net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *      YOSHIFUJI Hideaki @USAGI:       convert /proc/net/tcp6 to seq_file.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/config.h>
  30 #include <linux/errno.h>
  31 #include <linux/types.h>
  32 #include <linux/socket.h>
  33 #include <linux/sockios.h>
  34 #include <linux/net.h>
  35 #include <linux/jiffies.h>
  36 #include <linux/in.h>
  37 #include <linux/in6.h>
  38 #include <linux/netdevice.h>
  39 #include <linux/init.h>
  40 #include <linux/jhash.h>
  41 #include <linux/ipsec.h>
  42 #include <linux/times.h>
  43
  44 #include <linux/ipv6.h>
  45 #include <linux/icmpv6.h>
  46 #include <linux/random.h>
  47
  48 #include <net/tcp.h>
  49 #include <net/ndisc.h>
  50 #include <net/ipv6.h>
  51 #include <net/transp_v6.h>
  52 #include <net/addrconf.h>
  53 #include <net/ip6_route.h>
  54 #include <net/inet_ecn.h>
  55 #include <net/protocol.h>
  56 #include <net/xfrm.h>
  57
  58 #include <asm/uaccess.h>
  59
  60 #include <linux/proc_fs.h>
  61 #include <linux/seq_file.h>
  62
  63 static void     tcp_v6_send_reset(struct sk_buff *skb);
  64 static void     tcp_v6_or_send_ack(struct sk_buff *skb, struct open_request *req);
  65 static void     tcp_v6_send_check(struct sock *sk, struct tcphdr *th, int len,
  66                                   struct sk_buff *skb);
  67
  68 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  69 static int      tcp_v6_xmit(struct sk_buff *skb, int ipfragok);
  70
  71 static struct tcp_func ipv6_mapped;
  72 static struct tcp_func ipv6_specific;
  73
  74 /* I have no idea if this is a good hash for v6 or not. -DaveM */
  75 static __inline__ int tcp_v6_hashfn(struct in6_addr *laddr, u16 lport,
  76                                     struct in6_addr *faddr, u16 fport)
  77 {
  78         int hashent = (lport ^ fport);
  79
  80         hashent ^= (laddr->s6_addr32[3] ^ faddr->s6_addr32[3]);
  81         hashent ^= hashent>>16;
  82         hashent ^= hashent>>8;
  83         return (hashent & (tcp_ehash_size - 1));
  84 }
  85
  86 static __inline__ int tcp_v6_sk_hashfn(struct sock *sk)
  87 {
  88         struct inet_opt *inet = inet_sk(sk);
  89         struct ipv6_pinfo *np = inet6_sk(sk);
  90         struct in6_addr *laddr = &np->rcv_saddr;
  91         struct in6_addr *faddr = &np->daddr;
  92         __u16 lport = inet->num;
  93         __u16 fport = inet->dport;
  94         return tcp_v6_hashfn(laddr, lport, faddr, fport);
  95 }
  96
  97 static inline int tcp_v6_bind_conflict(struct sock *sk,
  98                                        struct tcp_bind_bucket *tb)
  99 {
 100         struct sock *sk2;
 101         struct hlist_node *node;
 102
 103         /* We must walk the whole port owner list in this case. -DaveM */
 104         sk_for_each_bound(sk2, node, &tb->owners) {
 105                 if (sk != sk2 &&
 106                     (!sk->sk_bound_dev_if ||
 107                      !sk2->sk_bound_dev_if ||
 108                      sk->sk_bound_dev_if == sk2->sk_bound_dev_if) &&
 109                     (!sk->sk_reuse || !sk2->sk_reuse ||
 110                      sk2->sk_state == TCP_LISTEN) &&
 111                      ipv6_rcv_saddr_equal(sk, sk2))
 112                         break;
 113         }
 114
 115         return node != NULL;
 116 }
 117
 118 /* Grrr, addr_type already calculated by caller, but I don't want
 119  * to add some silly "cookie" argument to this method just for that.
 120  * But it doesn't matter, the recalculation is in the rarest path
 121  * this function ever takes.
 122  */
 123 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
 124 {
 125         struct tcp_bind_hashbucket *head;
 126         struct tcp_bind_bucket *tb;
 127         struct hlist_node *node;
 128         int ret;
 129
 130         local_bh_disable();
 131         if (snum == 0) {
 132                 int low = sysctl_local_port_range[0];
 133                 int high = sysctl_local_port_range[1];
 134                 int remaining = (high - low) + 1;
 135                 int rover;
 136
 137                 spin_lock(&tcp_portalloc_lock);
 138                 rover = tcp_port_rover;
 139                 do {    rover++;
 140                         if ((rover < low) || (rover > high))
 141                                 rover = low;
 142                         head = &tcp_bhash[tcp_bhashfn(rover)];
 143                         spin_lock(&head->lock);
 144                         tb_for_each(tb, node, &head->chain)
 145                                 if (tb->port == rover)
 146                                         goto next;
 147                         break;
 148                 next:
 149                         spin_unlock(&head->lock);
 150                 } while (--remaining > 0);
 151                 tcp_port_rover = rover;
 152                 spin_unlock(&tcp_portalloc_lock);
 153
 154                 /* Exhausted local port range during search? */
 155                 ret = 1;
 156                 if (remaining <= 0)
 157                         goto fail;
 158
 159                 /* OK, here is the one we will use. */
 160                 snum = rover;
 161         } else {
 162                 head = &tcp_bhash[tcp_bhashfn(snum)];
 163                 spin_lock(&head->lock);
 164                 tb_for_each(tb, node, &head->chain)
 165                         if (tb->port == snum)
 166                                 goto tb_found;
 167         }
 168         tb = NULL;
 169         goto tb_not_found;
 170 tb_found:
 171         if (tb && !hlist_empty(&tb->owners)) {
 172                 if (tb->fastreuse > 0 && sk->sk_reuse &&
 173                     sk->sk_state != TCP_LISTEN) {
 174                         goto success;
 175                 } else {
 176                         ret = 1;
 177                         if (tcp_v6_bind_conflict(sk, tb))
 178                                 goto fail_unlock;
 179                 }
 180         }
 181 tb_not_found:
 182         ret = 1;
 183         if (!tb && (tb = tcp_bucket_create(head, snum)) == NULL)
 184                 goto fail_unlock;
 185         if (hlist_empty(&tb->owners)) {
 186                 if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
 187                         tb->fastreuse = 1;
 188                 else
 189                         tb->fastreuse = 0;
 190         } else if (tb->fastreuse &&
 191                    (!sk->sk_reuse || sk->sk_state == TCP_LISTEN))
 192                 tb->fastreuse = 0;
 193
 194 success:
 195         if (!tcp_sk(sk)->bind_hash)
 196                 tcp_bind_hash(sk, tb, snum);
 197         BUG_TRAP(tcp_sk(sk)->bind_hash == tb);
 198         ret = 0;
 199
 200 fail_unlock:
 201         spin_unlock(&head->lock);
 202 fail:
 203         local_bh_enable();
 204         return ret;
 205 }
 206
 207 static __inline__ void __tcp_v6_hash(struct sock *sk)
 208 {
 209         struct hlist_head *list;
 210         rwlock_t *lock;
 211
 212         BUG_TRAP(sk_unhashed(sk));
 213
 214         if (sk->sk_state == TCP_LISTEN) {
 215                 list = &tcp_listening_hash[tcp_sk_listen_hashfn(sk)];
 216                 lock = &tcp_lhash_lock;
 217                 tcp_listen_wlock();
 218         } else {
 219                 sk->sk_hashent = tcp_v6_sk_hashfn(sk);
 220                 list = &tcp_ehash[sk->sk_hashent].chain;
 221                 lock = &tcp_ehash[sk->sk_hashent].lock;
 222                 write_lock(lock);
 223         }
 224
 225         __sk_add_node(sk, list);
 226         sock_prot_inc_use(sk->sk_prot);
 227         write_unlock(lock);
 228 }
 229
 230
 231 static void tcp_v6_hash(struct sock *sk)
 232 {
 233         if (sk->sk_state != TCP_CLOSE) {
 234                 struct tcp_opt *tp = tcp_sk(sk);
 235
 236                 if (tp->af_specific == &ipv6_mapped) {
 237                         tcp_prot.hash(sk);
 238                         return;
 239                 }
 240                 local_bh_disable();
 241                 __tcp_v6_hash(sk);
 242                 local_bh_enable();
 243         }
 244 }
 245
 246 static struct sock *tcp_v6_lookup_listener(struct in6_addr *daddr, unsigned short hnum, int dif)
 247 {
 248         struct sock *sk;
 249         struct hlist_node *node;
 250         struct sock *result = NULL;
 251         int score, hiscore;
 252
 253         hiscore=0;
 254         read_lock(&tcp_lhash_lock);
 255         sk_for_each(sk, node, &tcp_listening_hash[tcp_lhashfn(hnum)]) {
 256                 if (inet_sk(sk)->num == hnum && sk->sk_family == PF_INET6) {
 257                         struct ipv6_pinfo *np = inet6_sk(sk);
 258
 259                         score = 1;
 260                         if (!ipv6_addr_any(&np->rcv_saddr)) {
 261                                 if (ipv6_addr_cmp(&np->rcv_saddr, daddr))
 262                                         continue;
 263                                 score++;
 264                         }
 265                         if (sk->sk_bound_dev_if) {
 266                                 if (sk->sk_bound_dev_if != dif)
 267                                         continue;
 268                                 score++;
 269                         }
 270                         if (score == 3) {
 271                                 result = sk;
 272                                 break;
 273                         }
 274                         if (score > hiscore) {
 275                                 hiscore = score;
 276                                 result = sk;
 277                         }
 278                 }
 279         }
 280         if (result)
 281                 sock_hold(result);
 282         read_unlock(&tcp_lhash_lock);
 283         return result;
 284 }
 285
 286 /* Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
 287  * we need not check it for TCP lookups anymore, thanks Alexey. -DaveM
 288  *
 289  * The sockhash lock must be held as a reader here.
