1 files changed, 230 insertions, 164 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index fe6d40418c0b..87551ca568cd 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -76,8 +76,8 @@ static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
 static void     __tcp_v6_send_check(struct sk_buff *skb,
-                                    struct in6_addr *saddr,
-                                    struct in6_addr *daddr);
+                                    const struct in6_addr *saddr,
+                                    const struct in6_addr *daddr);
 
 static const struct inet_connection_sock_af_ops ipv6_mapped;
 static const struct inet_connection_sock_af_ops ipv6_specific;
@@ -86,7 +86,7 @@ static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
 #else
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
-                                                   struct in6_addr *addr)
+                                                   const struct in6_addr *addr)
 {
         return NULL;
 }
@@ -106,8 +106,8 @@ static void tcp_v6_hash(struct sock *sk)
 }
 
 static __inline__ __sum16 tcp_v6_check(int len,
-                                   struct in6_addr *saddr,
-                                   struct in6_addr *daddr,
+                                   const struct in6_addr *saddr,
+                                   const struct in6_addr *daddr,
                                    __wsum base)
 {
         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
@@ -130,7 +130,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         struct in6_addr *saddr = NULL, *final_p, final;
-        struct flowi fl;
+        struct rt6_info *rt;
+        struct flowi6 fl6;
         struct dst_entry *dst;
         int addr_type;
         int err;
@@ -139,16 +140,16 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 return -EINVAL;
 
         if (usin->sin6_family != AF_INET6)
-                return(-EAFNOSUPPORT);
+                return -EAFNOSUPPORT;
 
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
 
         if (np->sndflow) {
-                fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-                IP6_ECN_flow_init(fl.fl6_flowlabel);
-                if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
+                fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
+                IP6_ECN_flow_init(fl6.flowlabel);
+                if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
                         struct ip6_flowlabel *flowlabel;
-                        flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                         if (flowlabel == NULL)
                                 return -EINVAL;
                         ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
@@ -194,7 +195,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         }
 
         ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
-        np->flow_label = fl.fl6_flowlabel;
+        np->flow_label = fl6.flowlabel;
 
         /*
          *      TCP over IPv4
@@ -241,35 +242,27 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (!ipv6_addr_any(&np->rcv_saddr))
                 saddr = &np->rcv_saddr;
 
-        fl.proto = IPPROTO_TCP;
-        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
-        ipv6_addr_copy(&fl.fl6_src,
+        fl6.flowi6_proto = IPPROTO_TCP;
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
+        ipv6_addr_copy(&fl6.saddr,
                        (saddr ? saddr : &np->saddr));
-        fl.oif = sk->sk_bound_dev_if;
-        fl.mark = sk->sk_mark;
-        fl.fl_ip_dport = usin->sin6_port;
-        fl.fl_ip_sport = inet->inet_sport;
+        fl6.flowi6_oif = sk->sk_bound_dev_if;
+        fl6.flowi6_mark = sk->sk_mark;
+        fl6.fl6_dport = usin->sin6_port;
+        fl6.fl6_sport = inet->inet_sport;
 
-        final_p = fl6_update_dst(&fl, np->opt, &final);
+        final_p = fl6_update_dst(&fl6, np->opt, &final);
 
-        security_sk_classify_flow(sk, &fl);
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
-        err = ip6_dst_lookup(sk, &dst, &fl);
-        if (err)
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                 goto failure;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto failure;
         }
 
         if (saddr == NULL) {
-                saddr = &fl.fl6_src;
+                saddr = &fl6.saddr;
                 ipv6_addr_copy(&np->rcv_saddr, saddr);
         }
 
@@ -280,6 +273,26 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         sk->sk_gso_type = SKB_GSO_TCPV6;
         __ip6_dst_store(sk, dst, NULL, NULL);
 
+        rt = (struct rt6_info *) dst;
+        if (tcp_death_row.sysctl_tw_recycle &&
+            !tp->rx_opt.ts_recent_stamp &&
+            ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
+                struct inet_peer *peer = rt6_get_peer(rt);
+                /*
+                 * VJ's idea. We save last timestamp seen from
+                 * the destination in peer table, when entering state
+                 * TIME-WAIT * and initialize rx_opt.ts_recent from it,
+                 * when trying new connection.
+                 */
+                if (peer) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
+                                tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
+                                tp->rx_opt.ts_recent = peer->tcp_ts;
+                        }
+                }
+        }
+
         icsk->icsk_ext_hdr_len = 0;
         if (np->opt)
                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
@@ -318,7 +331,7 @@ failure:
 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 u8 type, u8 code, int offset, __be32 info)
 {
-        struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
         struct ipv6_pinfo *np;
         struct sock *sk;
@@ -364,7 +377,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         np = inet6_sk(sk);
 
         if (type == ICMPV6_PKT_TOOBIG) {
-                struct dst_entry *dst = NULL;
+                struct dst_entry *dst;
 
                 if (sock_owned_by_user(sk))
                         goto out;
@@ -376,29 +389,25 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
                 if (dst == NULL) {
                         struct inet_sock *inet = inet_sk(sk);
-                        struct flowi fl;
+                        struct flowi6 fl6;
 
