1 files changed, 32 insertions, 15 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 93825dd3a7c0..f6d629fd6aee 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -389,6 +389,13 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
         if (type == ICMPV6_PKT_TOOBIG) {
+                /* We are not interested in TCP_LISTEN and open_requests
+                 * (SYN-ACKs send out by Linux are always <576bytes so
+                 * they should go through unfragmented).
+                 */
+                if (sk->sk_state == TCP_LISTEN)
+                        goto out;
+
                 tp->mtu_info = ntohl(info);
                 if (!sock_owned_by_user(sk))
                         tcp_v6_mtu_reduced(sk);
@@ -423,6 +430,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 }
 
                 inet_csk_reqsk_queue_drop(sk, req, prev);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
                 goto out;
 
         case TCP_SYN_SENT:
@@ -712,7 +720,8 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 #endif
 
 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
-                                 u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
+                                 u32 tsval, u32 tsecr,
+                                 struct tcp_md5sig_key *key, int rst, u8 tclass)
 {
         const struct tcphdr *th = tcp_hdr(skb);
         struct tcphdr *t1;
@@ -724,7 +733,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         struct dst_entry *dst;
         __be32 *topt;
 
-        if (ts)
+        if (tsecr)
                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
 #ifdef CONFIG_TCP_MD5SIG
         if (key)
@@ -754,11 +763,11 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 
         topt = (__be32 *)(t1 + 1);
 
-        if (ts) {
+        if (tsecr) {
                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                 (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
-                *topt++ = htonl(tcp_time_stamp);
-                *topt++ = htonl(ts);
+                *topt++ = htonl(tsval);
+                *topt++ = htonl(tsecr);
         }
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -834,7 +843,8 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                  * no RST generated if md5 hash doesn't match.
                  */
                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
-                                           &tcp_hashinfo, &ipv6h->daddr,
+                                           &tcp_hashinfo, &ipv6h->saddr,
+                                           th->source, &ipv6h->daddr,
                                            ntohs(th->source), inet6_iif(skb));
                 if (!sk1)
                         return;
@@ -858,7 +868,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
                           (th->doff << 2);
 
-        tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
+        tcp_v6_send_response(skb, seq, ack_seq, 0, 0, 0, key, 1, 0);
 
 #ifdef CONFIG_TCP_MD5SIG
 release_sk1:
@@ -869,10 +879,11 @@ release_sk1:
 #endif
 }
 
-static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
+static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
+                            u32 win, u32 tsval, u32 tsecr,
                             struct tcp_md5sig_key *key, u8 tclass)
 {
-        tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
+        tcp_v6_send_response(skb, seq, ack, win, tsval, tsecr, key, 0, tclass);
 }
 
 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
@@ -882,6 +893,7 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 
         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
+                        tcp_time_stamp + tcptw->tw_ts_offset,
                         tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
                         tw->tw_tclass);
 
@@ -891,7 +903,8 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req)
 {
-        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
+        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
+                        req->rcv_wnd, tcp_time_stamp, req->ts_recent,
                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
 }
 
@@ -958,8 +971,10 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                         goto drop;
         }
 
-        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
+        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
                 goto drop;
+        }
 
         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
         if (req == NULL)
@@ -1027,7 +1042,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         treq->rmt_addr = ipv6_hdr(skb)->saddr;
         treq->loc_addr = ipv6_hdr(skb)->daddr;
         if (!want_cookie || tmp_opt.tstamp_ok)
-                TCP_ECN_create_request(req, skb);
+                TCP_ECN_create_request(req, skb, sock_net(sk));
 
         treq->iif = sk->sk_bound_dev_if;
 
@@ -1108,6 +1123,7 @@ drop_and_release:
 drop_and_free:
         reqsk_free(req);
 drop:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
         return 0; /* don't send reset */
 }
 
@@ -1163,7 +1179,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newnp->opt         = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
-                newnp->rcv_tclass  = ipv6_tclass(ipv6_hdr(skb));
+                newnp->rcv_tclass  = ipv6_get_dsfield(ipv6_hdr(skb));
 
                 /*
                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
@@ -1243,7 +1259,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newnp->opt        = NULL;
         newnp->mcast_oif  = inet6_iif(skb);
         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
-        newnp->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
+        newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
 
         /* Clone native IPv6 options from listening socket (if any)
 
@@ -1456,7 +1472,7 @@ ipv6_pktoptions:
                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
                 if (np->rxopt.bits.rxtclass)
-                        np->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
+                        np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
                 if (ipv6_opt_accepted(sk, opt_skb)) {
                         skb_set_owner_r(opt_skb, sk);
                         opt_skb = xchg(&np->pktoptions, opt_skb);
@@ -1598,6 +1614,7 @@ do_time_wait:
                 struct sock *sk2;
 
                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
+                                            &ipv6_hdr(skb)->saddr, th->source,
                                             &ipv6_hdr(skb)->daddr,
                                             ntohs(th->dest), inet6_iif(skb));
                 if (sk2 != NULL) {