net/ipv6/tcp_ipv6.c

   1 /*
   2  *      TCP over IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      $Id: tcp_ipv6.c,v 1.1.1.1 2005/04/11 02:51:13 jack Exp $
   9  *
  10  *      Based on:
  11  *      linux/net/ipv4/tcp.c
  12  *      linux/net/ipv4/tcp_input.c
  13  *      linux/net/ipv4/tcp_output.c
  14  *
  15  *      Fixes:
  16  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  17  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
  18  *      Alexey Kuznetsov                allow both IPv4 and IPv6 sockets to bind
  19  *                                      a single port at the same time.
  20  *
  21  *      This program is free software; you can redistribute it and/or
  22  *      modify it under the terms of the GNU General Public License
  23  *      as published by the Free Software Foundation; either version
  24  *      2 of the License, or (at your option) any later version.
  25  */
  26
  27 #define __NO_VERSION__
  28 #include <linux/module.h>
  29 #include <linux/config.h>
  30 #include <linux/errno.h>
  31 #include <linux/types.h>
  32 #include <linux/socket.h>
  33 #include <linux/sockios.h>
  34 #include <linux/net.h>
  35 #include <linux/sched.h>
  36 #include <linux/in.h>
  37 #include <linux/in6.h>
  38 #include <linux/netdevice.h>
  39 #include <linux/init.h>
  40 #include <linux/ipsec.h>
  41
  42 #include <linux/ipv6.h>
  43 #include <linux/icmpv6.h>
  44 #include <linux/random.h>
  45
  46 #include <net/tcp.h>
  47 #include <net/ndisc.h>
  48 #include <net/ipv6.h>
  49 #include <net/transp_v6.h>
  50 #include <net/addrconf.h>
  51 #include <net/ip6_route.h>
  52 #include <net/inet_ecn.h>
  53
  54 #include <asm/uaccess.h>
  55
  56 static void     tcp_v6_send_reset(struct sk_buff *skb);
  57 static void     tcp_v6_or_send_ack(struct sk_buff *skb, struct open_request *req);
  58 static void     tcp_v6_send_check(struct sock *sk, struct tcphdr *th, int len,
  59                                   struct sk_buff *skb);
  60
  61 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
  62 static int      tcp_v6_xmit(struct sk_buff *skb);
  63
  64 static struct tcp_func ipv6_mapped;
  65 static struct tcp_func ipv6_specific;
  66
  67 /* I have no idea if this is a good hash for v6 or not. -DaveM */
  68 static __inline__ int tcp_v6_hashfn(struct in6_addr *laddr, u16 lport,
  69                                     struct in6_addr *faddr, u16 fport)
  70 {
  71         int hashent = (lport ^ fport);
  72
  73         hashent ^= (laddr->s6_addr32[3] ^ faddr->s6_addr32[3]);
  74         hashent ^= hashent>>16;
  75         hashent ^= hashent>>8;
  76         return (hashent & (tcp_ehash_size - 1));
  77 }
  78
  79 static __inline__ int tcp_v6_sk_hashfn(struct sock *sk)
  80 {
  81         struct in6_addr *laddr = &sk->net_pinfo.af_inet6.rcv_saddr;
  82         struct in6_addr *faddr = &sk->net_pinfo.af_inet6.daddr;
  83         __u16 lport = sk->num;
  84         __u16 fport = sk->dport;
  85         return tcp_v6_hashfn(laddr, lport, faddr, fport);
  86 }
  87
  88 /* Grrr, addr_type already calculated by caller, but I don't want
  89  * to add some silly "cookie" argument to this method just for that.
  90  * But it doesn't matter, the recalculation is in the rarest path
  91  * this function ever takes.
  92  */
  93 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
  94 {
  95         struct tcp_bind_hashbucket *head;
  96         struct tcp_bind_bucket *tb;
  97         int ret;
  98
  99         local_bh_disable();
 100         if (snum == 0) {
 101                 int low = sysctl_local_port_range[0];
 102                 int high = sysctl_local_port_range[1];
 103                 int remaining = (high - low) + 1;
 104                 int rover;
 105
 106                 spin_lock(&tcp_portalloc_lock);
 107                 rover = tcp_port_rover;
 108                 do {    rover++;
 109                         if ((rover < low) || (rover > high))
 110                                 rover = low;
 111                         head = &tcp_bhash[tcp_bhashfn(rover)];
 112                         spin_lock(&head->lock);
 113                         for (tb = head->chain; tb; tb = tb->next)
 114                                 if (tb->port == rover)
 115                                         goto next;
 116                         break;
 117                 next:
 118                         spin_unlock(&head->lock);
 119                 } while (--remaining > 0);
 120                 tcp_port_rover = rover;
 121                 spin_unlock(&tcp_portalloc_lock);
 122
 123                 /* Exhausted local port range during search? */
 124                 ret = 1;
 125                 if (remaining <= 0)
 126                         goto fail;
 127
 128                 /* OK, here is the one we will use. */
 129                 snum = rover;
 130                 tb = NULL;
 131         } else {
 132                 head = &tcp_bhash[tcp_bhashfn(snum)];
 133                 spin_lock(&head->lock);
 134                 for (tb = head->chain; tb != NULL; tb = tb->next)
 135                         if (tb->port == snum)
 136                                 break;
 137         }
 138         if (tb != NULL && tb->owners != NULL) {
 139                 if (tb->fastreuse > 0 && sk->reuse != 0 && sk->state != TCP_LISTEN) {
 140                         goto success;
 141                 } else {
 142                         struct sock *sk2 = tb->owners;
 143                         int sk_reuse = sk->reuse;
 144                         int addr_type = ipv6_addr_type(&sk->net_pinfo.af_inet6.rcv_saddr);
 145
 146                         /* We must walk the whole port owner list in this case. -DaveM */
 147                         for( ; sk2 != NULL; sk2 = sk2->bind_next) {
 148                                 if (sk != sk2 &&
 149                                     sk->bound_dev_if == sk2->bound_dev_if) {
 150                                         if (!sk_reuse   ||
 151                                             !sk2->reuse ||
 152                                             sk2->state == TCP_LISTEN) {
 153                                                 /* NOTE: IPv6 tw bucket have different format */
 154                                                 if ((!sk2->rcv_saddr && !ipv6_only_sock(sk)) ||
 155                                                     (sk2->family == AF_INET6 &&
 156                                                      ipv6_addr_any(&sk2->net_pinfo.af_inet6.rcv_saddr) &&
 157                                                      !(ipv6_only_sock(sk2) && addr_type == IPV6_ADDR_MAPPED)) ||
 158                                                     (addr_type == IPV6_ADDR_ANY &&
 159                                                      (!ipv6_only_sock(sk) ||
 160                                                       !(sk2->family == AF_INET6 ? ipv6_addr_type(&sk2->net_pinfo.af_inet6.rcv_saddr) == IPV6_ADDR_MAPPED : 1))) ||
 161                                                     (sk2->family == AF_INET6 &&
 162                                                      !ipv6_addr_cmp(&sk->net_pinfo.af_inet6.rcv_saddr,
 163                                                                     sk2->state != TCP_TIME_WAIT ?
 164                                                                     &sk2->net_pinfo.af_inet6.rcv_saddr :
 165                                                                     &((struct tcp_tw_bucket*)sk)->v6_rcv_saddr)) ||
 166                                                     (addr_type == IPV6_ADDR_MAPPED &&
 167                                                      !ipv6_only_sock(sk2) &&
 168                                                      (!sk2->rcv_saddr ||
 169                                                       !sk->rcv_saddr ||
 170                                                       sk->rcv_saddr == sk2->rcv_saddr)))
 171                                                         break;
 172                                         }
 173                                 }
 174                         }
 175                         /* If we found a conflict, fail. */
 176                         ret = 1;
 177                         if (sk2 != NULL)
 178                                 goto fail_unlock;
 179                 }
 180         }
 181         ret = 1;
 182         if (tb == NULL &&
 183             (tb = tcp_bucket_create(head, snum)) == NULL)
 184                         goto fail_unlock;
 185         if (tb->owners == NULL) {
 186                 if (sk->reuse && sk->state != TCP_LISTEN)
 187                         tb->fastreuse = 1;
 188                 else
 189                         tb->fastreuse = 0;
 190         } else if (tb->fastreuse &&
 191                    ((sk->reuse == 0) || (sk->state == TCP_LISTEN)))
 192                 tb->fastreuse = 0;
 193
 194 success:
 195         sk->num = snum;
 196         if (sk->prev == NULL) {
 197                 if ((sk->bind_next = tb->owners) != NULL)
 198                         tb->owners->bind_pprev = &sk->bind_next;
 199                 tb->owners = sk;
 200                 sk->bind_pprev = &tb->owners;
 201                 sk->prev = (struct sock *) tb;
 202         } else {
 203                 BUG_TRAP(sk->prev == (struct sock *) tb);
 204         }
 205         ret = 0;
 206
 207 fail_unlock:
 208         spin_unlock(&head->lock);
 209 fail:
 210         local_bh_enable();
 211         return ret;
 212 }
 213
 214 static __inline__ void __tcp_v6_hash(struct sock *sk)
 215 {
 216         struct sock **skp;
 217         rwlock_t *lock;
 218
 219         BUG_TRAP(sk->pprev==NULL);
 220
 221         if(sk->state == TCP_LISTEN) {
 222                 skp = &tcp_listening_hash[tcp_sk_listen_hashfn(sk)];
 223                 lock = &tcp_lhash_lock;
 224                 tcp_listen_wlock();
 225         } else {
 226                 skp = &tcp_ehash[(sk->hashent = tcp_v6_sk_hashfn(sk))].chain;
 227                 lock = &tcp_ehash[sk->hashent].lock;
 228                 write_lock(lock);
 229         }
 230
 231         if((sk->next = *skp) != NULL)
 232                 (*skp)->pprev = &sk->next;
 233         *skp = sk;
 234         sk->pprev = skp;
 235         sock_prot_inc_use(sk->prot);
 236         write_unlock(lock);
 237 }
 238
 239
 240 static void tcp_v6_hash(struct sock *sk)
 241 {
 242         if(sk->state != TCP_CLOSE) {
 243                 if (sk->tp_pinfo.af_tcp.af_specific == &ipv6_mapped) {
 244                         tcp_prot.hash(sk);
 245                         return;
 246                 }
 247                 local_bh_disable();
 248                 __tcp_v6_hash(sk);
 249                 local_bh_enable();
 250         }
 251 }
 252
 253 static struct sock *tcp_v6_lookup_listener(struct in6_addr *daddr, unsigned short hnum, int dif)
 254 {
 255         struct sock *sk;
 256         struct sock *result = NULL;
 257         int score, hiscore;
 258
 259         hiscore=0;
 260         read_lock(&tcp_lhash_lock);
 261         sk = tcp_listening_hash[tcp_lhashfn(hnum)];
 262         for(; sk; sk = sk->next) {
 263                 if((sk->num == hnum) && (sk->family == PF_INET6)) {
 264                         struct ipv6_pinfo *np = &sk->net_pinfo.af_inet6;
 265
 266                         score = 1;
 267                         if(!ipv6_addr_any(&np->rcv_saddr)) {
 268                                 if(ipv6_addr_cmp(&np->rcv_saddr, daddr))
 269                                         continue;
 270                                 score++;
 271                         }
 272                         if (sk->bound_dev_if) {
 273                                 if (sk->bound_dev_if != dif)
 274                                         continue;
 275                                 score++;
 276                         }
 277                         if (score == 3) {
 278                                 result = sk;
 279                                 break;
 280                         }
 281                         if (score > hiscore) {
 282                                 hiscore = score;
 283                                 result = sk;
 284                         }
 285                 }
 286         }
 287         if (result)
 288                 sock_hold(result);
 289         read_unlock(&tcp_lhash_lock);
 290         return result;
 291 }
 292
 293 /* Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
 294  * we need not check it for TCP lookups anymore, thanks Alexey. -DaveM
 295  *
 296  * The sockhash lock must be held as a reader here.
