err.no Git - linux-2.6/blob - net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/types.h>
  31 #include <linux/socket.h>
  32 #include <linux/sockios.h>
  33 #include <linux/net.h>
  34 #include <linux/jiffies.h>
  35 #include <linux/in.h>
  36 #include <linux/in6.h>
  37 #include <linux/netdevice.h>
  38 #include <linux/init.h>
  39 #include <linux/jhash.h>
  40 #include <linux/ipsec.h>
  41 #include <linux/times.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62
  63 #include <asm/uaccess.h>
  64
  65 #include <linux/proc_fs.h>
  66 #include <linux/seq_file.h>
  67
  68 #include <linux/crypto.h>
  69 #include <linux/scatterlist.h>
  70
  71 /* Socket used for sending RSTs and ACKs */
  72 static struct socket *tcp6_socket;
  73
  74 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
  76 static void     tcp_v6_send_check(struct sock *sk, int len,
  77                                   struct sk_buff *skb);
  78
  79 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  80
  81 static struct inet_connection_sock_af_ops ipv6_mapped;
  82 static struct inet_connection_sock_af_ops ipv6_specific;
  83 #ifdef CONFIG_TCP_MD5SIG
  84 static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  85 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  86 #endif
  87
  88 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
  89 {
  90         return inet_csk_get_port(&tcp_hashinfo, sk, snum,
  91                                  inet6_csk_bind_conflict);
  92 }
  93
  94 static void tcp_v6_hash(struct sock *sk)
  95 {
  96         if (sk->sk_state != TCP_CLOSE) {
  97                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
  98                         tcp_prot.hash(sk);
  99                         return;
 100                 }
 101                 local_bh_disable();
 102                 __inet6_hash(&tcp_hashinfo, sk);
 103                 local_bh_enable();
 104         }
 105 }
 106
 107 static __inline__ __sum16 tcp_v6_check(struct tcphdr *th, int len,
 108                                    struct in6_addr *saddr,
 109                                    struct in6_addr *daddr,
 110                                    __wsum base)
 111 {
 112         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 113 }
 114
 115 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 116 {
 117         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 118                                             ipv6_hdr(skb)->saddr.s6_addr32,
 119                                             tcp_hdr(skb)->dest,
 120                                             tcp_hdr(skb)->source);
 121 }
 122
 123 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 124                           int addr_len)
 125 {
 126         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 127         struct inet_sock *inet = inet_sk(sk);
 128         struct inet_connection_sock *icsk = inet_csk(sk);
 129         struct ipv6_pinfo *np = inet6_sk(sk);
 130         struct tcp_sock *tp = tcp_sk(sk);
 131         struct in6_addr *saddr = NULL, *final_p = NULL, final;
 132         struct flowi fl;
 133         struct dst_entry *dst;
 134         int addr_type;
 135         int err;
 136
 137         if (addr_len < SIN6_LEN_RFC2133)
 138                 return -EINVAL;
 139
 140         if (usin->sin6_family != AF_INET6)
 141                 return(-EAFNOSUPPORT);
 142
 143         memset(&fl, 0, sizeof(fl));
 144
 145         if (np->sndflow) {
 146                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 147                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 148                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 149                         struct ip6_flowlabel *flowlabel;
 150                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 151                         if (flowlabel == NULL)
 152                                 return -EINVAL;
 153                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 154                         fl6_sock_release(flowlabel);
 155                 }
 156         }
 157
 158         /*
 159          *      connect() to INADDR_ANY means loopback (BSD'ism).
 160          */
 161
 162         if(ipv6_addr_any(&usin->sin6_addr))
 163                 usin->sin6_addr.s6_addr[15] = 0x1;
 164
 165         addr_type = ipv6_addr_type(&usin->sin6_addr);
 166
 167         if(addr_type & IPV6_ADDR_MULTICAST)
 168                 return -ENETUNREACH;
 169
 170         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 171                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 172                     usin->sin6_scope_id) {
 173                         /* If interface is set while binding, indices
 174                          * must coincide.
 175                          */
 176                         if (sk->sk_bound_dev_if &&
 177                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 178                                 return -EINVAL;
 179
 180                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 181                 }
 182
 183                 /* Connect to link-local address requires an interface */
 184                 if (!sk->sk_bound_dev_if)
 185                         return -EINVAL;
 186         }
 187
 188         if (tp->rx_opt.ts_recent_stamp &&
 189             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 190                 tp->rx_opt.ts_recent = 0;
 191                 tp->rx_opt.ts_recent_stamp = 0;
 192                 tp->write_seq = 0;
 193         }
 194
 195         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 196         np->flow_label = fl.fl6_flowlabel;
 197
 198         /*
 199          *      TCP over IPv4
 200          */
 201
 202         if (addr_type == IPV6_ADDR_MAPPED) {
 203                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 204                 struct sockaddr_in sin;
 205
 206                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 207
 208                 if (__ipv6_only_sock(sk))
 209                         return -ENETUNREACH;
 210
 211                 sin.sin_family = AF_INET;
 212                 sin.sin_port = usin->sin6_port;
 213                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 214
 215                 icsk->icsk_af_ops = &ipv6_mapped;
 216                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 217 #ifdef CONFIG_TCP_MD5SIG
 218                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 219 #endif
 220
 221                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 222
 223                 if (err) {
 224                         icsk->icsk_ext_hdr_len = exthdrlen;
 225                         icsk->icsk_af_ops = &ipv6_specific;
 226                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 227 #ifdef CONFIG_TCP_MD5SIG
 228                         tp->af_specific = &tcp_sock_ipv6_specific;
 229 #endif
 230                         goto failure;
 231                 } else {
 232                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 233                                       inet->saddr);
 234                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 235                                       inet->rcv_saddr);
 236                 }
 237
 238                 return err;
 239         }
 240
 241         if (!ipv6_addr_any(&np->rcv_saddr))
 242                 saddr = &np->rcv_saddr;
 243
 244         fl.proto = IPPROTO_TCP;
 245         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 246         ipv6_addr_copy(&fl.fl6_src,
 247                        (saddr ? saddr : &np->saddr));
 248         fl.oif = sk->sk_bound_dev_if;
 249         fl.fl_ip_dport = usin->sin6_port;
 250         fl.fl_ip_sport = inet->sport;
 251
 252         if (np->opt && np->opt->srcrt) {
 253                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 254                 ipv6_addr_copy(&final, &fl.fl6_dst);
 255                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 256                 final_p = &final;
 257         }
 258
 259         security_sk_classify_flow(sk, &fl);
 260
 261         err = ip6_dst_lookup(sk, &dst, &fl);
 262         if (err)
 263                 goto failure;
 264         if (final_p)
 265                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 266
 267         if ((err = __xfrm_lookup(&dst, &fl, sk, 1)) < 0) {
 268                 if (err == -EREMOTE)
 269                         err = ip6_dst_blackhole(sk, &dst, &fl);
 270                 if (err < 0)
 271                         goto failure;
 272         }
 273
 274         if (saddr == NULL) {
 275                 saddr = &fl.fl6_src;
 276                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 277         }
 278
 279         /* set the source address */
 280         ipv6_addr_copy(&np->saddr, saddr);
 281         inet->rcv_saddr = LOOPBACK4_IPV6;
 282
 283         sk->sk_gso_type = SKB_GSO_TCPV6;
 284         __ip6_dst_store(sk, dst, NULL, NULL);
 285
 286         icsk->icsk_ext_hdr_len = 0;
 287         if (np->opt)
 288                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 289                                           np->opt->opt_nflen);
 290
 291         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 292
 293         inet->dport = usin->sin6_port;
 294
 295         tcp_set_state(sk, TCP_SYN_SENT);
 296         err = inet6_hash_connect(&tcp_death_row, sk);
 297         if (err)
 298                 goto late_failure;
 299
 300         if (!tp->write_seq)
 301                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 302                                                              np->daddr.s6_addr32,
 303                                                              inet->sport,
 304                                                              inet->dport);
 305
 306         err = tcp_connect(sk);
 307         if (err)
 308                 goto late_failure;
 309
 310         return 0;
 311
 312 late_failure:
 313         tcp_set_state(sk, TCP_CLOSE);
 314         __sk_dst_reset(sk);
 315 failure:
 316         inet->dport = 0;
 317         sk->sk_route_caps = 0;
 318         return err;
 319 }
 320
 321 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 322                 int type, int code, int offset, __be32 info)
 323 {
 324         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 325         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 326         struct ipv6_pinfo *np;
 327         struct sock *sk;
 328         int err;
 329         struct tcp_sock *tp;
 330         __u32 seq;
 331
 332         sk = inet6_lookup(&tcp_hashinfo, &hdr->daddr, th->dest, &hdr->saddr,
 333                           th->source, skb->dev->ifindex);
 334
 335         if (sk == NULL) {
 336                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 337                 return;
 338         }
 339
 340         if (sk->sk_state == TCP_TIME_WAIT) {
 341                 inet_twsk_put(inet_twsk(sk));
 342                 return;
 343         }
 344
 345         bh_lock_sock(sk);
 346         if (sock_owned_by_user(sk))
 347                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 348
 349         if (sk->sk_state == TCP_CLOSE)
 350                 goto out;
 351
 352         tp = tcp_sk(sk);
 353         seq = ntohl(th->seq);
 354         if (sk->sk_state != TCP_LISTEN &&
 355             !between(seq, tp->snd_una, tp->snd_nxt)) {
 356                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 357                 goto out;
 358         }
 359
 360         np = inet6_sk(sk);
 361
 362         if (type == ICMPV6_PKT_TOOBIG) {
 363                 struct dst_entry *dst = NULL;
 364
 365                 if (sock_owned_by_user(sk))
 366                         goto out;
 367                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 368                         goto out;
 369
 370                 /* icmp should have updated the destination cache entry */
 371                 dst = __sk_dst_check(sk, np->dst_cookie);
 372
 373                 if (dst == NULL) {
 374                         struct inet_sock *inet = inet_sk(sk);
 375                         struct flowi fl;
 376
 377                         /* BUGGG_FUTURE: Again, it is not clear how
 378                            to handle rthdr case. Ignore this complexity
 379                            for now.
