1 /*
2 * TCP over IPv6
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 *
8 * Based on:
9 * linux/net/ipv4/tcp.c
10 * linux/net/ipv4/tcp_input.c
11 * linux/net/ipv4/tcp_output.c
12 *
13 * Fixes:
14 * Hideaki YOSHIFUJI : sin6_scope_id support
15 * YOSHIFUJI Hideaki @USAGI and: Support IPV6_V6ONLY socket option, which
16 * Alexey Kuznetsov allow both IPv4 and IPv6 sockets to bind
17 * a single port at the same time.
18 * YOSHIFUJI Hideaki @USAGI: convert /proc/net/tcp6 to seq_file.
19 *
20 * This program is free software; you can redistribute it and/or
21 * modify it under the terms of the GNU General Public License
22 * as published by the Free Software Foundation; either version
23 * 2 of the License, or (at your option) any later version.
24 */
25
26 #include <linux/bottom_half.h>
27 #include <linux/module.h>
28 #include <linux/errno.h>
29 #include <linux/types.h>
30 #include <linux/socket.h>
31 #include <linux/sockios.h>
32 #include <linux/net.h>
33 #include <linux/jiffies.h>
34 #include <linux/in.h>
35 #include <linux/in6.h>
36 #include <linux/netdevice.h>
37 #include <linux/init.h>
38 #include <linux/jhash.h>
39 #include <linux/ipsec.h>
40 #include <linux/times.h>
41 #include <linux/slab.h>
42 #include <linux/uaccess.h>
43 #include <linux/ipv6.h>
44 #include <linux/icmpv6.h>
45 #include <linux/random.h>
46
47 #include <net/tcp.h>
48 #include <net/ndisc.h>
49 #include <net/inet6_hashtables.h>
50 #include <net/inet6_connection_sock.h>
51 #include <net/ipv6.h>
52 #include <net/transp_v6.h>
53 #include <net/addrconf.h>
54 #include <net/ip6_route.h>
55 #include <net/ip6_checksum.h>
56 #include <net/inet_ecn.h>
57 #include <net/protocol.h>
58 #include <net/xfrm.h>
59 #include <net/snmp.h>
60 #include <net/dsfield.h>
61 #include <net/timewait_sock.h>
62 #include <net/inet_common.h>
63 #include <net/secure_seq.h>
64 #include <net/busy_poll.h>
65
66 #include <linux/proc_fs.h>
67 #include <linux/seq_file.h>
68
69 #include <crypto/hash.h>
70 #include <linux/scatterlist.h>
71
72 #include <trace/events/tcp.h>
73
74 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb);
75 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
76 struct request_sock *req);
77
78 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
79
80 static const struct inet_connection_sock_af_ops ipv6_mapped;
81 static const struct inet_connection_sock_af_ops ipv6_specific;
82 #ifdef CONFIG_TCP_MD5SIG
83 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
84 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
85 #else
tcp_v6_md5_do_lookup(const struct sock * sk,const struct in6_addr * addr)86 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
87 const struct in6_addr *addr)
88 {
89 return NULL;
90 }
91 #endif
92
inet6_sk_rx_dst_set(struct sock * sk,const struct sk_buff * skb)93 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
94 {
95 struct dst_entry *dst = skb_dst(skb);
96
97 if (dst && dst_hold_safe(dst)) {
98 const struct rt6_info *rt = (const struct rt6_info *)dst;
99
100 sk->sk_rx_dst = dst;
101 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
102 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
103 }
104 }
105
tcp_v6_init_seq(const struct sk_buff * skb)106 static u32 tcp_v6_init_seq(const struct sk_buff *skb)
107 {
108 return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32,
109 ipv6_hdr(skb)->saddr.s6_addr32,
110 tcp_hdr(skb)->dest,
111 tcp_hdr(skb)->source);
112 }
113
tcp_v6_init_ts_off(const struct net * net,const struct sk_buff * skb)114 static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb)
115 {
116 return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32,
117 ipv6_hdr(skb)->saddr.s6_addr32);
118 }
119
tcp_v6_pre_connect(struct sock * sk,struct sockaddr * uaddr,int addr_len)120 static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
121 int addr_len)
122 {
123 /* This check is replicated from tcp_v6_connect() and intended to
124 * prevent BPF program called below from accessing bytes that are out
125 * of the bound specified by user in addr_len.
126 */
127 if (addr_len < SIN6_LEN_RFC2133)
128 return -EINVAL;
129
130 sock_owned_by_me(sk);
131
132 return BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr);
133 }
134
tcp_v6_connect(struct sock * sk,struct sockaddr * uaddr,int addr_len)135 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
136 int addr_len)
137 {
138 struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
139 struct inet_sock *inet = inet_sk(sk);
140 struct inet_connection_sock *icsk = inet_csk(sk);
141 struct ipv6_pinfo *np = inet6_sk(sk);
142 struct tcp_sock *tp = tcp_sk(sk);
143 struct in6_addr *saddr = NULL, *final_p, final;
144 struct ipv6_txoptions *opt;
145 struct flowi6 fl6;
146 struct dst_entry *dst;
147 int addr_type;
148 int err;
149 struct inet_timewait_death_row *tcp_death_row = &sock_net(sk)->ipv4.tcp_death_row;
150
151 if (addr_len < SIN6_LEN_RFC2133)
152 return -EINVAL;
153
154 if (usin->sin6_family != AF_INET6)
155 return -EAFNOSUPPORT;
156
157 memset(&fl6, 0, sizeof(fl6));
158
159 if (np->sndflow) {
160 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
161 IP6_ECN_flow_init(fl6.flowlabel);
162 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
163 struct ip6_flowlabel *flowlabel;
164 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
165 if (!flowlabel)
166 return -EINVAL;
167 fl6_sock_release(flowlabel);
168 }
169 }
170
171 /*
172 * connect() to INADDR_ANY means loopback (BSD'ism).
173 */
174
175 if (ipv6_addr_any(&usin->sin6_addr)) {
176 if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr))
177 ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK),
178 &usin->sin6_addr);
179 else
180 usin->sin6_addr = in6addr_loopback;
181 }
182
183 addr_type = ipv6_addr_type(&usin->sin6_addr);
184
185 if (addr_type & IPV6_ADDR_MULTICAST)
186 return -ENETUNREACH;
187
188 if (addr_type&IPV6_ADDR_LINKLOCAL) {
189 if (addr_len >= sizeof(struct sockaddr_in6) &&
190 usin->sin6_scope_id) {
191 /* If interface is set while binding, indices
192 * must coincide.
193 */
194 if (!sk_dev_equal_l3scope(sk, usin->sin6_scope_id))
195 return -EINVAL;
196
197 sk->sk_bound_dev_if = usin->sin6_scope_id;
198 }
199
200 /* Connect to link-local address requires an interface */
201 if (!sk->sk_bound_dev_if)
202 return -EINVAL;
203 }
204
205 if (tp->rx_opt.ts_recent_stamp &&
206 !ipv6_addr_equal(&sk->sk_v6_daddr, &usin->sin6_addr)) {
207 tp->rx_opt.ts_recent = 0;
208 tp->rx_opt.ts_recent_stamp = 0;
209 tp->write_seq = 0;
210 }
211
212 sk->sk_v6_daddr = usin->sin6_addr;
213 np->flow_label = fl6.flowlabel;
214
215 /*
216 * TCP over IPv4
217 */
218
219 if (addr_type & IPV6_ADDR_MAPPED) {
220 u32 exthdrlen = icsk->icsk_ext_hdr_len;
221 struct sockaddr_in sin;
222
223 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
224
225 if (__ipv6_only_sock(sk))
226 return -ENETUNREACH;
227
228 sin.sin_family = AF_INET;
229 sin.sin_port = usin->sin6_port;
230 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
231
232 icsk->icsk_af_ops = &ipv6_mapped;
233 sk->sk_backlog_rcv = tcp_v4_do_rcv;
234 #ifdef CONFIG_TCP_MD5SIG
235 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
236 #endif
237
238 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
239
240 if (err) {
241 icsk->icsk_ext_hdr_len = exthdrlen;
242 icsk->icsk_af_ops = &ipv6_specific;
243 sk->sk_backlog_rcv = tcp_v6_do_rcv;
244 #ifdef CONFIG_TCP_MD5SIG
245 tp->af_specific = &tcp_sock_ipv6_specific;
246 #endif
247 goto failure;
248 }
249 np->saddr = sk->sk_v6_rcv_saddr;
250
251 return err;
252 }
253
254 if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr))
255 saddr = &sk->sk_v6_rcv_saddr;
256
257 fl6.flowi6_proto = IPPROTO_TCP;
258 fl6.daddr = sk->sk_v6_daddr;
259 fl6.saddr = saddr ? *saddr : np->saddr;
260 fl6.flowi6_oif = sk->sk_bound_dev_if;
261 fl6.flowi6_mark = sk->sk_mark;
262 fl6.fl6_dport = usin->sin6_port;
263 fl6.fl6_sport = inet->inet_sport;
264 fl6.flowi6_uid = sk->sk_uid;
265
266 opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
267 final_p = fl6_update_dst(&fl6, opt, &final);
268
269 security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
270
271 dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
272 if (IS_ERR(dst)) {
273 err = PTR_ERR(dst);
274 goto failure;
275 }
276
277 if (!saddr) {
278 saddr = &fl6.saddr;
279 sk->sk_v6_rcv_saddr = *saddr;
280 }
281
282 /* set the source address */
283 np->saddr = *saddr;
284 inet->inet_rcv_saddr = LOOPBACK4_IPV6;
285
286 sk->sk_gso_type = SKB_GSO_TCPV6;
287 ip6_dst_store(sk, dst, NULL, NULL);
288
289 icsk->icsk_ext_hdr_len = 0;
290 if (opt)
291 icsk->icsk_ext_hdr_len = opt->opt_flen +
292 opt->opt_nflen;
293
294 tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
