net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on:
   9  *      linux/net/ipv4/tcp.c
  10  *      linux/net/ipv4/tcp_input.c
  11  *      linux/net/ipv4/tcp_output.c
  12  *
  13  *      Fixes:
  14  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  15  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  16  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  17  *                                      a single port at the same time.
  18  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  */
  25
  26 #include <linux/bottom_half.h>
  27 #include <linux/module.h>
  28 #include <linux/errno.h>
  29 #include <linux/types.h>
  30 #include <linux/socket.h>
  31 #include <linux/sockios.h>
  32 #include <linux/net.h>
  33 #include <linux/jiffies.h>
  34 #include <linux/in.h>
  35 #include <linux/in6.h>
  36 #include <linux/netdevice.h>
  37 #include <linux/init.h>
  38 #include <linux/jhash.h>
  39 #include <linux/ipsec.h>
  40 #include <linux/times.h>
  41 #include <linux/slab.h>
  42
  43 #include <linux/ipv6.h>
  44 #include <linux/icmpv6.h>
  45 #include <linux/random.h>
  46
  47 #include <net/tcp.h>
  48 #include <net/ndisc.h>
  49 #include <net/inet6_hashtables.h>
  50 #include <net/inet6_connection_sock.h>
  51 #include <net/ipv6.h>
  52 #include <net/transp_v6.h>
  53 #include <net/addrconf.h>
  54 #include <net/ip6_route.h>
  55 #include <net/ip6_checksum.h>
  56 #include <net/inet_ecn.h>
  57 #include <net/protocol.h>
  58 #include <net/xfrm.h>
  59 #include <net/snmp.h>
  60 #include <net/dsfield.h>
  61 #include <net/timewait_sock.h>
  62 #include <net/netdma.h>
  63 #include <net/inet_common.h>
  64 #include <net/secure_seq.h>
  65
  66 #include <asm/uaccess.h>
  67
  68 #include <linux/proc_fs.h>
  69 #include <linux/seq_file.h>
  70
  71 #include <linux/crypto.h>
  72 #include <linux/scatterlist.h>
  73
  74 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
  75 static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  76                                       struct request_sock *req);
  77
  78 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  79 static void     __tcp_v6_send_check(struct sk_buff *skb,
  80                                     struct in6_addr *saddr,
  81                                     struct in6_addr *daddr);
  82
  83 static const struct inet_connection_sock_af_ops ipv6_mapped;
  84 static const struct inet_connection_sock_af_ops ipv6_specific;
  85 #ifdef CONFIG_TCP_MD5SIG
  86 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
  87 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
  88 #else
  89 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
  90                                                    struct in6_addr *addr)
  91 {
  92         return NULL;
  93 }
  94 #endif
  95
  96 static void tcp_v6_hash(struct sock *sk)
  97 {
  98         if (sk->sk_state != TCP_CLOSE) {
  99                 if (inet_csk(sk)->icsk_af_ops == &ipv6_mapped) {
 100                         tcp_prot.hash(sk);
 101                         return;
 102                 }
 103                 local_bh_disable();
 104                 __inet6_hash(sk, NULL);
 105                 local_bh_enable();
 106         }
 107 }
 108
 109 static __inline__ __sum16 tcp_v6_check(int len,
 110                                    struct in6_addr *saddr,
 111                                    struct in6_addr *daddr,
 112                                    __wsum base)
 113 {
 114         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 115 }
 116
 117 static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 118 {
 119         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
 120                                             ipv6_hdr(skb)->saddr.s6_addr32,
 121                                             tcp_hdr(skb)->dest,
 122                                             tcp_hdr(skb)->source);
 123 }
 124
 125 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 126                           int addr_len)
 127 {
 128         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 129         struct inet_sock *inet = inet_sk(sk);
 130         struct inet_connection_sock *icsk = inet_csk(sk);
 131         struct ipv6_pinfo *np = inet6_sk(sk);
 132         struct tcp_sock *tp = tcp_sk(sk);
 133         struct in6_addr *saddr = NULL, *final_p, final;
 134         struct rt6_info *rt;
 135         struct flowi fl;
 136         struct dst_entry *dst;
 137         int addr_type;
 138         int err;
 139
 140         if (addr_len < SIN6_LEN_RFC2133)
 141                 return -EINVAL;
 142
 143         if (usin->sin6_family != AF_INET6)
 144                 return -EAFNOSUPPORT;
 145
 146         memset(&fl, 0, sizeof(fl));
 147
 148         if (np->sndflow) {
 149                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 150                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 151                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 152                         struct ip6_flowlabel *flowlabel;
 153                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 154                         if (flowlabel == NULL)
 155                                 return -EINVAL;
 156                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 157                         fl6_sock_release(flowlabel);
 158                 }
 159         }
 160
 161         /*
 162          *      connect() to INADDR_ANY means loopback (BSD'ism).
 163          */
 164
 165         if(ipv6_addr_any(&usin->sin6_addr))
 166                 usin->sin6_addr.s6_addr[15] = 0x1;
 167
 168         addr_type = ipv6_addr_type(&usin->sin6_addr);
 169
 170         if(addr_type & IPV6_ADDR_MULTICAST)
 171                 return -ENETUNREACH;
 172
 173         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 174                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 175                     usin->sin6_scope_id) {
 176                         /* If interface is set while binding, indices
 177                          * must coincide.
 178                          */
 179                         if (sk->sk_bound_dev_if &&
 180                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 181                                 return -EINVAL;
 182
 183                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 184                 }
 185
 186                 /* Connect to link-local address requires an interface */
 187                 if (!sk->sk_bound_dev_if)
 188                         return -EINVAL;
 189         }
 190
 191         if (tp->rx_opt.ts_recent_stamp &&
 192             !ipv6_addr_equal(&np->daddr, &usin->sin6_addr)) {
 193                 tp->rx_opt.ts_recent = 0;
 194                 tp->rx_opt.ts_recent_stamp = 0;
 195                 tp->write_seq = 0;
 196         }
 197
 198         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 199         np->flow_label = fl.fl6_flowlabel;
 200
 201         /*
 202          *      TCP over IPv4
 203          */
 204
 205         if (addr_type == IPV6_ADDR_MAPPED) {
 206                 u32 exthdrlen = icsk->icsk_ext_hdr_len;
 207                 struct sockaddr_in sin;
 208
 209                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 210
 211                 if (__ipv6_only_sock(sk))
 212                         return -ENETUNREACH;
 213
 214                 sin.sin_family = AF_INET;
 215                 sin.sin_port = usin->sin6_port;
 216                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 217
 218                 icsk->icsk_af_ops = &ipv6_mapped;
 219                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 220 #ifdef CONFIG_TCP_MD5SIG
 221                 tp->af_specific = &tcp_sock_ipv6_mapped_specific;
 222 #endif
 223
 224                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 225
 226                 if (err) {
 227                         icsk->icsk_ext_hdr_len = exthdrlen;
 228                         icsk->icsk_af_ops = &ipv6_specific;
 229                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 230 #ifdef CONFIG_TCP_MD5SIG
 231                         tp->af_specific = &tcp_sock_ipv6_specific;
 232 #endif
 233                         goto failure;
 234                 } else {
 235                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 236                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
 237                                                &np->rcv_saddr);
 238                 }
 239
 240                 return err;
 241         }
 242
 243         if (!ipv6_addr_any(&np->rcv_saddr))
 244                 saddr = &np->rcv_saddr;
 245
 246         fl.proto = IPPROTO_TCP;
 247         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 248         ipv6_addr_copy(&fl.fl6_src,
 249                        (saddr ? saddr : &np->saddr));
 250         fl.oif = sk->sk_bound_dev_if;
 251         fl.mark = sk->sk_mark;
 252         fl.fl_ip_dport = usin->sin6_port;
 253         fl.fl_ip_sport = inet->inet_sport;
 254
 255         final_p = fl6_update_dst(&fl, np->opt, &final);
 256
 257         security_sk_classify_flow(sk, &fl);
 258
 259         err = ip6_dst_lookup(sk, &dst, &fl);
 260         if (err)
 261                 goto failure;
 262         if (final_p)
 263                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 264
 265         err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
 266         if (err < 0) {
 267                 if (err == -EREMOTE)
 268                         err = ip6_dst_blackhole(sk, &dst, &fl);
 269                 if (err < 0)
 270                         goto failure;
 271         }
 272
 273         if (saddr == NULL) {
 274                 saddr = &fl.fl6_src;
 275                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 276         }
 277
 278         /* set the source address */
 279         ipv6_addr_copy(&np->saddr, saddr);
 280         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 281
 282         sk->sk_gso_type = SKB_GSO_TCPV6;
 283         __ip6_dst_store(sk, dst, NULL, NULL);
 284
 285         rt = (struct rt6_info *) dst;
 286         if (tcp_death_row.sysctl_tw_recycle &&
 287             !tp->rx_opt.ts_recent_stamp &&
 288             ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
 289                 struct inet_peer *peer = rt6_get_peer(rt);
 290                 /*
 291                  * VJ's idea. We save last timestamp seen from
 292                  * the destination in peer table, when entering state
 293                  * TIME-WAIT * and initialize rx_opt.ts_recent from it,
 294                  * when trying new connection.