 380                          */
 381                         memset(&fl, 0, sizeof(fl));
 382                         fl.proto = IPPROTO_TCP;
 383                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 384                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 385                         fl.oif = sk->sk_bound_dev_if;
 386                         fl.fl_ip_dport = inet->dport;
 387                         fl.fl_ip_sport = inet->sport;
 388                         security_skb_classify_flow(skb, &fl);
 389
 390                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 391                                 sk->sk_err_soft = -err;
 392                                 goto out;
 393                         }
 394
 395                         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
 396                                 sk->sk_err_soft = -err;
 397                                 goto out;
 398                         }
 399
 400                 } else
 401                         dst_hold(dst);
 402
 403                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 404                         tcp_sync_mss(sk, dst_mtu(dst));
 405                         tcp_simple_retransmit(sk);
 406                 } /* else let the usual retransmit timer handle it */
 407                 dst_release(dst);
 408                 goto out;
 409         }
 410
 411         icmpv6_err_convert(type, code, &err);
 412
 413         /* Might be for an request_sock */
 414         switch (sk->sk_state) {
 415                 struct request_sock *req, **prev;
 416         case TCP_LISTEN:
 417                 if (sock_owned_by_user(sk))
 418                         goto out;
 419
 420                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 421                                            &hdr->saddr, inet6_iif(skb));
 422                 if (!req)
 423                         goto out;
 424
 425                 /* ICMPs are not backlogged, hence we cannot get
 426                  * an established socket here.
 427                  */
 428                 BUG_TRAP(req->sk == NULL);
 429
 430                 if (seq != tcp_rsk(req)->snt_isn) {
 431                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 432                         goto out;
 433                 }
 434
 435                 inet_csk_reqsk_queue_drop(sk, req, prev);
 436                 goto out;
 437
 438         case TCP_SYN_SENT:
 439         case TCP_SYN_RECV:  /* Cannot happen.
 440                                It can, it SYNs are crossed. --ANK */
 441                 if (!sock_owned_by_user(sk)) {
 442                         sk->sk_err = err;
 443                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 444
 445                         tcp_done(sk);
 446                 } else
 447                         sk->sk_err_soft = err;
 448                 goto out;
 449         }
 450
 451         if (!sock_owned_by_user(sk) && np->recverr) {
 452                 sk->sk_err = err;
 453                 sk->sk_error_report(sk);
 454         } else
 455                 sk->sk_err_soft = err;
 456
 457 out:
 458         bh_unlock_sock(sk);
 459         sock_put(sk);
 460 }
 461
 462
 463 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 464                               struct dst_entry *dst)
 465 {
 466         struct inet6_request_sock *treq = inet6_rsk(req);
 467         struct ipv6_pinfo *np = inet6_sk(sk);
 468         struct sk_buff * skb;
 469         struct ipv6_txoptions *opt = NULL;
 470         struct in6_addr * final_p = NULL, final;
 471         struct flowi fl;
 472         int err = -1;
 473
 474         memset(&fl, 0, sizeof(fl));
 475         fl.proto = IPPROTO_TCP;
 476         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 477         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 478         fl.fl6_flowlabel = 0;
 479         fl.oif = treq->iif;
 480         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 481         fl.fl_ip_sport = inet_sk(sk)->sport;
 482         security_req_classify_flow(req, &fl);
 483
 484         if (dst == NULL) {
 485                 opt = np->opt;
 486                 if (opt && opt->srcrt) {
 487                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 488                         ipv6_addr_copy(&final, &fl.fl6_dst);
 489                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 490                         final_p = &final;
 491                 }
 492
 493                 err = ip6_dst_lookup(sk, &dst, &fl);
 494                 if (err)
 495                         goto done;
 496                 if (final_p)
 497                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 498                 if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
 499                         goto done;
 500         }
 501
 502         skb = tcp_make_synack(sk, dst, req);
 503         if (skb) {
 504                 struct tcphdr *th = tcp_hdr(skb);
 505
 506                 th->check = tcp_v6_check(th, skb->len,
 507                                          &treq->loc_addr, &treq->rmt_addr,
 508                                          csum_partial((char *)th, skb->len, skb->csum));
 509
 510                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 511                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 512                 err = net_xmit_eval(err);
 513         }
 514
 515 done:
 516         if (opt && opt != np->opt)
 517                 sock_kfree_s(sk, opt, opt->tot_len);
 518         dst_release(dst);
 519         return err;
 520 }
 521
 522 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 523 {
 524         if (inet6_rsk(req)->pktopts)
 525                 kfree_skb(inet6_rsk(req)->pktopts);
 526 }
 527
 528 #ifdef CONFIG_TCP_MD5SIG
 529 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 530                                                    struct in6_addr *addr)
 531 {
 532         struct tcp_sock *tp = tcp_sk(sk);
 533         int i;
 534
 535         BUG_ON(tp == NULL);
 536
 537         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 538                 return NULL;
 539
 540         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 541                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, addr) == 0)
 542                         return &tp->md5sig_info->keys6[i].base;
 543         }
 544         return NULL;
 545 }
 546
 547 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 548                                                 struct sock *addr_sk)
 549 {
 550         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 551 }
 552
 553 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 554                                                       struct request_sock *req)
 555 {
 556         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 557 }
 558
 559 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 560                              char *newkey, u8 newkeylen)
 561 {
 562         /* Add key to the list */
 563         struct tcp6_md5sig_key *key;
 564         struct tcp_sock *tp = tcp_sk(sk);
 565         struct tcp6_md5sig_key *keys;
 566
 567         key = (struct tcp6_md5sig_key*) tcp_v6_md5_do_lookup(sk, peer);
 568         if (key) {
 569                 /* modify existing entry - just update that one */
 570                 kfree(key->base.key);
 571                 key->base.key = newkey;
 572                 key->base.keylen = newkeylen;
 573         } else {
 574                 /* reallocate new list if current one is full. */
 575                 if (!tp->md5sig_info) {
 576                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 577                         if (!tp->md5sig_info) {
 578                                 kfree(newkey);
 579                                 return -ENOMEM;
 580                         }
 581                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 582                 }
 583                 tcp_alloc_md5sig_pool();
 584                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 585                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 586                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 587
 588                         if (!keys) {
 589                                 tcp_free_md5sig_pool();
 590                                 kfree(newkey);
 591                                 return -ENOMEM;
 592                         }
 593
 594                         if (tp->md5sig_info->entries6)
 595                                 memmove(keys, tp->md5sig_info->keys6,
 596                                         (sizeof (tp->md5sig_info->keys6[0]) *
 597                                          tp->md5sig_info->entries6));
 598
 599                         kfree(tp->md5sig_info->keys6);
 600                         tp->md5sig_info->keys6 = keys;
 601                         tp->md5sig_info->alloced6++;
 602                 }
 603
 604                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 605                                peer);
 606                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 607                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 608
 609                 tp->md5sig_info->entries6++;
 610         }
 611         return 0;
 612 }
 613
 614 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 615                                u8 *newkey, __u8 newkeylen)
 616 {
 617         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 618                                  newkey, newkeylen);
 619 }
 620
 621 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
 622 {
 623         struct tcp_sock *tp = tcp_sk(sk);
 624         int i;
 625
 626         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 627                 if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, peer) == 0) {
 628                         /* Free the key */
 629                         kfree(tp->md5sig_info->keys6[i].base.key);
 630                         tp->md5sig_info->entries6--;
 631
 632                         if (tp->md5sig_info->entries6 == 0) {
 633                                 kfree(tp->md5sig_info->keys6);
 634                                 tp->md5sig_info->keys6 = NULL;