295
296 inet->inet_dport = usin->sin6_port;
297
298 tcp_set_state(sk, TCP_SYN_SENT);
299 err = inet6_hash_connect(tcp_death_row, sk);
300 if (err)
301 goto late_failure;
302
303 sk_set_txhash(sk);
304
305 if (likely(!tp->repair)) {
306 if (!tp->write_seq)
307 tp->write_seq = secure_tcpv6_seq(np->saddr.s6_addr32,
308 sk->sk_v6_daddr.s6_addr32,
309 inet->inet_sport,
310 inet->inet_dport);
311 tp->tsoffset = secure_tcpv6_ts_off(sock_net(sk),
312 np->saddr.s6_addr32,
313 sk->sk_v6_daddr.s6_addr32);
314 }
315
316 if (tcp_fastopen_defer_connect(sk, &err))
317 return err;
318 if (err)
319 goto late_failure;
320
321 err = tcp_connect(sk);
322 if (err)
323 goto late_failure;
324
325 return 0;
326
327 late_failure:
328 tcp_set_state(sk, TCP_CLOSE);
329 failure:
330 inet->inet_dport = 0;
331 sk->sk_route_caps = 0;
332 return err;
333 }
334
tcp_v6_mtu_reduced(struct sock * sk)335 static void tcp_v6_mtu_reduced(struct sock *sk)
336 {
337 struct dst_entry *dst;
338
339 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
340 return;
341
342 dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
343 if (!dst)
344 return;
345
346 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
347 tcp_sync_mss(sk, dst_mtu(dst));
348 tcp_simple_retransmit(sk);
349 }
350 }
351
tcp_v6_err(struct sk_buff * skb,struct inet6_skb_parm * opt,u8 type,u8 code,int offset,__be32 info)352 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
353 u8 type, u8 code, int offset, __be32 info)
354 {
355 const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
356 const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
357 struct net *net = dev_net(skb->dev);
358 struct request_sock *fastopen;
359 struct ipv6_pinfo *np;
360 struct tcp_sock *tp;
361 __u32 seq, snd_una;
362 struct sock *sk;
363 bool fatal;
364 int err;
365
366 sk = __inet6_lookup_established(net, &tcp_hashinfo,
367 &hdr->daddr, th->dest,
368 &hdr->saddr, ntohs(th->source),
369 skb->dev->ifindex, inet6_sdif(skb));
370
371 if (!sk) {
372 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
373 ICMP6_MIB_INERRORS);
374 return;
375 }
376
377 if (sk->sk_state == TCP_TIME_WAIT) {
378 inet_twsk_put(inet_twsk(sk));
379 return;
380 }
381 seq = ntohl(th->seq);
382 fatal = icmpv6_err_convert(type, code, &err);
383 if (sk->sk_state == TCP_NEW_SYN_RECV)
384 return tcp_req_err(sk, seq, fatal);
385
386 bh_lock_sock(sk);
387 if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
388 __NET_INC_STATS(net, LINUX_MIB_LOCKDROPPEDICMPS);
389
390 if (sk->sk_state == TCP_CLOSE)
391 goto out;
392
393 if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
394 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
395 goto out;
396 }
397
398 tp = tcp_sk(sk);
399 /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
400 fastopen = tp->fastopen_rsk;
401 snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
402 if (sk->sk_state != TCP_LISTEN &&
403 !between(seq, snd_una, tp->snd_nxt)) {
404 __NET_INC_STATS(net, LINUX_MIB_OUTOFWINDOWICMPS);
405 goto out;
406 }
407
408 np = inet6_sk(sk);
409
410 if (type == NDISC_REDIRECT) {
411 if (!sock_owned_by_user(sk)) {
412 struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
413
414 if (dst)
415 dst->ops->redirect(dst, sk, skb);
416 }
417 goto out;
418 }
419
420 if (type == ICMPV6_PKT_TOOBIG) {
421 /* We are not interested in TCP_LISTEN and open_requests
422 * (SYN-ACKs send out by Linux are always <576bytes so
423 * they should go through unfragmented).
424 */
425 if (sk->sk_state == TCP_LISTEN)
426 goto out;
427
428 if (!ip6_sk_accept_pmtu(sk))
429 goto out;
430
431 tp->mtu_info = ntohl(info);
432 if (!sock_owned_by_user(sk))
433 tcp_v6_mtu_reduced(sk);
434 else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
435 &sk->sk_tsq_flags))
436 sock_hold(sk);
437 goto out;
438 }
439
440
441 /* Might be for an request_sock */
442 switch (sk->sk_state) {
443 case TCP_SYN_SENT:
444 case TCP_SYN_RECV:
445 /* Only in fast or simultaneous open. If a fast open socket is
446 * is already accepted it is treated as a connected one below.
447 */
448 if (fastopen && !fastopen->sk)
449 break;
450
451 if (!sock_owned_by_user(sk)) {
452 sk->sk_err = err;
453 sk->sk_error_report(sk); /* Wake people up to see the error (see connect in sock.c) */
454
455 tcp_done(sk);
456 } else
457 sk->sk_err_soft = err;
458 goto out;
459 }
460
461 if (!sock_owned_by_user(sk) && np->recverr) {
462 sk->sk_err = err;
463 sk->sk_error_report(sk);
464 } else
465 sk->sk_err_soft = err;
466
467 out:
468 bh_unlock_sock(sk);
469 sock_put(sk);
470 }
471
472
tcp_v6_send_synack(const struct sock * sk,struct dst_entry * dst,struct flowi * fl,struct request_sock * req,struct tcp_fastopen_cookie * foc,enum tcp_synack_type synack_type)473 static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
474 struct flowi *fl,
475 struct request_sock *req,
476 struct tcp_fastopen_cookie *foc,
477 enum tcp_synack_type synack_type)
478 {
479 struct inet_request_sock *ireq = inet_rsk(req);
480 struct ipv6_pinfo *np = inet6_sk(sk);
481 struct ipv6_txoptions *opt;
482 struct flowi6 *fl6 = &fl->u.ip6;
483 struct sk_buff *skb;
484 int err = -ENOMEM;
485
486 /* First, grab a route. */
487 if (!dst && (dst = inet6_csk_route_req(sk, fl6, req,
488 IPPROTO_TCP)) == NULL)
489 goto done;
490
491 skb = tcp_make_synack(sk, dst, req, foc, synack_type);
492
493 if (skb) {
494 __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
495 &ireq->ir_v6_rmt_addr);
496
497 fl6->daddr = ireq->ir_v6_rmt_addr;
498 if (np->repflow && ireq->pktopts)
499 fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
500
501 rcu_read_lock();
502 opt = ireq->ipv6_opt;
503 if (!opt)
504 opt = rcu_dereference(np->opt);
505 err = ip6_xmit(sk, skb, fl6, sk->sk_mark, opt, np->tclass);
506 rcu_read_unlock();
507 err = net_xmit_eval(err);
508 }
509
510 done:
511 return err;
512 }
513
514
tcp_v6_reqsk_destructor(struct request_sock * req)515 static void tcp_v6_reqsk_destructor(struct request_sock *req)
516 {
517 kfree(inet_rsk(req)->ipv6_opt);
518 kfree_skb(inet_rsk(req)->pktopts);
519 }
520
521 #ifdef CONFIG_TCP_MD5SIG
tcp_v6_md5_do_lookup(const struct sock * sk,const struct in6_addr * addr)522 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(const struct sock *sk,
523 const struct in6_addr *addr)
524 {
525 return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
526 }
527
tcp_v6_md5_lookup(const struct sock * sk,const struct sock * addr_sk)528 static struct tcp_md5sig_key *tcp_v6_md5_lookup(const struct sock *sk,
529 const struct sock *addr_sk)
530 {
531 return tcp_v6_md5_do_lookup(sk, &addr_sk->sk_v6_daddr);
532 }
533
tcp_v6_parse_md5_keys(struct sock * sk,int optname,char __user * optval,int optlen)534 static int tcp_v6_parse_md5_keys(struct sock *sk, int optname,
535 char __user *optval, int optlen)
536 {
537 struct tcp_md5sig cmd;
538 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
539 u8 prefixlen;
540
541 if (optlen < sizeof(cmd))
542 return -EINVAL;
543
544 if (copy_from_user(&cmd, optval, sizeof(cmd)))
545 return -EFAULT;
546
547 if (sin6->sin6_family != AF_INET6)
548 return -EINVAL;
549
550 if (optname == TCP_MD5SIG_EXT &&
551 cmd.tcpm_flags & TCP_MD5SIG_FLAG_PREFIX) {
552 prefixlen = cmd.tcpm_prefixlen;
553 if (prefixlen > 128 || (ipv6_addr_v4mapped(&sin6->sin6_addr) &&
554 prefixlen > 32))
555 return -EINVAL;
556 } else {
557 prefixlen = ipv6_addr_v4mapped(&sin6->sin6_addr) ? 32 : 128;
558 }
559
560 if (!cmd.tcpm_keylen) {
561 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
562 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
563 AF_INET, prefixlen);
564 return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
565 AF_INET6, prefixlen);
566 }
567
568 if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
569 return -EINVAL;
570
571 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
572 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
573 AF_INET, prefixlen, cmd.tcpm_key,
574 cmd.tcpm_keylen, GFP_KERNEL);
575
576 return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
577 AF_INET6, prefixlen, cmd.tcpm_key,
578 cmd.tcpm_keylen, GFP_KERNEL);
579 }
580
tcp_v6_md5_hash_headers(struct tcp_md5sig_pool * hp,const struct in6_addr * daddr,const struct in6_addr * saddr,const struct tcphdr * th,int nbytes)581 static int tcp_v6_md5_hash_headers(struct tcp_md5sig_pool *hp,
582 const struct in6_addr *daddr,
583 const struct in6_addr *saddr,
584 const struct tcphdr *th, int nbytes)
585 {
586 struct tcp6_pseudohdr *bp;
587 struct scatterlist sg;
588 struct tcphdr *_th;
589
590 bp = hp->scratch;
591 /* 1. TCP pseudo-header (RFC2460) */
592 bp->saddr = *saddr;
593 bp->daddr = *daddr;
594 bp->protocol = cpu_to_be32(IPPROTO_TCP);
595 bp->len = cpu_to_be32(nbytes);