 297  */
 298
 299 static inline struct sock *__tcp_v6_lookup_established(struct in6_addr *saddr, u16 sport,
 300                                                        struct in6_addr *daddr, u16 hnum,
 301                                                        int dif)
 302 {
 303         struct tcp_ehash_bucket *head;
 304         struct sock *sk;
 305         __u32 ports = TCP_COMBINED_PORTS(sport, hnum);
 306         int hash;
 307
 308         /* Optimize here for direct hit, only listening connections can
 309          * have wildcards anyways.
 310          */
 311         hash = tcp_v6_hashfn(daddr, hnum, saddr, sport);
 312         head = &tcp_ehash[hash];
 313         read_lock(&head->lock);
 314         for(sk = head->chain; sk; sk = sk->next) {
 315                 /* For IPV6 do the cheaper port and family tests first. */
 316                 if(TCP_IPV6_MATCH(sk, saddr, daddr, ports, dif))
 317                         goto hit; /* You sunk my battleship! */
 318         }
 319         /* Must check for a TIME_WAIT'er before going to listener hash. */
 320         for(sk = (head + tcp_ehash_size)->chain; sk; sk = sk->next) {
 321                 if(*((__u32 *)&(sk->dport))     == ports        &&
 322                    sk->family                   == PF_INET6) {
 323                         struct tcp_tw_bucket *tw = (struct tcp_tw_bucket *)sk;
 324                         if(!ipv6_addr_cmp(&tw->v6_daddr, saddr) &&
 325                            !ipv6_addr_cmp(&tw->v6_rcv_saddr, daddr) &&
 326                            (!sk->bound_dev_if || sk->bound_dev_if == dif))
 327                                 goto hit;
 328                 }
 329         }
 330         read_unlock(&head->lock);
 331         return NULL;
 332
 333 hit:
 334         sock_hold(sk);
 335         read_unlock(&head->lock);
 336         return sk;
 337 }
 338
 339
 340 static inline struct sock *__tcp_v6_lookup(struct in6_addr *saddr, u16 sport,
 341                                            struct in6_addr *daddr, u16 hnum,
 342                                            int dif)
 343 {
 344         struct sock *sk;
 345
 346         sk = __tcp_v6_lookup_established(saddr, sport, daddr, hnum, dif);
 347
 348         if (sk)
 349                 return sk;
 350
 351         return tcp_v6_lookup_listener(daddr, hnum, dif);
 352 }
 353
 354 __inline__ struct sock *tcp_v6_lookup(struct in6_addr *saddr, u16 sport,
 355                                       struct in6_addr *daddr, u16 dport,
 356                                       int dif)
 357 {
 358         struct sock *sk;
 359
 360         local_bh_disable();
 361         sk = __tcp_v6_lookup(saddr, sport, daddr, ntohs(dport), dif);
 362         local_bh_enable();
 363
 364         return sk;
 365 }
 366
 367
 368 /*
 369  * Open request hash tables.
 370  */
 371
 372 static __inline__ unsigned tcp_v6_synq_hash(struct in6_addr *raddr, u16 rport)
 373 {
 374         unsigned h = raddr->s6_addr32[3] ^ rport;
 375         h ^= h>>16;
 376         h ^= h>>8;
 377         return h&(TCP_SYNQ_HSIZE-1);
 378 }
 379
 380 static struct open_request *tcp_v6_search_req(struct tcp_opt *tp,
 381                                               struct open_request ***prevp,
 382                                               __u16 rport,
 383                                               struct in6_addr *raddr,
 384                                               struct in6_addr *laddr,
 385                                               int iif)
 386 {
 387         struct tcp_listen_opt *lopt = tp->listen_opt;
 388         struct open_request *req, **prev;
 389
 390         for (prev = &lopt->syn_table[tcp_v6_synq_hash(raddr, rport)];
 391              (req = *prev) != NULL;
 392              prev = &req->dl_next) {
 393                 if (req->rmt_port == rport &&
 394                     req->class->family == AF_INET6 &&
 395                     !ipv6_addr_cmp(&req->af.v6_req.rmt_addr, raddr) &&
 396                     !ipv6_addr_cmp(&req->af.v6_req.loc_addr, laddr) &&
 397                     (!req->af.v6_req.iif || req->af.v6_req.iif == iif)) {
 398                         BUG_TRAP(req->sk == NULL);
 399                         *prevp = prev;
 400                         return req;
 401                 }
 402         }
 403
 404         return NULL;
 405 }
 406
 407 static __inline__ u16 tcp_v6_check(struct tcphdr *th, int len,
 408                                    struct in6_addr *saddr,
 409                                    struct in6_addr *daddr,
 410                                    unsigned long base)
 411 {
 412         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 413 }
 414
 415 static __u32 tcp_v6_init_sequence(struct sock *sk, struct sk_buff *skb)
 416 {
 417         if (skb->protocol == htons(ETH_P_IPV6)) {
 418                 return secure_tcpv6_sequence_number(skb->nh.ipv6h->daddr.s6_addr32,
 419                                                     skb->nh.ipv6h->saddr.s6_addr32,
 420                                                     skb->h.th->dest,
 421                                                     skb->h.th->source);
 422         } else {
 423                 return secure_tcp_sequence_number(skb->nh.iph->daddr,
 424                                                   skb->nh.iph->saddr,
 425                                                   skb->h.th->dest,
 426                                                   skb->h.th->source);
 427         }
 428 }
 429
 430 static int tcp_v6_check_established(struct sock *sk)
 431 {
 432         struct in6_addr *daddr = &sk->net_pinfo.af_inet6.rcv_saddr;
 433         struct in6_addr *saddr = &sk->net_pinfo.af_inet6.daddr;
 434         int dif = sk->bound_dev_if;
 435         u32 ports = TCP_COMBINED_PORTS(sk->dport, sk->num);
 436         int hash = tcp_v6_hashfn(daddr, sk->num, saddr, sk->dport);
 437         struct tcp_ehash_bucket *head = &tcp_ehash[hash];
 438         struct sock *sk2, **skp;
 439         struct tcp_tw_bucket *tw;
 440
 441         write_lock_bh(&head->lock);
 442
 443         for(skp = &(head + tcp_ehash_size)->chain; (sk2=*skp)!=NULL; skp = &sk2->next) {
 444                 tw = (struct tcp_tw_bucket*)sk2;
 445
 446                 if(*((__u32 *)&(sk2->dport))    == ports        &&
 447                    sk2->family                  == PF_INET6     &&
 448                    !ipv6_addr_cmp(&tw->v6_daddr, saddr)         &&
 449                    !ipv6_addr_cmp(&tw->v6_rcv_saddr, daddr)     &&
 450                    sk2->bound_dev_if == sk->bound_dev_if) {
 451                         struct tcp_opt *tp = &(sk->tp_pinfo.af_tcp);
 452
 453                         if (tw->ts_recent_stamp) {
 454                                 /* See comment in tcp_ipv4.c */
 455                                 if ((tp->write_seq = tw->snd_nxt+65535+2) == 0)
 456                                         tp->write_seq = 1;
 457                                 tp->ts_recent = tw->ts_recent;
 458                                 tp->ts_recent_stamp = tw->ts_recent_stamp;
 459                                 sock_hold(sk2);
 460                                 skp = &head->chain;
 461                                 goto unique;
 462                         } else
 463                                 goto not_unique;
 464                 }
 465         }
 466         tw = NULL;
 467
 468         for(skp = &head->chain; (sk2=*skp)!=NULL; skp = &sk2->next) {
 469                 if(TCP_IPV6_MATCH(sk, saddr, daddr, ports, dif))
 470                         goto not_unique;
 471         }
 472
 473 unique:
 474         BUG_TRAP(sk->pprev==NULL);
 475         if ((sk->next = *skp) != NULL)
 476                 (*skp)->pprev = &sk->next;
 477
 478         *skp = sk;
 479         sk->pprev = skp;
 480         sk->hashent = hash;
 481         sock_prot_inc_use(sk->prot);
 482         write_unlock_bh(&head->lock);
 483
 484         if (tw) {
 485                 /* Silly. Should hash-dance instead... */
 486                 local_bh_disable();
 487                 tcp_tw_deschedule(tw);
 488                 tcp_timewait_kill(tw);
 489                 NET_INC_STATS_BH(TimeWaitRecycled);
 490                 local_bh_enable();
 491
 492                 tcp_tw_put(tw);
 493         }
 494         return 0;
 495
 496 not_unique:
 497         write_unlock_bh(&head->lock);
 498         return -EADDRNOTAVAIL;
 499 }
 500
 501 static int tcp_v6_hash_connect(struct sock *sk)
 502 {
 503         struct tcp_bind_hashbucket *head;
 504         struct tcp_bind_bucket *tb;
 505
 506         /* XXX */
 507         if (sk->num == 0) {
 508                 int err = tcp_v6_get_port(sk, sk->num);
 509                 if (err)
 510                         return err;
 511                 sk->sport = htons(sk->num);
 512         }
 513
 514         head = &tcp_bhash[tcp_bhashfn(sk->num)];
 515         tb = head->chain;
 516
 517         spin_lock_bh(&head->lock);
 518
 519         if (tb->owners == sk && sk->bind_next == NULL) {
 520                 __tcp_v6_hash(sk);
 521                 spin_unlock_bh(&head->lock);
 522                 return 0;
 523         } else {
 524                 spin_unlock_bh(&head->lock);
 525                 return tcp_v6_check_established(sk);
 526         }
 527 }
 528
 529 static __inline__ int tcp_v6_iif(struct sk_buff *skb)
 530 {
 531         struct inet6_skb_parm *opt = (struct inet6_skb_parm *) skb->cb;
 532         return opt->iif;
 533 }
 534
 535 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 536                           int addr_len)
 537 {
 538         struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr;
 539         struct ipv6_pinfo *np = &sk->net_pinfo.af_inet6;
 540         struct tcp_opt *tp = &sk->tp_pinfo.af_tcp;
 541         struct in6_addr *saddr = NULL;
 542         struct in6_addr saddr_buf;
 543         struct flowi fl;
 544         struct dst_entry *dst;
 545         int addr_type;
 546         int err;
 547
 548         if (addr_len < SIN6_LEN_RFC2133)
 549                 return -EINVAL;
 550
 551         if (usin->sin6_family != AF_INET6)
 552                 return(-EAFNOSUPPORT);
 553
 554         fl.fl6_flowlabel = 0;
 555         if (np->sndflow) {
 556                 fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
 557                 IP6_ECN_flow_init(fl.fl6_flowlabel);
 558                 if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
 559                         struct ip6_flowlabel *flowlabel;
 560                         flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
 561                         if (flowlabel == NULL)
 562                                 return -EINVAL;
 563                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
 564                         fl6_sock_release(flowlabel);
 565                 }
 566         }
 567
 568         /*
 569          *      connect() to INADDR_ANY means loopback (BSD'ism).