 635                                 tp->md5sig_info->alloced6 = 0;
 636
 637                                 tcp_free_md5sig_pool();
 638
 639                                 return 0;
 640                         } else {
 641                                 /* shrink the database */
 642                                 if (tp->md5sig_info->entries6 != i)
 643                                         memmove(&tp->md5sig_info->keys6[i],
 644                                                 &tp->md5sig_info->keys6[i+1],
 645                                                 (tp->md5sig_info->entries6 - i)
 646                                                 * sizeof (tp->md5sig_info->keys6[0]));
 647                         }
 648                 }
 649         }
 650         return -ENOENT;
 651 }
 652
 653 static void tcp_v6_clear_md5_list (struct sock *sk)
 654 {
 655         struct tcp_sock *tp = tcp_sk(sk);
 656         int i;
 657
 658         if (tp->md5sig_info->entries6) {
 659                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 660                         kfree(tp->md5sig_info->keys6[i].base.key);
 661                 tp->md5sig_info->entries6 = 0;
 662                 tcp_free_md5sig_pool();
 663         }
 664
 665         kfree(tp->md5sig_info->keys6);
 666         tp->md5sig_info->keys6 = NULL;
 667         tp->md5sig_info->alloced6 = 0;
 668
 669         if (tp->md5sig_info->entries4) {
 670                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 671                         kfree(tp->md5sig_info->keys4[i].base.key);
 672                 tp->md5sig_info->entries4 = 0;
 673                 tcp_free_md5sig_pool();
 674         }
 675
 676         kfree(tp->md5sig_info->keys4);
 677         tp->md5sig_info->keys4 = NULL;
 678         tp->md5sig_info->alloced4 = 0;
 679 }
 680
 681 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 682                                   int optlen)
 683 {
 684         struct tcp_md5sig cmd;
 685         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 686         u8 *newkey;
 687
 688         if (optlen < sizeof(cmd))
 689                 return -EINVAL;
 690
 691         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 692                 return -EFAULT;
 693
 694         if (sin6->sin6_family != AF_INET6)
 695                 return -EINVAL;
 696
 697         if (!cmd.tcpm_keylen) {
 698                 if (!tcp_sk(sk)->md5sig_info)
 699                         return -ENOENT;
 700                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 701                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 702                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 703         }
 704
 705         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 706                 return -EINVAL;
 707
 708         if (!tcp_sk(sk)->md5sig_info) {
 709                 struct tcp_sock *tp = tcp_sk(sk);
 710                 struct tcp_md5sig_info *p;
 711
 712                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 713                 if (!p)
 714                         return -ENOMEM;
 715
 716                 tp->md5sig_info = p;
 717                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
 718         }
 719
 720         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 721         if (!newkey)
 722                 return -ENOMEM;
 723         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 724                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 725                                          newkey, cmd.tcpm_keylen);
 726         }
 727         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 728 }
 729
 730 static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 731                                    struct in6_addr *saddr,
 732                                    struct in6_addr *daddr,
 733                                    struct tcphdr *th, int protocol,
 734                                    int tcplen)
 735 {
 736         struct scatterlist sg[4];
 737         __u16 data_len;
 738         int block = 0;
 739         __sum16 cksum;
 740         struct tcp_md5sig_pool *hp;
 741         struct tcp6_pseudohdr *bp;
 742         struct hash_desc *desc;
 743         int err;
 744         unsigned int nbytes = 0;
 745
 746         hp = tcp_get_md5sig_pool();
 747         if (!hp) {
 748                 printk(KERN_WARNING "%s(): hash pool not found...\n", __FUNCTION__);
 749                 goto clear_hash_noput;
 750         }
 751         bp = &hp->md5_blk.ip6;
 752         desc = &hp->md5_desc;
 753
 754         /* 1. TCP pseudo-header (RFC2460) */
 755         ipv6_addr_copy(&bp->saddr, saddr);
 756         ipv6_addr_copy(&bp->daddr, daddr);
 757         bp->len = htonl(tcplen);
 758         bp->protocol = htonl(protocol);
 759
 760         sg_init_table(sg, 4);
 761
 762         sg_set_buf(&sg[block++], bp, sizeof(*bp));
 763         nbytes += sizeof(*bp);
 764
 765         /* 2. TCP header, excluding options */
 766         cksum = th->check;
 767         th->check = 0;
 768         sg_set_buf(&sg[block++], th, sizeof(*th));
 769         nbytes += sizeof(*th);
 770
 771         /* 3. TCP segment data (if any) */
 772         data_len = tcplen - (th->doff << 2);
 773         if (data_len > 0) {
 774                 u8 *data = (u8 *)th + (th->doff << 2);
 775                 sg_set_buf(&sg[block++], data, data_len);
 776                 nbytes += data_len;
 777         }
 778
 779         /* 4. shared key */
 780         sg_set_buf(&sg[block++], key->key, key->keylen);
 781         nbytes += key->keylen;
 782
 783         sg_mark_end(sg, block);
 784
 785         /* Now store the hash into the packet */
 786         err = crypto_hash_init(desc);
 787         if (err) {
 788                 printk(KERN_WARNING "%s(): hash_init failed\n", __FUNCTION__);
 789                 goto clear_hash;
 790         }
 791         err = crypto_hash_update(desc, sg, nbytes);
 792         if (err) {
 793                 printk(KERN_WARNING "%s(): hash_update failed\n", __FUNCTION__);
 794                 goto clear_hash;
 795         }
 796         err = crypto_hash_final(desc, md5_hash);
 797         if (err) {
 798                 printk(KERN_WARNING "%s(): hash_final failed\n", __FUNCTION__);
 799                 goto clear_hash;
 800         }
 801
 802         /* Reset header, and free up the crypto */
 803         tcp_put_md5sig_pool();
 804         th->check = cksum;
 805 out:
 806         return 0;
 807 clear_hash:
 808         tcp_put_md5sig_pool();
 809 clear_hash_noput:
 810         memset(md5_hash, 0, 16);
 811         goto out;
 812 }
 813
 814 static int tcp_v6_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
 815                                 struct sock *sk,
 816                                 struct dst_entry *dst,
 817                                 struct request_sock *req,
 818                                 struct tcphdr *th, int protocol,
 819                                 int tcplen)
 820 {
 821         struct in6_addr *saddr, *daddr;
 822
 823         if (sk) {
 824                 saddr = &inet6_sk(sk)->saddr;
 825                 daddr = &inet6_sk(sk)->daddr;
 826         } else {
 827                 saddr = &inet6_rsk(req)->loc_addr;
 828                 daddr = &inet6_rsk(req)->rmt_addr;
 829         }
 830         return tcp_v6_do_calc_md5_hash(md5_hash, key,
 831                                        saddr, daddr,
 832                                        th, protocol, tcplen);
 833 }
 834
 835 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 836 {
 837         __u8 *hash_location = NULL;
 838         struct tcp_md5sig_key *hash_expected;
 839         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 840         struct tcphdr *th = tcp_hdr(skb);
 841         int length = (th->doff << 2) - sizeof (*th);
 842         int genhash;
 843         u8 *ptr;
 844         u8 newhash[16];
 845
 846         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 847
 848         /* If the TCP option is too short, we can short cut */
 849         if (length < TCPOLEN_MD5SIG)
 850                 return hash_expected ? 1 : 0;
 851
 852         /* parse options */
 853         ptr = (u8*)(th + 1);
 854         while (length > 0) {
 855                 int opcode = *ptr++;
 856                 int opsize;
 857
 858                 switch(opcode) {
 859                 case TCPOPT_EOL:
 860                         goto done_opts;
 861                 case TCPOPT_NOP:
 862                         length--;
 863                         continue;
 864                 default:
 865                         opsize = *ptr++;
 866                         if (opsize < 2 || opsize > length)
 867                                 goto done_opts;
 868                         if (opcode == TCPOPT_MD5SIG) {
 869                                 hash_location = ptr;
 870                                 goto done_opts;
 871                         }
 872                 }
 873                 ptr += opsize - 2;
 874                 length -= opsize;
 875         }
 876
 877 done_opts:
 878         /* do we have a hash as expected? */
 879         if (!hash_expected) {
 880                 if (!hash_location)
 881                         return 0;
 882                 if (net_ratelimit()) {
 883                         printk(KERN_INFO "MD5 Hash NOT expected but found "
 884                                "(" NIP6_FMT ", %u)->"
 885                                "(" NIP6_FMT ", %u)\n",
 886                                NIP6(ip6h->saddr), ntohs(th->source),
 887                                NIP6(ip6h->daddr), ntohs(th->dest));
 888                 }
 889                 return 1;
 890         }
 891
 892         if (!hash_location) {
 893                 if (net_ratelimit()) {
 894                         printk(KERN_INFO "MD5 Hash expected but NOT found "
 895                                "(" NIP6_FMT ", %u)->"
 896                                "(" NIP6_FMT ", %u)\n",
 897                                NIP6(ip6h->saddr), ntohs(th->source),
 898                                NIP6(ip6h->daddr), ntohs(th->dest));
 899                 }
 900                 return 1;
 901         }
 902
