp6_request_sock),
711 	.rtx_syn_ack	=	tcp_rtx_synack,
712 	.send_ack	=	tcp_v6_reqsk_send_ack,
713 	.destructor	=	tcp_v6_reqsk_destructor,
714 	.send_reset	=	tcp_v6_send_reset,
715 	.syn_ack_timeout =	tcp_syn_ack_timeout,
716 };
717 
718 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
719 	.mss_clamp	=	IPV6_MIN_MTU - sizeof(struct tcphdr) -
720 				sizeof(struct ipv6hdr),
721 #ifdef CONFIG_TCP_MD5SIG
722 	.req_md5_lookup	=	tcp_v6_md5_lookup,
723 	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
724 #endif
725 	.init_req	=	tcp_v6_init_req,
726 #ifdef CONFIG_SYN_COOKIES
727 	.cookie_init_seq =	cookie_v6_init_sequence,
728 #endif
729 	.route_req	=	tcp_v6_route_req,
730 	.init_seq	=	tcp_v6_init_sequence,
731 	.send_synack	=	tcp_v6_send_synack,
732 };
733 
734 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
735 				 u32 ack, u32 win, u32 tsval, u32 tsecr,
736 				 int oif, struct tcp_md5sig_key *key, int rst,
737 				 u8 tclass, u32 label)
738 {
739 	const struct tcphdr *th = tcp_hdr(skb);
740 	struct tcphdr *t1;
741 	struct sk_buff *buff;
742 	struct flowi6 fl6;
743 	struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
744 	struct sock *ctl_sk = net->ipv6.tcp_sk;
745 	unsigned int tot_len = sizeof(struct tcphdr);
746 	struct dst_entry *dst;
747 	__be32 *topt;
748 
749 	if (tsecr)
750 		tot_len += TCPOLEN_TSTAMP_ALIGNED;
751 #ifdef CONFIG_TCP_MD5SIG
752 	if (key)
753 		tot_len += TCPOLEN_MD5SIG_ALIGNED;
754 #endif
755 
756 	buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
757 			 GFP_ATOMIC);
758 	if (!buff)
759 		return;
760 
761 	skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
762 
763 	t1 = (struct tcphdr *) skb_push(buff, tot_len);
764 	skb_reset_transport_header(buff);
765 
766 	/* Swap the send and the receive. */
767 	memset(t1, 0, sizeof(*t1));
768 	t1->dest = th->source;
769 	t1->source = th->dest;
770 	t1->doff = tot_len / 4;
771 	t1->seq = htonl(seq);
772 	t1->ack_seq = htonl(ack);
773 	t1->ack = !rst || !th->ack;
774 	t1->rst = rst;
775 	t1->window = htons(win);
776 
777 	topt = (__be32 *)(t1 + 1);
778 
779 	if (tsecr) {
780 		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
781 				(TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
782 		*topt++ = htonl(tsval);
783 		*topt++ = htonl(tsecr);
784 	}
785 
786 #ifdef CONFIG_TCP_MD5SIG
787 	if (key) {
788 		*topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
789 				(TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
790 		tcp_v6_md5_hash_hdr((__u8 *)topt, key,
791 				    &ipv6_hdr(skb)->saddr,
792 				    &ipv6_hdr(skb)->daddr, t1);
793 	}
794 #endif
795 
796 	memset(&fl6, 0, sizeof(fl6));
797 	fl6.daddr = ipv6_hdr(skb)->saddr;
798 	fl6.saddr = ipv6_hdr(skb)->daddr;
799 	fl6.flowlabel = label;
800 
801 	buff->ip_summed = CHECKSUM_PARTIAL;
802 	buff->csum = 0;
803 
804 	__tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
805 
806 	fl6.flowi6_proto = IPPROTO_TCP;
807 	if (rt6_need_strict(&fl6.daddr) && !oif)
808 		fl6.flowi6_oif = tcp_v6_iif(skb);
809 	else
810 		fl6.flowi6_oif = oif;
811 	fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
812 	fl6.fl6_dport = t1->dest;
813 	fl6.fl6_sport = t1->source;
814 	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
815 
816 	/* Pass a socket to ip6_dst_lookup either it is for RST
817 	 * Underlying function will use this to retrieve the network
818 	 * namespace
819 	 */
820 	dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
821 	if (!IS_ERR(dst)) {
822 		skb_dst_set(buff, dst);
823 		ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
824 		TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
825 		if (rst)
826 			TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
827 		return;
828 	}
829 
830 	kfree_skb(buff);
831 }
832 
833 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
834 {
835 	const struct tcphdr *th = tcp_hdr(skb);
836 	u32 seq = 0, ack_seq = 0;
837 	struct tcp_md5sig_key *key = NULL;
838 #ifdef CONFIG_TCP_MD5SIG
839 	const __u8 *hash_location = NULL;
840 	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
841 	unsigned char newhash[16];
842 	int genhash;
843 	struct sock *sk1 = NULL;
844 #endif
845 	int oif;
846 
847 	if (th->rst)
848 		return;
849 
850 	/* If sk not NULL, it means we did a successful lookup and incoming
851 	 * route had to be correct. prequeue might have dropped our dst.
852 	 */
853 	if (!sk && !ipv6_unicast_destination(skb))
854 		return;
855 
856 #ifdef CONFIG_TCP_MD5SIG
857 	hash_location = tcp_parse_md5sig_option(th);
858 	if (sk && sk_fullsock(sk)) {
859 		key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
860 	} else if (hash_location) {
861 		/*
862 		 * active side is lost. Try to find listening socket through
863 		 * source port, and then find md5 key through listening socket.