 570          */
 571
 572         if(ipv6_addr_any(&usin->sin6_addr))
 573                 usin->sin6_addr.s6_addr[15] = 0x1;
 574
 575         addr_type = ipv6_addr_type(&usin->sin6_addr);
 576
 577         if(addr_type & IPV6_ADDR_MULTICAST)
 578                 return -ENETUNREACH;
 579
 580         if (addr_type&IPV6_ADDR_LINKLOCAL) {
 581                 if (addr_len >= sizeof(struct sockaddr_in6) &&
 582                     usin->sin6_scope_id) {
 583                         /* If interface is set while binding, indices
 584                          * must coincide.
 585                          */
 586                         if (sk->bound_dev_if &&
 587                             sk->bound_dev_if != usin->sin6_scope_id)
 588                                 return -EINVAL;
 589
 590                         sk->bound_dev_if = usin->sin6_scope_id;
 591                 }
 592
 593                 /* Connect to link-local address requires an interface */
 594                 if (sk->bound_dev_if == 0)
 595                         return -EINVAL;
 596         }
 597
 598         if (tp->ts_recent_stamp && ipv6_addr_cmp(&np->daddr, &usin->sin6_addr)) {
 599                 tp->ts_recent = 0;
 600                 tp->ts_recent_stamp = 0;
 601                 tp->write_seq = 0;
 602         }
 603
 604         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
 605         np->flow_label = fl.fl6_flowlabel;
 606
 607         /*
 608          *      TCP over IPv4
 609          */
 610
 611         if (addr_type == IPV6_ADDR_MAPPED) {
 612                 u32 exthdrlen = tp->ext_header_len;
 613                 struct sockaddr_in sin;
 614
 615                 SOCK_DEBUG(sk, "connect: ipv4 mapped\n");
 616
 617                 if (__ipv6_only_sock(sk))
 618                         return -ENETUNREACH;
 619
 620                 sin.sin_family = AF_INET;
 621                 sin.sin_port = usin->sin6_port;
 622                 sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3];
 623
 624                 sk->tp_pinfo.af_tcp.af_specific = &ipv6_mapped;
 625                 sk->backlog_rcv = tcp_v4_do_rcv;
 626
 627                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 628
 629                 if (err) {
 630                         tp->ext_header_len = exthdrlen;
 631                         sk->tp_pinfo.af_tcp.af_specific = &ipv6_specific;
 632                         sk->backlog_rcv = tcp_v6_do_rcv;
 633                         goto failure;
 634                 } else {
 635                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
 636                                       sk->saddr);
 637                         ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
 638                                       sk->rcv_saddr);
 639                 }
 640
 641                 return err;
 642         }
 643
 644         if (!ipv6_addr_any(&np->rcv_saddr))
 645                 saddr = &np->rcv_saddr;
 646
 647         fl.proto = IPPROTO_TCP;
 648         fl.fl6_dst = &np->daddr;
 649         fl.fl6_src = saddr;
 650         fl.oif = sk->bound_dev_if;
 651         fl.uli_u.ports.dport = usin->sin6_port;
 652         fl.uli_u.ports.sport = sk->sport;
 653
 654         if (np->opt && np->opt->srcrt) {
 655                 struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
 656                 fl.nl_u.ip6_u.daddr = rt0->addr;
 657         }
 658
 659         dst = ip6_route_output(sk, &fl);
 660
 661         if ((err = dst->error) != 0) {
 662                 dst_release(dst);
 663                 goto failure;
 664         }
 665
 666         ip6_dst_store(sk, dst, NULL);
 667         sk->route_caps = dst->dev->features&~NETIF_F_IP_CSUM;
 668
 669         if (saddr == NULL) {
 670                 err = ipv6_get_saddr(dst, &np->daddr, &saddr_buf);
 671                 if (err)
 672                         goto failure;
 673
 674                 saddr = &saddr_buf;
 675         }
 676
 677         /* set the source address */
 678         ipv6_addr_copy(&np->rcv_saddr, saddr);
 679         ipv6_addr_copy(&np->saddr, saddr);
 680         sk->rcv_saddr= LOOPBACK4_IPV6;
 681
 682         tp->ext_header_len = 0;
 683         if (np->opt)
 684                 tp->ext_header_len = np->opt->opt_flen+np->opt->opt_nflen;
 685         tp->mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 686
 687         sk->dport = usin->sin6_port;
 688
 689         tcp_set_state(sk, TCP_SYN_SENT);
 690         err = tcp_v6_hash_connect(sk);
 691         if (err)
 692                 goto late_failure;
 693
 694         if (!tp->write_seq)
 695                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
 696                                                              np->daddr.s6_addr32,
 697                                                              sk->sport, sk->dport);
 698         err = tcp_connect(sk);
 699         if (err)
 700                 goto late_failure;
 701
 702         return 0;
 703
 704 late_failure:
 705         tcp_set_state(sk, TCP_CLOSE);
 706 failure:
 707         __sk_dst_reset(sk);
 708         sk->dport = 0;
 709         sk->route_caps = 0;
 710         return err;
 711 }
 712
 713 void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 714                 int type, int code, int offset, __u32 info)
 715 {
 716         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
 717         struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
 718         struct ipv6_pinfo *np;
 719         struct sock *sk;
 720         int err;
 721         struct tcp_opt *tp;
 722         __u32 seq;
 723
 724         sk = tcp_v6_lookup(&hdr->daddr, th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 725
 726         if (sk == NULL) {
 727                 ICMP6_INC_STATS_BH(Icmp6InErrors);
 728                 return;
 729         }
 730
 731         if (sk->state == TCP_TIME_WAIT) {
 732                 tcp_tw_put((struct tcp_tw_bucket*)sk);
 733                 return;
 734         }
 735
 736         bh_lock_sock(sk);
 737         if (sk->lock.users)
 738                 NET_INC_STATS_BH(LockDroppedIcmps);
 739
 740         if (sk->state == TCP_CLOSE)
 741                 goto out;
 742
 743         tp = &sk->tp_pinfo.af_tcp;
 744         seq = ntohl(th->seq);
 745         if (sk->state != TCP_LISTEN && !between(seq, tp->snd_una, tp->snd_nxt)) {
 746                 NET_INC_STATS_BH(OutOfWindowIcmps);
 747                 goto out;
 748         }
 749
 750         np = &sk->net_pinfo.af_inet6;
 751
 752         if (type == ICMPV6_PKT_TOOBIG) {
 753                 struct dst_entry *dst = NULL;
 754
 755                 if (sk->lock.users)
 756                         goto out;
 757                 if ((1<<sk->state)&(TCPF_LISTEN|TCPF_CLOSE))
 758                         goto out;
 759
 760                 /* icmp should have updated the destination cache entry */
 761                 dst = __sk_dst_check(sk, np->dst_cookie);
 762
 763                 if (dst == NULL) {
 764                         struct flowi fl;
 765
 766                         /* BUGGG_FUTURE: Again, it is not clear how
 767                            to handle rthdr case. Ignore this complexity
 768                            for now.
 769                          */
 770                         fl.proto = IPPROTO_TCP;
 771                         fl.nl_u.ip6_u.daddr = &np->daddr;
 772                         fl.nl_u.ip6_u.saddr = &np->saddr;
 773                         fl.oif = sk->bound_dev_if;
 774                         fl.uli_u.ports.dport = sk->dport;
 775                         fl.uli_u.ports.sport = sk->sport;
 776
 777                         dst = ip6_route_output(sk, &fl);
 778                 } else
 779                         dst_clone(dst);
 780
 781                 if (dst->error) {
 782                         sk->err_soft = -dst->error;
 783                 } else if (tp->pmtu_cookie > dst->pmtu) {
 784                         tcp_sync_mss(sk, dst->pmtu);
 785                         tcp_simple_retransmit(sk);
 786                 } /* else let the usual retransmit timer handle it */
 787                 dst_release(dst);
 788                 goto out;
 789         }
 790
 791         icmpv6_err_convert(type, code, &err);
 792
 793         /* Might be for an open_request */
 794         switch (sk->state) {
 795                 struct open_request *req, **prev;
 796         case TCP_LISTEN:
 797                 if (sk->lock.users)
 798                         goto out;
 799
 800                 req = tcp_v6_search_req(tp, &prev, th->dest, &hdr->daddr,
 801                                         &hdr->saddr, tcp_v6_iif(skb));
 802                 if (!req)
 803                         goto out;
 804
 805                 /* ICMPs are not backlogged, hence we cannot get
 806                  * an established socket here.
 807                  */
 808                 BUG_TRAP(req->sk == NULL);
 809
 810                 if (seq != req->snt_isn) {
 811                         NET_INC_STATS_BH(OutOfWindowIcmps);
 812                         goto out;
 813                 }
 814
 815                 tcp_synq_drop(sk, req, prev);
 816                 goto out;
 817
 818         case TCP_SYN_SENT:
 819         case TCP_SYN_RECV:  /* Cannot happen.