 290  */
 291
 292 static inline struct sock *__tcp_v6_lookup_established(struct in6_addr *saddr, u16 sport,
 293                                                        struct in6_addr *daddr, u16 hnum,
 294                                                        int dif)
 295 {
 296         struct tcp_ehash_bucket *head;
 297         struct sock *sk;
 298         struct hlist_node *node;
 299         __u32 ports = TCP_COMBINED_PORTS(sport, hnum);
 300         int hash;
 301
 302         /* Optimize here for direct hit, only listening connections can
 303          * have wildcards anyways.
 304          */
 305         hash = tcp_v6_hashfn(daddr, hnum, saddr, sport);
 306         head = &tcp_ehash[hash];
 307         read_lock(&head->lock);
 308         sk_for_each(sk, node, &head->chain) {
 309                 /* For IPV6 do the cheaper port and family tests first. */
 310                 if(TCP_IPV6_MATCH(sk, saddr, daddr, ports, dif))
 311                         goto hit; /* You sunk my battleship! */
 312         }
 313         /* Must check for a TIME_WAIT'er before going to listener hash. */
 314         sk_for_each(sk, node, &(head + tcp_ehash_size)->chain) {
 315                 /* FIXME: acme: check this... */
 316                 struct tcp_tw_bucket *tw = (struct tcp_tw_bucket *)sk;
 317
 318                 if(*((__u32 *)&(tw->tw_dport))  == ports        &&
 319                    sk->sk_family                == PF_INET6) {
 320                         if(!ipv6_addr_cmp(&tw->tw_v6_daddr, saddr)      &&
 321                            !ipv6_addr_cmp(&tw->tw_v6_rcv_saddr, daddr)  &&
 322                            (!sk->sk_bound_dev_if || sk->sk_bound_dev_if == dif))
 323                                 goto hit;
 324                 }
 325         }
 326         read_unlock(&head->lock);
 327         return NULL;
 328
 329 hit:
 330         sock_hold(sk);
 331         read_unlock(&head->lock);
 332         return sk;
 333 }
 334
 335
 336 static inline struct sock *__tcp_v6_lookup(struct in6_addr *saddr, u16 sport,
 337                                            struct in6_addr *daddr, u16 hnum,
 338                                            int dif)
 339 {
 340         struct sock *sk;
 341
 342         sk = __tcp_v6_lookup_established(saddr, sport, daddr, hnum, dif);
 343
 344         if (sk)
 345                 return sk;
 346
 347         return tcp_v6_lookup_listener(daddr, hnum, dif);
 348 }
 349
 350 inline struct sock *tcp_v6_lookup(struct in6_addr *saddr, u16 sport,
 351                                   struct in6_addr *daddr, u16 dport,
 352                                   int dif)
 353 {
 354         struct sock *sk;
 355
 356         local_bh_disable();
 357         sk = __tcp_v6_lookup(saddr, sport, daddr, ntohs(dport), dif);
 358         local_bh_enable();
 359
 360         return sk;
 361 }
 362
 363
 364 /*
 365  * Open request hash tables.
 366  */
 367
 368 static u32 tcp_v6_synq_hash(struct in6_addr *raddr, u16 rport, u32 rnd)
 369 {
 370         u32 a, b, c;
 371
 372         a = raddr->s6_addr32[0];
 373         b = raddr->s6_addr32[1];
 374         c = raddr->s6_addr32[2];
 375
 376         a += JHASH_GOLDEN_RATIO;
 377         b += JHASH_GOLDEN_RATIO;
 378         c += rnd;
 379         __jhash_mix(a, b, c);
 380
 381         a += raddr->s6_addr32[3];
 382         b += (u32) rport;
 383         __jhash_mix(a, b, c);
 384
 385         return c & (TCP_SYNQ_HSIZE - 1);
 386 }
 387
 388 static struct open_request *tcp_v6_search_req(struct tcp_opt *tp,
 389                                               struct open_request ***prevp,
 390                                               __u16 rport,
 391                                               struct in6_addr *raddr,
 392                                               struct in6_addr *laddr,
 393                                               int iif)
 394 {
 395         struct tcp_listen_opt *lopt = tp->listen_opt;
 396         struct open_request *req, **prev;
 397
 398         for (prev = &lopt->syn_table[tcp_v6_synq_hash(raddr, rport, lopt->hash_rnd)];
 399              (req = *prev) != NULL;
 400              prev = &req->dl_next) {
 401                 if (req->rmt_port == rport &&
 402                     req->class->family == AF_INET6 &&
 403                     !ipv6_addr_cmp(&req->af.v6_req.rmt_addr, raddr) &&
 404                     !ipv6_addr_cmp(&req->af.v6_req.loc_addr, laddr) &&
 405                     (!req->af.v6_req.iif || req->af.v6_req.iif == iif)) {
 406                         BUG_TRAP(req->sk == NULL);
 407                         *prevp = prev;
 408                         return req;
 409                 }
 410         }
 411
 412         return NULL;
 413 }
 414
 415 static __inline__ u16 tcp_v6_check(struct tcphdr *th, int len,
 416                                    struct in6_addr *saddr,
 417                                    struct in6_addr *daddr,
 418                                    unsigned long base)
 419 {
 420         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 421 }
 422
 423 static __u32 tcp_v6_init_sequence(struct sock *sk, struct sk_buff *skb)
 424 {
 425         if (skb->protocol == htons(ETH_P_IPV6)) {
 426                 return secure_tcpv6_sequence_number(skb->nh.ipv6h->daddr.s6_addr32,
 427                                                     skb->nh.ipv6h->saddr.s6_addr32,
 428                                                     skb->h.th->dest,
 429                                                     skb->h.th->source);
 430         } else {
 431                 return secure_tcp_sequence_number(skb->nh.iph->daddr,
 432                                                   skb->nh.iph->saddr,
 433                                                   skb->h.th->dest,
 434                                                   skb->h.th->source);
 435         }
 436 }
 437
 438 static int tcp_v6_check_established(struct sock *sk)
 439 {
 440         struct inet_opt *inet = inet_sk(sk);
 441         struct ipv6_pinfo *np = inet6_sk(sk);
 442         struct in6_addr *daddr = &np->rcv_saddr;
 443         struct in6_addr *saddr = &np->daddr;
 444         int dif = sk->sk_bound_dev_if;
 445         u32 ports = TCP_COMBINED_PORTS(inet->dport, inet->num);
 446         int hash = tcp_v6_hashfn(daddr, inet->num, saddr, inet->dport);
 447         struct tcp_ehash_bucket *head = &tcp_ehash[hash];
 448         struct sock *sk2;
 449         struct hlist_node *node;
 450         struct tcp_tw_bucket *tw;
 451
 452         write_lock_bh(&head->lock);
 453
 454         /* Check TIME-WAIT sockets first. */
 455         sk_for_each(sk2, node, &(head + tcp_ehash_size)->chain) {
 456                 tw = (struct tcp_tw_bucket*)sk2;
 457
 458                 if(*((__u32 *)&(tw->tw_dport))  == ports        &&
 459                    sk2->sk_family               == PF_INET6     &&
 460                    !ipv6_addr_cmp(&tw->tw_v6_daddr, saddr)      &&
 461                    !ipv6_addr_cmp(&tw->tw_v6_rcv_saddr, daddr)  &&
 462                    sk2->sk_bound_dev_if == sk->sk_bound_dev_if) {
 463                         struct tcp_opt *tp = tcp_sk(sk);
 464
 465                         if (tw->tw_ts_recent_stamp) {
 466                                 /* See comment in tcp_ipv4.c */
 467                                 tp->write_seq = tw->tw_snd_nxt + 65535 + 2;
 468                                 if (!tp->write_seq)
 469                                         tp->write_seq = 1;
 470                                 tp->ts_recent = tw->tw_ts_recent;
 471                                 tp->ts_recent_stamp = tw->tw_ts_recent_stamp;
 472                                 sock_hold(sk2);
 473                                 goto unique;
 474                         } else
 475                                 goto not_unique;
 476                 }
 477         }
 478         tw = NULL;
 479
 480         /* And established part... */
 481         sk_for_each(sk2, node, &head->chain) {
 482                 if(TCP_IPV6_MATCH(sk2, saddr, daddr, ports, dif))
 483                         goto not_unique;
 484         }
 485
 486 unique:
 487         BUG_TRAP(sk_unhashed(sk));
 488         __sk_add_node(sk, &head->chain);
 489         sk->sk_hashent = hash;
 490         sock_prot_inc_use(sk->sk_prot);
 491         write_unlock_bh(&head->lock);
 492
 493         if (tw) {
 494                 /* Silly. Should hash-dance instead... */
 495                 local_bh_disable();
 496                 tcp_tw_deschedule(tw);
 497                 NET_INC_STATS_BH(TimeWaitRecycled);
 498                 local_bh_enable();
 499
 500                 tcp_tw_put(tw);
 501         }
 502         return 0;
 503
 504 not_unique:
 505         write_unlock_bh(&head->lock);
 506         return -EADDRNOTAVAIL;
 507 }
 508
 509 static int tcp_v6_hash_connect(struct sock *sk)
 510 {
 511         struct tcp_bind_hashbucket *head;
 512         struct tcp_bind_bucket *tb;
 513
 514         /* XXX */
 515         if (inet_sk(sk)->num == 0) {
 516                 int err = tcp_v6_get_port(sk, inet_sk(sk)->num);
 517                 if (err)
 518                         return err;
 519                 inet_sk(sk)->sport = htons(inet_sk(sk)->num);
 520         }
 521
 522         head = &tcp_bhash[tcp_bhashfn(inet_sk(sk)->num)];
 523         tb = tb_head(head);
 524
 525         spin_lock_bh(&head->lock);
 526
 527         if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
 528                 __tcp_v6_hash(sk);
 529                 spin_unlock_bh(&head->lock);
 530                 return 0;
 531         } else {
 532                 spin_unlock_bh(&head->lock);
 533                 return tcp_v6_check_established(sk);
 534         }
 535 }
 536
 537 static __inline__ int tcp_v6_iif(struct sk_buff *skb)
 538 {
 539         return IP6CB(skb)->iif;
 540 }
 541
 542 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 543                           int addr_len)
 544 {
 545         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 546         struct inet_opt *inet = inet_sk(sk);
 547         struct ipv6_pinfo *np = inet6_sk(sk);
 548         struct tcp_opt *tp = tcp_sk(sk);
 549         struct in6_addr *saddr = NULL;
 550         struct flowi fl;
 551         struct dst_entry *dst;
 552         int addr_type;
 553         int err;
 554
 555         if (addr_len < SIN6_LEN_RFC2133)
 556                 return -EINVAL;
 557
 558         if (usin->sin6_family != AF_INET6)
 559                 return(-EAFNOSUPPORT);
 560
 561         memset(&fl, 0, sizeof(fl));
 562
 563         if (np->sndflow) {
 564                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 565                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 566                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 567                         struct ip6_flowlabel *flowlabel;
 568                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 569                         if (flowlabel == NULL)
 570                                 return -EINVAL;
 571                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 572                         fl6_sock_release(flowlabel);
 573                 }
 574         }
 575
 576         /*
 577          *      connect() to INADDR_ANY means loopback (BSD'ism).