 903         /* check the signature */
 904         genhash = tcp_v6_do_calc_md5_hash(newhash,
 905                                           hash_expected,
 906                                           &ip6h->saddr, &ip6h->daddr,
 907                                           th, sk->sk_protocol,
 908                                           skb->len);
 909         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 910                 if (net_ratelimit()) {
 911                         printk(KERN_INFO "MD5 Hash %s for "
 912                                "(" NIP6_FMT ", %u)->"
 913                                "(" NIP6_FMT ", %u)\n",
 914                                genhash ? "failed" : "mismatch",
 915                                NIP6(ip6h->saddr), ntohs(th->source),
 916                                NIP6(ip6h->daddr), ntohs(th->dest));
 917                 }
 918                 return 1;
 919         }
 920         return 0;
 921 }
 922 #endif
 923
 924 static struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 925         .family         =       AF_INET6,
 926         .obj_size       =       sizeof(struct tcp6_request_sock),
 927         .rtx_syn_ack    =       tcp_v6_send_synack,
 928         .send_ack       =       tcp_v6_reqsk_send_ack,
 929         .destructor     =       tcp_v6_reqsk_destructor,
 930         .send_reset     =       tcp_v6_send_reset
 931 };
 932
 933 #ifdef CONFIG_TCP_MD5SIG
 934 static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 935         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 936 };
 937 #endif
 938
 939 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
 940         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
 941         .twsk_unique    = tcp_twsk_unique,
 942         .twsk_destructor= tcp_twsk_destructor,
 943 };
 944
 945 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 946 {
 947         struct ipv6_pinfo *np = inet6_sk(sk);
 948         struct tcphdr *th = tcp_hdr(skb);
 949
 950         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 951                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 952                 skb->csum_start = skb_transport_header(skb) - skb->head;
 953                 skb->csum_offset = offsetof(struct tcphdr, check);
 954         } else {
 955                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 956                                             csum_partial((char *)th, th->doff<<2,
 957                                                          skb->csum));
 958         }
 959 }
 960
 961 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 962 {
 963         struct ipv6hdr *ipv6h;
 964         struct tcphdr *th;
 965
 966         if (!pskb_may_pull(skb, sizeof(*th)))
 967                 return -EINVAL;
 968
 969         ipv6h = ipv6_hdr(skb);
 970         th = tcp_hdr(skb);
 971
 972         th->check = 0;
 973         th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
 974                                      IPPROTO_TCP, 0);
 975         skb->csum_start = skb_transport_header(skb) - skb->head;
 976         skb->csum_offset = offsetof(struct tcphdr, check);
 977         skb->ip_summed = CHECKSUM_PARTIAL;
 978         return 0;
 979 }
 980
 981 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 982 {
 983         struct tcphdr *th = tcp_hdr(skb), *t1;
 984         struct sk_buff *buff;
 985         struct flowi fl;
 986         int tot_len = sizeof(*th);
 987 #ifdef CONFIG_TCP_MD5SIG
 988         struct tcp_md5sig_key *key;
 989 #endif
 990
 991         if (th->rst)
 992                 return;
 993
 994         if (!ipv6_unicast_destination(skb))
 995                 return;
 996
 997 #ifdef CONFIG_TCP_MD5SIG
 998         if (sk)
 999                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1000         else
1001                 key = NULL;
1002
1003         if (key)
1004                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1005 #endif
1006
1007         /*
1008          * We need to grab some memory, and put together an RST,
1009          * and then put it into the queue to be sent.
1010          */
1011
1012         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1013                          GFP_ATOMIC);
1014         if (buff == NULL)
1015                 return;
1016
1017         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1018
1019         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1020
1021         /* Swap the send and the receive. */
1022         memset(t1, 0, sizeof(*t1));
1023         t1->dest = th->source;
1024         t1->source = th->dest;
1025         t1->doff = tot_len / 4;
1026         t1->rst = 1;
1027
1028         if(th->ack) {
1029                 t1->seq = th->ack_seq;
1030         } else {
1031                 t1->ack = 1;
1032                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
1033                                     + skb->len - (th->doff<<2));
1034         }
1035
1036 #ifdef CONFIG_TCP_MD5SIG
1037         if (key) {
1038                 __be32 *opt = (__be32*)(t1 + 1);
1039                 opt[0] = htonl((TCPOPT_NOP << 24) |
1040                                (TCPOPT_NOP << 16) |
1041                                (TCPOPT_MD5SIG << 8) |
1042                                TCPOLEN_MD5SIG);
1043                 tcp_v6_do_calc_md5_hash((__u8 *)&opt[1], key,
1044                                         &ipv6_hdr(skb)->daddr,
1045                                         &ipv6_hdr(skb)->saddr,
1046                                         t1, IPPROTO_TCP, tot_len);
1047         }
1048 #endif
1049
1050         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
1051
1052         memset(&fl, 0, sizeof(fl));
1053         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1054         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1055
1056         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1057                                     sizeof(*t1), IPPROTO_TCP,
1058                                     buff->csum);
1059
1060         fl.proto = IPPROTO_TCP;
1061         fl.oif = inet6_iif(skb);
1062         fl.fl_ip_dport = t1->dest;
1063         fl.fl_ip_sport = t1->source;
1064         security_skb_classify_flow(skb, &fl);
1065
1066         /* sk = NULL, but it is safe for now. RST socket required. */
1067         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1068
1069                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1070                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1071                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1072                         TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
1073                         return;
1074                 }
1075         }
1076
1077         kfree_skb(buff);
1078 }
1079
1080 static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
1081                             struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
1082 {
1083         struct tcphdr *th = tcp_hdr(skb), *t1;
1084         struct sk_buff *buff;
1085         struct flowi fl;
1086         int tot_len = sizeof(struct tcphdr);
1087         __be32 *topt;
1088 #ifdef CONFIG_TCP_MD5SIG
1089         struct tcp_md5sig_key *key;
1090         struct tcp_md5sig_key tw_key;
1091 #endif
1092
1093 #ifdef CONFIG_TCP_MD5SIG
1094         if (!tw && skb->sk) {
1095                 key = tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr);
1096         } else if (tw && tw->tw_md5_keylen) {
1097                 tw_key.key = tw->tw_md5_key;
1098                 tw_key.keylen = tw->tw_md5_keylen;
1099                 key = &tw_key;
1100         } else {
1101                 key = NULL;
1102         }
1103 #endif
1104
1105         if (ts)
1106                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
1107 #ifdef CONFIG_TCP_MD5SIG
1108         if (key)
1109                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1110 #endif
1111
1112         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1113                          GFP_ATOMIC);
1114         if (buff == NULL)
1115                 return;
1116
1117         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1118
1119         t1 = (struct tcphdr *) skb_push(buff,tot_len);
1120
1121         /* Swap the send and the receive. */
1122         memset(t1, 0, sizeof(*t1));
1123         t1->dest = th->source;
1124         t1->source = th->dest;
1125         t1->doff = tot_len/4;
1126         t1->seq = htonl(seq);
1127         t1->ack_seq = htonl(ack);
1128         t1->ack = 1;
1129         t1->window = htons(win);
1130
1131         topt = (__be32 *)(t1 + 1);
1132
1133         if (ts) {
1134                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1135                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1136                 *topt++ = htonl(tcp_time_stamp);
1137                 *topt = htonl(ts);
1138         }
1139
1140 #ifdef CONFIG_TCP_MD5SIG
1141         if (key) {
1142                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1143                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1144                 tcp_v6_do_calc_md5_hash((__u8 *)topt, key,
1145                                         &ipv6_hdr(skb)->daddr,
1146                                         &ipv6_hdr(skb)->saddr,
1147                                         t1, IPPROTO_TCP, tot_len);
1148         }
1149 #endif
1150
1151         buff->csum = csum_partial((char *)t1, tot_len, 0);
1152
1153         memset(&fl, 0, sizeof(fl));
1154         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1155         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1156
1157         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1158                                     tot_len, IPPROTO_TCP,
1159                                     buff->csum);
1160
1161         fl.proto = IPPROTO_TCP;
1162         fl.oif = inet6_iif(skb);
1163         fl.fl_ip_dport = t1->dest;
1164         fl.fl_ip_sport = t1->source;
1165         security_skb_classify_flow(skb, &fl);
1166
1167         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1168                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
1169                         ip6_xmit(tcp6_socket->sk, buff, &fl, NULL, 0);