 820                                It can, it SYNs are crossed. --ANK */
 821                 if (sk->lock.users == 0) {
 822                         TCP_INC_STATS_BH(TcpAttemptFails);
 823                         sk->err = err;
 824                         sk->error_report(sk);           /* Wake people up to see the error (see connect in sock.c) */
 825
 826                         tcp_done(sk);
 827                 } else {
 828                         sk->err_soft = err;
 829                 }
 830                 goto out;
 831         }
 832
 833         if (sk->lock.users == 0 && np->recverr) {
 834                 sk->err = err;
 835                 sk->error_report(sk);
 836         } else {
 837                 sk->err_soft = err;
 838         }
 839
 840 out:
 841         bh_unlock_sock(sk);
 842         sock_put(sk);
 843 }
 844
 845
 846 static int tcp_v6_send_synack(struct sock *sk, struct open_request *req,
 847                               struct dst_entry *dst)
 848 {
 849         struct sk_buff * skb;
 850         struct ipv6_txoptions *opt = NULL;
 851         struct flowi fl;
 852         int err = -1;
 853
 854         fl.proto = IPPROTO_TCP;
 855         fl.nl_u.ip6_u.daddr = &req->af.v6_req.rmt_addr;
 856         fl.nl_u.ip6_u.saddr = &req->af.v6_req.loc_addr;
 857         fl.fl6_flowlabel = 0;
 858         fl.oif = req->af.v6_req.iif;
 859         fl.uli_u.ports.dport = req->rmt_port;
 860         fl.uli_u.ports.sport = sk->sport;
 861
 862         if (dst == NULL) {
 863                 opt = sk->net_pinfo.af_inet6.opt;
 864                 if (opt == NULL &&
 865                     sk->net_pinfo.af_inet6.rxopt.bits.srcrt == 2 &&
 866                     req->af.v6_req.pktopts) {
 867                         struct sk_buff *pktopts = req->af.v6_req.pktopts;
 868                         struct inet6_skb_parm *rxopt = (struct inet6_skb_parm *)pktopts->cb;
 869                         if (rxopt->srcrt)
 870                                 opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(pktopts->nh.raw + rxopt->srcrt));
 871                 }
 872
 873                 if (opt && opt->srcrt) {
 874                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
 875                         fl.nl_u.ip6_u.daddr = rt0->addr;
 876                 }
 877
 878                 dst = ip6_route_output(sk, &fl);
 879                 if (dst->error)
 880                         goto done;
 881         }
 882
 883         skb = tcp_make_synack(sk, dst, req);
 884         if (skb) {
 885                 struct tcphdr *th = skb->h.th;
 886
 887                 th->check = tcp_v6_check(th, skb->len,
 888                                          &req->af.v6_req.loc_addr, &req->af.v6_req.rmt_addr,
 889                                          csum_partial((char *)th, skb->len, skb->csum));
 890
 891                 fl.nl_u.ip6_u.daddr = &req->af.v6_req.rmt_addr;
 892                 err = ip6_xmit(sk, skb, &fl, opt);
 893                 if (err == NET_XMIT_CN)
 894                         err = 0;
 895         }
 896
 897 done:
 898         dst_release(dst);
 899         if (opt && opt != sk->net_pinfo.af_inet6.opt)
 900                 sock_kfree_s(sk, opt, opt->tot_len);
 901         return err;
 902 }
 903
 904 static void tcp_v6_or_free(struct open_request *req)
 905 {
 906         if (req->af.v6_req.pktopts)
 907                 kfree_skb(req->af.v6_req.pktopts);
 908 }
 909
 910 static struct or_calltable or_ipv6 = {
 911         AF_INET6,
 912         tcp_v6_send_synack,
 913         tcp_v6_or_send_ack,
 914         tcp_v6_or_free,
 915         tcp_v6_send_reset
 916 };
 917
 918 static int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
 919 {
 920         struct inet6_skb_parm *opt = (struct inet6_skb_parm *)skb->cb;
 921
 922         if (sk->net_pinfo.af_inet6.rxopt.all) {
 923                 if ((opt->hop && sk->net_pinfo.af_inet6.rxopt.bits.hopopts) ||
 924                     ((IPV6_FLOWINFO_MASK&*(u32*)skb->nh.raw) &&
 925                      sk->net_pinfo.af_inet6.rxopt.bits.rxflow) ||
 926                     (opt->srcrt && sk->net_pinfo.af_inet6.rxopt.bits.srcrt) ||
 927                     ((opt->dst1 || opt->dst0) && sk->net_pinfo.af_inet6.rxopt.bits.dstopts))
 928                         return 1;
 929         }
 930         return 0;
 931 }
 932
 933
 934 static void tcp_v6_send_check(struct sock *sk, struct tcphdr *th, int len,
 935                               struct sk_buff *skb)
 936 {
 937         struct ipv6_pinfo *np = &sk->net_pinfo.af_inet6;
 938
 939         if (skb->ip_summed == CHECKSUM_HW) {
 940                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
 941                 skb->csum = offsetof(struct tcphdr, check);
 942         } else {
 943                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
 944                                             csum_partial((char *)th, th->doff<<2,
 945                                                          skb->csum));
 946         }
 947 }
 948
 949
 950 static void tcp_v6_send_reset(struct sk_buff *skb)
 951 {
 952         struct tcphdr *th = skb->h.th, *t1;
 953         struct sk_buff *buff;
 954         struct flowi fl;
 955
 956         if (th->rst)
 957                 return;
 958
 959         if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr))
 960                 return;
 961
 962         /*
 963          * We need to grab some memory, and put together an RST,
 964          * and then put it into the queue to be sent.
 965          */
 966
 967         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr), GFP_ATOMIC);
 968         if (buff == NULL)
 969                 return;
 970
 971         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr));
 972
 973         t1 = (struct tcphdr *) skb_push(buff,sizeof(struct tcphdr));
 974
 975         /* Swap the send and the receive. */
 976         memset(t1, 0, sizeof(*t1));
 977         t1->dest = th->source;
 978         t1->source = th->dest;
 979         t1->doff = sizeof(*t1)/4;
 980         t1->rst = 1;
 981
 982         if(th->ack) {
 983                 t1->seq = th->ack_seq;
 984         } else {
 985                 t1->ack = 1;
 986                 t1->ack_seq = htonl(ntohl(th->seq) + th->syn + th->fin
 987                                     + skb->len - (th->doff<<2));
 988         }
 989
 990         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
 991
 992         fl.nl_u.ip6_u.daddr = &skb->nh.ipv6h->saddr;
 993         fl.nl_u.ip6_u.saddr = &skb->nh.ipv6h->daddr;
 994         fl.fl6_flowlabel = 0;
 995
 996         t1->check = csum_ipv6_magic(fl.nl_u.ip6_u.saddr,
 997                                     fl.nl_u.ip6_u.daddr,
 998                                     sizeof(*t1), IPPROTO_TCP,
 999                                     buff->csum);
1000
1001         fl.proto = IPPROTO_TCP;
1002         fl.oif = tcp_v6_iif(skb);
1003         fl.uli_u.ports.dport = t1->dest;
1004         fl.uli_u.ports.sport = t1->source;
1005
1006         /* sk = NULL, but it is safe for now. RST socket required. */
1007         buff->dst = ip6_route_output(NULL, &fl);
1008
1009         if (buff->dst->error == 0) {
1010                 ip6_xmit(NULL, buff, &fl, NULL);
1011                 TCP_INC_STATS_BH(TcpOutSegs);
1012                 TCP_INC_STATS_BH(TcpOutRsts);
1013                 return;
1014         }
1015
1016         kfree_skb(buff);
1017 }
1018
1019 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
1020 {
1021         struct tcphdr *th = skb->h.th, *t1;
1022         struct sk_buff *buff;
1023         struct flowi fl;
1024         int tot_len = sizeof(struct tcphdr);
1025
1026         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr), GFP_ATOMIC);
1027         if (buff == NULL)
1028                 return;
1029
1030         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr));
1031
1032         if (ts)
1033                 tot_len += 3*4;
1034
1035         t1 = (struct tcphdr *) skb_push(buff,tot_len);
1036
1037         /* Swap the send and the receive. */
1038         memset(t1, 0, sizeof(*t1));
1039         t1->dest = th->source;
1040         t1->source = th->dest;
1041         t1->doff = tot_len/4;
1042         t1->seq = htonl(seq);
1043         t1->ack_seq = htonl(ack);
1044         t1->ack = 1;
1045         t1->window = htons(win);
1046
1047         if (ts) {
1048                 u32 *ptr = (u32*)(t1 + 1);
1049                 *ptr++ = htonl((TCPOPT_NOP << 24) |
1050                                (TCPOPT_NOP << 16) |
1051                                (TCPOPT_TIMESTAMP << 8) |
1052                                TCPOLEN_TIMESTAMP);
1053                 *ptr++ = htonl(tcp_time_stamp);
1054                 *ptr = htonl(ts);
1055         }
1056
1057         buff->csum = csum_partial((char *)t1, tot_len, 0);
1058
1059         fl.nl_u.ip6_u.daddr = &skb->nh.ipv6h->saddr;
1060         fl.nl_u.ip6_u.saddr = &skb->nh.ipv6h->daddr;
1061         fl.fl6_flowlabel = 0;
1062
1063         t1->check = csum_ipv6_magic(fl.nl_u.ip6_u.saddr,
1064                                     fl.nl_u.ip6_u.daddr,
1065                                     tot_len, IPPROTO_TCP,
1066                                     buff->csum);
1067
1068         fl.proto = IPPROTO_TCP;
1069         fl.oif = tcp_v6_iif(skb);
1070         fl.uli_u.ports.dport = t1->dest;
1071         fl.uli_u.ports.sport = t1->source;
1072
1073         buff->dst = ip6_route_output(NULL, &fl);
1074
1075         if (buff->dst->error == 0) {
1076                 ip6_xmit(NULL, buff, &fl, NULL);
1077                 TCP_INC_STATS_BH(TcpOutSegs);
1078                 return;
1079         }
1080
1081         kfree_skb(buff);
1082 }
1083
1084 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
1085 {
1086         struct tcp_tw_bucket *tw = (struct tcp_tw_bucket *)sk;
1087
1088         tcp_v6_send_ack(skb, tw->snd_nxt, tw->rcv_nxt,
1089                         tw->rcv_wnd>>tw->rcv_wscale, tw->ts_recent);
1090
1091         tcp_tw_put(tw);
1092 }
1093
1094 static void tcp_v6_or_send_ack(struct sk_buff *skb, struct open_request *req)
1095 {
1096         tcp_v6_send_ack(skb, req->snt_isn+1, req->rcv_isn+1, req->rcv_wnd, req->ts_recent);
1097 }
1098
1099
1100 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
1101 {
1102         struct open_request *req, **prev;
1103         struct tcphdr *th = skb->h.th;
1104         struct tcp_opt *tp = &(sk->tp_pinfo.af_tcp);
1105         struct sock *nsk;
1106
1107         /* Find possible connection requests. */
1108         req = tcp_v6_search_req(tp, &prev, th->source, &skb->nh.ipv6h->saddr,
1109                                 &skb->nh.ipv6h->daddr, tcp_v6_iif(skb));
1110         if (req)
1111                 return tcp_check_req(sk, skb, req, prev);
1112
1113         nsk = __tcp_v6_lookup_established(&skb->nh.ipv6h->saddr,
1114                                           th->source,
1115                                           &skb->nh.ipv6h->daddr,
1116                                           ntohs(th->dest),
1117                                           tcp_v6_iif(skb));
1118
1119         if (nsk) {
1120                 if (nsk->state != TCP_TIME_WAIT) {
1121                         bh_lock_sock(nsk);
1122                         return nsk;
1123                 }
1124                 tcp_tw_put((struct tcp_tw_bucket*)nsk);
1125                 return NULL;
1126         }
1127
1128 #if 0 /*def CONFIG_SYN_COOKIES*/
1129         if (!th->rst && !th->syn && th->ack)
1130                 sk = cookie_v6_check(sk, skb, &(IPCB(skb)->opt));
1131 #endif
1132         return sk;
1133 }
1134
1135 static void tcp_v6_synq_add(struct sock *sk, struct open_request *req)
1136 {
1137         struct tcp_opt *tp = &sk->tp_pinfo.af_tcp;
1138         struct tcp_listen_opt *lopt = tp->listen_opt;
1139         unsigned h = tcp_v6_synq_hash(&req->af.v6_req.rmt_addr, req->rmt_port);
1140
1141         req->sk = NULL;
1142         req->expires = jiffies + TCP_TIMEOUT_INIT;
1143         req->retrans = 0;
1144         req->dl_next = lopt->syn_table[h];
1145
1146         write_lock(&tp->syn_wait_lock);
1147         lopt->syn_table[h] = req;
1148         write_unlock(&tp->syn_wait_lock);
1149
1150         tcp_synq_added(sk);
1151 }
1152
1153
1154 /* FIXME: this is substantially similar to the ipv4 code.