                         /* BUGGG_FUTURE: Again, it is not clear how
                            to handle rthdr case. Ignore this complexity
                            for now.
                          */
-                        memset(&fl, 0, sizeof(fl));
-                        fl.proto = IPPROTO_TCP;
-                        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
-                        ipv6_addr_copy(&fl.fl6_src, &np->saddr);
-                        fl.oif = sk->sk_bound_dev_if;
-                        fl.mark = sk->sk_mark;
-                        fl.fl_ip_dport = inet->inet_dport;
-                        fl.fl_ip_sport = inet->inet_sport;
-                        security_skb_classify_flow(skb, &fl);
-
-                        if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
-                                sk->sk_err_soft = -err;
-                                goto out;
-                        }
-
-                        if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
-                                sk->sk_err_soft = -err;
+                        memset(&fl6, 0, sizeof(fl6));
+                        fl6.flowi6_proto = IPPROTO_TCP;
+                        ipv6_addr_copy(&fl6.daddr, &np->daddr);
+                        ipv6_addr_copy(&fl6.saddr, &np->saddr);
+                        fl6.flowi6_oif = sk->sk_bound_dev_if;
+                        fl6.flowi6_mark = sk->sk_mark;
+                        fl6.fl6_dport = inet->inet_dport;
+                        fl6.fl6_sport = inet->inet_sport;
+                        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
+
+                        dst = ip6_dst_lookup_flow(sk, &fl6, NULL, false);
+                        if (IS_ERR(dst)) {
+                                sk->sk_err_soft = -PTR_ERR(dst);
                                 goto out;
                         }
 
@@ -473,38 +482,37 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         struct sk_buff * skb;
         struct ipv6_txoptions *opt = NULL;
         struct in6_addr * final_p, final;
-        struct flowi fl;
+        struct flowi6 fl6;
         struct dst_entry *dst;
-        int err = -1;
-
-        memset(&fl, 0, sizeof(fl));
-        fl.proto = IPPROTO_TCP;
-        ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
-        ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
-        fl.fl6_flowlabel = 0;
-        fl.oif = treq->iif;
-        fl.mark = sk->sk_mark;
-        fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-        fl.fl_ip_sport = inet_rsk(req)->loc_port;
-        security_req_classify_flow(req, &fl);
+        int err;
+
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_TCP;
+        ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
+        ipv6_addr_copy(&fl6.saddr, &treq->loc_addr);
+        fl6.flowlabel = 0;
+        fl6.flowi6_oif = treq->iif;
+        fl6.flowi6_mark = sk->sk_mark;
+        fl6.fl6_dport = inet_rsk(req)->rmt_port;
+        fl6.fl6_sport = inet_rsk(req)->loc_port;
+        security_req_classify_flow(req, flowi6_to_flowi(&fl6));
 
         opt = np->opt;
-        final_p = fl6_update_dst(&fl, opt, &final);
+        final_p = fl6_update_dst(&fl6, opt, &final);
 
-        err = ip6_dst_lookup(sk, &dst, &fl);
-        if (err)
-                goto done;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                dst = NULL;
                 goto done;
-
+        }
         skb = tcp_make_synack(sk, dst, req, rvp);
+        err = -ENOMEM;
         if (skb) {
                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 
-                ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
-                err = ip6_xmit(sk, skb, &fl, opt);
+                ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
+                err = ip6_xmit(sk, skb, &fl6, opt);
                 err = net_xmit_eval(err);
         }
 
@@ -543,7 +551,7 @@ static void tcp_v6_reqsk_destructor(struct request_sock *req)
 
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
-                                                   struct in6_addr *addr)
+                                                   const struct in6_addr *addr)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int i;
@@ -572,7 +580,7 @@ static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 }
 
-static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
+static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                              char *newkey, u8 newkeylen)
 {
         /* Add key to the list */
@@ -637,7 +645,7 @@ static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
                                  newkey, newkeylen);
 }
 
-static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
+static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int i;
@@ -745,8 +753,8 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 }
 