864 		 * we are not loose security here:
865 		 * Incoming packet is checked with md5 hash with finding key,
866 		 * no RST generated if md5 hash doesn't match.
867 		 */
868 		sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
869 					   &tcp_hashinfo, &ipv6h->saddr,
870 					   th->source, &ipv6h->daddr,
871 					   ntohs(th->source), tcp_v6_iif(skb));
872 		if (!sk1)
873 			return;
874 
875 		rcu_read_lock();
876 		key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
877 		if (!key)
878 			goto release_sk1;
879 
880 		genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
881 		if (genhash || memcmp(hash_location, newhash, 16) != 0)
882 			goto release_sk1;
883 	}
884 #endif
885 
886 	if (th->ack)
887 		seq = ntohl(th->ack_seq);
888 	else
889 		ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
890 			  (th->doff << 2);
891 
892 	oif = sk ? sk->sk_bound_dev_if : 0;
893 	tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
894 
895 #ifdef CONFIG_TCP_MD5SIG
896 release_sk1:
897 	if (sk1) {
898 		rcu_read_unlock();
899 		sock_put(sk1);
900 	}
901 #endif
902 }
903 
904 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
905 			    u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
906 			    struct tcp_md5sig_key *key, u8 tclass,
907 			    u32 label)
908 {
909 	tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
910 			     tclass, label);
911 }
912 
913 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
914 {
915 	struct inet_timewait_sock *tw = inet_twsk(sk);
916 	struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
917 
918 	tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
919 			tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
920 			tcp_time_stamp + tcptw->tw_ts_offset,
921 			tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
922 			tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
923 
924 	inet_twsk_put(tw);
925 }
926 
927 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
928 				  struct request_sock *req)
929 {
930 	/* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
931 	 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
932 	 */
933 	tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
934 			tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
935 			tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
936 			tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
937 			tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
938 			0, 0);
939 }
940 
941 
942 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
943 {
944 #ifdef CONFIG_SYN_COOKIES
945 	const struct tcphdr *th = tcp_hdr(skb);
946 
947 	if (!th->syn)
948 		sk = cookie_v6_check(sk, skb);
949 #endif
950 	return sk;
951 }
952 
953 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
954 {
955 	if (skb->protocol == htons(ETH_P_IP))
956 		return tcp_v4_conn_request(sk, skb);
957 
958 	if (!ipv6_unicast_destination(skb))
959 		goto drop;
960 
961 	return tcp_conn_request(&tcp6_request_sock_ops,
962 				&tcp_request_sock_ipv6_ops, sk, skb);
963 
964 drop:
965 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
966 	return 0; /* don't send reset */
967 }
968 
969 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
970 					 struct request_sock *req,
971 					 struct dst_entry *dst,
972 					 struct request_sock *req_unhash,
973 					 bool *own_req)
974 {
975 	struct inet_request_sock *ireq;
976 	struct ipv6_pinfo *newnp;
977 	const struct ipv6_pinfo *np = inet6_sk(sk);
978 	struct ipv6_txoptions *opt;
979 	struct tcp6_sock *newtcp6sk;
980 	struct inet_sock *newinet;
981 	struct tcp_sock *newtp;
982 	struct sock *newsk;
983 #ifdef CONFIG_TCP_MD5SIG
984 	struct tcp_md5sig_key *key;
985 #endif
986 	struct flowi6 fl6;
987 
988 	if (skb->protocol == htons(ETH_P_IP)) {
989 		/*
990 		 *	v6 mapped
991 		 */
992 
993 		newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
994 					     req_unhash, own_req);
995 
996 		if (!newsk)
997 			return NULL;
998 
999 		newtcp6sk = (struct tcp6_sock *)newsk;
1000 		inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1001 
1002 		newinet = inet_sk(newsk);
1003 		newnp = inet6_sk(newsk);
1004 		newtp = tcp_sk(newsk);
1005 
1006 		memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1007 
1008 		newnp->saddr = newsk->sk_v6_rcv_saddr;
1009 
1010 		inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1011 		newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1012 #ifdef CONFIG_TCP_MD5SIG
1013 		newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1014 #endif
1015 
1016 		newnp->ipv6_ac_list = NULL;
1017 		newnp->ipv6_fl_list = NULL;
1018 		newnp->pktoptions  = NULL;
1019 		newnp->opt	   = NULL;
1020 		newnp->mcast_oif   = tcp_v6_iif(skb);
1021 		newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1022 		newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1023 		if (np->repflow)
1024 			newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1025 
1026 		/*
1027 		 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1028 		 * here, tcp_create_openreq_child now does this for us, see the comment in
1029 		 * that function for the gory details. -acme
1030 		 */
1031 
1032 		/* It is tricky place. Until this moment IPv4 tcp
1033 		   worked with IPv6 icsk.icsk_af_ops.