596
597 _th = (struct tcphdr *)(bp + 1);
598 memcpy(_th, th, sizeof(*th));
599 _th->check = 0;
600
601 sg_init_one(&sg, bp, sizeof(*bp) + sizeof(*th));
602 ahash_request_set_crypt(hp->md5_req, &sg, NULL,
603 sizeof(*bp) + sizeof(*th));
604 return crypto_ahash_update(hp->md5_req);
605 }
606
tcp_v6_md5_hash_hdr(char * md5_hash,const struct tcp_md5sig_key * key,const struct in6_addr * daddr,struct in6_addr * saddr,const struct tcphdr * th)607 static int tcp_v6_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
608 const struct in6_addr *daddr, struct in6_addr *saddr,
609 const struct tcphdr *th)
610 {
611 struct tcp_md5sig_pool *hp;
612 struct ahash_request *req;
613
614 hp = tcp_get_md5sig_pool();
615 if (!hp)
616 goto clear_hash_noput;
617 req = hp->md5_req;
618
619 if (crypto_ahash_init(req))
620 goto clear_hash;
621 if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, th->doff << 2))
622 goto clear_hash;
623 if (tcp_md5_hash_key(hp, key))
624 goto clear_hash;
625 ahash_request_set_crypt(req, NULL, md5_hash, 0);
626 if (crypto_ahash_final(req))
627 goto clear_hash;
628
629 tcp_put_md5sig_pool();
630 return 0;
631
632 clear_hash:
633 tcp_put_md5sig_pool();
634 clear_hash_noput:
635 memset(md5_hash, 0, 16);
636 return 1;
637 }
638
tcp_v6_md5_hash_skb(char * md5_hash,const struct tcp_md5sig_key * key,const struct sock * sk,const struct sk_buff * skb)639 static int tcp_v6_md5_hash_skb(char *md5_hash,
640 const struct tcp_md5sig_key *key,
641 const struct sock *sk,
642 const struct sk_buff *skb)
643 {
644 const struct in6_addr *saddr, *daddr;
645 struct tcp_md5sig_pool *hp;
646 struct ahash_request *req;
647 const struct tcphdr *th = tcp_hdr(skb);
648
649 if (sk) { /* valid for establish/request sockets */
650 saddr = &sk->sk_v6_rcv_saddr;
651 daddr = &sk->sk_v6_daddr;
652 } else {
653 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
654 saddr = &ip6h->saddr;
655 daddr = &ip6h->daddr;
656 }
657
658 hp = tcp_get_md5sig_pool();
659 if (!hp)
660 goto clear_hash_noput;
661 req = hp->md5_req;
662
663 if (crypto_ahash_init(req))
664 goto clear_hash;
665
666 if (tcp_v6_md5_hash_headers(hp, daddr, saddr, th, skb->len))
667 goto clear_hash;
668 if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
669 goto clear_hash;
670 if (tcp_md5_hash_key(hp, key))
671 goto clear_hash;
672 ahash_request_set_crypt(req, NULL, md5_hash, 0);
673 if (crypto_ahash_final(req))
674 goto clear_hash;
675
676 tcp_put_md5sig_pool();
677 return 0;
678
679 clear_hash:
680 tcp_put_md5sig_pool();
681 clear_hash_noput:
682 memset(md5_hash, 0, 16);
683 return 1;
684 }
685
686 #endif
687
tcp_v6_inbound_md5_hash(const struct sock * sk,const struct sk_buff * skb)688 static bool tcp_v6_inbound_md5_hash(const struct sock *sk,
689 const struct sk_buff *skb)
690 {
691 #ifdef CONFIG_TCP_MD5SIG
692 const __u8 *hash_location = NULL;
693 struct tcp_md5sig_key *hash_expected;
694 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
695 const struct tcphdr *th = tcp_hdr(skb);
696 int genhash;
697 u8 newhash[16];
698
699 hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
700 hash_location = tcp_parse_md5sig_option(th);
701
702 /* We've parsed the options - do we have a hash? */
703 if (!hash_expected && !hash_location)
704 return false;
705
706 if (hash_expected && !hash_location) {
707 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
708 return true;
709 }
710
711 if (!hash_expected && hash_location) {
712 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
713 return true;
714 }
715
716 /* check the signature */
717 genhash = tcp_v6_md5_hash_skb(newhash,
718 hash_expected,
719 NULL, skb);
720
721 if (genhash || memcmp(hash_location, newhash, 16) != 0) {
722 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPMD5FAILURE);
723 net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
724 genhash ? "failed" : "mismatch",
725 &ip6h->saddr, ntohs(th->source),
726 &ip6h->daddr, ntohs(th->dest));
727 return true;
728 }
729 #endif
730 return false;
731 }
732
tcp_v6_init_req(struct request_sock * req,const struct sock * sk_listener,struct sk_buff * skb)733 static void tcp_v6_init_req(struct request_sock *req,
734 const struct sock *sk_listener,
735 struct sk_buff *skb)
736 {
737 struct inet_request_sock *ireq = inet_rsk(req);
738 const struct ipv6_pinfo *np = inet6_sk(sk_listener);
739
740 ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr;
741 ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
742
743 /* So that link locals have meaning */
744 if (!sk_listener->sk_bound_dev_if &&
745 ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
746 ireq->ir_iif = tcp_v6_iif(skb);
747
748 if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
749 (ipv6_opt_accepted(sk_listener, skb, &TCP_SKB_CB(skb)->header.h6) ||
750 np->rxopt.bits.rxinfo ||
751 np->rxopt.bits.rxoinfo || np->rxopt.bits.rxhlim ||
752 np->rxopt.bits.rxohlim || np->repflow)) {
753 refcount_inc(&skb->users);
754 ireq->pktopts = skb;
755 }
756 }
757
tcp_v6_route_req(const struct sock * sk,struct flowi * fl,const struct request_sock * req)758 static struct dst_entry *tcp_v6_route_req(const struct sock *sk,
759 struct flowi *fl,
760 const struct request_sock *req)
761 {
762 return inet6_csk_route_req(sk, &fl->u.ip6, req, IPPROTO_TCP);
763 }
764
765 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
766 .family = AF_INET6,
767 .obj_size = sizeof(struct tcp6_request_sock),
768 .rtx_syn_ack = tcp_rtx_synack,
769 .send_ack = tcp_v6_reqsk_send_ack,
770 .destructor = tcp_v6_reqsk_destructor,
771 .send_reset = tcp_v6_send_reset,
772 .syn_ack_timeout = tcp_syn_ack_timeout,
773 };
774
775 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
776 .mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) -
777 sizeof(struct ipv6hdr),
778 #ifdef CONFIG_TCP_MD5SIG
779 .req_md5_lookup = tcp_v6_md5_lookup,
780 .calc_md5_hash = tcp_v6_md5_hash_skb,
781 #endif
782 .init_req = tcp_v6_init_req,
783 #ifdef CONFIG_SYN_COOKIES
784 .cookie_init_seq = cookie_v6_init_sequence,
785 #endif
786 .route_req = tcp_v6_route_req,
787 .init_seq = tcp_v6_init_seq,
788 .init_ts_off = tcp_v6_init_ts_off,
789 .send_synack = tcp_v6_send_synack,
790 };
791
tcp_v6_send_response(const struct sock * sk,struct sk_buff * skb,u32 seq,u32 ack,u32 win,u32 tsval,u32 tsecr,int oif,struct tcp_md5sig_key * key,int rst,u8 tclass,__be32 label)792 static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32 seq,
793 u32 ack, u32 win, u32 tsval, u32 tsecr,
794 int oif, struct tcp_md5sig_key *key, int rst,
795 u8 tclass, __be32 label)
796 {
797 const struct tcphdr *th = tcp_hdr(skb);
798 struct tcphdr *t1;
799 struct sk_buff *buff;
800 struct flowi6 fl6;
801 struct net *net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
802 struct sock *ctl_sk = net->ipv6.tcp_sk;
803 unsigned int tot_len = sizeof(struct tcphdr);
804 struct dst_entry *dst;
805 __be32 *topt;
806 __u32 mark = 0;
807
808 if (tsecr)
809 tot_len += TCPOLEN_TSTAMP_ALIGNED;
810 #ifdef CONFIG_TCP_MD5SIG
811 if (key)
812 tot_len += TCPOLEN_MD5SIG_ALIGNED;
813 #endif
814
815 buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
816 GFP_ATOMIC);
817 if (!buff)
818 return;
819
820 skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
821
822 t1 = skb_push(buff, tot_len);
823 skb_reset_transport_header(buff);
824
825 /* Swap the send and the receive. */
826 memset(t1, 0, sizeof(*t1));
827 t1->dest = th->source;
828 t1->source = th->dest;
829 t1->doff = tot_len / 4;
830 t1->seq = htonl(seq);
831 t1->ack_seq = htonl(ack);
832 t1->ack = !rst || !th->ack;
833 t1->rst = rst;
834 t1->window = htons(win);
835
836 topt = (__be32 *)(t1 + 1);
837
838 if (tsecr) {
839 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
840 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
841 *topt++ = htonl(tsval);
842 *topt++ = htonl(tsecr);
843 }
844
845 #ifdef CONFIG_TCP_MD5SIG
846 if (key) {
847 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
848 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
849 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
850 &ipv6_hdr(skb)->saddr,
851 &ipv6_hdr(skb)->daddr, t1);
852 }
853 #endif
854
855 memset(&fl6, 0, sizeof(fl6));
856 fl6.daddr = ipv6_hdr(skb)->saddr;
857 fl6.saddr = ipv6_hdr(skb)->daddr;
858 fl6.flowlabel = label;
859
860 buff->ip_summed = CHECKSUM_PARTIAL;
861 buff->csum = 0;
862
863 __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
864
865 fl6.flowi6_proto = IPPROTO_TCP;
866 if (rt6_need_strict(&fl6.daddr) && !oif)
867 fl6.flowi6_oif = tcp_v6_iif(skb);
868 else {
869 if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
870 oif = skb->skb_iif;
871
872 fl6.flowi6_oif = oif;
873 }
874
875 if (sk)
876 mark = (sk->sk_state == TCP_TIME_WAIT) ?