1155  * Can some kind of merge be done? -- erics
1156  */
1157 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1158 {
1159         struct tcp_opt tp;
1160         struct open_request *req = NULL;
1161         __u32 isn = TCP_SKB_CB(skb)->when;
1162
1163         if (skb->protocol == htons(ETH_P_IP))
1164                 return tcp_v4_conn_request(sk, skb);
1165
1166         /* FIXME: do the same check for anycast */
1167         if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr))
1168                 goto drop;
1169
1170         /*
1171          *      There are no SYN attacks on IPv6, yet...
1172          */
1173         if (tcp_synq_is_full(sk) && !isn) {
1174                 if (net_ratelimit())
1175                         printk(KERN_INFO "TCPv6: dropping request, synflood is possible\n");
1176                 goto drop;
1177         }
1178
1179         if (tcp_acceptq_is_full(sk) && tcp_synq_young(sk) > 1)
1180                 goto drop;
1181
1182         req = tcp_openreq_alloc();
1183         if (req == NULL)
1184                 goto drop;
1185
1186         tcp_clear_options(&tp);
1187         tp.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
1188         tp.user_mss = sk->tp_pinfo.af_tcp.user_mss;
1189
1190         tcp_parse_options(skb, &tp, 0);
1191
1192         tp.tstamp_ok = tp.saw_tstamp;
1193         tcp_openreq_init(req, &tp, skb);
1194
1195         req->class = &or_ipv6;
1196         ipv6_addr_copy(&req->af.v6_req.rmt_addr, &skb->nh.ipv6h->saddr);
1197         ipv6_addr_copy(&req->af.v6_req.loc_addr, &skb->nh.ipv6h->daddr);
1198         TCP_ECN_create_request(req, skb->h.th);
1199         req->af.v6_req.pktopts = NULL;
1200         if (ipv6_opt_accepted(sk, skb) ||
1201             sk->net_pinfo.af_inet6.rxopt.bits.rxinfo ||
1202             sk->net_pinfo.af_inet6.rxopt.bits.rxhlim) {
1203                 atomic_inc(&skb->users);
1204                 req->af.v6_req.pktopts = skb;
1205         }
1206         req->af.v6_req.iif = sk->bound_dev_if;
1207
1208         /* So that link locals have meaning */
1209         if (!sk->bound_dev_if && ipv6_addr_type(&req->af.v6_req.rmt_addr)&IPV6_ADDR_LINKLOCAL)
1210                 req->af.v6_req.iif = tcp_v6_iif(skb);
1211
1212         if (isn == 0)
1213                 isn = tcp_v6_init_sequence(sk,skb);
1214
1215         req->snt_isn = isn;
1216
1217         if (tcp_v6_send_synack(sk, req, NULL))
1218                 goto drop;
1219
1220         tcp_v6_synq_add(sk, req);
1221
1222         return 0;
1223
1224 drop:
1225         if (req)
1226                 tcp_openreq_free(req);
1227
1228         TCP_INC_STATS_BH(TcpAttemptFails);
1229         return 0; /* don't send reset */
1230 }
1231
1232 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1233                                           struct open_request *req,
1234                                           struct dst_entry *dst)
1235 {
1236         struct ipv6_pinfo *np;
1237         struct flowi fl;
1238         struct tcp_opt *newtp;
1239         struct sock *newsk;
1240         struct ipv6_txoptions *opt;
1241
1242         if (skb->protocol == htons(ETH_P_IP)) {
1243                 /*
1244                  *      v6 mapped
1245                  */
1246
1247                 newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst);
1248
1249                 if (newsk == NULL)
1250                         return NULL;
1251
1252                 np = &newsk->net_pinfo.af_inet6;
1253
1254                 ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000FFFF),
1255                               newsk->daddr);
1256
1257                 ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
1258                               newsk->saddr);
1259
1260                 ipv6_addr_copy(&np->rcv_saddr, &np->saddr);
1261
1262                 newsk->tp_pinfo.af_tcp.af_specific = &ipv6_mapped;
1263                 newsk->backlog_rcv = tcp_v4_do_rcv;
1264                 newsk->net_pinfo.af_inet6.pktoptions = NULL;
1265                 newsk->net_pinfo.af_inet6.opt = NULL;
1266                 newsk->net_pinfo.af_inet6.mcast_oif = tcp_v6_iif(skb);
1267                 newsk->net_pinfo.af_inet6.mcast_hops = skb->nh.ipv6h->hop_limit;
1268
1269                 /* Charge newly allocated IPv6 socket. Though it is mapped,
1270                  * it is IPv6 yet.
1271                  */
1272 #ifdef INET_REFCNT_DEBUG
1273                 atomic_inc(&inet6_sock_nr);
1274 #endif
1275                 MOD_INC_USE_COUNT;
1276
1277                 /* It is tricky place. Until this moment IPv4 tcp
1278                    worked with IPv6 af_tcp.af_specific.
1279                    Sync it now.
1280                  */
1281                 tcp_sync_mss(newsk, newsk->tp_pinfo.af_tcp.pmtu_cookie);
1282
1283                 return newsk;
1284         }
1285
1286         opt = sk->net_pinfo.af_inet6.opt;
1287
1288         if (tcp_acceptq_is_full(sk))
1289                 goto out_overflow;
1290
1291         if (sk->net_pinfo.af_inet6.rxopt.bits.srcrt == 2 &&
1292             opt == NULL && req->af.v6_req.pktopts) {
1293                 struct inet6_skb_parm *rxopt = (struct inet6_skb_parm *)req->af.v6_req.pktopts->cb;
1294                 if (rxopt->srcrt)
1295                         opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(req->af.v6_req.pktopts->nh.raw+rxopt->srcrt));
1296         }
1297
1298         if (dst == NULL) {
1299                 fl.proto = IPPROTO_TCP;
1300                 fl.nl_u.ip6_u.daddr = &req->af.v6_req.rmt_addr;
1301                 if (opt && opt->srcrt) {
1302                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
1303                         fl.nl_u.ip6_u.daddr = rt0->addr;
1304                 }
1305                 fl.nl_u.ip6_u.saddr = &req->af.v6_req.loc_addr;
1306                 fl.fl6_flowlabel = 0;
1307                 fl.oif = sk->bound_dev_if;
1308                 fl.uli_u.ports.dport = req->rmt_port;
1309                 fl.uli_u.ports.sport = sk->sport;
1310
1311                 dst = ip6_route_output(sk, &fl);
1312         }
1313
1314         if (dst->error)
1315                 goto out;
1316
1317         newsk = tcp_create_openreq_child(sk, req, skb);
1318         if (newsk == NULL)
1319                 goto out;
1320
1321         /* Charge newly allocated IPv6 socket */
1322 #ifdef INET_REFCNT_DEBUG
1323         atomic_inc(&inet6_sock_nr);
1324 #endif
1325         MOD_INC_USE_COUNT;
1326
1327         ip6_dst_store(newsk, dst, NULL);
1328         sk->route_caps = dst->dev->features&~NETIF_F_IP_CSUM;
1329
1330         newtp = &(newsk->tp_pinfo.af_tcp);
1331
1332         np = &newsk->net_pinfo.af_inet6;
1333         ipv6_addr_copy(&np->daddr, &req->af.v6_req.rmt_addr);
1334         ipv6_addr_copy(&np->saddr, &req->af.v6_req.loc_addr);
1335         ipv6_addr_copy(&np->rcv_saddr, &req->af.v6_req.loc_addr);
1336         newsk->bound_dev_if = req->af.v6_req.iif;
1337
1338         /* Now IPv6 options...