1034 		   Sync it now.
1035 		 */
1036 		tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1037 
1038 		return newsk;
1039 	}
1040 
1041 	ireq = inet_rsk(req);
1042 
1043 	if (sk_acceptq_is_full(sk))
1044 		goto out_overflow;
1045 
1046 	if (!dst) {
1047 		dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1048 		if (!dst)
1049 			goto out;
1050 	}
1051 
1052 	newsk = tcp_create_openreq_child(sk, req, skb);
1053 	if (!newsk)
1054 		goto out_nonewsk;
1055 
1056 	/*
1057 	 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1058 	 * count here, tcp_create_openreq_child now does this for us, see the
1059 	 * comment in that function for the gory details. -acme
1060 	 */
1061 
1062 	newsk->sk_gso_type = SKB_GSO_TCPV6;
1063 	ip6_dst_store(newsk, dst, NULL, NULL);
1064 	inet6_sk_rx_dst_set(newsk, skb);
1065 
1066 	newtcp6sk = (struct tcp6_sock *)newsk;
1067 	inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1068 
1069 	newtp = tcp_sk(newsk);
1070 	newinet = inet_sk(newsk);
1071 	newnp = inet6_sk(newsk);
1072 
1073 	memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1074 
1075 	newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1076 	newnp->saddr = ireq->ir_v6_loc_addr;
1077 	newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1078 	newsk->sk_bound_dev_if = ireq->ir_iif;
1079 
1080 	/* Now IPv6 options...
1081 
1082 	   First: no IPv4 options.
1083 	 */
1084 	newinet->inet_opt = NULL;
1085 	newnp->ipv6_ac_list = NULL;
1086 	newnp->ipv6_fl_list = NULL;
1087 
1088 	/* Clone RX bits */
1089 	newnp->rxopt.all = np->rxopt.all;
1090 
1091 	newnp->pktoptions = NULL;
1092 	newnp->opt	  = NULL;
1093 	newnp->mcast_oif  = tcp_v6_iif(skb);
1094 	newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1095 	newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1096 	if (np->repflow)
1097 		newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1098 
1099 	/* Clone native IPv6 options from listening socket (if any)
1100 
1101 	   Yes, keeping reference count would be much more clever,
1102 	   but we make one more one thing there: reattach optmem
1103 	   to newsk.
1104 	 */
1105 	opt = rcu_dereference(np->opt);
1106 	if (opt) {
1107 		opt = ipv6_dup_options(newsk, opt);
1108 		RCU_INIT_POINTER(newnp->opt, opt);
1109 	}
1110 	inet_csk(newsk)->icsk_ext_hdr_len = 0;
1111 	if (opt)
1112 		inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1113 						    opt->opt_flen;
1114 
1115 	tcp_ca_openreq_child(newsk, dst);
1116 
1117 	tcp_sync_mss(newsk, dst_mtu(dst));
1118 	newtp->advmss = dst_metric_advmss(dst);
1119 	if (tcp_sk(sk)->rx_opt.user_mss &&
1120 	    tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
1121 		newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
1122 
1123 	tcp_initialize_rcv_mss(newsk);
1124 
1125 	newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1126 	newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1127 
1128 #ifdef CONFIG_TCP_MD5SIG
1129 	/* Copy over the MD5 key from the original socket */
1130 	key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1131 	if (key) {
1132 		/* We're using one, so create a matching key
1133 		 * on the newsk structure. If we fail to get
1134 		 * memory, then we end up not copying the key
1135 		 * across. Shucks.
1136 		 */
1137 		tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1138 			       AF_INET6, key->key, key->keylen,
1139 			       sk_gfp_mask(sk, GFP_ATOMIC));
1140 	}
1141 #endif
1142 
1143 	if (__inet_inherit_port(sk, newsk) < 0) {
1144 		inet_csk_prepare_forced_close(newsk);
1145 		tcp_done(newsk);
1146 		goto out;
1147 	}
1148 	*own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1149 	if (*own_req) {
1150 		tcp_move_syn(newtp, req);
1151 
1152 		/* Clone pktoptions received with SYN, if we own the req */
1153 		if (ireq->pktopts) {
1154 			newnp->pktoptions = skb_clone(ireq->pktopts,
1155 						      sk_gfp_mask(sk, GFP_ATOMIC));
1156 			consume_skb(ireq->pktopts);
1157 			ireq->pktopts = NULL;
1158 			if (newnp->pktoptions)
1159 				skb_set_owner_r(newnp->pktoptions, newsk);
1160 		}
1161 	}
1162 
1163 	return newsk;
1164 
1165 out_overflow:
1166 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1167 out_nonewsk:
1168 	dst_release(dst);
1169 out:
1170 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1171 	return NULL;
1172 }
1173 
1174 /* The socket must have it's spinlock held when we get
1175  * here, unless it is a TCP_LISTEN socket.
1176  *
1177  * We have a potential double-lock case here, so even when
1178  * doing backlog processing we use the BH locking scheme.
1179  * This is because we cannot sleep with the original spinlock
1180  * held.
1181  */
1182 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1183 {
1184 	struct ipv6_pinfo *np = inet6_sk(sk);
1185 	struct tcp_sock *tp;
1186 	struct sk_buff *opt_skb = NULL;
1187 
1188 	/* Imagine: socket is IPv6. IPv4 packet arrives,
1189 	   goes to IPv4 receive handler and backlogged.
1190 	   From backlog it always goes here. Kerboom...
1191 	   Fortunately, tcp_rcv_established and rcv_established
1192 	   handle them correctly, but it is not case with
1193 	   tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1194 	 */
1195 
1196 	if (skb->protocol == htons(ETH_P_IP))
1197 		return tcp_v4_do_rcv(sk, skb);
1198 
1199 	if (sk_filter(sk, skb))
1200 		goto discard;
1201 
1202 	/*
1203 	 *	socket locking is here for SMP purposes as backlog rcv
1204 	 *	is currently called with bh processing disabled.
1205 	 */
1206 
1207 	/* Do Stevens' IPV6_PKTOPTIONS.
1208 
1209 	   Yes, guys, it is the only place in our code, where we
1210 	   may make it not affecting IPv4.
1211 	   The rest of code is protocol independent,
1212 	   and I do not like idea to uglify IPv4.