 295                  */
 296                 if (peer) {
 297                         inet_peer_refcheck(peer);
 298                         if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
 299                                 tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
 300                                 tp->rx_opt.ts_recent = peer->tcp_ts;
 301                         }
 302                 }
 303         }
 304
 305         icsk->icsk_ext_hdr_len = 0;
 306         if (np->opt)
 307                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
 308                                           np->opt->opt_nflen);
 309
 310         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 311
 312         inet->inet_dport = usin->sin6_port;
 313
 314         tcp_set_state(sk, TCP_SYN_SENT);
 315         err = inet6_hash_connect(&tcp_death_row, sk);
 316         if (err)
 317                 goto late_failure;
 318
 319         if (!tp->write_seq)
 320                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 321                                                              np->daddr.s6_addr32,
 322                                                              inet->inet_sport,
 323                                                              inet->inet_dport);
 324
 325         err = tcp_connect(sk);
 326         if (err)
 327                 goto late_failure;
 328
 329         return 0;
 330
 331 late_failure:
 332         tcp_set_state(sk, TCP_CLOSE);
 333         __sk_dst_reset(sk);
 334 failure:
 335         inet->inet_dport = 0;
 336         sk->sk_route_caps = 0;
 337         return err;
 338 }
 339
 340 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 341                 u8 type, u8 code, int offset, __be32 info)
 342 {
 343         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 344         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 345         struct ipv6_pinfo *np;
 346         struct sock *sk;
 347         int err;
 348         struct tcp_sock *tp;
 349         __u32 seq;
 350         struct net *net = dev_net(skb->dev);
 351
 352         sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
 353                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 354
 355         if (sk == NULL) {
 356                 ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev),
 357                                    ICMP6_MIB_INERRORS);
 358                 return;
 359         }
 360
 361         if (sk->sk_state == TCP_TIME_WAIT) {
 362                 inet_twsk_put(inet_twsk(sk));
 363                 return;
 364         }
 365
 366         bh_lock_sock(sk);
 367         if (sock_owned_by_user(sk))
 368                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 369
 370         if (sk->sk_state == TCP_CLOSE)
 371                 goto out;
 372
 373         if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
 374                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
 375                 goto out;
 376         }
 377
 378         tp = tcp_sk(sk);
 379         seq = ntohl(th->seq);
 380         if (sk->sk_state != TCP_LISTEN &&
 381             !between(seq, tp->snd_una, tp->snd_nxt)) {
 382                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 383                 goto out;
 384         }
 385
 386         np = inet6_sk(sk);
 387
 388         if (type == ICMPV6_PKT_TOOBIG) {
 389                 struct dst_entry *dst = NULL;
 390
 391                 if (sock_owned_by_user(sk))
 392                         goto out;
 393                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 394                         goto out;
 395
 396                 /* icmp should have updated the destination cache entry */
 397                 dst = __sk_dst_check(sk, np->dst_cookie);
 398
 399                 if (dst == NULL) {
 400                         struct inet_sock *inet = inet_sk(sk);
 401                         struct flowi fl;
 402
 403                         /* BUGGG_FUTURE: Again, it is not clear how
 404                            to handle rthdr case. Ignore this complexity
 405                            for now.
 406                          */
 407                         memset(&fl, 0, sizeof(fl));
 408                         fl.proto = IPPROTO_TCP;
 409                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 410                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 411                         fl.oif = sk->sk_bound_dev_if;
 412                         fl.mark = sk->sk_mark;
 413                         fl.fl_ip_dport = inet->inet_dport;
 414                         fl.fl_ip_sport = inet->inet_sport;
 415                         security_skb_classify_flow(skb, &fl);
 416
 417                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 418                                 sk->sk_err_soft = -err;
 419                                 goto out;
 420                         }
 421
 422                         if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
 423                                 sk->sk_err_soft = -err;
 424                                 goto out;
 425                         }
 426
 427                 } else
 428                         dst_hold(dst);
 429
 430                 if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
 431                         tcp_sync_mss(sk, dst_mtu(dst));
 432                         tcp_simple_retransmit(sk);
 433                 } /* else let the usual retransmit timer handle it */
 434                 dst_release(dst);
 435                 goto out;
 436         }
 437
 438         icmpv6_err_convert(type, code, &err);
 439
 440         /* Might be for an request_sock */
 441         switch (sk->sk_state) {
 442                 struct request_sock *req, **prev;
 443         case TCP_LISTEN:
 444                 if (sock_owned_by_user(sk))
 445                         goto out;
 446
 447                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
 448                                            &hdr->saddr, inet6_iif(skb));
 449                 if (!req)
 450                         goto out;
 451
 452                 /* ICMPs are not backlogged, hence we cannot get
 453                  * an established socket here.
 454                  */
 455                 WARN_ON(req->sk != NULL);
 456
 457                 if (seq != tcp_rsk(req)->snt_isn) {
 458                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
 459                         goto out;
 460                 }
 461
 462                 inet_csk_reqsk_queue_drop(sk, req, prev);
 463                 goto out;
 464
 465         case TCP_SYN_SENT:
 466         case TCP_SYN_RECV:  /* Cannot happen.
 467                                It can, it SYNs are crossed. --ANK */
 468                 if (!sock_owned_by_user(sk)) {
 469                         sk->sk_err = err;
 470                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 471
 472                         tcp_done(sk);
 473                 } else
 474                         sk->sk_err_soft = err;
 475                 goto out;
 476         }
 477
 478         if (!sock_owned_by_user(sk) && np->recverr) {
 479                 sk->sk_err = err;
 480                 sk->sk_error_report(sk);
 481         } else
 482                 sk->sk_err_soft = err;
 483
 484 out:
 485         bh_unlock_sock(sk);
 486         sock_put(sk);
 487 }
 488
 489
 490 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 491                               struct request_values *rvp)
 492 {
 493         struct inet6_request_sock *treq = inet6_rsk(req);
 494         struct ipv6_pinfo *np = inet6_sk(sk);
 495         struct sk_buff * skb;
 496         struct ipv6_txoptions *opt = NULL;
 497         struct in6_addr * final_p, final;
 498         struct flowi fl;
 499         struct dst_entry *dst;
 500         int err = -1;
 501
 502         memset(&fl, 0, sizeof(fl));
 503         fl.proto = IPPROTO_TCP;
 504         ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 505         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
 506         fl.fl6_flowlabel = 0;
 507         fl.oif = treq->iif;
 508         fl.mark = sk->sk_mark;
 509         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
 510         fl.fl_ip_sport = inet_rsk(req)->loc_port;
 511         security_req_classify_flow(req, &fl);
 512
 513         opt = np->opt;
 514         final_p = fl6_update_dst(&fl, opt, &final);
 515
 516         err = ip6_dst_lookup(sk, &dst, &fl);
 517         if (err)
 518                 goto done;
 519         if (final_p)
 520                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 521         if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
 522                 goto done;
 523
 524         skb = tcp_make_synack(sk, dst, req, rvp);
 525         if (skb) {
 526                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 527
 528                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
 529                 err = ip6_xmit(sk, skb, &fl, opt);
 530                 err = net_xmit_eval(err);
 531         }
 532
 533 done:
 534         if (opt && opt != np->opt)
 535                 sock_kfree_s(sk, opt, opt->tot_len);
 536         dst_release(dst);
 537         return err;
 538 }
 539
 540 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
 541                              struct request_values *rvp)
 542 {
 543         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
 544         return tcp_v6_send_synack(sk, req, rvp);
 545 }
 546
 547 static inline void syn_flood_warning(struct sk_buff *skb)
 548 {
 549 #ifdef CONFIG_SYN_COOKIES
 550         if (sysctl_tcp_syncookies)
 551                 printk(KERN_INFO
 552                        "TCPv6: Possible SYN flooding on port %d. "
 553                        "Sending cookies.\n", ntohs(tcp_hdr(skb)->dest));
 554         else
 555 #endif
 556                 printk(KERN_INFO
 557                        "TCPv6: Possible SYN flooding on port %d. "
 558                        "Dropping request.\n", ntohs(tcp_hdr(skb)->dest));
 559 }
 560
 561 static void tcp_v6_reqsk_destructor(struct request_sock *req)
 562 {
 563         kfree_skb(inet6_rsk(req)->pktopts);
 564 }
 565
 566 #ifdef CONFIG_TCP_MD5SIG
 567 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 568                                                    struct in6_addr *addr)
 569 {
 570         struct tcp_sock *tp = tcp_sk(sk);
 571         int i;
 572
 573         BUG_ON(tp == NULL);
 574
 575         if (!tp->md5sig_info || !tp->md5sig_info->entries6)
 576                 return NULL;
 577
 578         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 579                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
 580                         return &tp->md5sig_info->keys6[i].base;
 581         }
 582         return NULL;
 583 }
 584
 585 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
 586                                                 struct sock *addr_sk)
 587 {
 588         return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
 589 }
 590
 591 static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