 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
-                                        struct in6_addr *daddr,
-                                        struct in6_addr *saddr, int nbytes)
+                                        const struct in6_addr *daddr,
+                                        const struct in6_addr *saddr, int nbytes)
 {
         struct tcp6_pseudohdr *bp;
         struct scatterlist sg;
@@ -763,7 +771,7 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 }
 
 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
-                               struct in6_addr *daddr, struct in6_addr *saddr,
+                               const struct in6_addr *daddr, struct in6_addr *saddr,
                                struct tcphdr *th)
 {
         struct tcp_md5sig_pool *hp;
@@ -799,7 +807,7 @@ static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                                struct sock *sk, struct request_sock *req,
                                struct sk_buff *skb)
 {
-        struct in6_addr *saddr, *daddr;
+        const struct in6_addr *saddr, *daddr;
         struct tcp_md5sig_pool *hp;
         struct hash_desc *desc;
         struct tcphdr *th = tcp_hdr(skb);
@@ -811,7 +819,7 @@ static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                 saddr = &inet6_rsk(req)->loc_addr;
                 daddr = &inet6_rsk(req)->rmt_addr;
         } else {
-                struct ipv6hdr *ip6h = ipv6_hdr(skb);
+                const struct ipv6hdr *ip6h = ipv6_hdr(skb);
                 saddr = &ip6h->saddr;
                 daddr = &ip6h->daddr;
         }
@@ -849,7 +857,7 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 {
         __u8 *hash_location = NULL;
         struct tcp_md5sig_key *hash_expected;
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
         struct tcphdr *th = tcp_hdr(skb);
         int genhash;
         u8 newhash[16];
@@ -906,14 +914,8 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 };
 #endif
 
-static struct timewait_sock_ops tcp6_timewait_sock_ops = {
-        .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
-        .twsk_unique    = tcp_twsk_unique,
-        .twsk_destructor= tcp_twsk_destructor,
-};
-
 static void __tcp_v6_send_check(struct sk_buff *skb,
-                                struct in6_addr *saddr, struct in6_addr *daddr)
+                                const struct in6_addr *saddr, const struct in6_addr *daddr)
 {
         struct tcphdr *th = tcp_hdr(skb);
 
@@ -937,7 +939,7 @@ static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 
 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 {
-        struct ipv6hdr *ipv6h;
+        const struct ipv6hdr *ipv6h;
         struct tcphdr *th;
 
         if (!pskb_may_pull(skb, sizeof(*th)))
@@ -955,7 +957,7 @@ static int tcp_v6_gso_send_check(struct sk_buff *skb)
 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
                                          struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = skb_gro_network_header(skb);
+        const struct ipv6hdr *iph = skb_gro_network_header(skb);
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
@@ -976,7 +978,7 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 
 static int tcp6_gro_complete(struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         struct tcphdr *th = tcp_hdr(skb);
 
         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
@@ -991,7 +993,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 {
         struct tcphdr *th = tcp_hdr(skb), *t1;
         struct sk_buff *buff;
-        struct flowi fl;
+        struct flowi6 fl6;
         struct net *net = dev_net(skb_dst(skb)->dev);
         struct sock *ctl_sk = net->ipv6.tcp_sk;
         unsigned int tot_len = sizeof(struct tcphdr);
@@ -1045,34 +1047,33 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         }
 #endif
 
-        memset(&fl, 0, sizeof(fl));
-        ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
-        ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
+        memset(&fl6, 0, sizeof(fl6));
+        ipv6_addr_copy(&fl6.daddr, &ipv6_hdr(skb)->saddr);
+        ipv6_addr_copy(&fl6.saddr, &ipv6_hdr(skb)->daddr);
 
         buff->ip_summed = CHECKSUM_PARTIAL;
         buff->csum = 0;
 
-        __tcp_v6_send_check(buff, &fl.fl6_src, &fl.fl6_dst);
+        __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 
-        fl.proto = IPPROTO_TCP;
-        fl.oif = inet6_iif(skb);
-        fl.fl_ip_dport = t1->dest;
-        fl.fl_ip_sport = t1->source;
-        security_skb_classify_flow(skb, &fl);
+        fl6.flowi6_proto = IPPROTO_TCP;
+        fl6.flowi6_oif = inet6_iif(skb);
+        fl6.fl6_dport = t1->dest;
+        fl6.fl6_sport = t1->source;
+        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 
         /* Pass a socket to ip6_dst_lookup either it is for RST
          * Underlying function will use this to retrieve the network
          * namespace
          */
-        if (!ip6_dst_lookup(ctl_sk, &dst, &fl)) {
-                if (xfrm_lookup(net, &dst, &fl, NULL, 0) >= 0) {
-                        skb_dst_set(buff, dst);
-                        ip6_xmit(ctl_sk, buff, &fl, NULL);
-                        TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
-                        if (rst)
-                                TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
-                        return;
-                }
+        dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
+        if (!IS_ERR(dst)) {
+                skb_dst_set(buff, dst);
+                ip6_xmit(ctl_sk, buff, &fl6, NULL);
+                TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
+                if (rst)
+                        TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
+                return;
         }
 