1213 
1214 	   Actually, all the idea behind IPV6_PKTOPTIONS
1215 	   looks not very well thought. For now we latch
1216 	   options, received in the last packet, enqueued
1217 	   by tcp. Feel free to propose better solution.
1218 					       --ANK (980728)
1219 	 */
1220 	if (np->rxopt.all)
1221 		opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1222 
1223 	if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1224 		struct dst_entry *dst = sk->sk_rx_dst;
1225 
1226 		sock_rps_save_rxhash(sk, skb);
1227 		sk_mark_napi_id(sk, skb);
1228 		if (dst) {
1229 			if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1230 			    dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1231 				dst_release(dst);
1232 				sk->sk_rx_dst = NULL;
1233 			}
1234 		}
1235 
1236 		tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len);
1237 		if (opt_skb)
1238 			goto ipv6_pktoptions;
1239 		return 0;
1240 	}
1241 
1242 	if (tcp_checksum_complete(skb))
1243 		goto csum_err;
1244 
1245 	if (sk->sk_state == TCP_LISTEN) {
1246 		struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1247 
1248 		if (!nsk)
1249 			goto discard;
1250 
1251 		if (nsk != sk) {
1252 			sock_rps_save_rxhash(nsk, skb);
1253 			sk_mark_napi_id(nsk, skb);
1254 			if (tcp_child_process(sk, nsk, skb))
1255 				goto reset;
1256 			if (opt_skb)
1257 				__kfree_skb(opt_skb);
1258 			return 0;
1259 		}
1260 	} else
1261 		sock_rps_save_rxhash(sk, skb);
1262 
1263 	if (tcp_rcv_state_process(sk, skb))
1264 		goto reset;
1265 	if (opt_skb)
1266 		goto ipv6_pktoptions;
1267 	return 0;
1268 
1269 reset:
1270 	tcp_v6_send_reset(sk, skb);
1271 discard:
1272 	if (opt_skb)
1273 		__kfree_skb(opt_skb);
1274 	kfree_skb(skb);
1275 	return 0;
1276 csum_err:
1277 	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_CSUMERRORS);
1278 	TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1279 	goto discard;
1280 
1281 
1282 ipv6_pktoptions:
1283 	/* Do you ask, what is it?
1284 
1285 	   1. skb was enqueued by tcp.
1286 	   2. skb is added to tail of read queue, rather than out of order.
1287 	   3. socket is not in passive state.
1288 	   4. Finally, it really contains options, which user wants to receive.
1289 	 */
1290 	tp = tcp_sk(sk);
1291 	if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1292 	    !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1293 		if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1294 			np->mcast_oif = tcp_v6_iif(opt_skb);
1295 		if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1296 			np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1297 		if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1298 			np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1299 		if (np->repflow)
1300 			np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1301 		if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1302 			skb_set_owner_r(opt_skb, sk);
1303 			opt_skb = xchg(&np->pktoptions, opt_skb);
1304 		} else {
1305 			__kfree_skb(opt_skb);
1306 			opt_skb = xchg(&np->pktoptions, NULL);
1307 		}
1308 	}
1309 
1310 	kfree_skb(opt_skb);
1311 	return 0;
1312 }
1313 
1314 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1315 			   const struct tcphdr *th)
1316 {
1317 	/* This is tricky: we move IP6CB at its correct location into
1318 	 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1319 	 * _decode_session6() uses IP6CB().
1320 	 * barrier() makes sure compiler won't play aliasing games.
1321 	 */
1322 	memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1323 		sizeof(struct inet6_skb_parm));
1324 	barrier();
1325 
1326 	TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1327 	TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1328 				    skb->len - th->doff*4);
1329 	TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1330 	TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1331 	TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1332 	TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1333 	TCP_SKB_CB(skb)->sacked = 0;
1334 }
1335 
1336 static void tcp_v6_restore_cb(struct sk_buff *skb)
1337 {
1338 	/* We need to move header back to the beginning if xfrm6_policy_check()
1339 	 * and tcp_v6_fill_cb() are going to be called again.
1340 	 */
1341 	memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1342 		sizeof(struct inet6_skb_parm));
1343 }
1344 
1345 static int tcp_v6_rcv(struct sk_buff *skb)
1346 {
1347 	const struct tcphdr *th;
1348 	const struct ipv6hdr *hdr;
1349 	struct sock *sk;
1350 	int ret;
1351 	struct net *net = dev_net(skb->dev);
1352 
1353 	if (skb->pkt_type != PACKET_HOST)
1354 		goto discard_it;
1355 
1356 	/*
1357 	 *	Count it even if it's bad.