 592                                                       struct request_sock *req)
 593 {
 594         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 595 }
 596
 597 static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 598                              char *newkey, u8 newkeylen)
 599 {
 600         /* Add key to the list */
 601         struct tcp_md5sig_key *key;
 602         struct tcp_sock *tp = tcp_sk(sk);
 603         struct tcp6_md5sig_key *keys;
 604
 605         key = tcp_v6_md5_do_lookup(sk, peer);
 606         if (key) {
 607                 /* modify existing entry - just update that one */
 608                 kfree(key->key);
 609                 key->key = newkey;
 610                 key->keylen = newkeylen;
 611         } else {
 612                 /* reallocate new list if current one is full. */
 613                 if (!tp->md5sig_info) {
 614                         tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
 615                         if (!tp->md5sig_info) {
 616                                 kfree(newkey);
 617                                 return -ENOMEM;
 618                         }
 619                         sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 620                 }
 621                 if (tcp_alloc_md5sig_pool(sk) == NULL) {
 622                         kfree(newkey);
 623                         return -ENOMEM;
 624                 }
 625                 if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
 626                         keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
 627                                        (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
 628
 629                         if (!keys) {
 630                                 tcp_free_md5sig_pool();
 631                                 kfree(newkey);
 632                                 return -ENOMEM;
 633                         }
 634
 635                         if (tp->md5sig_info->entries6)
 636                                 memmove(keys, tp->md5sig_info->keys6,
 637                                         (sizeof (tp->md5sig_info->keys6[0]) *
 638                                          tp->md5sig_info->entries6));
 639
 640                         kfree(tp->md5sig_info->keys6);
 641                         tp->md5sig_info->keys6 = keys;
 642                         tp->md5sig_info->alloced6++;
 643                 }
 644
 645                 ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
 646                                peer);
 647                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
 648                 tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 649
 650                 tp->md5sig_info->entries6++;
 651         }
 652         return 0;
 653 }
 654
 655 static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
 656                                u8 *newkey, __u8 newkeylen)
 657 {
 658         return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
 659                                  newkey, newkeylen);
 660 }
 661
 662 static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
 663 {
 664         struct tcp_sock *tp = tcp_sk(sk);
 665         int i;
 666
 667         for (i = 0; i < tp->md5sig_info->entries6; i++) {
 668                 if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
 669                         /* Free the key */
 670                         kfree(tp->md5sig_info->keys6[i].base.key);
 671                         tp->md5sig_info->entries6--;
 672
 673                         if (tp->md5sig_info->entries6 == 0) {
 674                                 kfree(tp->md5sig_info->keys6);
 675                                 tp->md5sig_info->keys6 = NULL;
 676                                 tp->md5sig_info->alloced6 = 0;
 677                         } else {
 678                                 /* shrink the database */
 679                                 if (tp->md5sig_info->entries6 != i)
 680                                         memmove(&tp->md5sig_info->keys6[i],
 681                                                 &tp->md5sig_info->keys6[i+1],
 682                                                 (tp->md5sig_info->entries6 - i)
 683                                                 * sizeof (tp->md5sig_info->keys6[0]));
 684                         }
 685                         tcp_free_md5sig_pool();
 686                         return 0;
 687                 }
 688         }
 689         return -ENOENT;
 690 }
 691
 692 static void tcp_v6_clear_md5_list (struct sock *sk)
 693 {
 694         struct tcp_sock *tp = tcp_sk(sk);
 695         int i;
 696
 697         if (tp->md5sig_info->entries6) {
 698                 for (i = 0; i < tp->md5sig_info->entries6; i++)
 699                         kfree(tp->md5sig_info->keys6[i].base.key);
 700                 tp->md5sig_info->entries6 = 0;
 701                 tcp_free_md5sig_pool();
 702         }
 703
 704         kfree(tp->md5sig_info->keys6);
 705         tp->md5sig_info->keys6 = NULL;
 706         tp->md5sig_info->alloced6 = 0;
 707
 708         if (tp->md5sig_info->entries4) {
 709                 for (i = 0; i < tp->md5sig_info->entries4; i++)
 710                         kfree(tp->md5sig_info->keys4[i].base.key);
 711                 tp->md5sig_info->entries4 = 0;
 712                 tcp_free_md5sig_pool();
 713         }
 714
 715         kfree(tp->md5sig_info->keys4);
 716         tp->md5sig_info->keys4 = NULL;
 717         tp->md5sig_info->alloced4 = 0;
 718 }
 719
 720 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 721                                   int optlen)
 722 {
 723         struct tcp_md5sig cmd;
 724         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
 725         u8 *newkey;
 726
 727         if (optlen < sizeof(cmd))
 728                 return -EINVAL;
 729
 730         if (copy_from_user(&cmd, optval, sizeof(cmd)))
 731                 return -EFAULT;
 732
 733         if (sin6->sin6_family != AF_INET6)
 734                 return -EINVAL;
 735
 736         if (!cmd.tcpm_keylen) {
 737                 if (!tcp_sk(sk)->md5sig_info)
 738                         return -ENOENT;
 739                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
 740                         return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
 741                 return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
 742         }
 743
 744         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
 745                 return -EINVAL;
 746
 747         if (!tcp_sk(sk)->md5sig_info) {
 748                 struct tcp_sock *tp = tcp_sk(sk);
 749                 struct tcp_md5sig_info *p;
 750
 751                 p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
 752                 if (!p)
 753                         return -ENOMEM;
 754
 755                 tp->md5sig_info = p;
 756                 sk_nocaps_add(sk, NETIF_F_GSO_MASK);
 757         }
 758
 759         newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
 760         if (!newkey)
 761                 return -ENOMEM;
 762         if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
 763                 return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
 764                                          newkey, cmd.tcpm_keylen);
 765         }
 766         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 767 }
 768
 769 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 770                                         struct in6_addr *daddr,
 771                                         struct in6_addr *saddr, int nbytes)
 772 {
 773         struct tcp6_pseudohdr *bp;
 774         struct scatterlist sg;
 775
 776         bp = &hp->md5_blk.ip6;
 777         /* 1. TCP pseudo-header (RFC2460) */
 778         ipv6_addr_copy(&bp->saddr, saddr);
 779         ipv6_addr_copy(&bp->daddr, daddr);
 780         bp->protocol = cpu_to_be32(IPPROTO_TCP);
 781         bp->len = cpu_to_be32(nbytes);
 782
 783         sg_init_one(&sg, bp, sizeof(*bp));
 784         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
 785 }
 786
 787 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
 788                                struct in6_addr *daddr, struct in6_addr *saddr,
 789                                struct tcphdr *th)
 790 {
 791         struct tcp_md5sig_pool *hp;
 792         struct hash_desc *desc;
 793
 794         hp = tcp_get_md5sig_pool();
 795         if (!hp)
 796                 goto clear_hash_noput;
 797         desc = &hp->md5_desc;
 798
 799         if (crypto_hash_init(desc))
 800                 goto clear_hash;
 801         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
 802                 goto clear_hash;
 803         if (tcp_md5_hash_header(hp, th))
 804                 goto clear_hash;
 805         if (tcp_md5_hash_key(hp, key))
 806                 goto clear_hash;
 807         if (crypto_hash_final(desc, md5_hash))
 808                 goto clear_hash;
 809
 810         tcp_put_md5sig_pool();
 811         return 0;
 812
 813 clear_hash:
 814         tcp_put_md5sig_pool();
 815 clear_hash_noput:
 816         memset(md5_hash, 0, 16);
 817         return 1;
 818 }
 819
 820 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
 821                                struct sock *sk, struct request_sock *req,
 822                                struct sk_buff *skb)
 823 {
 824         struct in6_addr *saddr, *daddr;
 825         struct tcp_md5sig_pool *hp;
 826         struct hash_desc *desc;
 827         struct tcphdr *th = tcp_hdr(skb);
 828
 829         if (sk) {
 830                 saddr = &inet6_sk(sk)->saddr;
 831                 daddr = &inet6_sk(sk)->daddr;
 832         } else if (req) {
 833                 saddr = &inet6_rsk(req)->loc_addr;
 834                 daddr = &inet6_rsk(req)->rmt_addr;
 835         } else {
 836                 struct ipv6hdr *ip6h = ipv6_hdr(skb);
 837                 saddr = &ip6h->saddr;
 838                 daddr = &ip6h->daddr;
 839         }
 840
 841         hp = tcp_get_md5sig_pool();
 842         if (!hp)
 843                 goto clear_hash_noput;
 844         desc = &hp->md5_desc;
 845
 846         if (crypto_hash_init(desc))
 847                 goto clear_hash;
 848
 849         if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
 850                 goto clear_hash;
 851         if (tcp_md5_hash_header(hp, th))
 852                 goto clear_hash;
 853         if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
 854                 goto clear_hash;
 855         if (tcp_md5_hash_key(hp, key))
 856                 goto clear_hash;
 857         if (crypto_hash_final(desc, md5_hash))
 858                 goto clear_hash;
 859
 860         tcp_put_md5sig_pool();
 861         return 0;
 862
 863 clear_hash:
 864         tcp_put_md5sig_pool();
 865 clear_hash_noput:
 866         memset(md5_hash, 0, 16);
 867         return 1;
 868 }
 869
 870 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 871 {
 872         __u8 *hash_location = NULL;
 873         struct tcp_md5sig_key *hash_expected;
 874         struct ipv6hdr *ip6h = ipv6_hdr(skb);
 875         struct tcphdr *th = tcp_hdr(skb);
 876         int genhash;
 877         u8 newhash[16];
 878