         kfree_skb(buff);
@@ -1176,6 +1177,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 isn = TCP_SKB_CB(skb)->when;
+        struct dst_entry *dst = NULL;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
 #else
@@ -1273,6 +1275,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
 
         if (!isn) {
+                struct inet_peer *peer = NULL;
+
                 if (ipv6_opt_accepted(sk, skb) ||
                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
@@ -1285,13 +1289,57 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 if (!sk->sk_bound_dev_if &&
                     ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
                         treq->iif = inet6_iif(skb);
-                if (!want_cookie) {
-                        isn = tcp_v6_init_sequence(skb);
-                } else {
+
+                if (want_cookie) {
                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
                         req->cookie_ts = tmp_opt.tstamp_ok;
+                        goto have_isn;
+                }
+
+                /* VJ's idea. We save last timestamp seen
+                 * from the destination in peer table, when entering
+                 * state TIME-WAIT, and check against it before
+                 * accepting new connection request.
+                 *
+                 * If "isn" is not zero, this request hit alive
+                 * timewait bucket, so that all the necessary checks
+                 * are made in the function processing timewait state.
+                 */
+                if (tmp_opt.saw_tstamp &&
+                    tcp_death_row.sysctl_tw_recycle &&
+                    (dst = inet6_csk_route_req(sk, req)) != NULL &&
+                    (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
+                    ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
+                                    &treq->rmt_addr)) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
+                            (s32)(peer->tcp_ts - req->ts_recent) >
+                                                        TCP_PAWS_WINDOW) {
+                                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
+                                goto drop_and_release;
+                        }
                 }
+                /* Kill the following clause, if you dislike this way. */
+                else if (!sysctl_tcp_syncookies &&
+                         (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
+                          (sysctl_max_syn_backlog >> 2)) &&
+                         (!peer || !peer->tcp_ts_stamp) &&
+                         (!dst || !dst_metric(dst, RTAX_RTT))) {
+                        /* Without syncookies last quarter of
+                         * backlog is filled with destinations,
+                         * proven to be alive.
+                         * It means that we continue to communicate
+                         * to destinations, already remembered
+                         * to the moment of synflood.
+                         */
+                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
+                                       &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
+                        goto drop_and_release;
+                }
+
+                isn = tcp_v6_init_sequence(skb);
         }
+have_isn:
         tcp_rsk(req)->snt_isn = isn;
 
         security_inet_conn_request(sk, skb, req);
@@ -1304,6 +1352,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
         return 0;
 
+drop_and_release:
+        dst_release(dst);
 drop_and_free:
         reqsk_free(req);
 drop:
@@ -1382,34 +1432,15 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         if (sk_acceptq_is_full(sk))
                 goto out_overflow;
 
-        if (dst == NULL) {
-                struct in6_addr *final_p, final;
-                struct flowi fl;
-
-                memset(&fl, 0, sizeof(fl));
-                fl.proto = IPPROTO_TCP;
-                ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
-                final_p = fl6_update_dst(&fl, opt, &final);
-                ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
-                fl.oif = sk->sk_bound_dev_if;
-                fl.mark = sk->sk_mark;
-                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_rsk(req)->loc_port;
-                security_req_classify_flow(req, &fl);
-
-                if (ip6_dst_lookup(sk, &dst, &fl))
-                        goto out;
-
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-                if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
+        if (!dst) {
+                dst = inet6_csk_route_req(sk, req);
+                if (!dst)
                         goto out;
         }
 
         newsk = tcp_create_openreq_child(sk, req, skb);
         if (newsk == NULL)
-                goto out;
+                goto out_nonewsk;
 
         /*
          * No need to charge this sock to the relevant IPv6 refcnt debug socks
@@ -1438,7 +1469,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
            First: no IPv4 options.
          */
-        newinet->opt = NULL;
+        newinet->inet_opt = NULL;
         newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
@@ -1476,7 +1507,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
-        newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
+        newtp->advmss = dst_metric_advmss(dst);
         tcp_initialize_rcv_mss(newsk);
 
         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
@@ -1497,18 +1528,22 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         }
 #endif
 
