xref: /onnv-gate/usr/src/uts/common/inet/sctp/sctp_cookie.c (revision 852:e823a5cfc1c2)
10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
50Sstevel@tonic-gate  * Common Development and Distribution License, Version 1.0 only
60Sstevel@tonic-gate  * (the "License").  You may not use this file except in compliance
70Sstevel@tonic-gate  * with the License.
80Sstevel@tonic-gate  *
90Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
100Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
110Sstevel@tonic-gate  * See the License for the specific language governing permissions
120Sstevel@tonic-gate  * and limitations under the License.
130Sstevel@tonic-gate  *
140Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
150Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
160Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
170Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
180Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
190Sstevel@tonic-gate  *
200Sstevel@tonic-gate  * CDDL HEADER END
210Sstevel@tonic-gate  */
220Sstevel@tonic-gate /*
230Sstevel@tonic-gate  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
240Sstevel@tonic-gate  * Use is subject to license terms.
250Sstevel@tonic-gate  */
260Sstevel@tonic-gate 
270Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
280Sstevel@tonic-gate 
290Sstevel@tonic-gate #include <sys/types.h>
300Sstevel@tonic-gate #include <sys/systm.h>
310Sstevel@tonic-gate #include <sys/stream.h>
320Sstevel@tonic-gate #include <sys/cmn_err.h>
330Sstevel@tonic-gate #include <sys/md5.h>
340Sstevel@tonic-gate #include <sys/kmem.h>
350Sstevel@tonic-gate #include <sys/strsubr.h>
360Sstevel@tonic-gate #include <sys/random.h>
370Sstevel@tonic-gate 
380Sstevel@tonic-gate #include <netinet/in.h>
390Sstevel@tonic-gate #include <netinet/ip6.h>
400Sstevel@tonic-gate 
410Sstevel@tonic-gate #include <inet/common.h>
420Sstevel@tonic-gate #include <inet/ip.h>
430Sstevel@tonic-gate #include <inet/ip6.h>
440Sstevel@tonic-gate #include <inet/sctp_ip.h>
450Sstevel@tonic-gate #include <inet/ipclassifier.h>
460Sstevel@tonic-gate #include "sctp_impl.h"
470Sstevel@tonic-gate 
480Sstevel@tonic-gate /*
49*852Svi117747  * Helper function for SunCluster (PSARC/2005/602) to get the original source
50*852Svi117747  * address from the COOKIE
51*852Svi117747  */
52*852Svi117747 int cl_sctp_cookie_paddr(sctp_chunk_hdr_t *, in6_addr_t *);
53*852Svi117747 
54*852Svi117747 /*
550Sstevel@tonic-gate  * From RFC 2104. This should probably go into libmd5 (and while
560Sstevel@tonic-gate  * we're at it, maybe we should make a libdigest so we can later
570Sstevel@tonic-gate  * add SHA1 and others, esp. since some weaknesses have been found
580Sstevel@tonic-gate  * with MD5).
590Sstevel@tonic-gate  *
600Sstevel@tonic-gate  * text		IN			pointer to data stream
610Sstevel@tonic-gate  * text_len	IN			length of data stream
620Sstevel@tonic-gate  * key		IN			pointer to authentication key
630Sstevel@tonic-gate  * key_len	IN			length of authentication key
640Sstevel@tonic-gate  * digest	OUT			caller digest to be filled in
650Sstevel@tonic-gate  */
660Sstevel@tonic-gate static void
670Sstevel@tonic-gate hmac_md5(uchar_t *text, size_t text_len, uchar_t *key, size_t key_len,
680Sstevel@tonic-gate     uchar_t *digest)
690Sstevel@tonic-gate {
700Sstevel@tonic-gate 	MD5_CTX context;
710Sstevel@tonic-gate 	uchar_t k_ipad[65];	/* inner padding - key XORd with ipad */
720Sstevel@tonic-gate 	uchar_t k_opad[65];	/* outer padding - key XORd with opad */
730Sstevel@tonic-gate 	uchar_t tk[16];
740Sstevel@tonic-gate 	int i;
750Sstevel@tonic-gate 