 879         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
 880         hash_location = tcp_parse_md5sig_option(th);
 881
 882         /* We've parsed the options - do we have a hash? */
 883         if (!hash_expected && !hash_location)
 884                 return 0;
 885
 886         if (hash_expected && !hash_location) {
 887                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
 888                 return 1;
 889         }
 890
 891         if (!hash_expected && hash_location) {
 892                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
 893                 return 1;
 894         }
 895
 896         /* check the signature */
 897         genhash = tcp_v6_md5_hash_skb(newhash,
 898                                       hash_expected,
 899                                       NULL, NULL, skb);
 900
 901         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
 902                 if (net_ratelimit()) {
 903                         printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
 904                                genhash ? "failed" : "mismatch",
 905                                &ip6h->saddr, ntohs(th->source),
 906                                &ip6h->daddr, ntohs(th->dest));
 907                 }
 908                 return 1;
 909         }
 910         return 0;
 911 }
 912 #endif
 913
 914 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
 915         .family         =       AF_INET6,
 916         .obj_size       =       sizeof(struct tcp6_request_sock),
 917         .rtx_syn_ack    =       tcp_v6_rtx_synack,
 918         .send_ack       =       tcp_v6_reqsk_send_ack,
 919         .destructor     =       tcp_v6_reqsk_destructor,
 920         .send_reset     =       tcp_v6_send_reset,
 921         .syn_ack_timeout =      tcp_syn_ack_timeout,
 922 };
 923
 924 #ifdef CONFIG_TCP_MD5SIG
 925 static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 926         .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
 927         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
 928 };
 929 #endif
 930
 931 static void __tcp_v6_send_check(struct sk_buff *skb,
 932                                 struct in6_addr *saddr, struct in6_addr *daddr)
 933 {
 934         struct tcphdr *th = tcp_hdr(skb);
 935
 936         if (skb->ip_summed == CHECKSUM_PARTIAL) {
 937                 th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
 938                 skb->csum_start = skb_transport_header(skb) - skb->head;
 939                 skb->csum_offset = offsetof(struct tcphdr, check);
 940         } else {
 941                 th->check = tcp_v6_check(skb->len, saddr, daddr,
 942                                          csum_partial(th, th->doff << 2,
 943                                                       skb->csum));
 944         }
 945 }
 946
 947 static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 948 {
 949         struct ipv6_pinfo *np = inet6_sk(sk);
 950
 951         __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
 952 }
 953
 954 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 955 {
 956         struct ipv6hdr *ipv6h;
 957         struct tcphdr *th;
 958
 959         if (!pskb_may_pull(skb, sizeof(*th)))
 960                 return -EINVAL;
 961
 962         ipv6h = ipv6_hdr(skb);
 963         th = tcp_hdr(skb);
 964
 965         th->check = 0;
 966         skb->ip_summed = CHECKSUM_PARTIAL;
 967         __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
 968         return 0;
 969 }
 970
 971 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 972                                          struct sk_buff *skb)
 973 {
 974         struct ipv6hdr *iph = skb_gro_network_header(skb);
 975
 976         switch (skb->ip_summed) {
 977         case CHECKSUM_COMPLETE:
 978                 if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
 979                                   skb->csum)) {
 980                         skb->ip_summed = CHECKSUM_UNNECESSARY;
 981                         break;
 982                 }
 983
 984                 /* fall through */
 985         case CHECKSUM_NONE:
 986                 NAPI_GRO_CB(skb)->flush = 1;
 987                 return NULL;
 988         }
 989
 990         return tcp_gro_receive(head, skb);
 991 }
 992
 993 static int tcp6_gro_complete(struct sk_buff *skb)
 994 {
 995         struct ipv6hdr *iph = ipv6_hdr(skb);
 996         struct tcphdr *th = tcp_hdr(skb);
 997
 998         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
 999                                   &iph->saddr, &iph->daddr, 0);
1000         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
1001
1002         return tcp_gro_complete(skb);
1003 }
1004
1005 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
1006                                  u32 ts, struct tcp_md5sig_key *key, int rst)
1007 {
1008         struct tcphdr *th = tcp_hdr(skb), *t1;
1009         struct sk_buff *buff;
1010         struct flowi fl;
1011         struct net *net = dev_net(skb_dst(skb)->dev);
1012         struct sock *ctl_sk = net->ipv6.tcp_sk;
1013         unsigned int tot_len = sizeof(struct tcphdr);
1014         struct dst_entry *dst;
1015         __be32 *topt;
1016
1017         if (ts)
1018                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
1019 #ifdef CONFIG_TCP_MD5SIG
1020         if (key)
1021                 tot_len += TCPOLEN_MD5SIG_ALIGNED;
1022 #endif
1023
1024         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
1025                          GFP_ATOMIC);
1026         if (buff == NULL)
1027                 return;
1028
1029         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
1030
1031         t1 = (struct tcphdr *) skb_push(buff, tot_len);
1032         skb_reset_transport_header(buff);
1033
1034         /* Swap the send and the receive. */
1035         memset(t1, 0, sizeof(*t1));
1036         t1->dest = th->source;
1037         t1->source = th->dest;
1038         t1->doff = tot_len / 4;
1039         t1->seq = htonl(seq);
1040         t1->ack_seq = htonl(ack);
1041         t1->ack = !rst || !th->ack;
1042         t1->rst = rst;
1043         t1->window = htons(win);
1044
1045         topt = (__be32 *)(t1 + 1);
1046
1047         if (ts) {
1048                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1049                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1050                 *topt++ = htonl(tcp_time_stamp);
1051                 *topt++ = htonl(ts);
1052         }
1053
1054 #ifdef CONFIG_TCP_MD5SIG
1055         if (key) {
1056                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1057                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
1058                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
1059                                     &ipv6_hdr(skb)->saddr,
1060                                     &ipv6_hdr(skb)->daddr, t1);
1061         }
1062 #endif
1063
1064         memset(&fl, 0, sizeof(fl));
1065         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
1066         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
1067
1068         buff->ip_summed = CHECKSUM_PARTIAL;
1069         buff->csum = 0;
1070
1071         __tcp_v6_send_check(buff, &fl.fl6_src, &fl.fl6_dst);
1072
1073         fl.proto = IPPROTO_TCP;
1074         fl.oif = inet6_iif(skb);
1075         fl.fl_ip_dport = t1->dest;
1076         fl.fl_ip_sport = t1->source;
1077         security_skb_classify_flow(skb, &fl);
1078
1079         /* Pass a socket to ip6_dst_lookup either it is for RST
1080          * Underlying function will use this to retrieve the network
1081          * namespace
1082          */
1083         if (!ip6_dst_lookup(ctl_sk, &dst, &fl)) {
1084                 if (xfrm_lookup(net, &dst, &fl, NULL, 0) >= 0) {
1085                         skb_dst_set(buff, dst);
1086                         ip6_xmit(ctl_sk, buff, &fl, NULL);
1087                         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
1088                         if (rst)
1089                                 TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
1090                         return;
1091                 }
1092         }
1093
1094         kfree_skb(buff);
1095 }
1096
1097 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
1098 {
1099         struct tcphdr *th = tcp_hdr(skb);
1100         u32 seq = 0, ack_seq = 0;
1101         struct tcp_md5sig_key *key = NULL;
1102
1103         if (th->rst)
1104                 return;
1105
1106         if (!ipv6_unicast_destination(skb))
1107                 return;
1108
1109 #ifdef CONFIG_TCP_MD5SIG
1110         if (sk)
1111                 key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
1112 #endif
1113
1114         if (th->ack)
1115                 seq = ntohl(th->ack_seq);
1116         else
1117                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
1118                           (th->doff << 2);
1119
1120         tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1);
1121 }
1122
1123 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
1124                             struct tcp_md5sig_key *key)
1125 {
1126         tcp_v6_send_response(skb, seq, ack, win, ts, key, 0);
1127 }
1128
1129 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1130 {
1131         struct inet_timewait_sock *tw = inet_twsk(sk);
1132         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
1133
1134         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
1135                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
1136                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw));
1137
1138         inet_twsk_put(tw);
1139 }
1140
1141 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
1142                                   struct request_sock *req)
1143 {
1144         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
1145                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
1146 }
1147
1148
1149 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1150 {
1151         struct request_sock *req, **prev;
1152         const struct tcphdr *th = tcp_hdr(skb);
1153         struct sock *nsk;
1154
1155         /* Find possible connection requests. */
1156         req = inet6_csk_search_req(sk, &prev, th->source,
1157                                    &ipv6_hdr(skb)->saddr,
1158                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
1159         if (req)
1160                 return tcp_check_req(sk, skb, req, prev);
1161
1162         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
1163                         &ipv6_hdr(skb)->saddr, th->source,
1164                         &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
1165
1166         if (nsk) {
1167                 if (nsk->sk_state != TCP_TIME_WAIT) {
1168                         bh_lock_sock(nsk);
1169                         return nsk;
1170                 }
1171                 inet_twsk_put(inet_twsk(nsk));
1172                 return NULL;
1173         }
1174
1175 #ifdef CONFIG_SYN_COOKIES
1176         if (!th->syn)
1177                 sk = cookie_v6_check(sk, skb);
1178 #endif
1179         return sk;
1180 }
1181
1182 /* FIXME: this is substantially similar to the ipv4 code.