+        if (__inet_inherit_port(sk, newsk) < 0) {
+                sock_put(newsk);
+                goto out;
+        }
         __inet6_hash(newsk, NULL);
-        __inet_inherit_port(sk, newsk);
 
         return newsk;
 
 out_overflow:
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
-out:
-        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
+out_nonewsk:
         if (opt && opt != np->opt)
                 sock_kfree_s(sk, opt, opt->tot_len);
         dst_release(dst);
+out:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
         return NULL;
 }
 
@@ -1587,10 +1622,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 opt_skb = skb_clone(skb, GFP_ATOMIC);
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
-                TCP_CHECK_TIMER(sk);
+                sock_rps_save_rxhash(sk, skb->rxhash);
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
-                TCP_CHECK_TIMER(sk);
                 if (opt_skb)
                         goto ipv6_pktoptions;
                 return 0;
@@ -1610,18 +1644,18 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                  * the new socket..
                  */
                 if(nsk != sk) {
+                        sock_rps_save_rxhash(nsk, skb->rxhash);
                         if (tcp_child_process(sk, nsk, skb))
                                 goto reset;
                         if (opt_skb)
                                 __kfree_skb(opt_skb);
                         return 0;
                 }
-        }
+        } else
+                sock_rps_save_rxhash(sk, skb->rxhash);
 
-        TCP_CHECK_TIMER(sk);
         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
                 goto reset;
-        TCP_CHECK_TIMER(sk);
         if (opt_skb)
                 goto ipv6_pktoptions;
         return 0;
@@ -1669,7 +1703,7 @@ ipv6_pktoptions:
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
         struct tcphdr *th;
-        struct ipv6hdr *hdr;
+        const struct ipv6hdr *hdr;
         struct sock *sk;
         int ret;
         struct net *net = dev_net(skb->dev);
@@ -1814,19 +1848,51 @@ do_time_wait:
         goto discard_it;
 }
 
-static int tcp_v6_remember_stamp(struct sock *sk)
+static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
 {
-        /* Alas, not yet... */
-        return 0;
+        struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct inet_peer *peer;
+
+        if (!rt ||
+            !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
+                peer = inet_getpeer_v6(&np->daddr, 1);
+                *release_it = true;
+        } else {
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+                peer = rt->rt6i_peer;
+                *release_it = false;
+        }
+
+        return peer;
+}
+
+static void *tcp_v6_tw_get_peer(struct sock *sk)
+{
+        struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
+        struct inet_timewait_sock *tw = inet_twsk(sk);
+
+        if (tw->tw_family == AF_INET)
+                return tcp_v4_tw_get_peer(sk);
+
+        return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
 }
 
+static struct timewait_sock_ops tcp6_timewait_sock_ops = {
+        .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
+        .twsk_unique    = tcp_twsk_unique,
+        .twsk_destructor= tcp_twsk_destructor,
+        .twsk_getpeer   = tcp_v6_tw_get_peer,
+};
+
 static const struct inet_connection_sock_af_ops ipv6_specific = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = tcp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
-        .remember_stamp    = tcp_v6_remember_stamp,
+        .get_peer          = tcp_v6_get_peer,
         .net_header_len    = sizeof(struct ipv6hdr),
         .setsockopt        = ipv6_setsockopt,
         .getsockopt        = ipv6_getsockopt,
@@ -1858,7 +1924,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .rebuild_header    = inet_sk_rebuild_header,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
-        .remember_stamp    = tcp_v4_remember_stamp,
+        .get_peer          = tcp_v4_get_peer,
         .net_header_len    = sizeof(struct iphdr),
         .setsockopt        = ipv6_setsockopt,
         .getsockopt        = ipv6_getsockopt,
@@ -1963,15 +2029,15 @@ static void get_openreq6(struct seq_file *seq,
                          struct sock *sk, struct request_sock *req, int i, int uid)
 {
         int ttd = req->expires - jiffies;
-        struct in6_addr *src = &inet6_rsk(req)->loc_addr;
-        struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
+        const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
+        const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
 
         if (ttd < 0)
                 ttd = 0;
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3],
@@ -1992,7 +2058,7 @@ static void get_openreq6(struct seq_file *seq,
 
 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 {
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
         __u16 destp, srcp;
         int timer_active;
         unsigned long timer_expires;
@@ -2022,7 +2088,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2049,7 +2115,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 static void get_timewait6_sock(struct seq_file *seq,
                                struct inet_timewait_sock *tw, int i)
 {
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
         __u16 destp, srcp;
         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
         int ttd = tw->tw_ttd - jiffies;
@@ -2064,7 +2130,7 @@ static void get_timewait6_sock(struct seq_file *seq,
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
                    i,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3], srcp,