1358 	 */
1359 	TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1360 
1361 	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1362 		goto discard_it;
1363 
1364 	th = tcp_hdr(skb);
1365 
1366 	if (th->doff < sizeof(struct tcphdr)/4)
1367 		goto bad_packet;
1368 	if (!pskb_may_pull(skb, th->doff*4))
1369 		goto discard_it;
1370 
1371 	if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1372 		goto csum_error;
1373 
1374 	th = tcp_hdr(skb);
1375 	hdr = ipv6_hdr(skb);
1376 
1377 lookup:
1378 	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
1379 				inet6_iif(skb));
1380 	if (!sk)
1381 		goto no_tcp_socket;
1382 
1383 process:
1384 	if (sk->sk_state == TCP_TIME_WAIT)
1385 		goto do_time_wait;
1386 
1387 	if (sk->sk_state == TCP_NEW_SYN_RECV) {
1388 		struct request_sock *req = inet_reqsk(sk);
1389 		struct sock *nsk = NULL;
1390 
1391 		sk = req->rsk_listener;
1392 		tcp_v6_fill_cb(skb, hdr, th);
1393 		if (tcp_v6_inbound_md5_hash(sk, skb)) {
1394 			reqsk_put(req);
1395 			goto discard_it;
1396 		}
1397 		if (likely(sk->sk_state == TCP_LISTEN)) {
1398 			nsk = tcp_check_req(sk, skb, req, false);
1399 		} else {
1400 			inet_csk_reqsk_queue_drop_and_put(sk, req);
1401 			goto lookup;
1402 		}
1403 		if (!nsk) {
1404 			reqsk_put(req);
1405 			goto discard_it;
1406 		}
1407 		if (nsk == sk) {
1408 			sock_hold(sk);
1409 			reqsk_put(req);
1410 			tcp_v6_restore_cb(skb);
1411 		} else if (tcp_child_process(sk, nsk, skb)) {
1412 			tcp_v6_send_reset(nsk, skb);
1413 			goto discard_it;
1414 		} else {
1415 			return 0;
1416 		}
1417 	}
1418 	if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1419 		NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1420 		goto discard_and_relse;
1421 	}
1422 
1423 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1424 		goto discard_and_relse;
1425 
1426 	tcp_v6_fill_cb(skb, hdr, th);
1427 
1428 	if (tcp_v6_inbound_md5_hash(sk, skb))
1429 		goto discard_and_relse;
1430 
1431 	if (sk_filter(sk, skb))
1432 		goto discard_and_relse;
1433 
1434 	skb->dev = NULL;
1435 
1436 	if (sk->sk_state == TCP_LISTEN) {
1437 		ret = tcp_v6_do_rcv(sk, skb);
1438 		goto put_and_return;
1439 	}
1440 
1441 	sk_incoming_cpu_update(sk);
1442 
1443 	bh_lock_sock_nested(sk);
1444 	tcp_sk(sk)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
1445 	ret = 0;
1446 	if (!sock_owned_by_user(sk)) {
1447 		if (!tcp_prequeue(sk, skb))
1448 			ret = tcp_v6_do_rcv(sk, skb);
1449 	} else if (unlikely(sk_add_backlog(sk, skb,
1450 					   sk->sk_rcvbuf + sk->sk_sndbuf))) {
1451 		bh_unlock_sock(sk);
1452 		NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1453 		goto discard_and_relse;
1454 	}
1455 	bh_unlock_sock(sk);
1456 
1457 put_and_return:
1458 	sock_put(sk);
1459 	return ret ? -1 : 0;
1460 
1461 no_tcp_socket:
1462 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1463 		goto discard_it;
1464 
1465 	tcp_v6_fill_cb(skb, hdr, th);
1466 
1467 	if (tcp_checksum_complete(skb)) {
1468 csum_error:
1469 		TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
1470 bad_packet:
1471 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1472 	} else {
1473 		tcp_v6_send_reset(NULL, skb);
1474 	}
1475 
1476 discard_it:
1477 	kfree_skb(skb);
1478 	return 0;
1479 
1480 discard_and_relse:
1481 	sock_put(sk);
1482 	goto discard_it;
1483 
1484 do_time_wait:
1485 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1486 		inet_twsk_put(inet_twsk(sk));
1487 		goto discard_it;
1488 	}
1489 
1490 	tcp_v6_fill_cb(skb, hdr, th);
1491 
1492 	if (tcp_checksum_complete(skb)) {
1493 		inet_twsk_put(inet_twsk(sk));
1494 		goto csum_error;
1495 	}
1496 
1497 	switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1498 	case TCP_TW_SYN:
1499 	{
1500 		struct sock *sk2;
1501 
1502 		sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1503 					    &ipv6_hdr(skb)->saddr, th->source,
1504 					    &ipv6_hdr(skb)->daddr,
1505 					    ntohs(th->dest), tcp_v6_iif(skb));
1506 		if (sk2) {
1507 			struct inet_timewait_sock *tw = inet_twsk(sk);
1508 			inet_twsk_deschedule_put(tw);
1509 			sk = sk2;
1510 			tcp_v6_restore_cb(skb);
1511 			goto process;
1512 		}
1513 		/* Fall through to ACK */
1514 	}
1515 	case TCP_TW_ACK:
1516 		tcp_v6_timewait_ack(sk, skb);
1517 		break;
1518 	case TCP_TW_RST:
1519 		tcp_v6_restore_cb(skb);
1520 		tcp_v6_send_reset(sk, skb);
1521 		inet_twsk_deschedule_put(inet_twsk(sk));
1522 		goto discard_it;
1523 	case TCP_TW_SUCCESS:
1524 		;
1525 	}
1526 	goto discard_it;
1527 }
1528 
1529 static void tcp_v6_early_demux(struct sk_buff *skb)
1530 {
1531 	const struct ipv6hdr *hdr;
1532 	const struct tcphdr *th;
1533 	struct sock *sk;