1339
1340            First: no IPv4 options.
1341          */
1342         newsk->protinfo.af_inet.opt = NULL;
1343
1344         /* Clone RX bits */
1345         np->rxopt.all = sk->net_pinfo.af_inet6.rxopt.all;
1346
1347         /* Clone pktoptions received with SYN */
1348         np->pktoptions = NULL;
1349         if (req->af.v6_req.pktopts) {
1350                 np->pktoptions = skb_clone(req->af.v6_req.pktopts, GFP_ATOMIC);
1351                 kfree_skb(req->af.v6_req.pktopts);
1352                 req->af.v6_req.pktopts = NULL;
1353                 if (np->pktoptions)
1354                         skb_set_owner_r(np->pktoptions, newsk);
1355         }
1356         np->opt = NULL;
1357         np->mcast_oif = tcp_v6_iif(skb);
1358         np->mcast_hops = skb->nh.ipv6h->hop_limit;
1359
1360         /* Clone native IPv6 options from listening socket (if any)
1361
1362            Yes, keeping reference count would be much more clever,
1363            but we make one more one thing there: reattach optmem
1364            to newsk.
1365          */
1366         if (opt) {
1367                 np->opt = ipv6_dup_options(newsk, opt);
1368                 if (opt != sk->net_pinfo.af_inet6.opt)
1369                         sock_kfree_s(sk, opt, opt->tot_len);
1370         }
1371
1372         newtp->ext_header_len = 0;
1373         if (np->opt)
1374                 newtp->ext_header_len = np->opt->opt_nflen + np->opt->opt_flen;
1375
1376         tcp_sync_mss(newsk, dst->pmtu);
1377         newtp->advmss = dst->advmss;
1378         tcp_initialize_rcv_mss(newsk);
1379
1380         newsk->daddr    = LOOPBACK4_IPV6;
1381         newsk->saddr    = LOOPBACK4_IPV6;
1382         newsk->rcv_saddr= LOOPBACK4_IPV6;
1383
1384         __tcp_v6_hash(newsk);
1385         tcp_inherit_port(sk, newsk);
1386
1387         return newsk;
1388
1389 out_overflow:
1390         NET_INC_STATS_BH(ListenOverflows);
1391 out:
1392         NET_INC_STATS_BH(ListenDrops);
1393         if (opt && opt != sk->net_pinfo.af_inet6.opt)
1394                 sock_kfree_s(sk, opt, opt->tot_len);
1395         dst_release(dst);
1396         return NULL;
1397 }
1398
1399 static int tcp_v6_checksum_init(struct sk_buff *skb)
1400 {
1401         if (skb->ip_summed == CHECKSUM_HW) {
1402                 skb->ip_summed = CHECKSUM_UNNECESSARY;
1403                 if (!tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1404                                   &skb->nh.ipv6h->daddr,skb->csum))
1405                         return 0;
1406                 NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "hw tcp v6 csum failed\n"));
1407         }
1408         if (skb->len <= 76) {
1409                 if (tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1410                                  &skb->nh.ipv6h->daddr,skb_checksum(skb, 0, skb->len, 0)))
1411                         return -1;
1412                 skb->ip_summed = CHECKSUM_UNNECESSARY;
1413         } else {
1414                 skb->csum = ~tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
1415                                           &skb->nh.ipv6h->daddr,0);
1416         }
1417         return 0;
1418 }
1419
1420 /* The socket must have it's spinlock held when we get
1421  * here.
1422  *
1423  * We have a potential double-lock case here, so even when
1424  * doing backlog processing we use the BH locking scheme.
1425  * This is because we cannot sleep with the original spinlock
1426  * held.
1427  */
1428 static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
1429 {
1430 #ifdef CONFIG_FILTER
1431         struct sk_filter *filter;
1432 #endif
1433         struct sk_buff *opt_skb = NULL;
1434
1435         /* Imagine: socket is IPv6. IPv4 packet arrives,
1436            goes to IPv4 receive handler and backlogged.
1437            From backlog it always goes here. Kerboom...
1438            Fortunately, tcp_rcv_established and rcv_established
1439            handle them correctly, but it is not case with
1440            tcp_v6_hnd_req and tcp_v6_send_reset().   --ANK
1441          */
1442
1443         if (skb->protocol == htons(ETH_P_IP))
1444                 return tcp_v4_do_rcv(sk, skb);
1445
1446 #ifdef CONFIG_FILTER
1447         filter = sk->filter;
1448         if (filter && sk_filter(skb, filter))
1449                 goto discard;
1450 #endif /* CONFIG_FILTER */
1451
1452         /*
1453          *      socket locking is here for SMP purposes as backlog rcv
1454          *      is currently called with bh processing disabled.
1455          */
1456
1457         IP6_INC_STATS_BH(Ip6InDelivers);
1458
1459         /* Do Stevens' IPV6_PKTOPTIONS.
1460
1461            Yes, guys, it is the only place in our code, where we
1462            may make it not affecting IPv4.
1463            The rest of code is protocol independent,
1464            and I do not like idea to uglify IPv4.
1465
1466            Actually, all the idea behind IPV6_PKTOPTIONS
1467            looks not very well thought. For now we latch
1468            options, received in the last packet, enqueued
1469            by tcp. Feel free to propose better solution.
1470                                                --ANK (980728)
1471          */
1472         if (sk->net_pinfo.af_inet6.rxopt.all)
1473                 opt_skb = skb_clone(skb, GFP_ATOMIC);
1474
1475         if (sk->state == TCP_ESTABLISHED) { /* Fast path */
1476                 TCP_CHECK_TIMER(sk);
1477                 if (tcp_rcv_established(sk, skb, skb->h.th, skb->len))
1478                         goto reset;
1479                 TCP_CHECK_TIMER(sk);
1480                 if (opt_skb)
1481                         goto ipv6_pktoptions;
1482                 return 0;
1483         }
1484
1485         if (skb->len < (skb->h.th->doff<<2) || tcp_checksum_complete(skb))
1486                 goto csum_err;
1487
1488         if (sk->state == TCP_LISTEN) {
1489                 struct sock *nsk = tcp_v6_hnd_req(sk, skb);
1490                 if (!nsk)
1491                         goto discard;
1492
1493                 /*
1494                  * Queue it on the new socket if the new socket is active,
1495                  * otherwise we just shortcircuit this and continue with
1496                  * the new socket..
1497                  */
1498                 if(nsk != sk) {
1499                         if (tcp_child_process(sk, nsk, skb))
1500                                 goto reset;
1501                         if (opt_skb)
1502                                 __kfree_skb(opt_skb);
1503                         return 0;
1504                 }
1505         }
1506
1507         TCP_CHECK_TIMER(sk);
1508         if (tcp_rcv_state_process(sk, skb, skb->h.th, skb->len))
1509                 goto reset;
1510         TCP_CHECK_TIMER(sk);
1511         if (opt_skb)
1512                 goto ipv6_pktoptions;
1513         return 0;
1514
1515 reset:
1516         tcp_v6_send_reset(skb);
1517 discard:
1518         if (opt_skb)
1519                 __kfree_skb(opt_skb);
1520         kfree_skb(skb);
1521         return 0;
1522 csum_err:
1523         TCP_INC_STATS_BH(TcpInErrs);
1524         goto discard;
1525
1526
1527 ipv6_pktoptions:
1528         /* Do you ask, what is it?
1529
1530            1. skb was enqueued by tcp.
1531            2. skb is added to tail of read queue, rather than out of order.
1532            3. socket is not in passive state.
1533            4. Finally, it really contains options, which user wants to receive.
1534          */
1535         if (TCP_SKB_CB(opt_skb)->end_seq == sk->tp_pinfo.af_tcp.rcv_nxt &&
1536             !((1<<sk->state)&(TCPF_CLOSE|TCPF_LISTEN))) {
1537                 if (sk->net_pinfo.af_inet6.rxopt.bits.rxinfo)
1538                         sk->net_pinfo.af_inet6.mcast_oif = tcp_v6_iif(opt_skb);
1539                 if (sk->net_pinfo.af_inet6.rxopt.bits.rxhlim)
1540                         sk->net_pinfo.af_inet6.mcast_hops = opt_skb->nh.ipv6h->hop_limit;
1541                 if (ipv6_opt_accepted(sk, opt_skb)) {
1542                         skb_set_owner_r(opt_skb, sk);
1543                         opt_skb = xchg(&sk->net_pinfo.af_inet6.pktoptions, opt_skb);
1544                 } else {
1545                         __kfree_skb(opt_skb);
1546                         opt_skb = xchg(&sk->net_pinfo.af_inet6.pktoptions, NULL);
1547                 }
1548         }
1549
1550         if (opt_skb)
1551                 kfree_skb(opt_skb);
1552         return 0;
1553 }
1554
1555 int tcp_v6_rcv(struct sk_buff *skb)
1556 {
1557         struct tcphdr *th;
1558         struct sock *sk;
1559         int ret;
1560
1561         if (skb->pkt_type != PACKET_HOST)
1562                 goto discard_it;
1563
1564         /*
1565          *      Count it even if it's bad.