877 inet_twsk(sk)->tw_mark : sk->sk_mark;
878 fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark) ?: mark;
879 fl6.fl6_dport = t1->dest;
880 fl6.fl6_sport = t1->source;
881 fl6.flowi6_uid = sock_net_uid(net, sk && sk_fullsock(sk) ? sk : NULL);
882 security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
883
884 /* Pass a socket to ip6_dst_lookup either it is for RST
885 * Underlying function will use this to retrieve the network
886 * namespace
887 */
888 dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
889 if (!IS_ERR(dst)) {
890 skb_dst_set(buff, dst);
891 ip6_xmit(ctl_sk, buff, &fl6, fl6.flowi6_mark, NULL, tclass);
892 TCP_INC_STATS(net, TCP_MIB_OUTSEGS);
893 if (rst)
894 TCP_INC_STATS(net, TCP_MIB_OUTRSTS);
895 return;
896 }
897
898 kfree_skb(buff);
899 }
900
tcp_v6_send_reset(const struct sock * sk,struct sk_buff * skb)901 static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb)
902 {
903 const struct tcphdr *th = tcp_hdr(skb);
904 u32 seq = 0, ack_seq = 0;
905 struct tcp_md5sig_key *key = NULL;
906 #ifdef CONFIG_TCP_MD5SIG
907 const __u8 *hash_location = NULL;
908 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
909 unsigned char newhash[16];
910 int genhash;
911 struct sock *sk1 = NULL;
912 #endif
913 int oif = 0;
914
915 if (th->rst)
916 return;
917
918 /* If sk not NULL, it means we did a successful lookup and incoming
919 * route had to be correct. prequeue might have dropped our dst.
920 */
921 if (!sk && !ipv6_unicast_destination(skb))
922 return;
923
924 #ifdef CONFIG_TCP_MD5SIG
925 rcu_read_lock();
926 hash_location = tcp_parse_md5sig_option(th);
927 if (sk && sk_fullsock(sk)) {
928 key = tcp_v6_md5_do_lookup(sk, &ipv6h->saddr);
929 } else if (hash_location) {
930 /*
931 * active side is lost. Try to find listening socket through
932 * source port, and then find md5 key through listening socket.
933 * we are not loose security here:
934 * Incoming packet is checked with md5 hash with finding key,
935 * no RST generated if md5 hash doesn't match.
936 */
937 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
938 &tcp_hashinfo, NULL, 0,
939 &ipv6h->saddr,
940 th->source, &ipv6h->daddr,
941 ntohs(th->source),
942 tcp_v6_iif_l3_slave(skb),
943 tcp_v6_sdif(skb));
944 if (!sk1)
945 goto out;
946
947 key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
948 if (!key)
949 goto out;
950
951 genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, skb);
952 if (genhash || memcmp(hash_location, newhash, 16) != 0)
953 goto out;
954 }
955 #endif
956
957 if (th->ack)
958 seq = ntohl(th->ack_seq);
959 else
960 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
961 (th->doff << 2);
962
963 if (sk) {
964 oif = sk->sk_bound_dev_if;
965 if (sk_fullsock(sk))
966 trace_tcp_send_reset(sk, skb);
967 }
968
969 tcp_v6_send_response(sk, skb, seq, ack_seq, 0, 0, 0, oif, key, 1, 0, 0);
970
971 #ifdef CONFIG_TCP_MD5SIG
972 out:
973 rcu_read_unlock();
974 #endif
975 }
976
tcp_v6_send_ack(const struct sock * sk,struct sk_buff * skb,u32 seq,u32 ack,u32 win,u32 tsval,u32 tsecr,int oif,struct tcp_md5sig_key * key,u8 tclass,__be32 label)977 static void tcp_v6_send_ack(const struct sock *sk, struct sk_buff *skb, u32 seq,
978 u32 ack, u32 win, u32 tsval, u32 tsecr, int oif,
979 struct tcp_md5sig_key *key, u8 tclass,
980 __be32 label)
981 {
982 tcp_v6_send_response(sk, skb, seq, ack, win, tsval, tsecr, oif, key, 0,
983 tclass, label);
984 }
985
tcp_v6_timewait_ack(struct sock * sk,struct sk_buff * skb)986 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
987 {
988 struct inet_timewait_sock *tw = inet_twsk(sk);
989 struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
990
991 tcp_v6_send_ack(sk, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
992 tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
993 tcp_time_stamp_raw() + tcptw->tw_ts_offset,
994 tcptw->tw_ts_recent, tw->tw_bound_dev_if, tcp_twsk_md5_key(tcptw),
995 tw->tw_tclass, cpu_to_be32(tw->tw_flowlabel));
996
997 inet_twsk_put(tw);
998 }
999
tcp_v6_reqsk_send_ack(const struct sock * sk,struct sk_buff * skb,struct request_sock * req)1000 static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
1001 struct request_sock *req)
1002 {
1003 /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
1004 * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
1005 */
1006 /* RFC 7323 2.3
1007 * The window field (SEG.WND) of every outgoing segment, with the
1008 * exception of <SYN> segments, MUST be right-shifted by
1009 * Rcv.Wind.Shift bits:
1010 */
1011 tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
1012 tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
1013 tcp_rsk(req)->rcv_nxt,
1014 req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
1015 tcp_time_stamp_raw() + tcp_rsk(req)->ts_off,
1016 req->ts_recent, sk->sk_bound_dev_if,
1017 tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr),
1018 0, 0);
1019 }
1020
1021
tcp_v6_cookie_check(struct sock * sk,struct sk_buff * skb)1022 static struct sock *tcp_v6_cookie_check(struct sock *sk, struct sk_buff *skb)
1023 {
1024 #ifdef CONFIG_SYN_COOKIES
1025 const struct tcphdr *th = tcp_hdr(skb);
1026
1027 if (!th->syn)
1028 sk = cookie_v6_check(sk, skb);
1029 #endif
1030 return sk;
1031 }
1032
tcp_v6_conn_request(struct sock * sk,struct sk_buff * skb)1033 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1034 {
1035 if (skb->protocol == htons(ETH_P_IP))
1036 return tcp_v4_conn_request(sk, skb);
1037
1038 if (!ipv6_unicast_destination(skb))
1039 goto drop;
1040
1041 return tcp_conn_request(&tcp6_request_sock_ops,
1042 &tcp_request_sock_ipv6_ops, sk, skb);
1043
1044 drop:
1045 tcp_listendrop(sk);
1046 return 0; /* don't send reset */
1047 }
1048
tcp_v6_restore_cb(struct sk_buff * skb)1049 static void tcp_v6_restore_cb(struct sk_buff *skb)
1050 {
1051 /* We need to move header back to the beginning if xfrm6_policy_check()
1052 * and tcp_v6_fill_cb() are going to be called again.
1053 * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there.