1170                         TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
1171                         return;
1172                 }
1173         }
1174
1175         kfree_skb(buff);
1176 }
1177
1178 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1179 {
1180         struct inet_timewait_sock *tw = inet_twsk(sk);
1181         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1182
1183         tcp_v6_send_ack(tcptw, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1184                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1185                         tcptw->tw_ts_recent);
1186
1187         inet_twsk_put(tw);
1188 }
1189
1190 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
1191 {
1192         tcp_v6_send_ack(NULL, skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
1193 }
1194
1195
1196 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1197 {
1198         struct request_sock *req, **prev;
1199         const struct tcphdr *th = tcp_hdr(skb);
1200         struct sock *nsk;
1201
1202         /* Find possible connection requests. */
1203         req = inet6_csk_search_req(sk, &prev, th->source,
1204                                    &ipv6_hdr(skb)->saddr,
1205                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1206         if (req)
1207                 return tcp_check_req(sk, skb, req, prev);
1208
1209         nsk = __inet6_lookup_established(&tcp_hashinfo, &ipv6_hdr(skb)->saddr,
1210                                          th->source, &ipv6_hdr(skb)->daddr,
1211                                          ntohs(th->dest), inet6_iif(skb));
1212
1213         if (nsk) {
1214                 if (nsk->sk_state != TCP_TIME_WAIT) {
1215                         bh_lock_sock(nsk);
1216                         return nsk;
1217                 }
1218                 inet_twsk_put(inet_twsk(nsk));
1219                 return NULL;
1220         }
1221
1222 #if 0 /*def CONFIG_SYN_COOKIES*/
1223         if (!th->rst && !th->syn && th->ack)
1224                 sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
1225 #endif
1226         return sk;
1227 }
1228
1229 /* FIXME: this is substantially similar to the ipv4 code.
1230  * Can some kind of merge be done? -- erics
1231  */
1232 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1233 {
1234         struct inet6_request_sock *treq;
1235         struct ipv6_pinfo *np = inet6_sk(sk);
1236         struct tcp_options_received tmp_opt;
1237         struct tcp_sock *tp = tcp_sk(sk);
1238         struct request_sock *req = NULL;
1239         __u32 isn = TCP_SKB_CB(skb)->when;
1240
1241         if (skb->protocol == htons(ETH_P_IP))
1242                 return tcp_v4_conn_request(sk, skb);
1243
1244         if (!ipv6_unicast_destination(skb))
1245                 goto drop;
1246
1247         /*
1248          *      There are no SYN attacks on IPv6, yet...
1249          */
1250         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1251                 if (net_ratelimit())
1252                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
1253                 goto drop;
1254         }
1255
1256         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1257                 goto drop;
1258
1259         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1260         if (req == NULL)
1261                 goto drop;
1262
1263 #ifdef CONFIG_TCP_MD5SIG
1264         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1265 #endif
1266
1267         tcp_clear_options(&tmp_opt);
1268         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1269         tmp_opt.user_mss = tp->rx_opt.user_mss;
1270
1271         tcp_parse_options(skb, &tmp_opt, 0);
1272
1273         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1274         tcp_openreq_init(req, &tmp_opt, skb);
1275
1276         treq = inet6_rsk(req);
1277         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1278         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1279         TCP_ECN_create_request(req, tcp_hdr(skb));
1280         treq->pktopts = NULL;
1281         if (ipv6_opt_accepted(sk, skb) ||
1282             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1283             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1284                 atomic_inc(&skb->users);
1285                 treq->pktopts = skb;
1286         }
1287         treq->iif = sk->sk_bound_dev_if;
1288
1289         /* So that link locals have meaning */
1290         if (!sk->sk_bound_dev_if &&
1291             ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1292                 treq->iif = inet6_iif(skb);
1293
1294         if (isn == 0)
1295                 isn = tcp_v6_init_sequence(skb);
1296
1297         tcp_rsk(req)->snt_isn = isn;
1298
1299         security_inet_conn_request(sk, skb, req);
1300
1301         if (tcp_v6_send_synack(sk, req, NULL))
1302                 goto drop;
1303
1304         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1305         return 0;
1306
1307 drop:
1308         if (req)
1309                 reqsk_free(req);
1310
1311         return 0; /* don't send reset */
1312 }
1313
1314 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1315                                           struct request_sock *req,
1316                                           struct dst_entry *dst)
1317 {
1318         struct inet6_request_sock *treq = inet6_rsk(req);
1319         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1320         struct tcp6_sock *newtcp6sk;
1321         struct inet_sock *newinet;
1322         struct tcp_sock *newtp;
1323         struct sock *newsk;
1324         struct ipv6_txoptions *opt;
1325 #ifdef CONFIG_TCP_MD5SIG
1326         struct tcp_md5sig_key *key;
1327 #endif
1328
1329         if (skb->protocol == htons(ETH_P_IP)) {
1330                 /*
1331                  *      v6 mapped
1332                  */
1333
1334                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1335
1336                 if (newsk == NULL)
1337                         return NULL;
1338
1339                 newtcp6sk = (struct tcp6_sock *)newsk;
1340                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1341
1342                 newinet = inet_sk(newsk);
1343                 newnp = inet6_sk(newsk);
1344                 newtp = tcp_sk(newsk);
1345
1346                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1347
1348                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
1349                               newinet->daddr);
1350
1351                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
1352                               newinet->saddr);
1353
1354                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1355
1356                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1357                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1358 #ifdef CONFIG_TCP_MD5SIG
1359                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1360 #endif
1361
1362                 newnp->pktoptions  = NULL;
1363                 newnp->opt         = NULL;
1364                 newnp->mcast_oif   = inet6_iif(skb);
1365                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1366
1367                 /*
1368                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1369                  * here, tcp_create_openreq_child now does this for us, see the comment in
1370                  * that function for the gory details. -acme
1371                  */
1372
1373                 /* It is tricky place. Until this moment IPv4 tcp
1374                    worked with IPv6 icsk.icsk_af_ops.
1375                    Sync it now.
1376                  */
1377                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1378
1379                 return newsk;
1380         }
1381
1382         opt = np->opt;
1383
1384         if (sk_acceptq_is_full(sk))
1385                 goto out_overflow;
1386
1387         if (dst == NULL) {
1388                 struct in6_addr *final_p = NULL, final;
1389                 struct flowi fl;
1390
1391                 memset(&fl, 0, sizeof(fl));
1392                 fl.proto = IPPROTO_TCP;
1393                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
1394                 if (opt && opt->srcrt) {
1395                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
1396                         ipv6_addr_copy(&final, &fl.fl6_dst);
1397                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1398                         final_p = &final;
1399                 }
1400                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
1401                 fl.oif = sk->sk_bound_dev_if;
1402                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
1403                 fl.fl_ip_sport = inet_sk(sk)->sport;
1404                 security_req_classify_flow(req, &fl);
1405
1406                 if (ip6_dst_lookup(sk, &dst, &fl))
1407                         goto out;
1408
1409                 if (final_p)
1410                         ipv6_addr_copy(&fl.fl6_dst, final_p);
1411
1412                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
1413                         goto out;
1414         }
1415
1416         newsk = tcp_create_openreq_child(sk, req, skb);
1417         if (newsk == NULL)
1418                 goto out;
1419
1420         /*
1421          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1422          * count here, tcp_create_openreq_child now does this for us, see the
1423          * comment in that function for the gory details. -acme
1424          */
1425
1426         newsk->sk_gso_type = SKB_GSO_TCPV6;
1427         __ip6_dst_store(newsk, dst, NULL, NULL);
1428
1429         newtcp6sk = (struct tcp6_sock *)newsk;
1430         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1431
1432         newtp = tcp_sk(newsk);
1433         newinet = inet_sk(newsk);
1434         newnp = inet6_sk(newsk);
1435
1436         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1437
1438         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1439         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1440         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1441         newsk->sk_bound_dev_if = treq->iif;
1442
1443         /* Now IPv6 options...