 578          */
 579
 580         if(ipv6_addr_any(&usin->sin6_addr))
 581                 usin->sin6_addr.s6_addr[15] = 0x1;
 582
 583         addr_type = ipv6_addr_type(&usin->sin6_addr);
 584
 585         if(addr_type & IPV6_ADDR_MULTICAST)
 586                 return -ENETUNREACH;
 587
 588         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 589                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 590                     usin->sin6_scope_id) {
 591                         /* If interface is set while binding, indices
 592                          * must coincide.
 593                          */
 594                         if (sk->sk_bound_dev_if &&
 595                             sk->sk_bound_dev_if != usin->sin6_scope_id)
 596                                 return -EINVAL;
 597
 598                         sk->sk_bound_dev_if = usin->sin6_scope_id;
 599                 }
 600
 601                 /* Connect to link-local address requires an interface */
 602                 if (!sk->sk_bound_dev_if)
 603                         return -EINVAL;
 604         }
 605
 606         if (tp->ts_recent_stamp &&
 607             ipv6_addr_cmp(&np->daddr, &usin->sin6_addr)) {
 608                 tp->ts_recent = 0;
 609                 tp->ts_recent_stamp = 0;
 610                 tp->write_seq = 0;
 611         }
 612
 613         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 614         np->flow_label = fl.fl6_flowlabel;
 615
 616         /*
 617          *      TCP over IPv4
 618          */
 619
 620         if (addr_type == IPV6_ADDR_MAPPED) {
 621                 u32 exthdrlen = tp->ext_header_len;
 622                 struct sockaddr_in sin;
 623
 624                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 625
 626                 if (__ipv6_only_sock(sk))
 627                         return -ENETUNREACH;
 628
 629                 sin.sin_family = AF_INET;
 630                 sin.sin_port = usin->sin6_port;
 631                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 632
 633                 tp->af_specific = &ipv6_mapped;
 634                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
 635
 636                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 637
 638                 if (err) {
 639                         tp->ext_header_len = exthdrlen;
 640                         tp->af_specific = &ipv6_specific;
 641                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
 642                         goto failure;
 643                 } else {
 644                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 645                                       inet->saddr);
 646                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 647                                       inet->rcv_saddr);
 648                 }
 649
 650                 return err;
 651         }
 652
 653         if (!ipv6_addr_any(&np->rcv_saddr))
 654                 saddr = &np->rcv_saddr;
 655
 656         fl.proto = IPPROTO_TCP;
 657         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 658         ipv6_addr_copy(&fl.fl6_src,
 659                        (saddr ? saddr : &np->saddr));
 660         fl.oif = sk->sk_bound_dev_if;
 661         fl.fl_ip_dport = usin->sin6_port;
 662         fl.fl_ip_sport = inet->sport;
 663
 664         if (np->opt && np->opt->srcrt) {
 665                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
 666                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 667         }
 668
 669         err = ip6_dst_lookup(sk, &dst, &fl);
 670
 671         if (err)
 672                 goto failure;
 673
 674         if (saddr == NULL) {
 675                 saddr = &fl.fl6_src;
 676                 ipv6_addr_copy(&np->rcv_saddr, saddr);
 677         }
 678
 679         /* set the source address */
 680         ipv6_addr_copy(&np->saddr, saddr);
 681         inet->rcv_saddr = LOOPBACK4_IPV6;
 682
 683         ip6_dst_store(sk, dst, NULL);
 684         sk->sk_route_caps = dst->dev->features &
 685                 ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
 686
 687         tp->ext_header_len = 0;
 688         if (np->opt)
 689                 tp->ext_header_len = np->opt->opt_flen + np->opt->opt_nflen;
 690         tp->ext2_header_len = dst->header_len;
 691
 692         tp->mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 693
 694         inet->dport = usin->sin6_port;
 695
 696         tcp_set_state(sk, TCP_SYN_SENT);
 697         err = tcp_v6_hash_connect(sk);
 698         if (err)
 699                 goto late_failure;
 700
 701         if (!tp->write_seq)
 702                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 703                                                              np->daddr.s6_addr32,
 704                                                              inet->sport,
 705                                                              inet->dport);
 706
 707         err = tcp_connect(sk);
 708         if (err)
 709                 goto late_failure;
 710
 711         return 0;
 712
 713 late_failure:
 714         tcp_set_state(sk, TCP_CLOSE);
 715         __sk_dst_reset(sk);
 716 failure:
 717         inet->dport = 0;
 718         sk->sk_route_caps = 0;
 719         return err;
 720 }
 721
 722 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 723                 int type, int code, int offset, __u32 info)
 724 {
 725         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 726         struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 727         struct ipv6_pinfo *np;
 728         struct sock *sk;
 729         int err;
 730         struct tcp_opt *tp;
 731         __u32 seq;
 732
 733         sk = tcp_v6_lookup(&hdr->daddr, th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 734
 735         if (sk == NULL) {
 736                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), Icmp6InErrors);
 737                 return;
 738         }
 739
 740         if (sk->sk_state == TCP_TIME_WAIT) {
 741                 tcp_tw_put((struct tcp_tw_bucket*)sk);
 742                 return;
 743         }
 744
 745         bh_lock_sock(sk);
 746         if (sock_owned_by_user(sk))
 747                 NET_INC_STATS_BH(LockDroppedIcmps);
 748
 749         if (sk->sk_state == TCP_CLOSE)
 750                 goto out;
 751
 752         tp = tcp_sk(sk);
 753         seq = ntohl(th->seq);
 754         if (sk->sk_state != TCP_LISTEN &&
 755             !between(seq, tp->snd_una, tp->snd_nxt)) {
 756                 NET_INC_STATS_BH(OutOfWindowIcmps);
 757                 goto out;
 758         }
 759
 760         np = inet6_sk(sk);
 761
 762         if (type == ICMPV6_PKT_TOOBIG) {
 763                 struct dst_entry *dst = NULL;
 764
 765                 if (sock_owned_by_user(sk))
 766                         goto out;
 767                 if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 768                         goto out;
 769
 770                 /* icmp should have updated the destination cache entry */
 771                 dst = __sk_dst_check(sk, np->dst_cookie);
 772
 773                 if (dst == NULL) {
 774                         struct inet_opt *inet = inet_sk(sk);
 775                         struct flowi fl;
 776
 777                         /* BUGGG_FUTURE: Again, it is not clear how
 778                            to handle rthdr case. Ignore this complexity
 779                            for now.
 780                          */
 781                         memset(&fl, 0, sizeof(fl));
 782                         fl.proto = IPPROTO_TCP;
 783                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
 784                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
 785                         fl.oif = sk->sk_bound_dev_if;
 786                         fl.fl_ip_dport = inet->dport;
 787                         fl.fl_ip_sport = inet->sport;
 788
 789                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
 790                                 sk->sk_err_soft = -err;
 791                                 goto out;
 792                         }
 793                 } else
 794                         dst_hold(dst);
 795
 796                 if (tp->pmtu_cookie > dst_pmtu(dst)) {
 797                         tcp_sync_mss(sk, dst_pmtu(dst));
 798                         tcp_simple_retransmit(sk);
 799                 } /* else let the usual retransmit timer handle it */
 800                 dst_release(dst);
 801                 goto out;
 802         }
 803
 804         icmpv6_err_convert(type, code, &err);
 805
 806         /* Might be for an open_request */
 807         switch (sk->sk_state) {
 808                 struct open_request *req, **prev;
 809         case TCP_LISTEN:
 810                 if (sock_owned_by_user(sk))
 811                         goto out;
 812
 813                 req = tcp_v6_search_req(tp, &prev, th->dest, &hdr->daddr,
 814                                         &hdr->saddr, tcp_v6_iif(skb));
 815                 if (!req)
 816                         goto out;
 817
 818                 /* ICMPs are not backlogged, hence we cannot get
 819                  * an established socket here.
 820                  */
 821                 BUG_TRAP(req->sk == NULL);
 822
 823                 if (seq != req->snt_isn) {
 824                         NET_INC_STATS_BH(OutOfWindowIcmps);
 825                         goto out;
 826                 }
 827
 828                 tcp_synq_drop(sk, req, prev);
 829                 goto out;
 830
 831         case TCP_SYN_SENT:
 832         case TCP_SYN_RECV:  /* Cannot happen.