1054 */
1055 memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6,
1056 sizeof(struct inet6_skb_parm));
1057 }
1058
tcp_v6_syn_recv_sock(const struct sock * sk,struct sk_buff * skb,struct request_sock * req,struct dst_entry * dst,struct request_sock * req_unhash,bool * own_req)1059 static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
1060 struct request_sock *req,
1061 struct dst_entry *dst,
1062 struct request_sock *req_unhash,
1063 bool *own_req)
1064 {
1065 struct inet_request_sock *ireq;
1066 struct ipv6_pinfo *newnp;
1067 const struct ipv6_pinfo *np = inet6_sk(sk);
1068 struct ipv6_txoptions *opt;
1069 struct tcp6_sock *newtcp6sk;
1070 struct inet_sock *newinet;
1071 struct tcp_sock *newtp;
1072 struct sock *newsk;
1073 #ifdef CONFIG_TCP_MD5SIG
1074 struct tcp_md5sig_key *key;
1075 #endif
1076 struct flowi6 fl6;
1077
1078 if (skb->protocol == htons(ETH_P_IP)) {
1079 /*
1080 * v6 mapped
1081 */
1082
1083 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst,
1084 req_unhash, own_req);
1085
1086 if (!newsk)
1087 return NULL;
1088
1089 newtcp6sk = (struct tcp6_sock *)newsk;
1090 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1091
1092 newinet = inet_sk(newsk);
1093 newnp = inet6_sk(newsk);
1094 newtp = tcp_sk(newsk);
1095
1096 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1097
1098 newnp->saddr = newsk->sk_v6_rcv_saddr;
1099
1100 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1101 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1102 #ifdef CONFIG_TCP_MD5SIG
1103 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1104 #endif
1105
1106 newnp->ipv6_mc_list = NULL;
1107 newnp->ipv6_ac_list = NULL;
1108 newnp->ipv6_fl_list = NULL;
1109 newnp->pktoptions = NULL;
1110 newnp->opt = NULL;
1111 newnp->mcast_oif = tcp_v6_iif(skb);
1112 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1113 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1114 if (np->repflow)
1115 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1116
1117 /*
1118 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1119 * here, tcp_create_openreq_child now does this for us, see the comment in
1120 * that function for the gory details. -acme
1121 */
1122
1123 /* It is tricky place. Until this moment IPv4 tcp
1124 worked with IPv6 icsk.icsk_af_ops.
1125 Sync it now.
1126 */
1127 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1128
1129 return newsk;
1130 }
1131
1132 ireq = inet_rsk(req);
1133
1134 if (sk_acceptq_is_full(sk))
1135 goto out_overflow;
1136
1137 if (!dst) {
1138 dst = inet6_csk_route_req(sk, &fl6, req, IPPROTO_TCP);
1139 if (!dst)
1140 goto out;
1141 }
1142
1143 newsk = tcp_create_openreq_child(sk, req, skb);
1144 if (!newsk)
1145 goto out_nonewsk;
1146
1147 /*
1148 * No need to charge this sock to the relevant IPv6 refcnt debug socks
1149 * count here, tcp_create_openreq_child now does this for us, see the
1150 * comment in that function for the gory details. -acme
1151 */
1152
1153 newsk->sk_gso_type = SKB_GSO_TCPV6;
1154 ip6_dst_store(newsk, dst, NULL, NULL);
1155 inet6_sk_rx_dst_set(newsk, skb);
1156
1157 newtcp6sk = (struct tcp6_sock *)newsk;
1158 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1159
1160 newtp = tcp_sk(newsk);
1161 newinet = inet_sk(newsk);
1162 newnp = inet6_sk(newsk);
1163
1164 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1165
1166 newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
1167 newnp->saddr = ireq->ir_v6_loc_addr;
1168 newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;
1169 newsk->sk_bound_dev_if = ireq->ir_iif;
1170
1171 /* Now IPv6 options...
1172
1173 First: no IPv4 options.
1174 */
1175 newinet->inet_opt = NULL;
1176 newnp->ipv6_mc_list = NULL;
1177 newnp->ipv6_ac_list = NULL;
1178 newnp->ipv6_fl_list = NULL;
1179
1180 /* Clone RX bits */
1181 newnp->rxopt.all = np->rxopt.all;
1182
1183 newnp->pktoptions = NULL;
1184 newnp->opt = NULL;
1185 newnp->mcast_oif = tcp_v6_iif(skb);
1186 newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1187 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
1188 if (np->repflow)
1189 newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
1190
1191 /* Clone native IPv6 options from listening socket (if any)
1192
1193 Yes, keeping reference count would be much more clever,
1194 but we make one more one thing there: reattach optmem
1195 to newsk.
1196 */
1197 opt = ireq->ipv6_opt;
1198 if (!opt)
1199 opt = rcu_dereference(np->opt);
1200 if (opt) {
1201 opt = ipv6_dup_options(newsk, opt);
1202 RCU_INIT_POINTER(newnp->opt, opt);
1203 }
1204 inet_csk(newsk)->icsk_ext_hdr_len = 0;
1205 if (opt)
1206 inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
1207 opt->opt_flen;
1208
1209 tcp_ca_openreq_child(newsk, dst);
1210
1211 tcp_sync_mss(newsk, dst_mtu(dst));
1212 newtp->advmss = tcp_mss_clamp(tcp_sk(sk), dst_metric_advmss(dst));
1213
1214 tcp_initialize_rcv_mss(newsk);
1215
1216 newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1217 newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1218
1219 #ifdef CONFIG_TCP_MD5SIG
1220 /* Copy over the MD5 key from the original socket */
1221 key = tcp_v6_md5_do_lookup(sk, &newsk->sk_v6_daddr);
1222 if (key) {
1223 /* We're using one, so create a matching key
1224 * on the newsk structure. If we fail to get
1225 * memory, then we end up not copying the key
1226 * across. Shucks.
1227 */
1228 tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newsk->sk_v6_daddr,
1229 AF_INET6, 128, key->key, key->keylen,
1230 sk_gfp_mask(sk, GFP_ATOMIC));
1231 }
1232 #endif
1233
1234 if (__inet_inherit_port(sk, newsk) < 0) {
1235 inet_csk_prepare_forced_close(newsk);
1236 tcp_done(newsk);
1237 goto out;
1238 }
1239 *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash));
1240 if (*own_req) {
1241 tcp_move_syn(newtp, req);
1242
1243 /* Clone pktoptions received with SYN, if we own the req */
1244 if (ireq->pktopts) {
1245 newnp->pktoptions = skb_clone(ireq->pktopts,
1246 sk_gfp_mask(sk, GFP_ATOMIC));
1247 consume_skb(ireq->pktopts);
1248 ireq->pktopts = NULL;
1249 if (newnp->pktoptions) {
1250 tcp_v6_restore_cb(newnp->pktoptions);
1251 skb_set_owner_r(newnp->pktoptions, newsk);
1252 }
1253 }
1254 }
1255
1256 return newsk;
1257
1258 out_overflow:
1259 __NET_INC_STATS(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1260 out_nonewsk:
1261 dst_release(dst);
1262 out:
1263 tcp_listendrop(sk);
1264 return NULL;
1265 }
1266
1267 /* The socket must have it's spinlock held when we get
1268 * here, unless it is a TCP_LISTEN socket.
1269 *
1270 * We have a potential double-lock case here, so even when
1271 * doing backlog processing we use the BH locking scheme.
1272 * This is because we cannot sleep with the original spinlock
1273 * held.
1274 */
tcp_v6_do_rcv(struct sock * sk,struct sk_buff * skb)1275 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1276 {
1277 struct ipv6_pinfo *np = inet6_sk(sk);
1278 struct tcp_sock *tp;
1279 struct sk_buff *opt_skb = NULL;
1280
1281 /* Imagine: socket is IPv6. IPv4 packet arrives,
1282 goes to IPv4 receive handler and backlogged.
1283 From backlog it always goes here. Kerboom...
1284 Fortunately, tcp_rcv_established and rcv_established
1285 handle them correctly, but it is not case with
1286 tcp_v6_hnd_req and tcp_v6_send_reset(). --ANK
1287 */
1288
1289 if (skb->protocol == htons(ETH_P_IP))
1290 return tcp_v4_do_rcv(sk, skb);
1291
1292 /*
1293 * socket locking is here for SMP purposes as backlog rcv
1294 * is currently called with bh processing disabled.
1295 */
1296
1297 /* Do Stevens' IPV6_PKTOPTIONS.
1298
1299 Yes, guys, it is the only place in our code, where we
1300 may make it not affecting IPv4.
1301 The rest of code is protocol independent,
1302 and I do not like idea to uglify IPv4.
1303
1304 Actually, all the idea behind IPV6_PKTOPTIONS
1305 looks not very well thought. For now we latch
1306 options, received in the last packet, enqueued
1307 by tcp. Feel free to propose better solution.