1444
1445            First: no IPv4 options.
1446          */
1447         newinet->opt = NULL;
1448         newnp->ipv6_fl_list = NULL;
1449
1450         /* Clone RX bits */
1451         newnp->rxopt.all = np->rxopt.all;
1452
1453         /* Clone pktoptions received with SYN */
1454         newnp->pktoptions = NULL;
1455         if (treq->pktopts != NULL) {
1456                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1457                 kfree_skb(treq->pktopts);
1458                 treq->pktopts = NULL;
1459                 if (newnp->pktoptions)
1460                         skb_set_owner_r(newnp->pktoptions, newsk);
1461         }
1462         newnp->opt        = NULL;
1463         newnp->mcast_oif  = inet6_iif(skb);
1464         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1465
1466         /* Clone native IPv6 options from listening socket (if any)
1467
1468            Yes, keeping reference count would be much more clever,
1469            but we make one more one thing there: reattach optmem
1470            to newsk.
1471          */
1472         if (opt) {
1473                 newnp->opt = ipv6_dup_options(newsk, opt);
1474                 if (opt != np->opt)
1475                         sock_kfree_s(sk, opt, opt->tot_len);
1476         }
1477
1478         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1479         if (newnp->opt)
1480                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1481                                                      newnp->opt->opt_flen);
1482
1483         tcp_mtup_init(newsk);
1484         tcp_sync_mss(newsk, dst_mtu(dst));
1485         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
1486         tcp_initialize_rcv_mss(newsk);
1487
1488         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
1489
1490 #ifdef CONFIG_TCP_MD5SIG
1491         /* Copy over the MD5 key from the original socket */
1492         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1493                 /* We're using one, so create a matching key
1494                  * on the newsk structure. If we fail to get
1495                  * memory, then we end up not copying the key
1496                  * across. Shucks.
1497                  */
1498                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1499                 if (newkey != NULL)
1500                         tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
1501                                           newkey, key->keylen);
1502         }
1503 #endif
1504
1505         __inet6_hash(&tcp_hashinfo, newsk);
1506         inet_inherit_port(&tcp_hashinfo, sk, newsk);
1507
1508         return newsk;
1509
1510 out_overflow:
1511         NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
1512 out:
1513         NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
1514         if (opt && opt != np->opt)
1515                 sock_kfree_s(sk, opt, opt->tot_len);
1516         dst_release(dst);
1517         return NULL;
1518 }
1519
1520 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1521 {
1522         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1523                 if (!tcp_v6_check(tcp_hdr(skb), skb->len, &ipv6_hdr(skb)->saddr,
1524                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1525                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1526                         return 0;
1527                 }
1528         }
1529
1530         skb->csum = ~csum_unfold(tcp_v6_check(tcp_hdr(skb), skb->len,
1531                                               &ipv6_hdr(skb)->saddr,
1532                                               &ipv6_hdr(skb)->daddr, 0));
1533
1534         if (skb->len <= 76) {
1535                 return __skb_checksum_complete(skb);
1536         }
1537         return 0;
1538 }
1539
1540 /* The socket must have it's spinlock held when we get
1541  * here.
1542  *
1543  * We have a potential double-lock case here, so even when
1544  * doing backlog processing we use the BH locking scheme.
1545  * This is because we cannot sleep with the original spinlock
1546  * held.
1547  */
1548 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1549 {
1550         struct ipv6_pinfo *np = inet6_sk(sk);
1551         struct tcp_sock *tp;
1552         struct sk_buff *opt_skb = NULL;
1553
1554         /* Imagine: socket is IPv6. IPv4 packet arrives,
1555            goes to IPv4 receive handler and backlogged.
1556            From backlog it always goes here. Kerboom...
1557            Fortunately, tcp_rcv_established and rcv_established
1558            handle them correctly, but it is not case with
1559            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1560          */
1561
1562         if (skb->protocol == htons(ETH_P_IP))
1563                 return tcp_v4_do_rcv(sk, skb);
1564
1565 #ifdef CONFIG_TCP_MD5SIG
1566         if (tcp_v6_inbound_md5_hash (sk, skb))
1567                 goto discard;
1568 #endif
1569
1570         if (sk_filter(sk, skb))
1571                 goto discard;
1572
1573         /*
1574          *      socket locking is here for SMP purposes as backlog rcv
1575          *      is currently called with bh processing disabled.
1576          */
1577
1578         /* Do Stevens' IPV6_PKTOPTIONS.
1579
1580            Yes, guys, it is the only place in our code, where we
1581            may make it not affecting IPv4.
1582            The rest of code is protocol independent,
1583            and I do not like idea to uglify IPv4.
1584
1585            Actually, all the idea behind IPV6_PKTOPTIONS
1586            looks not very well thought. For now we latch
1587            options, received in the last packet, enqueued
1588            by tcp. Feel free to propose better solution.
1589                                                --ANK (980728)
1590          */
1591         if (np->rxopt.all)
1592                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1593
1594         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1595                 TCP_CHECK_TIMER(sk);
1596                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1597                         goto reset;
1598                 TCP_CHECK_TIMER(sk);
1599                 if (opt_skb)
1600                         goto ipv6_pktoptions;
1601                 return 0;
1602         }
1603
1604         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1605                 goto csum_err;
1606
1607         if (sk->sk_state == TCP_LISTEN) {
1608                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1609                 if (!nsk)
1610                         goto discard;
1611
1612                 /*
1613                  * Queue it on the new socket if the new socket is active,
1614                  * otherwise we just shortcircuit this and continue with
1615                  * the new socket..
1616                  */
1617                 if(nsk != sk) {
1618                         if (tcp_child_process(sk, nsk, skb))
1619                                 goto reset;
1620                         if (opt_skb)
1621                                 __kfree_skb(opt_skb);
1622                         return 0;
1623                 }
1624         }
1625
1626         TCP_CHECK_TIMER(sk);
1627         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1628                 goto reset;
1629         TCP_CHECK_TIMER(sk);
1630         if (opt_skb)
1631                 goto ipv6_pktoptions;
1632         return 0;
1633
1634 reset:
1635         tcp_v6_send_reset(sk, skb);
1636 discard:
1637         if (opt_skb)
1638                 __kfree_skb(opt_skb);
1639         kfree_skb(skb);
1640         return 0;
1641 csum_err:
1642         TCP_INC_STATS_BH(TCP_MIB_INERRS);
1643         goto discard;
1644
1645
1646 ipv6_pktoptions:
1647         /* Do you ask, what is it?
1648
1649            1. skb was enqueued by tcp.
1650            2. skb is added to tail of read queue, rather than out of order.
1651            3. socket is not in passive state.
1652            4. Finally, it really contains options, which user wants to receive.
1653          */
1654         tp = tcp_sk(sk);
1655         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1656             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1657                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1658                         np->mcast_oif = inet6_iif(opt_skb);
1659                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1660                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1661                 if (ipv6_opt_accepted(sk, opt_skb)) {
1662                         skb_set_owner_r(opt_skb, sk);
1663                         opt_skb = xchg(&np->pktoptions, opt_skb);
1664                 } else {
1665                         __kfree_skb(opt_skb);
1666                         opt_skb = xchg(&np->pktoptions, NULL);
1667                 }
1668         }
1669
1670         if (opt_skb)
1671                 kfree_skb(opt_skb);
1672         return 0;
1673 }
1674
1675 static int tcp_v6_rcv(struct sk_buff *skb)
1676 {
1677         struct tcphdr *th;
1678         struct sock *sk;
1679         int ret;
1680
1681         if (skb->pkt_type != PACKET_HOST)
1682                 goto discard_it;
1683
1684         /*
1685          *      Count it even if it's bad.