 833                                It can, it SYNs are crossed. --ANK */
 834                 if (!sock_owned_by_user(sk)) {
 835                         TCP_INC_STATS_BH(TcpAttemptFails);
 836                         sk->sk_err = err;
 837                         sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
 838
 839                         tcp_done(sk);
 840                 } else
 841                         sk->sk_err_soft = err;
 842                 goto out;
 843         }
 844
 845         if (!sock_owned_by_user(sk) && np->recverr) {
 846                 sk->sk_err = err;
 847                 sk->sk_error_report(sk);
 848         } else
 849                 sk->sk_err_soft = err;
 850
 851 out:
 852         bh_unlock_sock(sk);
 853         sock_put(sk);
 854 }
 855
 856
 857 static int tcp_v6_send_synack(struct sock *sk, struct open_request *req,
 858                               struct dst_entry *dst)
 859 {
 860         struct ipv6_pinfo *np = inet6_sk(sk);
 861         struct sk_buff * skb;
 862         struct ipv6_txoptions *opt = NULL;
 863         struct flowi fl;
 864         int err = -1;
 865
 866         memset(&fl, 0, sizeof(fl));
 867         fl.proto = IPPROTO_TCP;
 868         ipv6_addr_copy(&fl.fl6_dst, &req->af.v6_req.rmt_addr);
 869         ipv6_addr_copy(&fl.fl6_src, &req->af.v6_req.loc_addr);
 870         fl.fl6_flowlabel = 0;
 871         fl.oif = req->af.v6_req.iif;
 872         fl.fl_ip_dport = req->rmt_port;
 873         fl.fl_ip_sport = inet_sk(sk)->sport;
 874
 875         if (dst == NULL) {
 876                 opt = np->opt;
 877                 if (opt == NULL &&
 878                     np->rxopt.bits.srcrt == 2 &&
 879                     req->af.v6_req.pktopts) {
 880                         struct sk_buff *pktopts = req->af.v6_req.pktopts;
 881                         struct inet6_skb_parm *rxopt = IP6CB(pktopts);
 882                         if (rxopt->srcrt)
 883                                 opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(pktopts->nh.raw + rxopt->srcrt));
 884                 }
 885
 886                 if (opt && opt->srcrt) {
 887                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 888                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
 889                 }
 890
 891                 err = ip6_dst_lookup(sk, &dst, &fl);
 892                 if (err)
 893                         goto done;
 894         }
 895
 896         skb = tcp_make_synack(sk, dst, req);
 897         if (skb) {
 898                 struct tcphdr *th = skb->h.th;
 899
 900                 th->check = tcp_v6_check(th, skb->len,
 901                                          &req->af.v6_req.loc_addr, &req->af.v6_req.rmt_addr,
 902                                          csum_partial((char *)th, skb->len, skb->csum));
 903
 904                 ipv6_addr_copy(&fl.fl6_dst, &req->af.v6_req.rmt_addr);
 905                 err = ip6_xmit(sk, skb, &fl, opt, 0);
 906                 if (err == NET_XMIT_CN)
 907                         err = 0;
 908         }
 909
 910 done:
 911         dst_release(dst);
 912         if (opt && opt != np->opt)
 913                 sock_kfree_s(sk, opt, opt->tot_len);
 914         return err;
 915 }
 916
 917 static void tcp_v6_or_free(struct open_request *req)
 918 {
 919         if (req->af.v6_req.pktopts)
 920                 kfree_skb(req->af.v6_req.pktopts);
 921 }
 922
 923 static struct or_calltable or_ipv6 = {
 924         .family         =       AF_INET6,
 925         .rtx_syn_ack    =       tcp_v6_send_synack,
 926         .send_ack       =       tcp_v6_or_send_ack,
 927         .destructor     =       tcp_v6_or_free,
 928         .send_reset     =       tcp_v6_send_reset
 929 };
 930
 931 static int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
 932 {
 933         struct ipv6_pinfo *np = inet6_sk(sk);
 934         struct inet6_skb_parm *opt = IP6CB(skb);
 935
 936         if (np->rxopt.all) {
 937                 if ((opt->hop && np->rxopt.bits.hopopts) ||
 938                     ((IPV6_FLOWINFO_MASK&*(u32*)skb->nh.raw) &&
 939                      np->rxopt.bits.rxflow) ||
 940                     (opt->srcrt && np->rxopt.bits.srcrt) ||
 941                     ((opt->dst1 || opt->dst0) && np->rxopt.bits.dstopts))
 942                         return 1;
 943         }
 944         return 0;
 945 }
 946
 947
 948 static void tcp_v6_send_check(struct sock *sk, struct tcphdr *th, int len,
 949                               struct sk_buff *skb)
 950 {
 951         struct ipv6_pinfo *np = inet6_sk(sk);
 952
 953         if (skb->ip_summed == CHECKSUM_HW) {
 954                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 955                 skb->csum = offsetof(struct tcphdr, check);
 956         } else {
 957                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 958                                             csum_partial((char *)th, th->doff<<2,
 959                                                          skb->csum));
 960         }
 961 }
 962
 963
 964 static void tcp_v6_send_reset(struct sk_buff *skb)
 965 {
 966         struct tcphdr *th = skb->h.th, *t1;
 967         struct sk_buff *buff;
 968         struct flowi fl;
 969
 970         if (th->rst)
 971                 return;
 972
 973         if (!ipv6_unicast_destination(skb))
 974                 return;
 975
 976         /*
 977          * We need to grab some memory, and put together an RST,
 978          * and then put it into the queue to be sent.
 979          */
 980
 981         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr), GFP_ATOMIC);
 982         if (buff == NULL)
 983                 return;
 984
 985         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr));
 986
 987         t1 = (struct tcphdr *) skb_push(buff,sizeof(struct tcphdr));
 988
 989         /* Swap the send and the receive. */
 990         memset(t1, 0, sizeof(*t1));
 991         t1->dest = th->source;
 992         t1->source = th->dest;
 993         t1->doff = sizeof(*t1)/4;
 994         t1->rst = 1;
 995
 996         if(th->ack) {
 997                 t1->seq = th->ack_seq;
 998         } else {
 999                 t1->ack = 1;
1000                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
1001                                     + skb->len - (th->doff<<2));
1002         }
1003
1004         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
1005
1006         memset(&fl, 0, sizeof(fl));
1007         ipv6_addr_copy(&fl.fl6_dst, &skb->nh.ipv6h->saddr);
1008         ipv6_addr_copy(&fl.fl6_src, &skb->nh.ipv6h->daddr);
1009
1010         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1011                                     sizeof(*t1), IPPROTO_TCP,
1012                                     buff->csum);
1013
1014         fl.proto = IPPROTO_TCP;
1015         fl.oif = tcp_v6_iif(skb);
1016         fl.fl_ip_dport = t1->dest;
1017         fl.fl_ip_sport = t1->source;
1018
1019         /* sk = NULL, but it is safe for now. RST socket required. */
1020         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1021                 ip6_xmit(NULL, buff, &fl, NULL, 0);
1022                 TCP_INC_STATS_BH(TcpOutSegs);
1023                 TCP_INC_STATS_BH(TcpOutRsts);
1024                 return;
1025         }
1026
1027         kfree_skb(buff);
1028 }
1029
1030 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
1031 {
1032         struct tcphdr *th = skb->h.th, *t1;
1033         struct sk_buff *buff;
1034         struct flowi fl;
1035         int tot_len = sizeof(struct tcphdr);
1036
1037         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr), GFP_ATOMIC);
1038         if (buff == NULL)
1039                 return;
1040
1041         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr));
1042
1043         if (ts)
1044                 tot_len += 3*4;
1045
1046         t1 = (struct tcphdr *) skb_push(buff,tot_len);
1047
1048         /* Swap the send and the receive. */
1049         memset(t1, 0, sizeof(*t1));
1050         t1->dest = th->source;
1051         t1->source = th->dest;
1052         t1->doff = tot_len/4;
1053         t1->seq = htonl(seq);
1054         t1->ack_seq = htonl(ack);
1055         t1->ack = 1;
1056         t1->window = htons(win);
1057
1058         if (ts) {
1059                 u32 *ptr = (u32*)(t1 + 1);
1060                 *ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
1061                                (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
1062                 *ptr++ = htonl(tcp_time_stamp);
1063                 *ptr = htonl(ts);
1064         }
1065
1066         buff->csum = csum_partial((char *)t1, tot_len, 0);
1067
1068         memset(&fl, 0, sizeof(fl));
1069         ipv6_addr_copy(&fl.fl6_dst, &skb->nh.ipv6h->saddr);
1070         ipv6_addr_copy(&fl.fl6_src, &skb->nh.ipv6h->daddr);
1071
1072         t1->check = csum_ipv6_magic(&fl.fl6_src, &fl.fl6_dst,
1073                                     tot_len, IPPROTO_TCP,
1074                                     buff->csum);
1075
1076         fl.proto = IPPROTO_TCP;
1077         fl.oif = tcp_v6_iif(skb);
1078         fl.fl_ip_dport = t1->dest;
1079         fl.fl_ip_sport = t1->source;
1080
1081         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
1082                 ip6_xmit(NULL, buff, &fl, NULL, 0);
1083                 TCP_INC_STATS_BH(TcpOutSegs);
1084                 return;
1085         }
1086
1087         kfree_skb(buff);
1088 }
1089
1090 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1091 {
1092         struct tcp_tw_bucket *tw = (struct tcp_tw_bucket *)sk;
1093
1094         tcp_v6_send_ack(skb, tw->tw_snd_nxt, tw->tw_rcv_nxt,
1095                         tw->tw_rcv_wnd >> tw->tw_rcv_wscale, tw->tw_ts_recent);
1096
1097         tcp_tw_put(tw);
1098 }
1099
1100 static void tcp_v6_or_send_ack(struct sk_buff *skb, struct open_request *req)
1101 {
1102         tcp_v6_send_ack(skb, req->snt_isn+1, req->rcv_isn+1, req->rcv_wnd, req->ts_recent);
1103 }
1104
1105
1106 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1107 {
1108         struct open_request *req, **prev;
1109         struct tcphdr *th = skb->h.th;
1110         struct tcp_opt *tp = tcp_sk(sk);
1111         struct sock *nsk;
1112
1113         /* Find possible connection requests. */
1114         req = tcp_v6_search_req(tp, &prev, th->source, &skb->nh.ipv6h->saddr,
1115                                 &skb->nh.ipv6h->daddr, tcp_v6_iif(skb));
1116         if (req)
1117                 return tcp_check_req(sk, skb, req, prev);
1118
1119         nsk = __tcp_v6_lookup_established(&skb->nh.ipv6h->saddr,
1120                                           th->source,
1121                                           &skb->nh.ipv6h->daddr,
1122                                           ntohs(th->dest),
1123                                           tcp_v6_iif(skb));
1124
1125         if (nsk) {
1126                 if (nsk->sk_state != TCP_TIME_WAIT) {
1127                         bh_lock_sock(nsk);
1128                         return nsk;
1129                 }
1130                 tcp_tw_put((struct tcp_tw_bucket*)nsk);
1131                 return NULL;
1132         }
1133
1134 #if 0 /*def CONFIG_SYN_COOKIES*/
1135         if (!th->rst && !th->syn && th->ack)
1136                 sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
1137 #endif
1138         return sk;
1139 }
1140
1141 static void tcp_v6_synq_add(struct sock *sk, struct open_request *req)
1142 {
1143         struct tcp_opt *tp = tcp_sk(sk);
1144         struct tcp_listen_opt *lopt = tp->listen_opt;
1145         u32 h = tcp_v6_synq_hash(&req->af.v6_req.rmt_addr, req->rmt_port, lopt->hash_rnd);
1146
1147         req->sk = NULL;
1148         req->expires = jiffies + TCP_TIMEOUT_INIT;
1149         req->retrans = 0;
1150         req->dl_next = lopt->syn_table[h];
1151
1152         write_lock(&tp->syn_wait_lock);
1153         lopt->syn_table[h] = req;
1154         write_unlock(&tp->syn_wait_lock);
1155
1156 #ifdef CONFIG_ACCEPT_QUEUES
1157         tcp_synq_added(sk, req);
1158 #else
1159         tcp_synq_added(sk);
1160 #endif
1161 }
1162
1163
1164 /* FIXME: this is substantially similar to the ipv4 code.