1183  * Can some kind of merge be done? -- erics
1184  */
1185 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1186 {
1187         struct tcp_extend_values tmp_ext;
1188         struct tcp_options_received tmp_opt;
1189         u8 *hash_location;
1190         struct request_sock *req;
1191         struct inet6_request_sock *treq;
1192         struct ipv6_pinfo *np = inet6_sk(sk);
1193         struct tcp_sock *tp = tcp_sk(sk);
1194         __u32 isn = TCP_SKB_CB(skb)->when;
1195         struct dst_entry *dst = NULL;
1196 #ifdef CONFIG_SYN_COOKIES
1197         int want_cookie = 0;
1198 #else
1199 #define want_cookie 0
1200 #endif
1201
1202         if (skb->protocol == htons(ETH_P_IP))
1203                 return tcp_v4_conn_request(sk, skb);
1204
1205         if (!ipv6_unicast_destination(skb))
1206                 goto drop;
1207
1208         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
1209                 if (net_ratelimit())
1210                         syn_flood_warning(skb);
1211 #ifdef CONFIG_SYN_COOKIES
1212                 if (sysctl_tcp_syncookies)
1213                         want_cookie = 1;
1214                 else
1215 #endif
1216                 goto drop;
1217         }
1218
1219         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1220                 goto drop;
1221
1222         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
1223         if (req == NULL)
1224                 goto drop;
1225
1226 #ifdef CONFIG_TCP_MD5SIG
1227         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
1228 #endif
1229
1230         tcp_clear_options(&tmp_opt);
1231         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1232         tmp_opt.user_mss = tp->rx_opt.user_mss;
1233         tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
1234
1235         if (tmp_opt.cookie_plus > 0 &&
1236             tmp_opt.saw_tstamp &&
1237             !tp->rx_opt.cookie_out_never &&
1238             (sysctl_tcp_cookie_size > 0 ||
1239              (tp->cookie_values != NULL &&
1240               tp->cookie_values->cookie_desired > 0))) {
1241                 u8 *c;
1242                 u32 *d;
1243                 u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
1244                 int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
1245
1246                 if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
1247                         goto drop_and_free;
1248
1249                 /* Secret recipe starts with IP addresses */
1250                 d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
1251                 *mess++ ^= *d++;
1252                 *mess++ ^= *d++;
1253                 *mess++ ^= *d++;
1254                 *mess++ ^= *d++;
1255                 d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
1256                 *mess++ ^= *d++;
1257                 *mess++ ^= *d++;
1258                 *mess++ ^= *d++;
1259                 *mess++ ^= *d++;
1260
1261                 /* plus variable length Initiator Cookie */
1262                 c = (u8 *)mess;
1263                 while (l-- > 0)
1264                         *c++ ^= *hash_location++;
1265
1266 #ifdef CONFIG_SYN_COOKIES
1267                 want_cookie = 0;        /* not our kind of cookie */
1268 #endif
1269                 tmp_ext.cookie_out_never = 0; /* false */
1270                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
1271         } else if (!tp->rx_opt.cookie_in_always) {
1272                 /* redundant indications, but ensure initialization. */
1273                 tmp_ext.cookie_out_never = 1; /* true */
1274                 tmp_ext.cookie_plus = 0;
1275         } else {
1276                 goto drop_and_free;
1277         }
1278         tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
1279
1280         if (want_cookie && !tmp_opt.saw_tstamp)
1281                 tcp_clear_options(&tmp_opt);
1282
1283         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
1284         tcp_openreq_init(req, &tmp_opt, skb);
1285
1286         treq = inet6_rsk(req);
1287         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1288         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1289         if (!want_cookie || tmp_opt.tstamp_ok)
1290                 TCP_ECN_create_request(req, tcp_hdr(skb));
1291
1292         if (!isn) {
1293                 struct inet_peer *peer = NULL;
1294
1295                 if (ipv6_opt_accepted(sk, skb) ||
1296                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
1297                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
1298                         atomic_inc(&skb->users);
1299                         treq->pktopts = skb;
1300                 }
1301                 treq->iif = sk->sk_bound_dev_if;
1302
1303                 /* So that link locals have meaning */
1304                 if (!sk->sk_bound_dev_if &&
1305                     ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
1306                         treq->iif = inet6_iif(skb);
1307
1308                 if (want_cookie) {
1309                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
1310                         req->cookie_ts = tmp_opt.tstamp_ok;
1311                         goto have_isn;
1312                 }
1313
1314                 /* VJ's idea. We save last timestamp seen
1315                  * from the destination in peer table, when entering
1316                  * state TIME-WAIT, and check against it before
1317                  * accepting new connection request.
1318                  *
1319                  * If "isn" is not zero, this request hit alive
1320                  * timewait bucket, so that all the necessary checks
1321                  * are made in the function processing timewait state.
1322                  */
1323                 if (tmp_opt.saw_tstamp &&
1324                     tcp_death_row.sysctl_tw_recycle &&
1325                     (dst = inet6_csk_route_req(sk, req)) != NULL &&
1326                     (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
1327                     ipv6_addr_equal((struct in6_addr *)peer->daddr.a6,
1328                                     &treq->rmt_addr)) {
1329                         inet_peer_refcheck(peer);
1330                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
1331                             (s32)(peer->tcp_ts - req->ts_recent) >
1332                                                         TCP_PAWS_WINDOW) {
1333                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
1334                                 goto drop_and_release;
1335                         }
1336                 }
1337                 /* Kill the following clause, if you dislike this way. */
1338                 else if (!sysctl_tcp_syncookies &&
1339                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
1340                           (sysctl_max_syn_backlog >> 2)) &&
1341                          (!peer || !peer->tcp_ts_stamp) &&
1342                          (!dst || !dst_metric(dst, RTAX_RTT))) {
1343                         /* Without syncookies last quarter of
1344                          * backlog is filled with destinations,
1345                          * proven to be alive.
1346                          * It means that we continue to communicate
1347                          * to destinations, already remembered
1348                          * to the moment of synflood.
1349                          */
1350                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
1351                                        &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
1352                         goto drop_and_release;
1353                 }
1354
1355                 isn = tcp_v6_init_sequence(skb);
1356         }
1357 have_isn:
1358         tcp_rsk(req)->snt_isn = isn;
1359
1360         security_inet_conn_request(sk, skb, req);
1361
1362         if (tcp_v6_send_synack(sk, req,
1363                                (struct request_values *)&tmp_ext) ||
1364             want_cookie)
1365                 goto drop_and_free;
1366
1367         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
1368         return 0;
1369
1370 drop_and_release:
1371         dst_release(dst);
1372 drop_and_free:
1373         reqsk_free(req);
1374 drop:
1375         return 0; /* don't send reset */
1376 }
1377
1378 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1379                                           struct request_sock *req,
1380                                           struct dst_entry *dst)
1381 {
1382         struct inet6_request_sock *treq;
1383         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1384         struct tcp6_sock *newtcp6sk;
1385         struct inet_sock *newinet;
1386         struct tcp_sock *newtp;
1387         struct sock *newsk;
1388         struct ipv6_txoptions *opt;
1389 #ifdef CONFIG_TCP_MD5SIG
1390         struct tcp_md5sig_key *key;
1391 #endif
1392
1393         if (skb->protocol == htons(ETH_P_IP)) {
1394                 /*
1395                  *      v6 mapped
1396                  */
1397
1398                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1399
1400                 if (newsk == NULL)
1401                         return NULL;
1402
1403                 newtcp6sk = (struct tcp6_sock *)newsk;
1404                 inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1405
1406                 newinet = inet_sk(newsk);
1407                 newnp = inet6_sk(newsk);
1408                 newtp = tcp_sk(newsk);
1409
1410                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1411
1412                 ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
1413
1414                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
1415
1416                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1417
1418                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
1419                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1420 #ifdef CONFIG_TCP_MD5SIG
1421                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
1422 #endif
1423
1424                 newnp->pktoptions  = NULL;
1425                 newnp->opt         = NULL;
1426                 newnp->mcast_oif   = inet6_iif(skb);
1427                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
1428
1429                 /*
1430                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
1431                  * here, tcp_create_openreq_child now does this for us, see the comment in
1432                  * that function for the gory details. -acme
1433                  */
1434
1435                 /* It is tricky place. Until this moment IPv4 tcp
1436                    worked with IPv6 icsk.icsk_af_ops.
1437                    Sync it now.
1438                  */
1439                 tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie);
1440
1441                 return newsk;
1442         }
1443
1444         treq = inet6_rsk(req);
1445         opt = np->opt;
1446
1447         if (sk_acceptq_is_full(sk))
1448                 goto out_overflow;
1449
1450         if (!dst) {
1451                 dst = inet6_csk_route_req(sk, req);
1452                 if (!dst)
1453                         goto out;
1454         }
1455
1456         newsk = tcp_create_openreq_child(sk, req, skb);
1457         if (newsk == NULL)
1458                 goto out_nonewsk;
1459
1460         /*
1461          * No need to charge this sock to the relevant IPv6 refcnt debug socks
1462          * count here, tcp_create_openreq_child now does this for us, see the
1463          * comment in that function for the gory details. -acme
1464          */
1465
1466         newsk->sk_gso_type = SKB_GSO_TCPV6;
1467         __ip6_dst_store(newsk, dst, NULL, NULL);
1468
1469         newtcp6sk = (struct tcp6_sock *)newsk;
1470         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
1471
1472         newtp = tcp_sk(newsk);
1473         newinet = inet_sk(newsk);
1474         newnp = inet6_sk(newsk);
1475
1476         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1477
1478         ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
1479         ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
1480         ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
1481         newsk->sk_bound_dev_if = treq->iif;
1482
1483         /* Now IPv6 options...
1484
1485            First: no IPv4 options.
1486          */
1487         newinet->opt = NULL;
1488         newnp->ipv6_fl_list = NULL;
1489
1490         /* Clone RX bits */
1491         newnp->rxopt.all = np->rxopt.all;
1492
1493         /* Clone pktoptions received with SYN */
1494         newnp->pktoptions = NULL;
1495         if (treq->pktopts != NULL) {
1496                 newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
1497                 kfree_skb(treq->pktopts);
1498                 treq->pktopts = NULL;
1499                 if (newnp->pktoptions)
1500                         skb_set_owner_r(newnp->pktoptions, newsk);
1501         }
1502         newnp->opt        = NULL;
1503         newnp->mcast_oif  = inet6_iif(skb);
1504         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
1505
1506         /* Clone native IPv6 options from listening socket (if any)
1507
1508            Yes, keeping reference count would be much more clever,
1509            but we make one more one thing there: reattach optmem
1510            to newsk.