1308 --ANK (980728)
1309 */
1310 if (np->rxopt.all)
1311 opt_skb = skb_clone(skb, sk_gfp_mask(sk, GFP_ATOMIC));
1312
1313 if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1314 struct dst_entry *dst = sk->sk_rx_dst;
1315
1316 sock_rps_save_rxhash(sk, skb);
1317 sk_mark_napi_id(sk, skb);
1318 if (dst) {
1319 if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
1320 dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
1321 dst_release(dst);
1322 sk->sk_rx_dst = NULL;
1323 }
1324 }
1325
1326 tcp_rcv_established(sk, skb);
1327 if (opt_skb)
1328 goto ipv6_pktoptions;
1329 return 0;
1330 }
1331
1332 if (tcp_checksum_complete(skb))
1333 goto csum_err;
1334
1335 if (sk->sk_state == TCP_LISTEN) {
1336 struct sock *nsk = tcp_v6_cookie_check(sk, skb);
1337
1338 if (!nsk)
1339 goto discard;
1340
1341 if (nsk != sk) {
1342 if (tcp_child_process(sk, nsk, skb))
1343 goto reset;
1344 if (opt_skb)
1345 __kfree_skb(opt_skb);
1346 return 0;
1347 }
1348 } else
1349 sock_rps_save_rxhash(sk, skb);
1350
1351 if (tcp_rcv_state_process(sk, skb))
1352 goto reset;
1353 if (opt_skb)
1354 goto ipv6_pktoptions;
1355 return 0;
1356
1357 reset:
1358 tcp_v6_send_reset(sk, skb);
1359 discard:
1360 if (opt_skb)
1361 __kfree_skb(opt_skb);
1362 kfree_skb(skb);
1363 return 0;
1364 csum_err:
1365 TCP_INC_STATS(sock_net(sk), TCP_MIB_CSUMERRORS);
1366 TCP_INC_STATS(sock_net(sk), TCP_MIB_INERRS);
1367 goto discard;
1368
1369
1370 ipv6_pktoptions:
1371 /* Do you ask, what is it?
1372
1373 1. skb was enqueued by tcp.
1374 2. skb is added to tail of read queue, rather than out of order.
1375 3. socket is not in passive state.
1376 4. Finally, it really contains options, which user wants to receive.
1377 */
1378 tp = tcp_sk(sk);
1379 if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1380 !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1381 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1382 np->mcast_oif = tcp_v6_iif(opt_skb);
1383 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1384 np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1385 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
1386 np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
1387 if (np->repflow)
1388 np->flow_label = ip6_flowlabel(ipv6_hdr(opt_skb));
1389 if (ipv6_opt_accepted(sk, opt_skb, &TCP_SKB_CB(opt_skb)->header.h6)) {
1390 skb_set_owner_r(opt_skb, sk);
1391 tcp_v6_restore_cb(opt_skb);
1392 opt_skb = xchg(&np->pktoptions, opt_skb);
1393 } else {
1394 __kfree_skb(opt_skb);
1395 opt_skb = xchg(&np->pktoptions, NULL);
1396 }
1397 }
1398
1399 kfree_skb(opt_skb);
1400 return 0;
1401 }
1402
tcp_v6_fill_cb(struct sk_buff * skb,const struct ipv6hdr * hdr,const struct tcphdr * th)1403 static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
1404 const struct tcphdr *th)
1405 {
1406 /* This is tricky: we move IP6CB at its correct location into
1407 * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
1408 * _decode_session6() uses IP6CB().
1409 * barrier() makes sure compiler won't play aliasing games.
1410 */
1411 memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
1412 sizeof(struct inet6_skb_parm));
1413 barrier();
1414
1415 TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1416 TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1417 skb->len - th->doff*4);
1418 TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1419 TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
1420 TCP_SKB_CB(skb)->tcp_tw_isn = 0;
1421 TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
1422 TCP_SKB_CB(skb)->sacked = 0;
1423 TCP_SKB_CB(skb)->has_rxtstamp =
1424 skb->tstamp || skb_hwtstamps(skb)->hwtstamp;
1425 }
1426
tcp_v6_rcv(struct sk_buff * skb)1427 static int tcp_v6_rcv(struct sk_buff *skb)
1428 {
1429 int sdif = inet6_sdif(skb);
1430 const struct tcphdr *th;
1431 const struct ipv6hdr *hdr;
1432 bool refcounted;
1433 struct sock *sk;
1434 int ret;
1435 struct net *net = dev_net(skb->dev);
1436
1437 if (skb->pkt_type != PACKET_HOST)
1438 goto discard_it;
1439
1440 /*
1441 * Count it even if it's bad.
1442 */
1443 __TCP_INC_STATS(net, TCP_MIB_INSEGS);
1444
1445 if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1446 goto discard_it;
1447
1448 th = (const struct tcphdr *)skb->data;
1449
1450 if (unlikely(th->doff < sizeof(struct tcphdr)/4))
1451 goto bad_packet;
1452 if (!pskb_may_pull(skb, th->doff*4))
1453 goto discard_it;
1454
1455 if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
1456 goto csum_error;
1457
1458 th = (const struct tcphdr *)skb->data;
1459 hdr = ipv6_hdr(skb);
1460
1461 lookup:
1462 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
1463 th->source, th->dest, inet6_iif(skb), sdif,
1464 &refcounted);
1465 if (!sk)
1466 goto no_tcp_socket;
1467
1468 process:
1469 if (sk->sk_state == TCP_TIME_WAIT)
1470 goto do_time_wait;
1471
1472 if (sk->sk_state == TCP_NEW_SYN_RECV) {
1473 struct request_sock *req = inet_reqsk(sk);
1474 bool req_stolen = false;
1475 struct sock *nsk;
1476
1477 sk = req->rsk_listener;
1478 if (tcp_v6_inbound_md5_hash(sk, skb)) {
1479 sk_drops_add(sk, skb);
1480 reqsk_put(req);
1481 goto discard_it;
1482 }
1483 if (tcp_checksum_complete(skb)) {
1484 reqsk_put(req);
1485 goto csum_error;
1486 }
1487 if (unlikely(sk->sk_state != TCP_LISTEN)) {
1488 inet_csk_reqsk_queue_drop_and_put(sk, req);
1489 goto lookup;
1490 }
1491 sock_hold(sk);
1492 refcounted = true;
1493 nsk = NULL;
1494 if (!tcp_filter(sk, skb)) {
1495 th = (const struct tcphdr *)skb->data;
1496 hdr = ipv6_hdr(skb);
1497 tcp_v6_fill_cb(skb, hdr, th);
1498 nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
1499 }
1500 if (!nsk) {
1501 reqsk_put(req);
1502 if (req_stolen) {
1503 /* Another cpu got exclusive access to req
1504 * and created a full blown socket.
1505 * Try to feed this packet to this socket
1506 * instead of discarding it.
1507 */
1508 tcp_v6_restore_cb(skb);
1509 sock_put(sk);
1510 goto lookup;
1511 }
1512 goto discard_and_relse;
1513 }
1514 if (nsk == sk) {
1515 reqsk_put(req);
1516 tcp_v6_restore_cb(skb);
1517 } else if (tcp_child_process(sk, nsk, skb)) {
1518 tcp_v6_send_reset(nsk, skb);
1519 goto discard_and_relse;
1520 } else {
1521 sock_put(sk);
1522 return 0;
1523 }
1524 }
1525 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1526 __NET_INC_STATS(net, LINUX_MIB_TCPMINTTLDROP);
1527 goto discard_and_relse;
1528 }
1529
1530 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1531 goto discard_and_relse;
1532
1533 if (tcp_v6_inbound_md5_hash(sk, skb))
1534 goto discard_and_relse;
1535
1536 if (tcp_filter(sk, skb))
1537 goto discard_and_relse;
1538 th = (const struct tcphdr *)skb->data;
1539 hdr = ipv6_hdr(skb);
1540 tcp_v6_fill_cb(skb, hdr, th);
1541
1542 skb->dev = NULL;
1543
1544 if (sk->sk_state == TCP_LISTEN) {
1545 ret = tcp_v6_do_rcv(sk, skb);
1546 goto put_and_return;
1547 }
1548
1549 sk_incoming_cpu_update(sk);
1550
1551 bh_lock_sock_nested(sk);
1552 tcp_segs_in(tcp_sk(sk), skb);
1553 ret = 0;
1554 if (!sock_owned_by_user(sk)) {
1555 ret = tcp_v6_do_rcv(sk, skb);
1556 } else if (tcp_add_backlog(sk, skb)) {
1557 goto discard_and_relse;
1558 }
1559 bh_unlock_sock(sk);
1560
1561 put_and_return:
1562 if (refcounted)
1563 sock_put(sk);
1564 return ret ? -1 : 0;
1565
1566 no_tcp_socket:
1567 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1568 goto discard_it;
1569
1570 tcp_v6_fill_cb(skb, hdr, th);
1571
1572 if (tcp_checksum_complete(skb)) {
1573 csum_error:
1574 __TCP_INC_STATS(net, TCP_MIB_CSUMERRORS);
1575 bad_packet:
1576 __TCP_INC_STATS(net, TCP_MIB_INERRS);
1577 } else {
1578 tcp_v6_send_reset(NULL, skb);
1579 }
1580
1581 discard_it:
1582 kfree_skb(skb);
1583 return 0;
1584
1585 discard_and_relse:
1586 sk_drops_add(sk, skb);
1587 if (refcounted)
1588 sock_put(sk);