1165  * Can some kind of merge be done? -- erics
1166  */
1167 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1168 {
1169         struct ipv6_pinfo *np = inet6_sk(sk);
1170         struct tcp_opt tmptp, *tp = tcp_sk(sk);
1171         struct open_request *req = NULL;
1172         __u32 isn = TCP_SKB_CB(skb)->when;
1173 #ifdef CONFIG_ACCEPT_QUEUES
1174         int class = 0;
1175 #endif
1176
1177         if (skb->protocol == htons(ETH_P_IP))
1178                 return tcp_v4_conn_request(sk, skb);
1179
1180         if (!ipv6_unicast_destination(skb))
1181                 goto drop;
1182
1183
1184         /*
1185          *      There are no SYN attacks on IPv6, yet...
1186          */
1187         if (tcp_synq_is_full(sk) && !isn) {
1188                 if (net_ratelimit())
1189                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
1190                 goto drop;
1191         }
1192
1193 #ifdef CONFIG_ACCEPT_QUEUES
1194         class = (skb->nfmark <= 0) ? 0 :
1195                         ((skb->nfmark >= NUM_ACCEPT_QUEUES) ? 0: skb->nfmark);
1196         /*
1197          * Accept only if the class has shares set or if the default class
1198          * i.e. class 0 has shares
1199          */
1200         if (!(tcp_sk(sk)->acceptq[class].aq_ratio)) {
1201                 if (tcp_sk(sk)->acceptq[0].aq_ratio)
1202                         class = 0;
1203                 else
1204                         goto drop;
1205         }
1206
1207         if (sk_acceptq_is_full(sk, class) && tcp_synq_young(sk, class) > 1)
1208 #else
1209         if (sk_acceptq_is_full(sk) && tcp_synq_young(sk) > 1)
1210 #endif
1211                 goto drop;
1212
1213
1214         req = tcp_openreq_alloc();
1215         if (req == NULL)
1216                 goto drop;
1217
1218         tcp_clear_options(&tmptp);
1219         tmptp.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1220         tmptp.user_mss = tp->user_mss;
1221
1222         tcp_parse_options(skb, &tmptp, 0);
1223
1224         tmptp.tstamp_ok = tmptp.saw_tstamp;
1225         tcp_openreq_init(req, &tmptp, skb);
1226 #ifdef CONFIG_ACCEPT_QUEUES
1227         req->acceptq_class = class;
1228         req->acceptq_time_stamp = jiffies;
1229 #endif
1230         req->class = &or_ipv6;
1231         ipv6_addr_copy(&req->af.v6_req.rmt_addr, &skb->nh.ipv6h->saddr);
1232         ipv6_addr_copy(&req->af.v6_req.loc_addr, &skb->nh.ipv6h->daddr);
1233         TCP_ECN_create_request(req, skb->h.th);
1234         req->af.v6_req.pktopts = NULL;
1235         if (ipv6_opt_accepted(sk, skb) ||
1236             np->rxopt.bits.rxinfo ||
1237             np->rxopt.bits.rxhlim) {
1238                 atomic_inc(&skb->users);
1239                 req->af.v6_req.pktopts = skb;
1240         }
1241         req->af.v6_req.iif = sk->sk_bound_dev_if;
1242
1243         /* So that link locals have meaning */
1244         if (!sk->sk_bound_dev_if &&
1245             ipv6_addr_type(&req->af.v6_req.rmt_addr) & IPV6_ADDR_LINKLOCAL)
1246                 req->af.v6_req.iif = tcp_v6_iif(skb);
1247
1248         if (isn == 0)
1249                 isn = tcp_v6_init_sequence(sk,skb);
1250
1251         req->snt_isn = isn;
1252
1253         if (tcp_v6_send_synack(sk, req, NULL))
1254                 goto drop;
1255
1256         tcp_v6_synq_add(sk, req);
1257
1258         return 0;
1259
1260 drop:
1261         if (req)
1262                 tcp_openreq_free(req);
1263
1264         TCP_INC_STATS_BH(TcpAttemptFails);
1265         return 0; /* don't send reset */
1266 }
1267
1268 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1269                                           struct open_request *req,
1270                                           struct dst_entry *dst)
1271 {
1272         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
1273         struct tcp6_sock *newtcp6sk;
1274         struct inet_opt *newinet;
1275         struct tcp_opt *newtp;
1276         struct sock *newsk;
1277         struct ipv6_txoptions *opt;
1278
1279         if (skb->protocol == htons(ETH_P_IP)) {
1280                 /*
1281                  *      v6 mapped
1282                  */
1283
1284                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1285
1286                 if (newsk == NULL)
1287                         return NULL;
1288
1289                 newtcp6sk = (struct tcp6_sock *)newsk;
1290                 newtcp6sk->pinet6 = &newtcp6sk->inet6;
1291
1292                 newinet = inet_sk(newsk);
1293                 newnp = inet6_sk(newsk);
1294                 newtp = tcp_sk(newsk);
1295
1296                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1297
1298                 ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
1299                               newinet->daddr);
1300
1301                 ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
1302                               newinet->saddr);
1303
1304                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
1305
1306                 newtp->af_specific = &ipv6_mapped;
1307                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
1308                 newnp->pktoptions  = NULL;
1309                 newnp->opt         = NULL;
1310                 newnp->mcast_oif   = tcp_v6_iif(skb);
1311                 newnp->mcast_hops  = skb->nh.ipv6h->hop_limit;
1312
1313                 /* Charge newly allocated IPv6 socket. Though it is mapped,
1314                  * it is IPv6 yet.
1315                  */
1316 #ifdef INET_REFCNT_DEBUG
1317                 atomic_inc(&inet6_sock_nr);
1318 #endif
1319
1320                 /* It is tricky place. Until this moment IPv4 tcp
1321                    worked with IPv6 af_tcp.af_specific.
1322                    Sync it now.
1323                  */
1324                 tcp_sync_mss(newsk, newtp->pmtu_cookie);
1325
1326                 return newsk;
1327         }
1328
1329         opt = np->opt;
1330
1331 #ifdef CONFIG_ACCEPT_QUEUES
1332         if (sk_acceptq_is_full(sk, req->acceptq_class))
1333 #else
1334         if (sk_acceptq_is_full(sk))
1335 #endif
1336                 goto out_overflow;
1337
1338         if (np->rxopt.bits.srcrt == 2 &&
1339             opt == NULL && req->af.v6_req.pktopts) {
1340                 struct inet6_skb_parm *rxopt = IP6CB(req->af.v6_req.pktopts);
1341                 if (rxopt->srcrt)
1342                         opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(req->af.v6_req.pktopts->nh.raw+rxopt->srcrt));
1343         }
1344
1345         if (dst == NULL) {
1346                 struct flowi fl;
1347
1348                 memset(&fl, 0, sizeof(fl));
1349                 fl.proto = IPPROTO_TCP;
1350                 ipv6_addr_copy(&fl.fl6_dst, &req->af.v6_req.rmt_addr);
1351                 if (opt && opt->srcrt) {
1352                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
1353                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1354                 }
1355                 ipv6_addr_copy(&fl.fl6_src, &req->af.v6_req.loc_addr);
1356                 fl.oif = sk->sk_bound_dev_if;
1357                 fl.fl_ip_dport = req->rmt_port;
1358                 fl.fl_ip_sport = inet_sk(sk)->sport;
1359
1360                 if (ip6_dst_lookup(sk, &dst, &fl))
1361                         goto out;
1362         }
1363
1364         newsk = tcp_create_openreq_child(sk, req, skb);
1365         if (newsk == NULL)
1366                 goto out;
1367
1368         /* Charge newly allocated IPv6 socket */
1369 #ifdef INET_REFCNT_DEBUG
1370         atomic_inc(&inet6_sock_nr);
1371 #endif
1372
1373         ip6_dst_store(newsk, dst, NULL);
1374         newsk->sk_route_caps = dst->dev->features &
1375                 ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
1376
1377         newtcp6sk = (struct tcp6_sock *)newsk;
1378         newtcp6sk->pinet6 = &newtcp6sk->inet6;
1379
1380         newtp = tcp_sk(newsk);
1381         newinet = inet_sk(newsk);
1382         newnp = inet6_sk(newsk);
1383
1384         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
1385
1386         ipv6_addr_copy(&newnp->daddr, &req->af.v6_req.rmt_addr);
1387         ipv6_addr_copy(&newnp->saddr, &req->af.v6_req.loc_addr);
1388         ipv6_addr_copy(&newnp->rcv_saddr, &req->af.v6_req.loc_addr);
1389         newsk->sk_bound_dev_if = req->af.v6_req.iif;
1390
1391         /* Now IPv6 options...