1686          */
1687         TCP_INC_STATS_BH(TCP_MIB_INSEGS);
1688
1689         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1690                 goto discard_it;
1691
1692         th = tcp_hdr(skb);
1693
1694         if (th->doff < sizeof(struct tcphdr)/4)
1695                 goto bad_packet;
1696         if (!pskb_may_pull(skb, th->doff*4))
1697                 goto discard_it;
1698
1699         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1700                 goto bad_packet;
1701
1702         th = tcp_hdr(skb);
1703         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1704         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1705                                     skb->len - th->doff*4);
1706         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1707         TCP_SKB_CB(skb)->when = 0;
1708         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
1709         TCP_SKB_CB(skb)->sacked = 0;
1710
1711         sk = __inet6_lookup(&tcp_hashinfo, &ipv6_hdr(skb)->saddr, th->source,
1712                             &ipv6_hdr(skb)->daddr, ntohs(th->dest),
1713                             inet6_iif(skb));
1714
1715         if (!sk)
1716                 goto no_tcp_socket;
1717
1718 process:
1719         if (sk->sk_state == TCP_TIME_WAIT)
1720                 goto do_time_wait;
1721
1722         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1723                 goto discard_and_relse;
1724
1725         if (sk_filter(sk, skb))
1726                 goto discard_and_relse;
1727
1728         skb->dev = NULL;
1729
1730         bh_lock_sock_nested(sk);
1731         ret = 0;
1732         if (!sock_owned_by_user(sk)) {
1733 #ifdef CONFIG_NET_DMA
1734                 struct tcp_sock *tp = tcp_sk(sk);
1735                 if (tp->ucopy.dma_chan)
1736                         ret = tcp_v6_do_rcv(sk, skb);
1737                 else
1738 #endif
1739                 {
1740                         if (!tcp_prequeue(sk, skb))
1741                                 ret = tcp_v6_do_rcv(sk, skb);
1742                 }
1743         } else
1744                 sk_add_backlog(sk, skb);
1745         bh_unlock_sock(sk);
1746
1747         sock_put(sk);
1748         return ret ? -1 : 0;
1749
1750 no_tcp_socket:
1751         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1752                 goto discard_it;
1753
1754         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1755 bad_packet:
1756                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1757         } else {
1758                 tcp_v6_send_reset(NULL, skb);
1759         }
1760
1761 discard_it:
1762
1763         /*
1764          *      Discard frame
1765          */
1766
1767         kfree_skb(skb);
1768         return 0;
1769
1770 discard_and_relse:
1771         sock_put(sk);
1772         goto discard_it;
1773
1774 do_time_wait:
1775         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1776                 inet_twsk_put(inet_twsk(sk));
1777                 goto discard_it;
1778         }
1779
1780         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1781                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
1782                 inet_twsk_put(inet_twsk(sk));
1783                 goto discard_it;
1784         }
1785
1786         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1787         case TCP_TW_SYN:
1788         {
1789                 struct sock *sk2;
1790
1791                 sk2 = inet6_lookup_listener(&tcp_hashinfo,
1792                                             &ipv6_hdr(skb)->daddr,
1793                                             ntohs(th->dest), inet6_iif(skb));
1794                 if (sk2 != NULL) {
1795                         struct inet_timewait_sock *tw = inet_twsk(sk);
1796                         inet_twsk_deschedule(tw, &tcp_death_row);
1797                         inet_twsk_put(tw);
1798                         sk = sk2;
1799                         goto process;
1800                 }
1801                 /* Fall through to ACK */
1802         }
1803         case TCP_TW_ACK:
1804                 tcp_v6_timewait_ack(sk, skb);
1805                 break;
1806         case TCP_TW_RST:
1807                 goto no_tcp_socket;
1808         case TCP_TW_SUCCESS:;
1809         }
1810         goto discard_it;
1811 }
1812
1813 static int tcp_v6_remember_stamp(struct sock *sk)
1814 {
1815         /* Alas, not yet... */
1816         return 0;
1817 }
1818
1819 static struct inet_connection_sock_af_ops ipv6_specific = {
1820         .queue_xmit        = inet6_csk_xmit,
1821         .send_check        = tcp_v6_send_check,
1822         .rebuild_header    = inet6_sk_rebuild_header,
1823         .conn_request      = tcp_v6_conn_request,
1824         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1825         .remember_stamp    = tcp_v6_remember_stamp,
1826         .net_header_len    = sizeof(struct ipv6hdr),
1827         .setsockopt        = ipv6_setsockopt,
1828         .getsockopt        = ipv6_getsockopt,
1829         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1830         .sockaddr_len      = sizeof(struct sockaddr_in6),
1831 #ifdef CONFIG_COMPAT
1832         .compat_setsockopt = compat_ipv6_setsockopt,
1833         .compat_getsockopt = compat_ipv6_getsockopt,
1834 #endif
1835 };
1836
1837 #ifdef CONFIG_TCP_MD5SIG
1838 static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1839         .md5_lookup     =       tcp_v6_md5_lookup,
1840         .calc_md5_hash  =       tcp_v6_calc_md5_hash,
1841         .md5_add        =       tcp_v6_md5_add_func,
1842         .md5_parse      =       tcp_v6_parse_md5_keys,
1843 };
1844 #endif
1845
1846 /*
1847  *      TCP over IPv4 via INET6 API
1848  */
1849
1850 static struct inet_connection_sock_af_ops ipv6_mapped = {
1851         .queue_xmit        = ip_queue_xmit,
1852         .send_check        = tcp_v4_send_check,
1853         .rebuild_header    = inet_sk_rebuild_header,
1854         .conn_request      = tcp_v6_conn_request,
1855         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1856         .remember_stamp    = tcp_v4_remember_stamp,
1857         .net_header_len    = sizeof(struct iphdr),
1858         .setsockopt        = ipv6_setsockopt,
1859         .getsockopt        = ipv6_getsockopt,
1860         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1861         .sockaddr_len      = sizeof(struct sockaddr_in6),
1862 #ifdef CONFIG_COMPAT
1863         .compat_setsockopt = compat_ipv6_setsockopt,
1864         .compat_getsockopt = compat_ipv6_getsockopt,
1865 #endif
1866 };
1867
1868 #ifdef CONFIG_TCP_MD5SIG
1869 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1870         .md5_lookup     =       tcp_v4_md5_lookup,
1871         .calc_md5_hash  =       tcp_v4_calc_md5_hash,
1872         .md5_add        =       tcp_v6_md5_add_func,
1873         .md5_parse      =       tcp_v6_parse_md5_keys,
1874 };
1875 #endif
1876
1877 /* NOTE: A lot of things set to zero explicitly by call to
1878  *       sk_alloc() so need not be done here.
1879  */
1880 static int tcp_v6_init_sock(struct sock *sk)
1881 {
1882         struct inet_connection_sock *icsk = inet_csk(sk);
1883         struct tcp_sock *tp = tcp_sk(sk);
1884
1885         skb_queue_head_init(&tp->out_of_order_queue);
1886         tcp_init_xmit_timers(sk);
1887         tcp_prequeue_init(tp);
1888
1889         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1890         tp->mdev = TCP_TIMEOUT_INIT;
1891
1892         /* So many TCP implementations out there (incorrectly) count the
1893          * initial SYN frame in their delayed-ACK and congestion control
1894          * algorithms that we must have the following bandaid to talk
1895          * efficiently to them.  -DaveM
1896          */
1897         tp->snd_cwnd = 2;
1898
1899         /* See draft-stevens-tcpca-spec-01 for discussion of the
1900          * initialization of these values.