1534 
1535 	if (skb->pkt_type != PACKET_HOST)
1536 		return;
1537 
1538 	if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1539 		return;
1540 
1541 	hdr = ipv6_hdr(skb);
1542 	th = tcp_hdr(skb);
1543 
1544 	if (th->doff < sizeof(struct tcphdr) / 4)
1545 		return;
1546 
1547 	/* Note : We use inet6_iif() here, not tcp_v6_iif() */
1548 	sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1549 					&hdr->saddr, th->source,
1550 					&hdr->daddr, ntohs(th->dest),
1551 					inet6_iif(skb));
1552 	if (sk) {
1553 		skb->sk = sk;
1554 		skb->destructor = sock_edemux;
1555 		if (sk_fullsock(sk)) {
1556 			struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1557 
1558 			if (dst)
1559 				dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1560 			if (dst &&
1561 			    inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1562 				skb_dst_set_noref(skb, dst);
1563 		}
1564 	}
1565 }
1566 
1567 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1568 	.twsk_obj_size	= sizeof(struct tcp6_timewait_sock),
1569 	.twsk_unique	= tcp_twsk_unique,
1570 	.twsk_destructor = tcp_twsk_destructor,
1571 };
1572 
1573 static const struct inet_connection_sock_af_ops ipv6_specific = {
1574 	.queue_xmit	   = inet6_csk_xmit,
1575 	.send_check	   = tcp_v6_send_check,
1576 	.rebuild_header	   = inet6_sk_rebuild_header,
1577 	.sk_rx_dst_set	   = inet6_sk_rx_dst_set,
1578 	.conn_request	   = tcp_v6_conn_request,
1579 	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
1580 	.net_header_len	   = sizeof(struct ipv6hdr),
1581 	.net_frag_header_len = sizeof(struct frag_hdr),
1582 	.setsockopt	   = ipv6_setsockopt,
1583 	.getsockopt	   = ipv6_getsockopt,
1584 	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
1585 	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1586 	.bind_conflict	   = inet6_csk_bind_conflict,
1587 #ifdef CONFIG_COMPAT
1588 	.compat_setsockopt = compat_ipv6_setsockopt,
1589 	.compat_getsockopt = compat_ipv6_getsockopt,
1590 #endif
1591 	.mtu_reduced	   = tcp_v6_mtu_reduced,
1592 };
1593 
1594 #ifdef CONFIG_TCP_MD5SIG
1595 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1596 	.md5_lookup	=	tcp_v6_md5_lookup,
1597 	.calc_md5_hash	=	tcp_v6_md5_hash_skb,
1598 	.md5_parse	=	tcp_v6_parse_md5_keys,
1599 };
1600 #endif
1601 
1602 /*
1603  *	TCP over IPv4 via INET6 API
1604  */
1605 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1606 	.queue_xmit	   = ip_queue_xmit,
1607 	.send_check	   = tcp_v4_send_check,
1608 	.rebuild_header	   = inet_sk_rebuild_header,
1609 	.sk_rx_dst_set	   = inet_sk_rx_dst_set,
1610 	.conn_request	   = tcp_v6_conn_request,
1611 	.syn_recv_sock	   = tcp_v6_syn_recv_sock,
1612 	.net_header_len	   = sizeof(struct iphdr),
1613 	.setsockopt	   = ipv6_setsockopt,
1614 	.getsockopt	   = ipv6_getsockopt,
1615 	.addr2sockaddr	   = inet6_csk_addr2sockaddr,
1616 	.sockaddr_len	   = sizeof(struct sockaddr_in6),
1617 	.bind_conflict	   = inet6_csk_bind_conflict,
1618 #ifdef CONFIG_COMPAT
1619 	.compat_setsockopt = compat_ipv6_setsockopt,
1620 	.compat_getsockopt = compat_ipv6_getsockopt,
1621 #endif
1622 	.mtu_reduced	   = tcp_v4_mtu_reduced,
1623 };
1624 
1625 #ifdef CONFIG_TCP_MD5SIG
1626 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1627 	.md5_lookup	=	tcp_v4_md5_lookup,
1628 	.calc_md5_hash	=	tcp_v4_md5_hash_skb,
1629 	.md5_parse	=	tcp_v6_parse_md5_keys,
1630 };
1631 #endif
1632 
1633 /* NOTE: A lot of things set to zero explicitly by call to
1634  *       sk_alloc() so need not be done here.
1635  */
1636 static int tcp_v6_init_sock(struct sock *sk)
1637 {
1638 	struct inet_connection_sock *icsk = inet_csk(sk);
1639 
1640 	tcp_init_sock(sk);
1641 
1642 	icsk->icsk_af_ops = &ipv6_specific;
1643 
1644 #ifdef CONFIG_TCP_MD5SIG
1645 	tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1646 #endif
1647 
1648 	return 0;
1649 }
1650 
1651 static void tcp_v6_destroy_sock(struct sock *sk)
1652 {
1653 	tcp_v4_destroy_sock(sk);
1654 	inet6_destroy_sock(sk);
1655 }
1656 
1657 #ifdef CONFIG_PROC_FS
1658 /* Proc filesystem TCPv6 sock list dumping. */
1659 static void get_openreq6(struct seq_file *seq,
1660 			 const struct request_sock *req, int i)
1661 {
1662 	long ttd = req->rsk_timer.expires - jiffies;
1663 	const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1664 	const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1665 
1666 	if (ttd < 0)
1667 		ttd = 0;
1668 
1669 	seq_printf(seq,
1670 		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1671 		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1672 		   i,
1673 		   src->s6_addr32[0], src->s6_addr32[1],
1674 		   src->s6_addr32[2], src->s6_addr32[3],