1392
1393            First: no IPv4 options.
1394          */
1395         newinet->opt = NULL;
1396
1397         /* Clone RX bits */
1398         newnp->rxopt.all = np->rxopt.all;
1399
1400         /* Clone pktoptions received with SYN */
1401         newnp->pktoptions = NULL;
1402         if (req->af.v6_req.pktopts) {
1403                 newnp->pktoptions = skb_clone(req->af.v6_req.pktopts,
1404                                               GFP_ATOMIC);
1405                 kfree_skb(req->af.v6_req.pktopts);
1406                 req->af.v6_req.pktopts = NULL;
1407                 if (newnp->pktoptions)
1408                         skb_set_owner_r(newnp->pktoptions, newsk);
1409         }
1410         newnp->opt        = NULL;
1411         newnp->mcast_oif  = tcp_v6_iif(skb);
1412         newnp->mcast_hops = skb->nh.ipv6h->hop_limit;
1413
1414         /* Clone native IPv6 options from listening socket (if any)
1415
1416            Yes, keeping reference count would be much more clever,
1417            but we make one more one thing there: reattach optmem
1418            to newsk.
1419          */
1420         if (opt) {
1421                 newnp->opt = ipv6_dup_options(newsk, opt);
1422                 if (opt != np->opt)
1423                         sock_kfree_s(sk, opt, opt->tot_len);
1424         }
1425
1426         newtp->ext_header_len = 0;
1427         if (newnp->opt)
1428                 newtp->ext_header_len = newnp->opt->opt_nflen +
1429                                         newnp->opt->opt_flen;
1430         newtp->ext2_header_len = dst->header_len;
1431
1432         tcp_sync_mss(newsk, dst_pmtu(dst));
1433         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
1434         tcp_initialize_rcv_mss(newsk);
1435
1436         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
1437
1438         __tcp_v6_hash(newsk);
1439         tcp_inherit_port(sk, newsk);
1440
1441         return newsk;
1442
1443 out_overflow:
1444         NET_INC_STATS_BH(ListenOverflows);
1445 out:
1446         NET_INC_STATS_BH(ListenDrops);
1447         if (opt && opt != np->opt)
1448                 sock_kfree_s(sk, opt, opt->tot_len);
1449         dst_release(dst);
1450         return NULL;
1451 }
1452
1453 static int tcp_v6_checksum_init(struct sk_buff *skb)
1454 {
1455         if (skb->ip_summed == CHECKSUM_HW) {
1456                 skb->ip_summed = CHECKSUM_UNNECESSARY;
1457                 if (!tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1458                                   &skb->nh.ipv6h->daddr,skb->csum))
1459                         return 0;
1460                 LIMIT_NETDEBUG(printk(KERN_DEBUG "hw tcp v6 csum failed\n"));
1461         }
1462         if (skb->len <= 76) {
1463                 if (tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1464                                  &skb->nh.ipv6h->daddr,skb_checksum(skb, 0, skb->len, 0)))
1465                         return -1;
1466                 skb->ip_summed = CHECKSUM_UNNECESSARY;
1467         } else {
1468                 skb->csum = ~tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1469                                           &skb->nh.ipv6h->daddr,0);
1470         }
1471         return 0;
1472 }
1473
1474 /* The socket must have it's spinlock held when we get
1475  * here.
1476  *
1477  * We have a potential double-lock case here, so even when
1478  * doing backlog processing we use the BH locking scheme.
1479  * This is because we cannot sleep with the original spinlock
1480  * held.
1481  */
1482 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1483 {
1484         struct ipv6_pinfo *np = inet6_sk(sk);
1485         struct tcp_opt *tp;
1486         struct sk_buff *opt_skb = NULL;
1487
1488         /* Imagine: socket is IPv6. IPv4 packet arrives,
1489            goes to IPv4 receive handler and backlogged.
1490            From backlog it always goes here. Kerboom...
1491            Fortunately, tcp_rcv_established and rcv_established
1492            handle them correctly, but it is not case with
1493            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1494          */
1495
1496         if (skb->protocol == htons(ETH_P_IP))
1497                 return tcp_v4_do_rcv(sk, skb);
1498
1499         if (sk_filter(sk, skb, 0))
1500                 goto discard;
1501
1502         /*
1503          *      socket locking is here for SMP purposes as backlog rcv
1504          *      is currently called with bh processing disabled.
1505          */
1506
1507         /* Do Stevens' IPV6_PKTOPTIONS.
1508
1509            Yes, guys, it is the only place in our code, where we
1510            may make it not affecting IPv4.
1511            The rest of code is protocol independent,
1512            and I do not like idea to uglify IPv4.
1513
1514            Actually, all the idea behind IPV6_PKTOPTIONS
1515            looks not very well thought. For now we latch
1516            options, received in the last packet, enqueued
1517            by tcp. Feel free to propose better solution.
1518                                                --ANK (980728)
1519          */
1520         if (np->rxopt.all)
1521                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1522
1523         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
1524                 TCP_CHECK_TIMER(sk);
1525                 if (tcp_rcv_established(sk, skb, skb->h.th, skb->len))
1526                         goto reset;
1527                 TCP_CHECK_TIMER(sk);
1528                 if (opt_skb)
1529                         goto ipv6_pktoptions;
1530                 return 0;
1531         }
1532
1533         if (skb->len < (skb->h.th->doff<<2) || tcp_checksum_complete(skb))
1534                 goto csum_err;
1535
1536         if (sk->sk_state == TCP_LISTEN) {
1537                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1538                 if (!nsk)
1539                         goto discard;
1540
1541                 /*
1542                  * Queue it on the new socket if the new socket is active,
1543                  * otherwise we just shortcircuit this and continue with
1544                  * the new socket..
1545                  */
1546                 if(nsk != sk) {
1547                         if (tcp_child_process(sk, nsk, skb))
1548                                 goto reset;
1549                         if (opt_skb)
1550                                 __kfree_skb(opt_skb);
1551                         return 0;
1552                 }
1553         }
1554
1555         TCP_CHECK_TIMER(sk);
1556         if (tcp_rcv_state_process(sk, skb, skb->h.th, skb->len))
1557                 goto reset;
1558         TCP_CHECK_TIMER(sk);
1559         if (opt_skb)
1560                 goto ipv6_pktoptions;
1561         return 0;
1562
1563 reset:
1564         tcp_v6_send_reset(skb);
1565 discard:
1566         if (opt_skb)
1567                 __kfree_skb(opt_skb);
1568         kfree_skb(skb);
1569         return 0;
1570 csum_err:
1571         TCP_INC_STATS_BH(TcpInErrs);
1572         goto discard;
1573
1574
1575 ipv6_pktoptions:
1576         /* Do you ask, what is it?
1577
1578            1. skb was enqueued by tcp.
1579            2. skb is added to tail of read queue, rather than out of order.
1580            3. socket is not in passive state.
1581            4. Finally, it really contains options, which user wants to receive.
1582          */
1583         tp = tcp_sk(sk);
1584         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
1585             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
1586                 if (np->rxopt.bits.rxinfo)
1587                         np->mcast_oif = tcp_v6_iif(opt_skb);
1588                 if (np->rxopt.bits.rxhlim)
1589                         np->mcast_hops = opt_skb->nh.ipv6h->hop_limit;
1590                 if (ipv6_opt_accepted(sk, opt_skb)) {
1591                         skb_set_owner_r(opt_skb, sk);
1592                         opt_skb = xchg(&np->pktoptions, opt_skb);
1593                 } else {
1594                         __kfree_skb(opt_skb);
1595                         opt_skb = xchg(&np->pktoptions, NULL);
1596                 }
1597         }
1598
1599         if (opt_skb)
1600                 kfree_skb(opt_skb);
1601         return 0;
1602 }
1603
1604 static int tcp_v6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
1605 {
1606         struct sk_buff *skb = *pskb;
1607         struct tcphdr *th;
1608         struct sock *sk;
1609         int ret;
1610
1611         if (skb->pkt_type != PACKET_HOST)
1612                 goto discard_it;
1613
1614         /*
1615          *      Count it even if it's bad.