1511          */
1512         if (opt) {
1513                 newnp->opt = ipv6_dup_options(newsk, opt);
1514                 if (opt != np->opt)
1515                         sock_kfree_s(sk, opt, opt->tot_len);
1516         }
1517
1518         inet_csk(newsk)->icsk_ext_hdr_len = 0;
1519         if (newnp->opt)
1520                 inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
1521                                                      newnp->opt->opt_flen);
1522
1523         tcp_mtup_init(newsk);
1524         tcp_sync_mss(newsk, dst_mtu(dst));
1525         newtp->advmss = dst_metric_advmss(dst);
1526         tcp_initialize_rcv_mss(newsk);
1527
1528         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
1529         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
1530
1531 #ifdef CONFIG_TCP_MD5SIG
1532         /* Copy over the MD5 key from the original socket */
1533         if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
1534                 /* We're using one, so create a matching key
1535                  * on the newsk structure. If we fail to get
1536                  * memory, then we end up not copying the key
1537                  * across. Shucks.
1538                  */
1539                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1540                 if (newkey != NULL)
1541                         tcp_v6_md5_do_add(newsk, &newnp->daddr,
1542                                           newkey, key->keylen);
1543         }
1544 #endif
1545
1546         if (__inet_inherit_port(sk, newsk) < 0) {
1547                 sock_put(newsk);
1548                 goto out;
1549         }
1550         __inet6_hash(newsk, NULL);
1551
1552         return newsk;
1553
1554 out_overflow:
1555         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
1556 out_nonewsk:
1557         if (opt && opt != np->opt)
1558                 sock_kfree_s(sk, opt, opt->tot_len);
1559         dst_release(dst);
1560 out:
1561         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
1562         return NULL;
1563 }
1564
1565 static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
1566 {
1567         if (skb->ip_summed == CHECKSUM_COMPLETE) {
1568                 if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
1569                                   &ipv6_hdr(skb)->daddr, skb->csum)) {
1570                         skb->ip_summed = CHECKSUM_UNNECESSARY;
1571                         return 0;
1572                 }
1573         }
1574
1575         skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
1576                                               &ipv6_hdr(skb)->saddr,
1577                                               &ipv6_hdr(skb)->daddr, 0));
1578
1579         if (skb->len <= 76) {
1580                 return __skb_checksum_complete(skb);
1581         }
1582         return 0;
1583 }
1584
1585 /* The socket must have it's spinlock held when we get
1586  * here.
1587  *
1588  * We have a potential double-lock case here, so even when
1589  * doing backlog processing we use the BH locking scheme.
1590  * This is because we cannot sleep with the original spinlock
1591  * held.
1592  */
1593 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1594 {
1595         struct ipv6_pinfo *np = inet6_sk(sk);
1596         struct tcp_sock *tp;
1597         struct sk_buff *opt_skb = NULL;
1598
1599         /* Imagine: socket is IPv6. IPv4 packet arrives,
1600            goes to IPv4 receive handler and backlogged.
1601            From backlog it always goes here. Kerboom...
1602            Fortunately, tcp_rcv_established and rcv_established
1603            handle them correctly, but it is not case with
1604            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1605          */
1606
1607         if (skb->protocol == htons(ETH_P_IP))
1608                 return tcp_v4_do_rcv(sk, skb);
1609
1610 #ifdef CONFIG_TCP_MD5SIG
1611         if (tcp_v6_inbound_md5_hash (sk, skb))
1612                 goto discard;
1613 #endif
1614
1615         if (sk_filter(sk, skb))
1616                 goto discard;
1617
1618         /*
1619          *      socket locking is here for SMP purposes as backlog rcv
1620          *      is currently called with bh processing disabled.
1621          */
1622
1623         /* Do Stevens' IPV6_PKTOPTIONS.
1624
1625            Yes, guys, it is the only place in our code, where we
1626            may make it not affecting IPv4.
1627            The rest of code is protocol independent,
1628            and I do not like idea to uglify IPv4.
1629
1630            Actually, all the idea behind IPV6_PKTOPTIONS
1631            looks not very well thought. For now we latch
1632            options, received in the last packet, enqueued
1633            by tcp. Feel free to propose better solution.
1634                                                --ANK (980728)
1635          */
1636         if (np->rxopt.all)
1637                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1638
1639         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1640                 TCP_CHECK_TIMER(sk);
1641                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
1642                         goto reset;
1643                 TCP_CHECK_TIMER(sk);
1644                 if (opt_skb)
1645                         goto ipv6_pktoptions;
1646                 return 0;
1647         }
1648
1649         if (skb->len < tcp_hdrlen(skb) || tcp_checksum_complete(skb))
1650                 goto csum_err;
1651
1652         if (sk->sk_state == TCP_LISTEN) {
1653                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1654                 if (!nsk)
1655                         goto discard;
1656
1657                 /*
1658                  * Queue it on the new socket if the new socket is active,
1659                  * otherwise we just shortcircuit this and continue with
1660                  * the new socket..
1661                  */
1662                 if(nsk != sk) {
1663                         if (tcp_child_process(sk, nsk, skb))
1664                                 goto reset;
1665                         if (opt_skb)
1666                                 __kfree_skb(opt_skb);
1667                         return 0;
1668                 }
1669         }
1670
1671         TCP_CHECK_TIMER(sk);
1672         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
1673                 goto reset;
1674         TCP_CHECK_TIMER(sk);
1675         if (opt_skb)
1676                 goto ipv6_pktoptions;
1677         return 0;
1678
1679 reset:
1680         tcp_v6_send_reset(sk, skb);
1681 discard:
1682         if (opt_skb)
1683                 __kfree_skb(opt_skb);
1684         kfree_skb(skb);
1685         return 0;
1686 csum_err:
1687         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
1688         goto discard;
1689
1690
1691 ipv6_pktoptions:
1692         /* Do you ask, what is it?
1693
1694            1. skb was enqueued by tcp.
1695            2. skb is added to tail of read queue, rather than out of order.
1696            3. socket is not in passive state.
1697            4. Finally, it really contains options, which user wants to receive.
1698          */
1699         tp = tcp_sk(sk);
1700         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1701             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1702                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
1703                         np->mcast_oif = inet6_iif(opt_skb);
1704                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
1705                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
1706                 if (ipv6_opt_accepted(sk, opt_skb)) {
1707                         skb_set_owner_r(opt_skb, sk);
1708                         opt_skb = xchg(&np->pktoptions, opt_skb);
1709                 } else {
1710                         __kfree_skb(opt_skb);
1711                         opt_skb = xchg(&np->pktoptions, NULL);
1712                 }
1713         }
1714
1715         kfree_skb(opt_skb);
1716         return 0;
1717 }
1718
1719 static int tcp_v6_rcv(struct sk_buff *skb)
1720 {
1721         struct tcphdr *th;
1722         struct ipv6hdr *hdr;
1723         struct sock *sk;
1724         int ret;
1725         struct net *net = dev_net(skb->dev);
1726
1727         if (skb->pkt_type != PACKET_HOST)
1728                 goto discard_it;
1729
1730         /*
1731          *      Count it even if it's bad.