1589 goto discard_it;
1590
1591 do_time_wait:
1592 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1593 inet_twsk_put(inet_twsk(sk));
1594 goto discard_it;
1595 }
1596
1597 tcp_v6_fill_cb(skb, hdr, th);
1598
1599 if (tcp_checksum_complete(skb)) {
1600 inet_twsk_put(inet_twsk(sk));
1601 goto csum_error;
1602 }
1603
1604 switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1605 case TCP_TW_SYN:
1606 {
1607 struct sock *sk2;
1608
1609 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1610 skb, __tcp_hdrlen(th),
1611 &ipv6_hdr(skb)->saddr, th->source,
1612 &ipv6_hdr(skb)->daddr,
1613 ntohs(th->dest),
1614 tcp_v6_iif_l3_slave(skb),
1615 sdif);
1616 if (sk2) {
1617 struct inet_timewait_sock *tw = inet_twsk(sk);
1618 inet_twsk_deschedule_put(tw);
1619 sk = sk2;
1620 tcp_v6_restore_cb(skb);
1621 refcounted = false;
1622 goto process;
1623 }
1624 }
1625 /* to ACK */
1626 /* fall through */
1627 case TCP_TW_ACK:
1628 tcp_v6_timewait_ack(sk, skb);
1629 break;
1630 case TCP_TW_RST:
1631 tcp_v6_send_reset(sk, skb);
1632 inet_twsk_deschedule_put(inet_twsk(sk));
1633 goto discard_it;
1634 case TCP_TW_SUCCESS:
1635 ;
1636 }
1637 goto discard_it;
1638 }
1639
tcp_v6_early_demux(struct sk_buff * skb)1640 static void tcp_v6_early_demux(struct sk_buff *skb)
1641 {
1642 const struct ipv6hdr *hdr;
1643 const struct tcphdr *th;
1644 struct sock *sk;
1645
1646 if (skb->pkt_type != PACKET_HOST)
1647 return;
1648
1649 if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
1650 return;
1651
1652 hdr = ipv6_hdr(skb);
1653 th = tcp_hdr(skb);
1654
1655 if (th->doff < sizeof(struct tcphdr) / 4)
1656 return;
1657
1658 /* Note : We use inet6_iif() here, not tcp_v6_iif() */
1659 sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
1660 &hdr->saddr, th->source,
1661 &hdr->daddr, ntohs(th->dest),
1662 inet6_iif(skb), inet6_sdif(skb));
1663 if (sk) {
1664 skb->sk = sk;
1665 skb->destructor = sock_edemux;
1666 if (sk_fullsock(sk)) {
1667 struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);
1668
1669 if (dst)
1670 dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
1671 if (dst &&
1672 inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
1673 skb_dst_set_noref(skb, dst);
1674 }
1675 }
1676 }
1677
1678 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1679 .twsk_obj_size = sizeof(struct tcp6_timewait_sock),
1680 .twsk_unique = tcp_twsk_unique,
1681 .twsk_destructor = tcp_twsk_destructor,
1682 };
1683
1684 static const struct inet_connection_sock_af_ops ipv6_specific = {
1685 .queue_xmit = inet6_csk_xmit,
1686 .send_check = tcp_v6_send_check,
1687 .rebuild_header = inet6_sk_rebuild_header,
1688 .sk_rx_dst_set = inet6_sk_rx_dst_set,
1689 .conn_request = tcp_v6_conn_request,
1690 .syn_recv_sock = tcp_v6_syn_recv_sock,
1691 .net_header_len = sizeof(struct ipv6hdr),
1692 .net_frag_header_len = sizeof(struct frag_hdr),
1693 .setsockopt = ipv6_setsockopt,
1694 .getsockopt = ipv6_getsockopt,
1695 .addr2sockaddr = inet6_csk_addr2sockaddr,
1696 .sockaddr_len = sizeof(struct sockaddr_in6),
1697 #ifdef CONFIG_COMPAT
1698 .compat_setsockopt = compat_ipv6_setsockopt,
1699 .compat_getsockopt = compat_ipv6_getsockopt,
1700 #endif
1701 .mtu_reduced = tcp_v6_mtu_reduced,
1702 };
1703
1704 #ifdef CONFIG_TCP_MD5SIG
1705 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1706 .md5_lookup = tcp_v6_md5_lookup,
1707 .calc_md5_hash = tcp_v6_md5_hash_skb,
1708 .md5_parse = tcp_v6_parse_md5_keys,
1709 };
1710 #endif
1711
1712 /*
1713 * TCP over IPv4 via INET6 API
1714 */
1715 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1716 .queue_xmit = ip_queue_xmit,
1717 .send_check = tcp_v4_send_check,
1718 .rebuild_header = inet_sk_rebuild_header,
1719 .sk_rx_dst_set = inet_sk_rx_dst_set,
1720 .conn_request = tcp_v6_conn_request,
1721 .syn_recv_sock = tcp_v6_syn_recv_sock,
1722 .net_header_len = sizeof(struct iphdr),
1723 .setsockopt = ipv6_setsockopt,
1724 .getsockopt = ipv6_getsockopt,
1725 .addr2sockaddr = inet6_csk_addr2sockaddr,
1726 .sockaddr_len = sizeof(struct sockaddr_in6),
1727 #ifdef CONFIG_COMPAT
1728 .compat_setsockopt = compat_ipv6_setsockopt,
1729 .compat_getsockopt = compat_ipv6_getsockopt,
1730 #endif
1731 .mtu_reduced = tcp_v4_mtu_reduced,
1732 };
1733
1734 #ifdef CONFIG_TCP_MD5SIG
1735 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1736 .md5_lookup = tcp_v4_md5_lookup,
1737 .calc_md5_hash = tcp_v4_md5_hash_skb,
1738 .md5_parse = tcp_v6_parse_md5_keys,
1739 };
1740 #endif
1741
1742 /* NOTE: A lot of things set to zero explicitly by call to
1743 * sk_alloc() so need not be done here.
1744 */
tcp_v6_init_sock(struct sock * sk)1745 static int tcp_v6_init_sock(struct sock *sk)
1746 {
1747 struct inet_connection_sock *icsk = inet_csk(sk);
1748
1749 tcp_init_sock(sk);
1750
1751 icsk->icsk_af_ops = &ipv6_specific;
1752
1753 #ifdef CONFIG_TCP_MD5SIG
1754 tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
1755 #endif
1756
1757 return 0;
1758 }
1759
tcp_v6_destroy_sock(struct sock * sk)1760 static void tcp_v6_destroy_sock(struct sock *sk)
1761 {
1762 tcp_v4_destroy_sock(sk);
1763 inet6_destroy_sock(sk);
1764 }
1765
1766 #ifdef CONFIG_PROC_FS
1767 /* Proc filesystem TCPv6 sock list dumping. */
get_openreq6(struct seq_file * seq,const struct request_sock * req,int i)1768 static void get_openreq6(struct seq_file *seq,
1769 const struct request_sock *req, int i)
1770 {
1771 long ttd = req->rsk_timer.expires - jiffies;
1772 const struct in6_addr *src = &inet_rsk(req)->ir_v6_loc_addr;
1773 const struct in6_addr *dest = &inet_rsk(req)->ir_v6_rmt_addr;
1774
1775 if (ttd < 0)
1776 ttd = 0;
1777
1778 seq_printf(seq,
1779 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1780 "%02X %08X:%08X %02X:%08lX %08X %5u %8d %d %d %pK\n",
1781 i,
1782 src->s6_addr32[0], src->s6_addr32[1],
1783 src->s6_addr32[2], src->s6_addr32[3],
1784 inet_rsk(req)->ir_num,
1785 dest->s6_addr32[0], dest->s6_addr32[1],
1786 dest->s6_addr32[2], dest->s6_addr32[3],
1787 ntohs(inet_rsk(req)->ir_rmt_port),
1788 TCP_SYN_RECV,
1789 0, 0, /* could print option size, but that is af dependent. */
1790 1, /* timers active (only the expire timer) */
1791 jiffies_to_clock_t(ttd),
1792 req->num_timeout,
1793 from_kuid_munged(seq_user_ns(seq),
1794 sock_i_uid(req->rsk_listener)),
1795 0, /* non standard timer */
1796 0, /* open_requests have no inode */
1797 0, req);
1798 }
1799
get_tcp6_sock(struct seq_file * seq,struct sock * sp,int i)1800 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1801 {
1802 const struct in6_addr *dest, *src;
1803 __u16 destp, srcp;
1804 int timer_active;
1805 unsigned long timer_expires;
1806 const struct inet_sock *inet = inet_sk(sp);
1807 const struct tcp_sock *tp = tcp_sk(sp);
1808 const struct inet_connection_sock *icsk = inet_csk(sp);
1809 const struct fastopen_queue *fastopenq = &icsk->icsk_accept_queue.fastopenq;
1810 int rx_queue;
1811 int state;
1812
1813 dest = &sp->sk_v6_daddr;
1814 src = &sp->sk_v6_rcv_saddr;
1815 destp = ntohs(inet->inet_dport);
1816 srcp = ntohs(inet->inet_sport);
1817
1818 if (icsk->icsk_pending == ICSK_TIME_RETRANS ||
1819 icsk->icsk_pending == ICSK_TIME_REO_TIMEOUT ||
1820 icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
1821 timer_active = 1;
1822 timer_expires = icsk->icsk_timeout;
1823 } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
1824 timer_active = 4;
1825 timer_expires = icsk->icsk_timeout;
1826 } else if (timer_pending(&sp->sk_timer)) {
1827 timer_active = 2;
1828 timer_expires = sp->sk_timer.expires;
1829 } else {
1830 timer_active = 0;
1831 timer_expires = jiffies;
1832 }
1833
1834 state = inet_sk_state_load(sp);
1835 if (state == TCP_LISTEN)
1836 rx_queue = sp->sk_ack_backlog;
1837 else
1838 /* Because we don't lock the socket,
1839 * we might find a transient negative value.