1675 		   inet_rsk(req)->ir_num,
1676 		   dest->s6_addr32[0], dest->s6_addr32[1],
1677 		   dest->s6_addr32[2], dest->s6_addr32[3],
1678 		   ntohs(inet_rsk(req)->ir_rmt_port),
1679 		   TCP_SYN_RECV,
1680 		   0, 0, /* could print option size, but that is af dependent. */
1681 		   1,   /* timers active (only the expire timer) */
1682 		   jiffies_to_clock_t(ttd),
1683 		   req->num_timeout,
1684 		   from_kuid_munged(seq_user_ns(seq),
1685 				    sock_i_uid(req->rsk_listener)),
1686 		   0,  /* non standard timer */
1687 		   0, /* open_requests have no inode */
1688 		   0, req);
1689 }
1690 
1691 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1692 {
1693 	const struct in6_addr *dest, *src;
1694 	__u16 destp, srcp;
1695 	int timer_active;
1696 	unsigned long timer_expires;
1697 	const struct inet_sock *inet = inet_sk(sp);
1698 	const struct tcp_sock *tp = tcp_sk(sp);
1699 	const struct inet_connection_sock *icsk = inet_csk(sp);
1700 	const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1701 	int rx_queue;
1702 	int state;
1703 
1704 	dest  = &sp->sk_v6_daddr;
1705 	src   = &sp->sk_v6_rcv_saddr;
1706 	destp = ntohs(inet->inet_dport);
1707 	srcp  = ntohs(inet->inet_sport);
1708 
1709 	if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1710 		timer_active	= 1;
1711 		timer_expires	= icsk->icsk_timeout;
1712 	} else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1713 		timer_active	= 4;
1714 		timer_expires	= icsk->icsk_timeout;
1715 	} else if (timer_pending(&sp->sk_timer)) {
1716 		timer_active	= 2;
1717 		timer_expires	= sp->sk_timer.expires;
1718 	} else {
1719 		timer_active	= 0;
1720 		timer_expires = jiffies;
1721 	}
1722 
1723 	state = sk_state_load(sp);
1724 	if (state == TCP_LISTEN)
1725 		rx_queue = sp->sk_ack_backlog;
1726 	else
1727 		/* Because we don't lock the socket,
1728 		 * we might find a transient negative value.
1729 		 */
1730 		rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1731 
1732 	seq_printf(seq,
1733 		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1734 		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1735 		   i,
1736 		   src->s6_addr32[0], src->s6_addr32[1],
1737 		   src->s6_addr32[2], src->s6_addr32[3], srcp,
1738 		   dest->s6_addr32[0], dest->s6_addr32[1],
1739 		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1740 		   state,
1741 		   tp->write_seq - tp->snd_una,
1742 		   rx_queue,
1743 		   timer_active,
1744 		   jiffies_delta_to_clock_t(timer_expires - jiffies),
1745 		   icsk->icsk_retransmits,
1746 		   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1747 		   icsk->icsk_probes_out,
1748 		   sock_i_ino(sp),
1749 		   atomic_read(&sp->sk_refcnt), sp,
1750 		   jiffies_to_clock_t(icsk->icsk_rto),
1751 		   jiffies_to_clock_t(icsk->icsk_ack.ato),
1752 		   (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1753 		   tp->snd_cwnd,
1754 		   state == TCP_LISTEN ?
1755 			fastopenq->max_qlen :
1756 			(tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1757 		   );
1758 }
1759 
1760 static void get_timewait6_sock(struct seq_file *seq,
1761 			       struct inet_timewait_sock *tw, int i)
1762 {
1763 	long delta = tw->tw_timer.expires - jiffies;
1764 	const struct in6_addr *dest, *src;
1765 	__u16 destp, srcp;
1766 
1767 	dest = &tw->tw_v6_daddr;
1768 	src  = &tw->tw_v6_rcv_saddr;
1769 	destp = ntohs(tw->tw_dport);
1770 	srcp  = ntohs(tw->tw_sport);
1771 
1772 	seq_printf(seq,
1773 		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1774 		   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1775 		   i,
1776 		   src->s6_addr32[0], src->s6_addr32[1],
1777 		   src->s6_addr32[2], src->s6_addr32[3], srcp,
1778 		   dest->s6_addr32[0], dest->s6_addr32[1],
1779 		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
1780 		   tw->tw_substate, 0, 0,
1781 		   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1782 		   atomic_read(&tw->tw_refcnt), tw);
1783 }
1784 
1785 static int tcp6_seq_show(struct seq_file *seq, void *v)
1786 {
1787 	struct tcp_iter_state *st;
1788 	struct sock *sk = v;
1789 
1790 	if (v == SEQ_START_TOKEN) {
1791 		seq_puts(seq,
1792 			 "  sl  "
1793 			 "local_address                         "
1794 			 "remote_address                        "
1795 			 "st tx_queue rx_queue tr tm->when retrnsmt"
1796 			 "   uid  timeout inode\n");
1797 		goto out;
1798 	}
1799 	st = seq->private;
1800 
1801 	if (sk->sk_state == TCP_TIME_WAIT)
1802 		get_timewait6_sock(seq, v, st->num);
1803 	else if (sk->sk_state == TCP_NEW_SYN_RECV)
1804 		get_openreq6(seq, v, st->num);
1805 	else
1806 		get_tcp6_sock(seq, v, st->num);
1807 out:
1808 	return 0;