1732          */
1733         TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
1734
1735         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1736                 goto discard_it;
1737
1738         th = tcp_hdr(skb);
1739
1740         if (th->doff < sizeof(struct tcphdr)/4)
1741                 goto bad_packet;
1742         if (!pskb_may_pull(skb, th->doff*4))
1743                 goto discard_it;
1744
1745         if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
1746                 goto bad_packet;
1747
1748         th = tcp_hdr(skb);
1749         hdr = ipv6_hdr(skb);
1750         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1751         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1752                                     skb->len - th->doff*4);
1753         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1754         TCP_SKB_CB(skb)->when = 0;
1755         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
1756         TCP_SKB_CB(skb)->sacked = 0;
1757
1758         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
1759         if (!sk)
1760                 goto no_tcp_socket;
1761
1762 process:
1763         if (sk->sk_state == TCP_TIME_WAIT)
1764                 goto do_time_wait;
1765
1766         if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
1767                 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
1768                 goto discard_and_relse;
1769         }
1770
1771         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1772                 goto discard_and_relse;
1773
1774         if (sk_filter(sk, skb))
1775                 goto discard_and_relse;
1776
1777         skb->dev = NULL;
1778
1779         bh_lock_sock_nested(sk);
1780         ret = 0;
1781         if (!sock_owned_by_user(sk)) {
1782 #ifdef CONFIG_NET_DMA
1783                 struct tcp_sock *tp = tcp_sk(sk);
1784                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1785                         tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
1786                 if (tp->ucopy.dma_chan)
1787                         ret = tcp_v6_do_rcv(sk, skb);
1788                 else
1789 #endif
1790                 {
1791                         if (!tcp_prequeue(sk, skb))
1792                                 ret = tcp_v6_do_rcv(sk, skb);
1793                 }
1794         } else if (unlikely(sk_add_backlog(sk, skb))) {
1795                 bh_unlock_sock(sk);
1796                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
1797                 goto discard_and_relse;
1798         }
1799         bh_unlock_sock(sk);
1800
1801         sock_put(sk);
1802         return ret ? -1 : 0;
1803
1804 no_tcp_socket:
1805         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1806                 goto discard_it;
1807
1808         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1809 bad_packet:
1810                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1811         } else {
1812                 tcp_v6_send_reset(NULL, skb);
1813         }
1814
1815 discard_it:
1816
1817         /*
1818          *      Discard frame
1819          */
1820
1821         kfree_skb(skb);
1822         return 0;
1823
1824 discard_and_relse:
1825         sock_put(sk);
1826         goto discard_it;
1827
1828 do_time_wait:
1829         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1830                 inet_twsk_put(inet_twsk(sk));
1831                 goto discard_it;
1832         }
1833
1834         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1835                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
1836                 inet_twsk_put(inet_twsk(sk));
1837                 goto discard_it;
1838         }
1839
1840         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
1841         case TCP_TW_SYN:
1842         {
1843                 struct sock *sk2;
1844
1845                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
1846                                             &ipv6_hdr(skb)->daddr,
1847                                             ntohs(th->dest), inet6_iif(skb));
1848                 if (sk2 != NULL) {
1849                         struct inet_timewait_sock *tw = inet_twsk(sk);
1850                         inet_twsk_deschedule(tw, &tcp_death_row);
1851                         inet_twsk_put(tw);
1852                         sk = sk2;
1853                         goto process;
1854                 }
1855                 /* Fall through to ACK */
1856         }
1857         case TCP_TW_ACK:
1858                 tcp_v6_timewait_ack(sk, skb);
1859                 break;
1860         case TCP_TW_RST:
1861                 goto no_tcp_socket;
1862         case TCP_TW_SUCCESS:;
1863         }
1864         goto discard_it;
1865 }
1866
1867 static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
1868 {
1869         struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
1870         struct ipv6_pinfo *np = inet6_sk(sk);
1871         struct inet_peer *peer;
1872
1873         if (!rt ||
1874             !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
1875                 peer = inet_getpeer_v6(&np->daddr, 1);
1876                 *release_it = true;
1877         } else {
1878                 if (!rt->rt6i_peer)
1879                         rt6_bind_peer(rt, 1);
1880                 peer = rt->rt6i_peer;
1881                 *release_it = false;
1882         }
1883
1884         return peer;
1885 }
1886
1887 static void *tcp_v6_tw_get_peer(struct sock *sk)
1888 {
1889         struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
1890         struct inet_timewait_sock *tw = inet_twsk(sk);
1891
1892         if (tw->tw_family == AF_INET)
1893                 return tcp_v4_tw_get_peer(sk);
1894
1895         return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
1896 }
1897
1898 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
1899         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
1900         .twsk_unique    = tcp_twsk_unique,
1901         .twsk_destructor= tcp_twsk_destructor,
1902         .twsk_getpeer   = tcp_v6_tw_get_peer,
1903 };
1904
1905 static const struct inet_connection_sock_af_ops ipv6_specific = {
1906         .queue_xmit        = inet6_csk_xmit,
1907         .send_check        = tcp_v6_send_check,
1908         .rebuild_header    = inet6_sk_rebuild_header,
1909         .conn_request      = tcp_v6_conn_request,
1910         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1911         .get_peer          = tcp_v6_get_peer,
1912         .net_header_len    = sizeof(struct ipv6hdr),
1913         .setsockopt        = ipv6_setsockopt,
1914         .getsockopt        = ipv6_getsockopt,
1915         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1916         .sockaddr_len      = sizeof(struct sockaddr_in6),
1917         .bind_conflict     = inet6_csk_bind_conflict,
1918 #ifdef CONFIG_COMPAT
1919         .compat_setsockopt = compat_ipv6_setsockopt,
1920         .compat_getsockopt = compat_ipv6_getsockopt,
1921 #endif
1922 };
1923
1924 #ifdef CONFIG_TCP_MD5SIG
1925 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
1926         .md5_lookup     =       tcp_v6_md5_lookup,
1927         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
1928         .md5_add        =       tcp_v6_md5_add_func,
1929         .md5_parse      =       tcp_v6_parse_md5_keys,
1930 };
1931 #endif
1932
1933 /*
1934  *      TCP over IPv4 via INET6 API
1935  */
1936
1937 static const struct inet_connection_sock_af_ops ipv6_mapped = {
1938         .queue_xmit        = ip_queue_xmit,
1939         .send_check        = tcp_v4_send_check,
1940         .rebuild_header    = inet_sk_rebuild_header,
1941         .conn_request      = tcp_v6_conn_request,
1942         .syn_recv_sock     = tcp_v6_syn_recv_sock,
1943         .get_peer          = tcp_v4_get_peer,
1944         .net_header_len    = sizeof(struct iphdr),
1945         .setsockopt        = ipv6_setsockopt,
1946         .getsockopt        = ipv6_getsockopt,
1947         .addr2sockaddr     = inet6_csk_addr2sockaddr,
1948         .sockaddr_len      = sizeof(struct sockaddr_in6),
1949         .bind_conflict     = inet6_csk_bind_conflict,
1950 #ifdef CONFIG_COMPAT
1951         .compat_setsockopt = compat_ipv6_setsockopt,
1952         .compat_getsockopt = compat_ipv6_getsockopt,
1953 #endif
1954 };
1955
1956 #ifdef CONFIG_TCP_MD5SIG
1957 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
1958         .md5_lookup     =       tcp_v4_md5_lookup,
1959         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
1960         .md5_add        =       tcp_v6_md5_add_func,
1961         .md5_parse      =       tcp_v6_parse_md5_keys,
1962 };
1963 #endif
1964
1965 /* NOTE: A lot of things set to zero explicitly by call to
1966  *       sk_alloc() so need not be done here.
1967  */
1968 static int tcp_v6_init_sock(struct sock *sk)
1969 {
1970         struct inet_connection_sock *icsk = inet_csk(sk);
1971         struct tcp_sock *tp = tcp_sk(sk);
1972
1973         skb_queue_head_init(&tp->out_of_order_queue);
1974         tcp_init_xmit_timers(sk);
1975         tcp_prequeue_init(tp);
1976
1977         icsk->icsk_rto = TCP_TIMEOUT_INIT;
1978         tp->mdev = TCP_TIMEOUT_INIT;
1979
1980         /* So many TCP implementations out there (incorrectly) count the
1981          * initial SYN frame in their delayed-ACK and congestion control
1982          * algorithms that we must have the following bandaid to talk
1983          * efficiently to them.  -DaveM
1984          */
1985         tp->snd_cwnd = 2;
1986
1987         /* See draft-stevens-tcpca-spec-01 for discussion of the
1988          * initialization of these values.
1989          */
1990         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
1991         tp->snd_cwnd_clamp = ~0;
1992         tp->mss_cache = TCP_MSS_DEFAULT;
1993
1994         tp->reordering = sysctl_tcp_reordering;
1995
1996         sk->sk_state = TCP_CLOSE;
1997
1998         icsk->icsk_af_ops = &ipv6_specific;
1999         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
2000         icsk->icsk_sync_mss = tcp_sync_mss;
2001         sk->sk_write_space = sk_stream_write_space;
2002         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
2003
2004 #ifdef CONFIG_TCP_MD5SIG
2005         tp->af_specific = &tcp_sock_ipv6_specific;
2006 #endif
2007
2008         /* TCP Cookie Transactions */
2009         if (sysctl_tcp_cookie_size > 0) {
2010                 /* Default, cookies without s_data_payload. */
2011                 tp->cookie_values =
2012                         kzalloc(sizeof(*tp->cookie_values),
2013                                 sk->sk_allocation);
2014                 if (tp->cookie_values != NULL)
2015                         kref_init(&tp->cookie_values->kref);
2016         }
2017         /* Presumed zeroed, in order of appearance:
2018          *      cookie_in_always, cookie_out_never,
2019          *      s_data_constant, s_data_in, s_data_out
2020          */
2021         sk->sk_sndbuf = sysctl_tcp_wmem[1];
2022         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
2023
2024         local_bh_disable();
2025         percpu_counter_inc(&tcp_sockets_allocated);
2026         local_bh_enable();
2027
2028         return 0;
2029 }
2030
2031 static void tcp_v6_destroy_sock(struct sock *sk)
2032 {
2033 #ifdef CONFIG_TCP_MD5SIG
2034         /* Clean up the MD5 key list */
2035         if (tcp_sk(sk)->md5sig_info)
2036                 tcp_v6_clear_md5_list(sk);
2037 #endif
2038         tcp_v4_destroy_sock(sk);
2039         inet6_destroy_sock(sk);
2040 }
2041
2042 #ifdef CONFIG_PROC_FS