1566          */
1567         TCP_INC_STATS_BH(TcpInSegs);
1568
1569         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
1570                 goto discard_it;
1571
1572         th = skb->h.th;
1573
1574         if (th->doff < sizeof(struct tcphdr)/4)
1575                 goto bad_packet;
1576         if (!pskb_may_pull(skb, th->doff*4))
1577                 goto discard_it;
1578
1579         if ((skb->ip_summed != CHECKSUM_UNNECESSARY &&
1580              tcp_v6_checksum_init(skb) < 0))
1581                 goto bad_packet;
1582
1583         th = skb->h.th;
1584         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
1585         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
1586                                     skb->len - th->doff*4);
1587         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
1588         TCP_SKB_CB(skb)->when = 0;
1589         TCP_SKB_CB(skb)->flags = ip6_get_dsfield(skb->nh.ipv6h);
1590         TCP_SKB_CB(skb)->sacked = 0;
1591
1592         sk = __tcp_v6_lookup(&skb->nh.ipv6h->saddr, th->source,
1593                              &skb->nh.ipv6h->daddr, ntohs(th->dest), tcp_v6_iif(skb));
1594
1595         if (!sk)
1596                 goto no_tcp_socket;
1597
1598 process:
1599         if(!ipsec_sk_policy(sk,skb))
1600                 goto discard_and_relse;
1601         if(sk->state == TCP_TIME_WAIT)
1602                 goto do_time_wait;
1603
1604         skb->dev = NULL;
1605
1606         bh_lock_sock(sk);
1607         ret = 0;
1608         if (!sk->lock.users) {
1609                 if (!tcp_prequeue(sk, skb))
1610                         ret = tcp_v6_do_rcv(sk, skb);
1611         } else
1612                 sk_add_backlog(sk, skb);
1613         bh_unlock_sock(sk);
1614
1615         sock_put(sk);
1616         return ret;
1617
1618 no_tcp_socket:
1619         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1620 bad_packet:
1621                 TCP_INC_STATS_BH(TcpInErrs);
1622         } else {
1623                 tcp_v6_send_reset(skb);
1624         }
1625
1626 discard_it:
1627
1628         /*
1629          *      Discard frame
1630          */
1631
1632         kfree_skb(skb);
1633         return 0;
1634
1635 discard_and_relse:
1636         sock_put(sk);
1637         goto discard_it;
1638
1639 do_time_wait:
1640         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
1641                 TCP_INC_STATS_BH(TcpInErrs);
1642                 sock_put(sk);
1643                 goto discard_it;
1644         }
1645
1646         switch(tcp_timewait_state_process((struct tcp_tw_bucket *)sk,
1647                                           skb, th, skb->len)) {
1648         case TCP_TW_SYN:
1649         {
1650                 struct sock *sk2;
1651
1652                 sk2 = tcp_v6_lookup_listener(&skb->nh.ipv6h->daddr, ntohs(th->dest), tcp_v6_iif(skb));
1653                 if (sk2 != NULL) {
1654                         tcp_tw_deschedule((struct tcp_tw_bucket *)sk);
1655                         tcp_timewait_kill((struct tcp_tw_bucket *)sk);
1656                         tcp_tw_put((struct tcp_tw_bucket *)sk);
1657                         sk = sk2;
1658                         goto process;
1659                 }
1660                 /* Fall through to ACK */
1661         }
1662         case TCP_TW_ACK:
1663                 tcp_v6_timewait_ack(sk, skb);
1664                 break;
1665         case TCP_TW_RST:
1666                 goto no_tcp_socket;
1667         case TCP_TW_SUCCESS:;
1668         }
1669         goto discard_it;
1670 }
1671
1672 static int tcp_v6_rebuild_header(struct sock *sk)
1673 {
1674         int err;
1675         struct dst_entry *dst;
1676         struct ipv6_pinfo *np = &sk->net_pinfo.af_inet6;
1677
1678         dst = __sk_dst_check(sk, np->dst_cookie);
1679
1680         if (dst == NULL) {
1681                 struct flowi fl;
1682
1683                 fl.proto = IPPROTO_TCP;
1684                 fl.nl_u.ip6_u.daddr = &np->daddr;
1685                 fl.nl_u.ip6_u.saddr = &np->saddr;
1686                 fl.fl6_flowlabel = np->flow_label;
1687                 fl.oif = sk->bound_dev_if;
1688                 fl.uli_u.ports.dport = sk->dport;
1689                 fl.uli_u.ports.sport = sk->sport;
1690
1691                 if (np->opt && np->opt->srcrt) {
1692                         struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
1693                         fl.nl_u.ip6_u.daddr = rt0->addr;
1694                 }
1695
1696                 dst = ip6_route_output(sk, &fl);
1697
1698                 if (dst->error) {
1699                         err = dst->error;
1700                         dst_release(dst);
1701                         sk->route_caps = 0;
1702                         return err;
1703                 }
1704
1705                 ip6_dst_store(sk, dst, NULL);
1706                 sk->route_caps = dst->dev->features&~NETIF_F_IP_CSUM;
1707         }
1708
1709         return 0;
1710 }
1711
1712 static int tcp_v6_xmit(struct sk_buff *skb)
1713 {
1714         struct sock *sk = skb->sk;
1715         struct ipv6_pinfo * np = &sk->net_pinfo.af_inet6;
1716         struct flowi fl;
1717         struct dst_entry *dst;
1718
1719         fl.proto = IPPROTO_TCP;
1720         fl.fl6_dst = &np->daddr;
1721         fl.fl6_src = &np->saddr;
1722         fl.fl6_flowlabel = np->flow_label;
1723         IP6_ECN_flow_xmit(sk, fl.fl6_flowlabel);
1724         fl.oif = sk->bound_dev_if;
1725         fl.uli_u.ports.sport = sk->sport;
1726         fl.uli_u.ports.dport = sk->dport;
1727
1728         if (np->opt && np->opt->srcrt) {
1729                 struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
1730                 fl.nl_u.ip6_u.daddr = rt0->addr;
1731         }
1732
1733         dst = __sk_dst_check(sk, np->dst_cookie);
1734
1735         if (dst == NULL) {
1736                 dst = ip6_route_output(sk, &fl);
1737
1738                 if (dst->error) {
1739                         sk->err_soft = -dst->error;
1740                         dst_release(dst);
1741                         return -sk->err_soft;
1742                 }
1743
1744                 ip6_dst_store(sk, dst, NULL);
1745         }
1746
1747         skb->dst = dst_clone(dst);
1748
1749         /* Restore final destination back after routing done */
1750         fl.nl_u.ip6_u.daddr = &np->daddr;
1751
1752         return ip6_xmit(sk, skb, &fl, np->opt);
1753 }
1754
1755 static void v6_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
1756 {
1757         struct ipv6_pinfo * np = &sk->net_pinfo.af_inet6;
1758         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) uaddr;
1759
1760         sin6->sin6_family = AF_INET6;
1761         memcpy(&sin6->sin6_addr, &np->daddr, sizeof(struct in6_addr));
1762         sin6->sin6_port = sk->dport;
1763         /* We do not store received flowlabel for TCP */
1764         sin6->sin6_flowinfo = 0;
1765         sin6->sin6_scope_id = 0;
1766         if (sk->bound_dev_if && ipv6_addr_type(&sin6->sin6_addr)&IPV6_ADDR_LINKLOCAL)
1767                 sin6->sin6_scope_id = sk->bound_dev_if;
1768 }
1769
1770 static int tcp_v6_remember_stamp(struct sock *sk)
1771 {
1772         /* Alas, not yet... */
1773         return 0;
1774 }
1775
1776 static struct tcp_func ipv6_specific = {
1777         tcp_v6_xmit,
1778         tcp_v6_send_check,
1779         tcp_v6_rebuild_header,
1780         tcp_v6_conn_request,
1781         tcp_v6_syn_recv_sock,
1782         tcp_v6_remember_stamp,
1783         sizeof(struct ipv6hdr),
1784
1785         ipv6_setsockopt,
1786         ipv6_getsockopt,
1787         v6_addr2sockaddr,
1788         sizeof(struct sockaddr_in6)
1789 };
1790
1791 /*
1792  *      TCP over IPv4 via INET6 API
1793  */
1794
1795 static struct tcp_func ipv6_mapped = {
1796         ip_queue_xmit,
1797         tcp_v4_send_check,
1798         tcp_v4_rebuild_header,
1799         tcp_v6_conn_request,
1800         tcp_v6_syn_recv_sock,
1801         tcp_v4_remember_stamp,
1802         sizeof(struct iphdr),
1803
1804         ipv6_setsockopt,
1805         ipv6_getsockopt,
1806         v6_addr2sockaddr,
1807         sizeof(struct sockaddr_in6)
1808 };
1809
1810
1811
1812 /* NOTE: A lot of things set to zero explicitly by call to
1813  *       sk_alloc() so need not be done here.
1814  */
1815 static int tcp_v6_init_sock(struct sock *sk)
1816 {
1817         struct tcp_opt *tp = &(sk->tp_pinfo.af_tcp);
1818
1819         skb_queue_head_init(&tp->out_of_order_queue);
1820         tcp_init_xmit_timers(sk);
1821         tcp_prequeue_init(tp);
1822
1823         tp->rto  = TCP_TIMEOUT_INIT;
1824         tp->mdev = TCP_TIMEOUT_INIT;
1825
1826         /* So many TCP implementations out there (incorrectly) count the
1827          * initial SYN frame in their delayed-ACK and congestion control
1828          * algorithms that we must have the following bandaid to talk
1829          * efficiently to them.  -DaveM
1830          */
1831         tp->snd_cwnd = 2;
1832
1833         /* See draft-stevens-tcpca-spec-01 for discussion of the
1834          * initialization of these values.