1616          */
1617         TCP_INC_STATS_BH(TcpInSegs);
1618
1619         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1620                 goto discard_it;
1621
1622         th = skb->h.th;
1623
1624         if (th->doff < sizeof(struct tcphdr)/4)
1625                 goto bad_packet;
1626         if (!pskb_may_pull(skb, th->doff*4))
1627                 goto discard_it;
1628
1629         if ((skb->ip_summed != CHECKSUM_UNNECESSARY &&
1630              tcp_v6_checksum_init(skb) < 0))
1631                 goto bad_packet;
1632
1633         th = skb->h.th;
1634         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1635         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1636                                     skb->len - th->doff*4);
1637         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1638         TCP_SKB_CB(skb)->when = 0;
1639         TCP_SKB_CB(skb)->flags = ip6_get_dsfield(skb->nh.ipv6h);
1640         TCP_SKB_CB(skb)->sacked = 0;
1641
1642         sk = __tcp_v6_lookup(&skb->nh.ipv6h->saddr, th->source,
1643                              &skb->nh.ipv6h->daddr, ntohs(th->dest), tcp_v6_iif(skb));
1644
1645         if (!sk)
1646                 goto no_tcp_socket;
1647
1648 process:
1649         if (sk->sk_state == TCP_TIME_WAIT)
1650                 goto do_time_wait;
1651
1652         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
1653                 goto discard_and_relse;
1654
1655         if (sk_filter(sk, skb, 0))
1656                 goto discard_and_relse;
1657
1658         skb->dev = NULL;
1659
1660         bh_lock_sock(sk);
1661         ret = 0;
1662         if (!sock_owned_by_user(sk)) {
1663                 if (!tcp_prequeue(sk, skb))
1664                         ret = tcp_v6_do_rcv(sk, skb);
1665         } else
1666                 sk_add_backlog(sk, skb);
1667         bh_unlock_sock(sk);
1668
1669         sock_put(sk);
1670         return ret ? -1 : 0;
1671
1672 no_tcp_socket:
1673         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
1674                 goto discard_it;
1675
1676         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1677 bad_packet:
1678                 TCP_INC_STATS_BH(TcpInErrs);
1679         } else {
1680                 tcp_v6_send_reset(skb);
1681         }
1682
1683 discard_it:
1684
1685         /*
1686          *      Discard frame
1687          */
1688
1689         kfree_skb(skb);
1690         return 0;
1691
1692 discard_and_relse:
1693         sock_put(sk);
1694         goto discard_it;
1695
1696 do_time_wait:
1697         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1698                 tcp_tw_put((struct tcp_tw_bucket *) sk);
1699                 goto discard_it;
1700         }
1701
1702         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1703                 TCP_INC_STATS_BH(TcpInErrs);
1704                 tcp_tw_put((struct tcp_tw_bucket *) sk);
1705                 goto discard_it;
1706         }
1707
1708         switch(tcp_timewait_state_process((struct tcp_tw_bucket *)sk,
1709                                           skb, th, skb->len)) {
1710         case TCP_TW_SYN:
1711         {
1712                 struct sock *sk2;
1713
1714                 sk2 = tcp_v6_lookup_listener(&skb->nh.ipv6h->daddr, ntohs(th->dest), tcp_v6_iif(skb));
1715                 if (sk2 != NULL) {
1716                         tcp_tw_deschedule((struct tcp_tw_bucket *)sk);
1717                         tcp_tw_put((struct tcp_tw_bucket *)sk);
1718                         sk = sk2;
1719                         goto process;
1720                 }
1721                 /* Fall through to ACK */
1722         }
1723         case TCP_TW_ACK:
1724                 tcp_v6_timewait_ack(sk, skb);
1725                 break;
1726         case TCP_TW_RST:
1727                 goto no_tcp_socket;
1728         case TCP_TW_SUCCESS:;
1729         }
1730         goto discard_it;
1731 }
1732
1733 static int tcp_v6_rebuild_header(struct sock *sk)
1734 {
1735         int err;
1736         struct dst_entry *dst;
1737         struct ipv6_pinfo *np = inet6_sk(sk);
1738
1739         dst = __sk_dst_check(sk, np->dst_cookie);
1740
1741         if (dst == NULL) {
1742                 struct inet_opt *inet = inet_sk(sk);
1743                 struct flowi fl;
1744
1745                 memset(&fl, 0, sizeof(fl));
1746                 fl.proto = IPPROTO_TCP;
1747                 ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
1748                 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
1749                 fl.fl6_flowlabel = np->flow_label;
1750                 fl.oif = sk->sk_bound_dev_if;
1751                 fl.fl_ip_dport = inet->dport;
1752                 fl.fl_ip_sport = inet->sport;
1753
1754                 if (np->opt && np->opt->srcrt) {
1755                         struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
1756                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1757                 }
1758
1759                 err = ip6_dst_lookup(sk, &dst, &fl);
1760
1761                 if (err) {
1762                         sk->sk_route_caps = 0;
1763                         return err;
1764                 }
1765
1766                 ip6_dst_store(sk, dst, NULL);
1767                 sk->sk_route_caps = dst->dev->features &
1768                         ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
1769                 tcp_sk(sk)->ext2_header_len = dst->header_len;
1770         }
1771
1772         return 0;
1773 }
1774
1775 static int tcp_v6_xmit(struct sk_buff *skb, int ipfragok)
1776 {
1777         struct sock *sk = skb->sk;
1778         struct inet_opt *inet = inet_sk(sk);
1779         struct ipv6_pinfo *np = inet6_sk(sk);
1780         struct flowi fl;
1781         struct dst_entry *dst;
1782
1783         memset(&fl, 0, sizeof(fl));
1784         fl.proto = IPPROTO_TCP;
1785         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
1786         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
1787         fl.fl6_flowlabel = np->flow_label;
1788         IP6_ECN_flow_xmit(sk, fl.fl6_flowlabel);
1789         fl.oif = sk->sk_bound_dev_if;
1790         fl.fl_ip_sport = inet->sport;
1791         fl.fl_ip_dport = inet->dport;
1792
1793         if (np->opt && np->opt->srcrt) {
1794                 struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
1795                 ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
1796         }
1797
1798         dst = __sk_dst_check(sk, np->dst_cookie);
1799
1800         if (dst == NULL) {
1801                 int err = ip6_dst_lookup(sk, &dst, &fl);
1802
1803                 if (err) {
1804                         sk->sk_err_soft = -err;
1805                         return err;
1806                 }
1807
1808                 ip6_dst_store(sk, dst, NULL);
1809                 sk->sk_route_caps = dst->dev->features &
1810                         ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
1811                 tcp_sk(sk)->ext2_header_len = dst->header_len;
1812         }
1813
1814         skb->dst = dst_clone(dst);
1815
1816         /* Restore final destination back after routing done */
1817         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
1818
1819         return ip6_xmit(sk, skb, &fl, np->opt, 0);
1820 }
1821
1822 static void v6_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
1823 {
1824         struct ipv6_pinfo *np = inet6_sk(sk);
1825         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) uaddr;
1826
1827         sin6->sin6_family = AF_INET6;
1828         ipv6_addr_copy(&sin6->sin6_addr, &np->daddr);
1829         sin6->sin6_port = inet_sk(sk)->dport;
1830         /* We do not store received flowlabel for TCP */
1831         sin6->sin6_flowinfo = 0;
1832         sin6->sin6_scope_id = 0;
1833         if (sk->sk_bound_dev_if &&
1834             ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
1835                 sin6->sin6_scope_id = sk->sk_bound_dev_if;
1836 }
1837
1838 static int tcp_v6_remember_stamp(struct sock *sk)
1839 {
1840         /* Alas, not yet... */
1841         return 0;
1842 }
1843
1844 static struct tcp_func ipv6_specific = {
1845         .queue_xmit     =       tcp_v6_xmit,
1846         .send_check     =       tcp_v6_send_check,
1847         .rebuild_header =       tcp_v6_rebuild_header,
1848         .conn_request   =       tcp_v6_conn_request,
1849         .syn_recv_sock  =       tcp_v6_syn_recv_sock,
1850         .remember_stamp =       tcp_v6_remember_stamp,
1851         .net_header_len =       sizeof(struct ipv6hdr),
1852
1853         .setsockopt     =       ipv6_setsockopt,
1854         .getsockopt     =       ipv6_getsockopt,
1855         .addr2sockaddr  =       v6_addr2sockaddr,
1856         .sockaddr_len   =       sizeof(struct sockaddr_in6)
1857 };
1858
1859 /*
1860  *      TCP over IPv4 via INET6 API
1861  */
1862
1863 static struct tcp_func ipv6_mapped = {
1864         .queue_xmit     =       ip_queue_xmit,
1865         .send_check     =       tcp_v4_send_check,
1866         .rebuild_header =       tcp_v4_rebuild_header,
1867         .conn_request   =       tcp_v6_conn_request,
1868         .syn_recv_sock  =       tcp_v6_syn_recv_sock,
1869         .remember_stamp =       tcp_v4_remember_stamp,
1870         .net_header_len =       sizeof(struct iphdr),
1871
1872         .setsockopt     =       ipv6_setsockopt,
1873         .getsockopt     =       ipv6_getsockopt,
1874         .addr2sockaddr  =       v6_addr2sockaddr,
1875         .sockaddr_len   =       sizeof(struct sockaddr_in6)
1876 };
1877
1878
1879
1880 /* NOTE: A lot of things set to zero explicitly by call to
1881  *       sk_alloc() so need not be done here.
1882  */
1883 static int tcp_v6_init_sock(struct sock *sk)
1884 {
1885         struct tcp_opt *tp = tcp_sk(sk);
1886
1887         skb_queue_head_init(&tp->out_of_order_queue);
1888         tcp_init_xmit_timers(sk);
1889         tcp_prequeue_init(tp);
1890
1891         tp->rto  = TCP_TIMEOUT_INIT;
1892         tp->mdev = TCP_TIMEOUT_INIT;
1893
1894         /* So many TCP implementations out there (incorrectly) count the
1895          * initial SYN frame in their delayed-ACK and congestion control
1896          * algorithms that we must have the following bandaid to talk
1897          * efficiently to them.  -DaveM
1898          */
1899         tp->snd_cwnd = 2;
1900
1901         /* See draft-stevens-tcpca-spec-01 for discussion of the
1902          * initialization of these values.