2043 /* Proc filesystem TCPv6 sock list dumping. */
2044 static void get_openreq6(struct seq_file *seq,
2045                          struct sock *sk, struct request_sock *req, int i, int uid)
2046 {
2047         int ttd = req->expires - jiffies;
2048         struct in6_addr *src = &inet6_rsk(req)->loc_addr;
2049         struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
2050
2051         if (ttd < 0)
2052                 ttd = 0;
2053
2054         seq_printf(seq,
2055                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2056                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2057                    i,
2058                    src->s6_addr32[0], src->s6_addr32[1],
2059                    src->s6_addr32[2], src->s6_addr32[3],
2060                    ntohs(inet_rsk(req)->loc_port),
2061                    dest->s6_addr32[0], dest->s6_addr32[1],
2062                    dest->s6_addr32[2], dest->s6_addr32[3],
2063                    ntohs(inet_rsk(req)->rmt_port),
2064                    TCP_SYN_RECV,
2065                    0,0, /* could print option size, but that is af dependent. */
2066                    1,   /* timers active (only the expire timer) */
2067                    jiffies_to_clock_t(ttd),
2068                    req->retrans,
2069                    uid,
2070                    0,  /* non standard timer */
2071                    0, /* open_requests have no inode */
2072                    0, req);
2073 }
2074
2075 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
2076 {
2077         struct in6_addr *dest, *src;
2078         __u16 destp, srcp;
2079         int timer_active;
2080         unsigned long timer_expires;
2081         struct inet_sock *inet = inet_sk(sp);
2082         struct tcp_sock *tp = tcp_sk(sp);
2083         const struct inet_connection_sock *icsk = inet_csk(sp);
2084         struct ipv6_pinfo *np = inet6_sk(sp);
2085
2086         dest  = &np->daddr;
2087         src   = &np->rcv_saddr;
2088         destp = ntohs(inet->inet_dport);
2089         srcp  = ntohs(inet->inet_sport);
2090
2091         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
2092                 timer_active    = 1;
2093                 timer_expires   = icsk->icsk_timeout;
2094         } else if (icsk->icsk_pending == ICSK_TIME_PROBE0) {
2095                 timer_active    = 4;
2096                 timer_expires   = icsk->icsk_timeout;
2097         } else if (timer_pending(&sp->sk_timer)) {
2098                 timer_active    = 2;
2099                 timer_expires   = sp->sk_timer.expires;
2100         } else {
2101                 timer_active    = 0;
2102                 timer_expires = jiffies;
2103         }
2104
2105         seq_printf(seq,
2106                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2107                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
2108                    i,
2109                    src->s6_addr32[0], src->s6_addr32[1],
2110                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2111                    dest->s6_addr32[0], dest->s6_addr32[1],
2112                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2113                    sp->sk_state,
2114                    tp->write_seq-tp->snd_una,
2115                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
2116                    timer_active,
2117                    jiffies_to_clock_t(timer_expires - jiffies),
2118                    icsk->icsk_retransmits,
2119                    sock_i_uid(sp),
2120                    icsk->icsk_probes_out,
2121                    sock_i_ino(sp),
2122                    atomic_read(&sp->sk_refcnt), sp,
2123                    jiffies_to_clock_t(icsk->icsk_rto),
2124                    jiffies_to_clock_t(icsk->icsk_ack.ato),
2125                    (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
2126                    tp->snd_cwnd,
2127                    tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
2128                    );
2129 }
2130
2131 static void get_timewait6_sock(struct seq_file *seq,
2132                                struct inet_timewait_sock *tw, int i)
2133 {
2134         struct in6_addr *dest, *src;
2135         __u16 destp, srcp;
2136         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
2137         int ttd = tw->tw_ttd - jiffies;
2138
2139         if (ttd < 0)
2140                 ttd = 0;
2141
2142         dest = &tw6->tw_v6_daddr;
2143         src  = &tw6->tw_v6_rcv_saddr;
2144         destp = ntohs(tw->tw_dport);
2145         srcp  = ntohs(tw->tw_sport);
2146
2147         seq_printf(seq,
2148                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2149                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
2150                    i,
2151                    src->s6_addr32[0], src->s6_addr32[1],
2152                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2153                    dest->s6_addr32[0], dest->s6_addr32[1],
2154                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2155                    tw->tw_substate, 0, 0,
2156                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2157                    atomic_read(&tw->tw_refcnt), tw);
2158 }
2159
2160 static int tcp6_seq_show(struct seq_file *seq, void *v)
2161 {
2162         struct tcp_iter_state *st;
2163
2164         if (v == SEQ_START_TOKEN) {
2165                 seq_puts(seq,
2166                          "  sl  "
2167                          "local_address                         "
2168                          "remote_address                        "
2169                          "st tx_queue rx_queue tr tm->when retrnsmt"
2170                          "   uid  timeout inode\n");
2171                 goto out;
2172         }
2173         st = seq->private;
2174
2175         switch (st->state) {
2176         case TCP_SEQ_STATE_LISTENING:
2177         case TCP_SEQ_STATE_ESTABLISHED:
2178                 get_tcp6_sock(seq, v, st->num);
2179                 break;
2180         case TCP_SEQ_STATE_OPENREQ:
2181                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2182                 break;
2183         case TCP_SEQ_STATE_TIME_WAIT:
2184                 get_timewait6_sock(seq, v, st->num);
2185                 break;
2186         }
2187 out:
2188         return 0;
2189 }
2190
2191 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2192         .name           = "tcp6",
2193         .family         = AF_INET6,
2194         .seq_fops       = {
2195                 .owner          = THIS_MODULE,
2196         },
2197         .seq_ops        = {
2198                 .show           = tcp6_seq_show,
2199         },
2200 };
2201
2202 int __net_init tcp6_proc_init(struct net *net)
2203 {
2204         return tcp_proc_register(net, &tcp6_seq_afinfo);
2205 }
2206
2207 void tcp6_proc_exit(struct net *net)
2208 {
2209         tcp_proc_unregister(net, &tcp6_seq_afinfo);
2210 }
2211 #endif
2212
2213 struct proto tcpv6_prot = {
2214         .name                   = "TCPv6",
2215         .owner                  = THIS_MODULE,
2216         .close                  = tcp_close,
2217         .connect                = tcp_v6_connect,
2218         .disconnect             = tcp_disconnect,
2219         .accept                 = inet_csk_accept,
2220         .ioctl                  = tcp_ioctl,
2221         .init                   = tcp_v6_init_sock,
2222         .destroy                = tcp_v6_destroy_sock,
2223         .shutdown               = tcp_shutdown,
2224         .setsockopt             = tcp_setsockopt,
2225         .getsockopt             = tcp_getsockopt,
2226         .recvmsg                = tcp_recvmsg,
2227         .sendmsg                = tcp_sendmsg,
2228         .sendpage               = tcp_sendpage,
2229         .backlog_rcv            = tcp_v6_do_rcv,
2230         .hash                   = tcp_v6_hash,
2231         .unhash                 = inet_unhash,
2232         .get_port               = inet_csk_get_port,
2233         .enter_memory_pressure  = tcp_enter_memory_pressure,
2234         .sockets_allocated      = &tcp_sockets_allocated,
2235         .memory_allocated       = &tcp_memory_allocated,
2236         .memory_pressure        = &tcp_memory_pressure,
2237         .orphan_count           = &tcp_orphan_count,
2238         .sysctl_mem             = sysctl_tcp_mem,
2239         .sysctl_wmem            = sysctl_tcp_wmem,
2240         .sysctl_rmem            = sysctl_tcp_rmem,
2241         .max_header             = MAX_TCP_HEADER,
2242         .obj_size               = sizeof(struct tcp6_sock),
2243         .slab_flags             = SLAB_DESTROY_BY_RCU,
2244         .twsk_prot              = &tcp6_timewait_sock_ops,
2245         .rsk_prot               = &tcp6_request_sock_ops,
2246         .h.hashinfo             = &tcp_hashinfo,
2247         .no_autobind            = true,
2248 #ifdef CONFIG_COMPAT
2249         .compat_setsockopt      = compat_tcp_setsockopt,
2250         .compat_getsockopt      = compat_tcp_getsockopt,
2251 #endif
2252 };
2253
2254 static const struct inet6_protocol tcpv6_protocol = {
2255         .handler        =       tcp_v6_rcv,
2256         .err_handler    =       tcp_v6_err,
2257         .gso_send_check =       tcp_v6_gso_send_check,
2258         .gso_segment    =       tcp_tso_segment,
2259         .gro_receive    =       tcp6_gro_receive,
2260         .gro_complete   =       tcp6_gro_complete,
2261         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2262 };
2263
2264 static struct inet_protosw tcpv6_protosw = {
2265         .type           =       SOCK_STREAM,
2266         .protocol       =       IPPROTO_TCP,
2267         .prot           =       &tcpv6_prot,
2268         .ops            =       &inet6_stream_ops,
2269         .no_check       =       0,
2270         .flags          =       INET_PROTOSW_PERMANENT |
2271                                 INET_PROTOSW_ICSK,
2272 };
2273
2274 static int __net_init tcpv6_net_init(struct net *net)
2275 {
2276         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
2277                                     SOCK_RAW, IPPROTO_TCP, net);
2278 }
2279
2280 static void __net_exit tcpv6_net_exit(struct net *net)
2281 {
2282         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
2283 }
2284
2285 static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
2286 {
2287         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
2288 }
2289
2290 static struct pernet_operations tcpv6_net_ops = {
2291         .init       = tcpv6_net_init,
2292         .exit       = tcpv6_net_exit,
2293         .exit_batch = tcpv6_net_exit_batch,
2294 };
2295
2296 int __init tcpv6_init(void)
2297 {
2298         int ret;
2299
2300         ret = inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP);
2301         if (ret)
2302                 goto out;
2303
2304         /* register inet6 protocol */
2305         ret = inet6_register_protosw(&tcpv6_protosw);
2306         if (ret)
2307                 goto out_tcpv6_protocol;
2308
2309         ret = register_pernet_subsys(&tcpv6_net_ops);
2310         if (ret)
2311                 goto out_tcpv6_protosw;
2312 out:
2313         return ret;
2314
2315 out_tcpv6_protocol:
2316         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2317 out_tcpv6_protosw:
2318         inet6_unregister_protosw(&tcpv6_protosw);
2319         goto out;
2320 }
2321
2322 void tcpv6_exit(void)
2323 {
2324         unregister_pernet_subsys(&tcpv6_net_ops);
2325         inet6_unregister_protosw(&tcpv6_protosw);
2326         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
2327 }