1835          */
1836         tp->snd_ssthresh = 0x7fffffff;
1837         tp->snd_cwnd_clamp = ~0;
1838         tp->mss_cache = 536;
1839
1840         tp->reordering = sysctl_tcp_reordering;
1841
1842         sk->state = TCP_CLOSE;
1843
1844         sk->tp_pinfo.af_tcp.af_specific = &ipv6_specific;
1845
1846         sk->write_space = tcp_write_space;
1847         sk->use_write_queue = 1;
1848
1849         sk->sndbuf = sysctl_tcp_wmem[1];
1850         sk->rcvbuf = sysctl_tcp_rmem[1];
1851
1852         atomic_inc(&tcp_sockets_allocated);
1853
1854         return 0;
1855 }
1856
1857 static int tcp_v6_destroy_sock(struct sock *sk)
1858 {
1859         struct tcp_opt *tp = &(sk->tp_pinfo.af_tcp);
1860
1861         tcp_clear_xmit_timers(sk);
1862
1863         /* Cleanup up the write buffer. */
1864         tcp_writequeue_purge(sk);
1865
1866         /* Cleans up our, hopefully empty, out_of_order_queue. */
1867         __skb_queue_purge(&tp->out_of_order_queue);
1868
1869         /* Clean prequeue, it must be empty really */
1870         __skb_queue_purge(&tp->ucopy.prequeue);
1871
1872         /* Clean up a referenced TCP bind bucket. */
1873         if(sk->prev != NULL)
1874                 tcp_put_port(sk);
1875
1876         /* If sendmsg cached page exists, toss it. */
1877         if (tp->sndmsg_page != NULL)
1878                 __free_page(tp->sndmsg_page);
1879
1880         atomic_dec(&tcp_sockets_allocated);
1881
1882         return inet6_destroy_sock(sk);
1883 }
1884
1885 /* Proc filesystem TCPv6 sock list dumping. */
1886 static void get_openreq6(struct sock *sk, struct open_request *req, char *tmpbuf, int i, int uid)
1887 {
1888         struct in6_addr *dest, *src;
1889         int ttd = req->expires - jiffies;
1890
1891         if (ttd < 0)
1892                 ttd = 0;
1893
1894         src = &req->af.v6_req.loc_addr;
1895         dest = &req->af.v6_req.rmt_addr;
1896         sprintf(tmpbuf,
1897                 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1898                 "%02X %08X:%08X %02X:%08X %08X %5d %8d %d %d %p",
1899                 i,
1900                 src->s6_addr32[0], src->s6_addr32[1],
1901                 src->s6_addr32[2], src->s6_addr32[3],
1902                 ntohs(sk->sport),
1903                 dest->s6_addr32[0], dest->s6_addr32[1],
1904                 dest->s6_addr32[2], dest->s6_addr32[3],
1905                 ntohs(req->rmt_port),
1906                 TCP_SYN_RECV,
1907                 0,0, /* could print option size, but that is af dependent. */
1908                 1,   /* timers active (only the expire timer) */
1909                 ttd,
1910                 req->retrans,
1911                 uid,
1912                 0,  /* non standard timer */
1913                 0, /* open_requests have no inode */
1914                 0, req);
1915 }
1916
1917 static void get_tcp6_sock(struct sock *sp, char *tmpbuf, int i)
1918 {
1919         struct in6_addr *dest, *src;
1920         __u16 destp, srcp;
1921         int timer_active;
1922         unsigned long timer_expires;
1923         struct tcp_opt *tp = &sp->tp_pinfo.af_tcp;
1924
1925         dest  = &sp->net_pinfo.af_inet6.daddr;
1926         src   = &sp->net_pinfo.af_inet6.rcv_saddr;
1927         destp = ntohs(sp->dport);
1928         srcp  = ntohs(sp->sport);
1929         if (tp->pending == TCP_TIME_RETRANS) {
1930                 timer_active    = 1;
1931                 timer_expires   = tp->timeout;
1932         } else if (tp->pending == TCP_TIME_PROBE0) {
1933                 timer_active    = 4;
1934                 timer_expires   = tp->timeout;
1935         } else if (timer_pending(&sp->timer)) {
1936                 timer_active    = 2;
1937                 timer_expires   = sp->timer.expires;
1938         } else {
1939                 timer_active    = 0;
1940                 timer_expires = jiffies;
1941         }
1942
1943         sprintf(tmpbuf,
1944                 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1945                 "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %u %u %u %u %d",
1946                 i,
1947                 src->s6_addr32[0], src->s6_addr32[1],
1948                 src->s6_addr32[2], src->s6_addr32[3], srcp,
1949                 dest->s6_addr32[0], dest->s6_addr32[1],
1950                 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1951                 sp->state,
1952                 tp->write_seq-tp->snd_una, tp->rcv_nxt-tp->copied_seq,
1953                 timer_active, timer_expires-jiffies,
1954                 tp->retransmits,
1955                 sock_i_uid(sp),
1956                 tp->probes_out,
1957                 sock_i_ino(sp),
1958                 atomic_read(&sp->refcnt), sp,
1959                 tp->rto, tp->ack.ato, (tp->ack.quick<<1)|tp->ack.pingpong,
1960                 tp->snd_cwnd, tp->snd_ssthresh>=0xFFFF?-1:tp->snd_ssthresh
1961                 );
1962 }
1963
1964 static void get_timewait6_sock(struct tcp_tw_bucket *tw, char *tmpbuf, int i)
1965 {
1966         struct in6_addr *dest, *src;
1967         __u16 destp, srcp;
1968         int ttd = tw->ttd - jiffies;
1969
1970         if (ttd < 0)
1971                 ttd = 0;
1972
1973         dest  = &tw->v6_daddr;
1974         src   = &tw->v6_rcv_saddr;
1975         destp = ntohs(tw->dport);
1976         srcp  = ntohs(tw->sport);
1977
1978         sprintf(tmpbuf,
1979                 "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
1980                 "%02X %08X:%08X %02X:%08X %08X %5d %8d %d %d %p",
1981                 i,
1982                 src->s6_addr32[0], src->s6_addr32[1],
1983                 src->s6_addr32[2], src->s6_addr32[3], srcp,
1984                 dest->s6_addr32[0], dest->s6_addr32[1],
1985                 dest->s6_addr32[2], dest->s6_addr32[3], destp,
1986                 tw->substate, 0, 0,
1987                 3, ttd, 0, 0, 0, 0,
1988                 atomic_read(&tw->refcnt), tw);
1989 }
1990
1991 #define LINE_LEN 190
1992 #define LINE_FMT "%-190s\n"
1993
1994 int tcp6_get_info(char *buffer, char **start, off_t offset, int length)
1995 {
1996         int len = 0, num = 0, i;
1997         off_t begin, pos = 0;
1998         char tmpbuf[LINE_LEN+2];
1999
2000         if (offset < LINE_LEN+1)
2001                 len += sprintf(buffer, LINE_FMT,
2002                                "  sl  "                                         /* 6 */
2003                                "local_address                         "         /* 38 */
2004                                "remote_address                        "         /* 38 */
2005                                "st tx_queue rx_queue tr tm->when retrnsmt"      /* 41 */
2006                                "   uid  timeout inode");                        /* 21 */
2007                                                                                 /*----*/
2008                                                                                 /*144 */
2009
2010         pos = LINE_LEN+1;
2011
2012         /* First, walk listening socket table. */
2013         tcp_listen_lock();
2014         for(i = 0; i < TCP_LHTABLE_SIZE; i++) {
2015                 struct sock *sk = tcp_listening_hash[i];
2016                 struct tcp_listen_opt *lopt;
2017                 int k;
2018
2019                 for (sk = tcp_listening_hash[i]; sk; sk = sk->next, num++) {
2020                         struct open_request *req;
2021                         int uid;
2022                         struct tcp_opt *tp = &(sk->tp_pinfo.af_tcp);
2023
2024                         if (sk->family != PF_INET6)
2025                                 continue;
2026                         pos += LINE_LEN+1;
2027                         if (pos >= offset) {
2028                                 get_tcp6_sock(sk, tmpbuf, num);
2029                                 len += sprintf(buffer+len, LINE_FMT, tmpbuf);
2030                                 if (pos >= offset + length) {
2031                                         tcp_listen_unlock();
2032                                         goto out_no_bh;
2033                                 }
2034                         }
2035
2036                         uid = sock_i_uid(sk);
2037                         read_lock_bh(&tp->syn_wait_lock);
2038                         lopt = tp->listen_opt;
2039                         if (lopt && lopt->qlen != 0) {
2040                                 for (k=0; k<TCP_SYNQ_HSIZE; k++) {
2041                                         for (req = lopt->syn_table[k]; req; req = req->dl_next, num++) {
2042                                                 if (req->class->family != PF_INET6)
2043                                                         continue;
2044                                                 pos += LINE_LEN+1;
2045                                                 if (pos <= offset)
2046                                                         continue;
2047                                                 get_openreq6(sk, req, tmpbuf, num, uid);
2048                                                 len += sprintf(buffer+len, LINE_FMT, tmpbuf);
2049                                                 if (pos >= offset + length) {
2050                                                         read_unlock_bh(&tp->syn_wait_lock);
2051                                                         tcp_listen_unlock();
2052                                                         goto out_no_bh;
2053                                                 }
2054                                         }
2055                                 }
2056                         }
2057                         read_unlock_bh(&tp->syn_wait_lock);
2058
2059                         /* Completed requests are in normal socket hash table */
2060                 }
2061         }
2062         tcp_listen_unlock();
2063
2064         local_bh_disable();
2065
2066         /* Next, walk established hash chain. */
2067         for (i = 0; i < tcp_ehash_size; i++) {
2068                 struct tcp_ehash_bucket *head = &tcp_ehash[i];
2069                 struct sock *sk;
2070                 struct tcp_tw_bucket *tw;
2071
2072                 read_lock(&head->lock);
2073                 for(sk = head->chain; sk; sk = sk->next, num++) {
2074                         if (sk->family != PF_INET6)
2075                                 continue;
2076                         pos += LINE_LEN+1;
2077                         if (pos <= offset)
2078                                 continue;
2079                         get_tcp6_sock(sk, tmpbuf, num);
2080                         len += sprintf(buffer+len, LINE_FMT, tmpbuf);
2081                         if (pos >= offset + length) {
2082                                 read_unlock(&head->lock);
2083                                 goto out;
2084                         }
2085                 }
2086                 for (tw = (struct tcp_tw_bucket *)tcp_ehash[i+tcp_ehash_size].chain;
2087                      tw != NULL;
2088                      tw = (struct tcp_tw_bucket *)tw->next, num++) {
2089                         if (tw->family != PF_INET6)
2090                                 continue;
2091                         pos += LINE_LEN+1;
2092                         if (pos <= offset)
2093                                 continue;
2094                         get_timewait6_sock(tw, tmpbuf, num);
2095                         len += sprintf(buffer+len, LINE_FMT, tmpbuf);
2096                         if (pos >= offset + length) {
2097                                 read_unlock(&head->lock);
2098                                 goto out;
2099                         }
2100                 }
2101                 read_unlock(&head->lock);
2102         }
2103
2104 out:
2105         local_bh_enable();
2106 out_no_bh:
2107
2108         begin = len - (pos - offset);
2109         *start = buffer + begin;
2110         len -= begin;
2111         if (len > length)
2112                 len = length;
2113         if (len < 0)
2114                 len = 0;
2115         return len;
2116 }
2117
2118 struct proto tcpv6_prot = {
2119         name:           "TCPv6",
2120         close:          tcp_close,
2121         connect:        tcp_v6_connect,
2122         disconnect:     tcp_disconnect,
2123         accept:         tcp_accept,
2124         ioctl:          tcp_ioctl,
2125         init:           tcp_v6_init_sock,
2126         destroy:        tcp_v6_destroy_sock,
2127         shutdown:       tcp_shutdown,
2128         setsockopt:     tcp_setsockopt,
2129         getsockopt:     tcp_getsockopt,
2130         sendmsg:        tcp_sendmsg,
2131         recvmsg:        tcp_recvmsg,
2132         backlog_rcv:    tcp_v6_do_rcv,
2133         hash:           tcp_v6_hash,
2134         unhash:         tcp_unhash,
2135         get_port:       tcp_v6_get_port,
2136 };
2137
2138 static struct inet6_protocol tcpv6_protocol =
2139 {
2140         tcp_v6_rcv,             /* TCP handler          */
2141         tcp_v6_err,             /* TCP error control    */
2142         NULL,                   /* next                 */
2143         IPPROTO_TCP,            /* protocol ID          */
2144         0,                      /* copy                 */
2145         NULL,                   /* data                 */
2146         "TCPv6"                 /* name                 */
2147 };
2148
2149 extern struct proto_ops inet6_stream_ops;
2150
2151 static struct inet_protosw tcpv6_protosw = {
2152         type:        SOCK_STREAM,
2153         protocol:    IPPROTO_TCP,
2154         prot:        &tcpv6_prot,
2155         ops:         &inet6_stream_ops,
2156         capability:  -1,
2157         no_check:    0,
2158         flags:       INET_PROTOSW_PERMANENT,
2159 };
2160
2161 void __init tcpv6_init(void)
2162 {
2163         /* register inet6 protocol */
2164         inet6_add_protocol(&tcpv6_protocol);
2165         inet6_register_protosw(&tcpv6_protosw);
2166 }