1809 }
1810 
1811 static const struct file_operations tcp6_afinfo_seq_fops = {
1812 	.owner   = THIS_MODULE,
1813 	.open    = tcp_seq_open,
1814 	.read    = seq_read,
1815 	.llseek  = seq_lseek,
1816 	.release = seq_release_net
1817 };
1818 
1819 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1820 	.name		= "tcp6",
1821 	.family		= AF_INET6,
1822 	.seq_fops	= &tcp6_afinfo_seq_fops,
1823 	.seq_ops	= {
1824 		.show		= tcp6_seq_show,
1825 	},
1826 };
1827 
1828 int __net_init tcp6_proc_init(struct net *net)
1829 {
1830 	return tcp_proc_register(net, &tcp6_seq_afinfo);
1831 }
1832 
1833 void tcp6_proc_exit(struct net *net)
1834 {
1835 	tcp_proc_unregister(net, &tcp6_seq_afinfo);
1836 }
1837 #endif
1838 
1839 static void tcp_v6_clear_sk(struct sock *sk, int size)
1840 {
1841 	struct inet_sock *inet = inet_sk(sk);
1842 
1843 	/* we do not want to clear pinet6 field, because of RCU lookups */
1844 	sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
1845 
1846 	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
1847 	memset(&inet->pinet6 + 1, 0, size);
1848 }
1849 
1850 struct proto tcpv6_prot = {
1851 	.name			= "TCPv6",
1852 	.owner			= THIS_MODULE,
1853 	.close			= tcp_close,
1854 	.connect		= tcp_v6_connect,
1855 	.disconnect		= tcp_disconnect,
1856 	.accept			= inet_csk_accept,
1857 	.ioctl			= tcp_ioctl,
1858 	.init			= tcp_v6_init_sock,
1859 	.destroy		= tcp_v6_destroy_sock,
1860 	.shutdown		= tcp_shutdown,
1861 	.setsockopt		= tcp_setsockopt,
1862 	.getsockopt		= tcp_getsockopt,
1863 	.recvmsg		= tcp_recvmsg,
1864 	.sendmsg		= tcp_sendmsg,
1865 	.sendpage		= tcp_sendpage,
1866 	.backlog_rcv		= tcp_v6_do_rcv,
1867 	.release_cb		= tcp_release_cb,
1868 	.hash			= inet_hash,
1869 	.unhash			= inet_unhash,
1870 	.get_port		= inet_csk_get_port,
1871 	.enter_memory_pressure	= tcp_enter_memory_pressure,
1872 	.stream_memory_free	= tcp_stream_memory_free,
1873 	.sockets_allocated	= &tcp_sockets_allocated,
1874 	.memory_allocated	= &tcp_memory_allocated,
1875 	.memory_pressure	= &tcp_memory_pressure,
1876 	.orphan_count		= &tcp_orphan_count,
1877 	.sysctl_mem		= sysctl_tcp_mem,
1878 	.sysctl_wmem		= sysctl_tcp_wmem,
1879 	.sysctl_rmem		= sysctl_tcp_rmem,
1880 	.max_header		= MAX_TCP_HEADER,
1881 	.obj_size		= sizeof(struct tcp6_sock),
1882 	.slab_flags		= SLAB_DESTROY_BY_RCU,
1883 	.twsk_prot		= &tcp6_timewait_sock_ops,
1884 	.rsk_prot		= &tcp6_request_sock_ops,
1885 	.h.hashinfo		= &tcp_hashinfo,
1886 	.no_autobind		= true,
1887 #ifdef CONFIG_COMPAT
1888 	.compat_setsockopt	= compat_tcp_setsockopt,
1889 	.compat_getsockopt	= compat_tcp_getsockopt,
1890 #endif
1891 	.clear_sk		= tcp_v6_clear_sk,
1892 	.diag_destroy		= tcp_abort,
1893 };
1894 
1895 static const struct inet6_protocol tcpv6_protocol = {
1896 	.early_demux	=	tcp_v6_early_demux,
1897 	.handler	=	tcp_v6_rcv,
1898 	.err_handler	=	tcp_v6_err,
1899 	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
1900 };
1901 
1902 static struct inet_protosw tcpv6_protosw = {
1903 	.type		=	SOCK_STREAM,
1904 	.protocol	=	IPPROTO_TCP,
1905 	.prot		=	&tcpv6_prot,
1906 	.ops		=	&inet6_stream_ops,
1907 	.flags		=	INET_PROTOSW_PERMANENT |
1908 				INET_PROTOSW_ICSK,
1909 };
1910 
1911 static int __net_init tcpv6_net_init(struct net *net)
1912 {
1913 	return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
1914 				    SOCK_RAW, IPPROTO_TCP, net);
1915 }
1916 
1917 static void __net_exit tcpv6_net_exit(struct net *net)
1918 {
1919 	inet_ctl_sock_destroy(net->ipv6.tcp_sk);
1920 }
1921 
1922 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
1923 {
1924 	inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
1925 }
1926 
1927 static struct pernet_operations tcpv6_net_ops = {
1928 	.init	    = tcpv6_net_init,
1929 	.exit	    = tcpv6_net_exit,
1930 	.exit_batch = tcpv6_net_exit_batch,
1931 };
1932 
1933 int __init tcpv6_init(void)
1934 {
1935 	int ret;
1936 
1937 	ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
1938 	if (ret)
1939 		goto out;
1940 
1941 	/* register inet6 protocol */
1942 	ret = inet6_register_protosw(&tcpv6_protosw);
1943 	if (ret)
1944 		goto out_tcpv6_protocol;
1945 
1946 	ret = register_pernet_subsys(&tcpv6_net_ops);
1947 	if (ret)
1948 		goto out_tcpv6_protosw;
1949 out:
1950 	return ret;
1951 
1952 out_tcpv6_protosw:
1953 	inet6_unregister_protosw(&tcpv6_protosw);
1954 out_tcpv6_protocol:
1955 	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1956 	goto out;
1957 }
1958 
1959 void tcpv6_exit(void)
1960 {
1961 	unregister_pernet_subsys(&tcpv6_net_ops);
1962 	inet6_unregister_protosw(&tcpv6_protosw);
1963 	inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
1964 }
1965