1903          */
1904         tp->snd_ssthresh = 0x7fffffff;
1905         tp->snd_cwnd_clamp = ~0;
1906         tp->mss_cache = 536;
1907
1908         tp->reordering = sysctl_tcp_reordering;
1909
1910         sk->sk_state = TCP_CLOSE;
1911
1912         tp->af_specific = &ipv6_specific;
1913
1914         sk->sk_write_space = sk_stream_write_space;
1915         sk->sk_use_write_queue = 1;
1916
1917         sk->sk_sndbuf = sysctl_tcp_wmem[1];
1918         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
1919
1920         atomic_inc(&tcp_sockets_allocated);
1921
1922         return 0;
1923 }
1924
1925 static int tcp_v6_destroy_sock(struct sock *sk)
1926 {
1927         struct tcp_opt *tp = tcp_sk(sk);
1928         struct inet_opt *inet = inet_sk(sk);
1929
1930         tcp_clear_xmit_timers(sk);
1931
1932         /* Cleanup up the write buffer. */
1933         tcp_writequeue_purge(sk);
1934
1935         /* Cleans up our, hopefully empty, out_of_order_queue. */
1936         __skb_queue_purge(&tp->out_of_order_queue);
1937
1938         /* Clean prequeue, it must be empty really */
1939         __skb_queue_purge(&tp->ucopy.prequeue);
1940
1941         /* Clean up a referenced TCP bind bucket. */
1942         if (tcp_sk(sk)->bind_hash)
1943                 tcp_put_port(sk);
1944
1945         /* If sendmsg cached page exists, toss it. */
1946         if (inet->sndmsg_page != NULL)
1947                 __free_page(inet->sndmsg_page);
1948
1949         atomic_dec(&tcp_sockets_allocated);
1950
1951         return inet6_destroy_sock(sk);
1952 }
1953
1954 /* Proc filesystem TCPv6 sock list dumping. */
1955 static void get_openreq6(struct seq_file *seq,
1956                          struct sock *sk, struct open_request *req, int i, int uid)
1957 {
1958         struct in6_addr *dest, *src;
1959         int ttd = req->expires - jiffies;
1960
1961         if (ttd < 0)
1962                 ttd = 0;
1963
1964         src = &req->af.v6_req.loc_addr;
1965         dest = &req->af.v6_req.rmt_addr;
1966         seq_printf(seq,
1967                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1968                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
1969                    i,
1970                    src->s6_addr32[0], src->s6_addr32[1],
1971                    src->s6_addr32[2], src->s6_addr32[3],
1972                    ntohs(inet_sk(sk)->sport),
1973                    dest->s6_addr32[0], dest->s6_addr32[1],
1974                    dest->s6_addr32[2], dest->s6_addr32[3],
1975                    ntohs(req->rmt_port),
1976                    TCP_SYN_RECV,
1977                    0,0, /* could print option size, but that is af dependent. */
1978                    1,   /* timers active (only the expire timer) */
1979                    jiffies_to_clock_t(ttd),
1980                    req->retrans,
1981                    uid,
1982                    0,  /* non standard timer */
1983                    0, /* open_requests have no inode */
1984                    0, req);
1985 }
1986
1987 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
1988 {
1989         struct in6_addr *dest, *src;
1990         __u16 destp, srcp;
1991         int timer_active;
1992         unsigned long timer_expires;
1993         struct inet_opt *inet = inet_sk(sp);
1994         struct tcp_opt *tp = tcp_sk(sp);
1995         struct ipv6_pinfo *np = inet6_sk(sp);
1996
1997         dest  = &np->daddr;
1998         src   = &np->rcv_saddr;
1999         destp = ntohs(inet->dport);
2000         srcp  = ntohs(inet->sport);
2001         if (tp->pending == TCP_TIME_RETRANS) {
2002                 timer_active    = 1;
2003                 timer_expires   = tp->timeout;
2004         } else if (tp->pending == TCP_TIME_PROBE0) {
2005                 timer_active    = 4;
2006                 timer_expires   = tp->timeout;
2007         } else if (timer_pending(&sp->sk_timer)) {
2008                 timer_active    = 2;
2009                 timer_expires   = sp->sk_timer.expires;
2010         } else {
2011                 timer_active    = 0;
2012                 timer_expires = jiffies;
2013         }
2014
2015         seq_printf(seq,
2016                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2017                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d\n",
2018                    i,
2019                    src->s6_addr32[0], src->s6_addr32[1],
2020                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2021                    dest->s6_addr32[0], dest->s6_addr32[1],
2022                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2023                    sp->sk_state,
2024                    tp->write_seq-tp->snd_una, tp->rcv_nxt-tp->copied_seq,
2025                    timer_active,
2026                    jiffies_to_clock_t(timer_expires - jiffies),
2027                    tp->retransmits,
2028                    sock_i_uid(sp),
2029                    tp->probes_out,
2030                    sock_i_ino(sp),
2031                    atomic_read(&sp->sk_refcnt), sp,
2032                    tp->rto, tp->ack.ato, (tp->ack.quick<<1)|tp->ack.pingpong,
2033                    tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
2034                    );
2035 }
2036
2037 static void get_timewait6_sock(struct seq_file *seq,
2038                                struct tcp_tw_bucket *tw, int i)
2039 {
2040         struct in6_addr *dest, *src;
2041         __u16 destp, srcp;
2042         int ttd = tw->tw_ttd - jiffies;
2043
2044         if (ttd < 0)
2045                 ttd = 0;
2046
2047         dest  = &tw->tw_v6_daddr;
2048         src   = &tw->tw_v6_rcv_saddr;
2049         destp = ntohs(tw->tw_dport);
2050         srcp  = ntohs(tw->tw_sport);
2051
2052         seq_printf(seq,
2053                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
2054                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
2055                    i,
2056                    src->s6_addr32[0], src->s6_addr32[1],
2057                    src->s6_addr32[2], src->s6_addr32[3], srcp,
2058                    dest->s6_addr32[0], dest->s6_addr32[1],
2059                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
2060                    tw->tw_substate, 0, 0,
2061                    3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
2062                    atomic_read(&tw->tw_refcnt), tw);
2063 }
2064
2065 #ifdef CONFIG_PROC_FS
2066 static int tcp6_seq_show(struct seq_file *seq, void *v)
2067 {
2068         struct tcp_iter_state *st;
2069
2070         if (v == SEQ_START_TOKEN) {
2071                 seq_printf(seq,
2072                            "  sl  "
2073                            "local_address                         "
2074                            "remote_address                        "
2075                            "st tx_queue rx_queue tr tm->when retrnsmt"
2076                            "   uid  timeout inode\n");
2077                 goto out;
2078         }
2079         st = seq->private;
2080
2081         switch (st->state) {
2082         case TCP_SEQ_STATE_LISTENING:
2083         case TCP_SEQ_STATE_ESTABLISHED:
2084                 get_tcp6_sock(seq, v, st->num);
2085                 break;
2086         case TCP_SEQ_STATE_OPENREQ:
2087                 get_openreq6(seq, st->syn_wait_sk, v, st->num, st->uid);
2088                 break;
2089         case TCP_SEQ_STATE_TIME_WAIT:
2090                 get_timewait6_sock(seq, v, st->num);
2091                 break;
2092         }
2093 out:
2094         return 0;
2095 }
2096
2097 static struct file_operations tcp6_seq_fops;
2098 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
2099         .owner          = THIS_MODULE,
2100         .name           = "tcp6",
2101         .family         = AF_INET6,
2102         .seq_show       = tcp6_seq_show,
2103         .seq_fops       = &tcp6_seq_fops,
2104 };
2105
2106 int __init tcp6_proc_init(void)
2107 {
2108         return tcp_proc_register(&tcp6_seq_afinfo);
2109 }
2110
2111 void tcp6_proc_exit(void)
2112 {
2113         tcp_proc_unregister(&tcp6_seq_afinfo);
2114 }
2115 #endif
2116
2117 struct proto tcpv6_prot = {
2118         .name           =       "TCPv6",
2119         .close          =       tcp_close,
2120         .connect        =       tcp_v6_connect,
2121         .disconnect     =       tcp_disconnect,
2122         .accept         =       tcp_accept,
2123         .ioctl          =       tcp_ioctl,
2124         .init           =       tcp_v6_init_sock,
2125         .destroy        =       tcp_v6_destroy_sock,
2126         .shutdown       =       tcp_shutdown,
2127         .setsockopt     =       tcp_setsockopt,
2128         .getsockopt     =       tcp_getsockopt,
2129         .sendmsg        =       tcp_sendmsg,
2130         .recvmsg        =       tcp_recvmsg,
2131         .backlog_rcv    =       tcp_v6_do_rcv,
2132         .hash           =       tcp_v6_hash,
2133         .unhash         =       tcp_unhash,
2134         .get_port       =       tcp_v6_get_port,
2135 };
2136
2137 static struct inet6_protocol tcpv6_protocol = {
2138         .handler        =       tcp_v6_rcv,
2139         .err_handler    =       tcp_v6_err,
2140         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
2141 };
2142
2143 extern struct proto_ops inet6_stream_ops;
2144
2145 static struct inet_protosw tcpv6_protosw = {
2146         .type           =       SOCK_STREAM,
2147         .protocol       =       IPPROTO_TCP,
2148         .prot           =       &tcpv6_prot,
2149         .ops            =       &inet6_stream_ops,
2150         .capability     =       -1,
2151         .no_check       =       0,
2152         .flags          =       INET_PROTOSW_PERMANENT,
2153 };
2154
2155 void __init tcpv6_init(void)
2156 {
2157         /* register inet6 protocol */
2158         if (inet6_add_protocol(&tcpv6_protocol, IPPROTO_TCP) < 0)
2159                 printk(KERN_ERR "tcpv6_init: Could not register protocol\n");
2160         inet6_register_protosw(&tcpv6_protosw);
2161 }