1840 */
1841 rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
1842
1843 seq_printf(seq,
1844 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1845 "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %lu %lu %u %u %d\n",
1846 i,
1847 src->s6_addr32[0], src->s6_addr32[1],
1848 src->s6_addr32[2], src->s6_addr32[3], srcp,
1849 dest->s6_addr32[0], dest->s6_addr32[1],
1850 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1851 state,
1852 tp->write_seq - tp->snd_una,
1853 rx_queue,
1854 timer_active,
1855 jiffies_delta_to_clock_t(timer_expires - jiffies),
1856 icsk->icsk_retransmits,
1857 from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
1858 icsk->icsk_probes_out,
1859 sock_i_ino(sp),
1860 refcount_read(&sp->sk_refcnt), sp,
1861 jiffies_to_clock_t(icsk->icsk_rto),
1862 jiffies_to_clock_t(icsk->icsk_ack.ato),
1863 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
1864 tp->snd_cwnd,
1865 state == TCP_LISTEN ?
1866 fastopenq->max_qlen :
1867 (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
1868 );
1869 }
1870
get_timewait6_sock(struct seq_file * seq,struct inet_timewait_sock * tw,int i)1871 static void get_timewait6_sock(struct seq_file *seq,
1872 struct inet_timewait_sock *tw, int i)
1873 {
1874 long delta = tw->tw_timer.expires - jiffies;
1875 const struct in6_addr *dest, *src;
1876 __u16 destp, srcp;
1877
1878 dest = &tw->tw_v6_daddr;
1879 src = &tw->tw_v6_rcv_saddr;
1880 destp = ntohs(tw->tw_dport);
1881 srcp = ntohs(tw->tw_sport);
1882
1883 seq_printf(seq,
1884 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1885 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
1886 i,
1887 src->s6_addr32[0], src->s6_addr32[1],
1888 src->s6_addr32[2], src->s6_addr32[3], srcp,
1889 dest->s6_addr32[0], dest->s6_addr32[1],
1890 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1891 tw->tw_substate, 0, 0,
1892 3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
1893 refcount_read(&tw->tw_refcnt), tw);
1894 }
1895
tcp6_seq_show(struct seq_file * seq,void * v)1896 static int tcp6_seq_show(struct seq_file *seq, void *v)
1897 {
1898 struct tcp_iter_state *st;
1899 struct sock *sk = v;
1900
1901 if (v == SEQ_START_TOKEN) {
1902 seq_puts(seq,
1903 " sl "
1904 "local_address "
1905 "remote_address "
1906 "st tx_queue rx_queue tr tm->when retrnsmt"
1907 " uid timeout inode\n");
1908 goto out;
1909 }
1910 st = seq->private;
1911
1912 if (sk->sk_state == TCP_TIME_WAIT)
1913 get_timewait6_sock(seq, v, st->num);
1914 else if (sk->sk_state == TCP_NEW_SYN_RECV)
1915 get_openreq6(seq, v, st->num);
1916 else
1917 get_tcp6_sock(seq, v, st->num);
1918 out:
1919 return 0;
1920 }
1921
1922 static const struct seq_operations tcp6_seq_ops = {
1923 .show = tcp6_seq_show,
1924 .start = tcp_seq_start,
1925 .next = tcp_seq_next,
1926 .stop = tcp_seq_stop,
1927 };
1928
1929 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
1930 .family = AF_INET6,
1931 };
1932
tcp6_proc_init(struct net * net)1933 int __net_init tcp6_proc_init(struct net *net)
1934 {
1935 if (!proc_create_net_data("tcp6", 0444, net->proc_net, &tcp6_seq_ops,
1936 sizeof(struct tcp_iter_state), &tcp6_seq_afinfo))
1937 return -ENOMEM;
1938 return 0;
1939 }
1940
tcp6_proc_exit(struct net * net)1941 void tcp6_proc_exit(struct net *net)
1942 {
1943 remove_proc_entry("tcp6", net->proc_net);
1944 }
1945 #endif
1946
1947 struct proto tcpv6_prot = {
1948 .name = "TCPv6",
1949 .owner = THIS_MODULE,
1950 .close = tcp_close,
1951 .pre_connect = tcp_v6_pre_connect,
1952 .connect = tcp_v6_connect,
1953 .disconnect = tcp_disconnect,
1954 .accept = inet_csk_accept,
1955 .ioctl = tcp_ioctl,
1956 .init = tcp_v6_init_sock,
1957 .destroy = tcp_v6_destroy_sock,
1958 .shutdown = tcp_shutdown,
1959 .setsockopt = tcp_setsockopt,
1960 .getsockopt = tcp_getsockopt,
1961 .keepalive = tcp_set_keepalive,
1962 .recvmsg = tcp_recvmsg,
1963 .sendmsg = tcp_sendmsg,
1964 .sendpage = tcp_sendpage,
1965 .backlog_rcv = tcp_v6_do_rcv,
1966 .release_cb = tcp_release_cb,
1967 .hash = inet6_hash,
1968 .unhash = inet_unhash,
1969 .get_port = inet_csk_get_port,
1970 .enter_memory_pressure = tcp_enter_memory_pressure,
1971 .leave_memory_pressure = tcp_leave_memory_pressure,
1972 .stream_memory_free = tcp_stream_memory_free,
1973 .sockets_allocated = &tcp_sockets_allocated,
1974 .memory_allocated = &tcp_memory_allocated,
1975 .memory_pressure = &tcp_memory_pressure,
1976 .orphan_count = &tcp_orphan_count,
1977 .sysctl_mem = sysctl_tcp_mem,
1978 .sysctl_wmem_offset = offsetof(struct net, ipv4.sysctl_tcp_wmem),
1979 .sysctl_rmem_offset = offsetof(struct net, ipv4.sysctl_tcp_rmem),
1980 .max_header = MAX_TCP_HEADER,
1981 .obj_size = sizeof(struct tcp6_sock),
1982 .slab_flags = SLAB_TYPESAFE_BY_RCU,
1983 .twsk_prot = &tcp6_timewait_sock_ops,
1984 .rsk_prot = &tcp6_request_sock_ops,
1985 .h.hashinfo = &tcp_hashinfo,
1986 .no_autobind = true,
1987 #ifdef CONFIG_COMPAT
1988 .compat_setsockopt = compat_tcp_setsockopt,
1989 .compat_getsockopt = compat_tcp_getsockopt,
1990 #endif
1991 .diag_destroy = tcp_abort,
1992 };
1993
1994 /* thinking of making this const? Don't.
1995 * early_demux can change based on sysctl.
1996 */
1997 static struct inet6_protocol tcpv6_protocol = {
1998 .early_demux = tcp_v6_early_demux,
1999 .early_demux_handler = tcp_v6_early_demux,
2000 .handler = tcp_v6_rcv,
2001 .err_handler = tcp_v6_err,
2002 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2003 };
2004
2005 static struct inet_protosw tcpv6_protosw = {
2006 .type = SOCK_STREAM,
2007 .protocol = IPPROTO_TCP,
2008 .prot = &tcpv6_prot,
2009 .ops = &inet6_stream_ops,
2010 .flags = INET_PROTOSW_PERMANENT |
2011 INET_PROTOSW_ICSK,
2012 };
2013
tcpv6_net_init(struct net * net)2014 static int __net_init tcpv6_net_init(struct net *net)
2015 {
2016 return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2017 SOCK_RAW, IPPROTO_TCP, net);
2018 }
2019
tcpv6_net_exit(struct net * net)2020 static void __net_exit tcpv6_net_exit(struct net *net)
2021 {
2022 inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2023 }
2024
tcpv6_net_exit_batch(struct list_head * net_exit_list)2025 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2026 {
2027 inet_twsk_purge(&tcp_hashinfo, AF_INET6);
2028 }
2029
2030 static struct pernet_operations tcpv6_net_ops = {
2031 .init = tcpv6_net_init,
2032 .exit = tcpv6_net_exit,
2033 .exit_batch = tcpv6_net_exit_batch,
2034 };
2035
tcpv6_init(void)2036 int __init tcpv6_init(void)
2037 {
2038 int ret;
2039
2040 ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2041 if (ret)
2042 goto out;
2043
2044 /* register inet6 protocol */
2045 ret = inet6_register_protosw(&tcpv6_protosw);
2046 if (ret)
2047 goto out_tcpv6_protocol;
2048
2049 ret = register_pernet_subsys(&tcpv6_net_ops);
2050 if (ret)
2051 goto out_tcpv6_protosw;
2052 out:
2053 return ret;
2054
2055 out_tcpv6_protosw:
2056 inet6_unregister_protosw(&tcpv6_protosw);
2057 out_tcpv6_protocol:
2058 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2059 goto out;
2060 }
2061
tcpv6_exit(void)2062 void tcpv6_exit(void)
2063 {
2064 unregister_pernet_subsys(&tcpv6_net_ops);
2065 inet6_unregister_protosw(&tcpv6_protosw);
2066 inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2067 }
2068