1901          */
1902         tp->snd_ssthresh = 0x7fffffff;
1903         tp->snd_cwnd_clamp = ~0;
1904         tp->mss_cache = 536;
1905
1906         tp->reordering = sysctl_tcp_reordering;
1907
1908         sk->sk_state = TCP_CLOSE;
1909
1910         icsk->icsk_af_ops = &ipv6_specific;
1911         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
1912         icsk->icsk_sync_mss = tcp_sync_mss;
1913         sk->sk_write_space = sk_stream_write_space;
1914         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
1915
1916 #ifdef CONFIG_TCP_MD5SIG
1917         tp->af_specific = &tcp_sock_ipv6_specific;
1918 #endif
1919
1920         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1921         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1922
1923         atomic_inc(&tcp_sockets_allocated);
1924
1925         return 0;
1926 }
1927
1928 static int tcp_v6_destroy_sock(struct sock *sk)
1929 {
1930 #ifdef CONFIG_TCP_MD5SIG
1931         /* Clean up the MD5 key list */
1932         if (tcp_sk(sk)->md5sig_info)
1933                 tcp_v6_clear_md5_list(sk);
1934 #endif
1935         tcp_v4_destroy_sock(sk);
1936         return inet6_destroy_sock(sk);
1937 }
1938
1939 #ifdef CONFIG_PROC_FS
1940 /* Proc filesystem TCPv6 sock list dumping. */
1941 static void get_openreq6(struct seq_file *seq,
1942                          struct sock *sk, struct request_sock *req, int i, int uid)
1943 {
1944         int ttd = req->expires - jiffies;
1945         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
1946         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
1947
1948         if (ttd < 0)
1949                 ttd = 0;
1950
1951         seq_printf(seq,
1952                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1953                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1954                    i,
1955                    src->s6_addr32[0], src->s6_addr32[1],
1956                    src->s6_addr32[2], src->s6_addr32[3],
1957                    ntohs(inet_sk(sk)->sport),
1958                    dest->s6_addr32[0], dest->s6_addr32[1],
1959                    dest->s6_addr32[2], dest->s6_addr32[3],
1960                    ntohs(inet_rsk(req)->rmt_port),
1961                    TCP_SYN_RECV,
1962                    0,0, /* could print option size, but that is af dependent. */
1963                    1,   /* timers active (only the expire timer) */
1964                    jiffies_to_clock_t(ttd),
1965                    req->retrans,
1966                    uid,
1967                    0,  /* non standard timer */
1968                    0, /* open_requests have no inode */
1969                    0, req);
1970 }
1971
1972 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1973 {
1974         struct in6_addr *dest, *src;
1975         __u16 destp, srcp;
1976         int timer_active;
1977         unsigned long timer_expires;
1978         struct inet_sock *inet = inet_sk(sp);
1979         struct tcp_sock *tp = tcp_sk(sp);
1980         const struct inet_connection_sock *icsk = inet_csk(sp);
1981         struct ipv6_pinfo *np = inet6_sk(sp);
1982
1983         dest  = &np->daddr;
1984         src   = &np->rcv_saddr;
1985         destp = ntohs(inet->dport);
1986         srcp  = ntohs(inet->sport);
1987
1988         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
1989                 timer_active    = 1;
1990                 timer_expires   = icsk->icsk_timeout;
1991         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1992                 timer_active    = 4;
1993                 timer_expires   = icsk->icsk_timeout;
1994         } else if (timer_pending(&sp->sk_timer)) {
1995                 timer_active    = 2;
1996                 timer_expires   = sp->sk_timer.expires;
1997         } else {
1998                 timer_active    = 0;
1999                 timer_expires = jiffies;
2000         }
2001
2002         seq_printf(seq,
2003                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2004                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
2005                    i,
2006                    src->s6_addr32[0], src->s6_addr32[1],
2007                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2008                    dest->s6_addr32[0], dest->s6_addr32[1],
2009                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2010                    sp->sk_state,
2011                    tp->write_seq-tp->snd_una,
2012                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2013                    timer_active,
2014                    jiffies_to_clock_t(timer_expires - jiffies),
2015                    icsk->icsk_retransmits,
2016                    sock_i_uid(sp),
2017                    icsk->icsk_probes_out,
2018                    sock_i_ino(sp),
2019                    atomic_read(&sp->sk_refcnt), sp,
2020                    icsk->icsk_rto,
2021                    icsk->icsk_ack.ato,
2022                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2023                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
2024                    );
2025 }
2026
2027 static void get_timewait6_sock(struct seq_file *seq,
2028                                struct inet_timewait_sock *tw, int i)
2029 {
2030         struct in6_addr *dest, *src;
2031         __u16 destp, srcp;
2032         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2033         int ttd = tw->tw_ttd - jiffies;
2034
2035         if (ttd < 0)
2036                 ttd = 0;
2037
2038         dest = &tw6->tw_v6_daddr;
2039         src  = &tw6->tw_v6_rcv_saddr;
2040         destp = ntohs(tw->tw_dport);
2041         srcp  = ntohs(tw->tw_sport);
2042
2043         seq_printf(seq,
2044                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2045                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2046                    i,
2047                    src->s6_addr32[0], src->s6_addr32[1],
2048                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2049                    dest->s6_addr32[0], dest->s6_addr32[1],
2050                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2051                    tw->tw_substate, 0, 0,
2052                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2053                    atomic_read(&tw->tw_refcnt), tw);
2054 }
2055
2056 static int tcp6_seq_show(struct seq_file *seq, void *v)
2057 {
2058         struct tcp_iter_state *st;
2059
2060         if (v == SEQ_START_TOKEN) {
2061                 seq_puts(seq,
2062                          "  sl  "
2063                          "local_address                         "
2064                          "remote_address                        "
2065                          "st tx_queue rx_queue tr tm->when retrnsmt"
2066                          "   uid  timeout inode\n");
2067                 goto out;
2068         }
2069         st = seq->private;
2070
2071         switch (st->state) {
2072         case TCP_SEQ_STATE_LISTENING:
2073         case TCP_SEQ_STATE_ESTABLISHED:
2074                 get_tcp6_sock(seq, v, st->num);
2075                 break;
2076         case TCP_SEQ_STATE_OPENREQ:
2077                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2078                 break;
2079         case TCP_SEQ_STATE_TIME_WAIT:
2080                 get_timewait6_sock(seq, v, st->num);
2081                 break;
2082         }
2083 out:
2084         return 0;
2085 }
2086
2087 static struct file_operations tcp6_seq_fops;
2088 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2089         .owner          = THIS_MODULE,
2090         .name           = "tcp6",
2091         .family         = AF_INET6,
2092         .seq_show       = tcp6_seq_show,
2093         .seq_fops       = &tcp6_seq_fops,
2094 };
2095
2096 int __init tcp6_proc_init(void)
2097 {
2098         return tcp_proc_register(&tcp6_seq_afinfo);
2099 }
2100
2101 void tcp6_proc_exit(void)
2102 {
2103         tcp_proc_unregister(&tcp6_seq_afinfo);
2104 }
2105 #endif
2106
2107 struct proto tcpv6_prot = {
2108         .name                   = "TCPv6",
2109         .owner                  = THIS_MODULE,
2110         .close                  = tcp_close,
2111         .connect                = tcp_v6_connect,
2112         .disconnect             = tcp_disconnect,
2113         .accept                 = inet_csk_accept,
2114         .ioctl                  = tcp_ioctl,
2115         .init                   = tcp_v6_init_sock,
2116         .destroy                = tcp_v6_destroy_sock,
2117         .shutdown               = tcp_shutdown,
2118         .setsockopt             = tcp_setsockopt,
2119         .getsockopt             = tcp_getsockopt,
2120         .recvmsg                = tcp_recvmsg,
2121         .backlog_rcv            = tcp_v6_do_rcv,
2122         .hash                   = tcp_v6_hash,
2123         .unhash                 = tcp_unhash,
2124         .get_port               = tcp_v6_get_port,
2125         .enter_memory_pressure  = tcp_enter_memory_pressure,
2126         .sockets_allocated      = &tcp_sockets_allocated,
2127         .memory_allocated       = &tcp_memory_allocated,
2128         .memory_pressure        = &tcp_memory_pressure,
2129         .orphan_count           = &tcp_orphan_count,
2130         .sysctl_mem             = sysctl_tcp_mem,
2131         .sysctl_wmem            = sysctl_tcp_wmem,
2132         .sysctl_rmem            = sysctl_tcp_rmem,
2133         .max_header             = MAX_TCP_HEADER,
2134         .obj_size               = sizeof(struct tcp6_sock),
2135         .twsk_prot              = &tcp6_timewait_sock_ops,
2136         .rsk_prot               = &tcp6_request_sock_ops,
2137 #ifdef CONFIG_COMPAT
2138         .compat_setsockopt      = compat_tcp_setsockopt,
2139         .compat_getsockopt      = compat_tcp_getsockopt,
2140 #endif
2141 };
2142
2143 static struct inet6_protocol tcpv6_protocol = {
2144         .handler        =       tcp_v6_rcv,
2145         .err_handler    =       tcp_v6_err,
2146         .gso_send_check =       tcp_v6_gso_send_check,
2147         .gso_segment    =       tcp_tso_segment,
2148         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2149 };
2150
2151 static struct inet_protosw tcpv6_protosw = {
2152         .type           =       SOCK_STREAM,
2153         .protocol       =       IPPROTO_TCP,
2154         .prot           =       &tcpv6_prot,
2155         .ops            =       &inet6_stream_ops,
2156         .capability     =       -1,
2157         .no_check       =       0,
2158         .flags          =       INET_PROTOSW_PERMANENT |
2159                                 INET_PROTOSW_ICSK,
2160 };
2161
2162 void __init tcpv6_init(void)
2163 {
2164         /* register inet6 protocol */
2165         if (inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP) < 0)
2166                 printk(KERN_ERR "tcpv6_init: Could not register protocol\n");
2167         inet6_register_protosw(&tcpv6_protosw);
2168
2169         if (inet_csk_ctl_sock_create(&tcp6_socket, PF_INET6, SOCK_RAW,
2170                                      IPPROTO_TCP) < 0)
2171                 panic("Failed to create the TCPv6 control socket.\n");
2172 }