760Sstevel@tonic-gate 	/* if key is longer than 64 bytes reset it to key=MD5(key) */
770Sstevel@tonic-gate 	if (key_len > 64) {
780Sstevel@tonic-gate 		MD5_CTX tctx;
790Sstevel@tonic-gate 
800Sstevel@tonic-gate 		MD5Init(&tctx);
810Sstevel@tonic-gate 		MD5Update(&tctx, key, key_len);
820Sstevel@tonic-gate 		MD5Final(tk, &tctx);
830Sstevel@tonic-gate 
840Sstevel@tonic-gate 		key = tk;
850Sstevel@tonic-gate 		key_len = 16;
860Sstevel@tonic-gate 	}
870Sstevel@tonic-gate 
880Sstevel@tonic-gate 	/*
890Sstevel@tonic-gate 	 * the HMAC_MD5 transform looks like:
900Sstevel@tonic-gate 	 *
910Sstevel@tonic-gate 	 * MD5(K XOR opad, MD5(K XOR ipad, text))
920Sstevel@tonic-gate 	 *
930Sstevel@tonic-gate 	 * where K is an n byte key
940Sstevel@tonic-gate 	 * ipad is the byte 0x36 repeated 64 times
950Sstevel@tonic-gate 	 * opad is the byte 0x5c repeated 64 times
960Sstevel@tonic-gate 	 * and text is the data being protected
970Sstevel@tonic-gate 	 */
980Sstevel@tonic-gate 
990Sstevel@tonic-gate 	/* start out by storing key in pads */
1000Sstevel@tonic-gate 	bzero(k_ipad, sizeof (k_ipad));
1010Sstevel@tonic-gate 	bzero(k_opad, sizeof (k_opad));
1020Sstevel@tonic-gate 	bcopy(key, k_ipad, key_len);
1030Sstevel@tonic-gate 	bcopy(key, k_opad, key_len);
1040Sstevel@tonic-gate 
1050Sstevel@tonic-gate 	/* XOR key with ipad and opad values */
1060Sstevel@tonic-gate 	for (i = 0; i < 64; i++) {
1070Sstevel@tonic-gate 		k_ipad[i] ^= 0x36;
1080Sstevel@tonic-gate 		k_opad[i] ^= 0x5c;
1090Sstevel@tonic-gate 	}
1100Sstevel@tonic-gate 	/*
1110Sstevel@tonic-gate 	 * perform inner MD5
1120Sstevel@tonic-gate 	 */
1130Sstevel@tonic-gate 	MD5Init(&context);			/* init context for 1st */
1140Sstevel@tonic-gate 						/* pass */
1150Sstevel@tonic-gate 	MD5Update(&context, k_ipad, 64);	/* start with inner pad */
1160Sstevel@tonic-gate 	MD5Update(&context, text, text_len);	/* then text of datagram */
1170Sstevel@tonic-gate 	MD5Final(digest, &context);		/* finish up 1st pass */
1180Sstevel@tonic-gate 	/*
1190Sstevel@tonic-gate 	 * perform outer MD5
1200Sstevel@tonic-gate 	 */
1210Sstevel@tonic-gate 	MD5Init(&context);			/* init context for 2nd */
1220Sstevel@tonic-gate 						/* pass */
1230Sstevel@tonic-gate 	MD5Update(&context, k_opad, 64);	/* start with outer pad */
1240Sstevel@tonic-gate 	MD5Update(&context, digest, 16);	/* then results of 1st */
1250Sstevel@tonic-gate 						/* hash */
1260Sstevel@tonic-gate 	MD5Final(digest, &context);		/* finish up 2nd pass */
1270Sstevel@tonic-gate }
1280Sstevel@tonic-gate 
1290Sstevel@tonic-gate /*
1300Sstevel@tonic-gate  * If inmp is non-NULL, and we need to abort, it will use the IP/SCTP
1310Sstevel@tonic-gate  * info in initmp to send the abort. Otherwise, no abort will be sent.
1320Sstevel@tonic-gate  * If errmp is non-NULL, a chain of unrecognized parameters will
1330Sstevel@tonic-gate  * be created and returned via *errmp.
1340Sstevel@tonic-gate  *
1350Sstevel@tonic-gate  * Returns 1 if the parameters are OK (or there are no parameters), or
1360Sstevel@tonic-gate  * 0 if not.
1370Sstevel@tonic-gate  */
1380Sstevel@tonic-gate static int
1390Sstevel@tonic-gate validate_init_params(sctp_t *sctp, sctp_chunk_hdr_t *ch,
1400Sstevel@tonic-gate     sctp_init_chunk_t *init, mblk_t *inmp, sctp_parm_hdr_t **want_cookie,
1410Sstevel@tonic-gate     mblk_t **errmp, int *supp_af, uint_t *sctp_options)
1420Sstevel@tonic-gate {
1430Sstevel@tonic-gate 	sctp_parm_hdr_t		*cph;
1440Sstevel@tonic-gate 	sctp_init_chunk_t	*ic;
1450Sstevel@tonic-gate 	ssize_t			remaining;
1460Sstevel@tonic-gate 	uint16_t		serror = 0;
1470Sstevel@tonic-gate 	char			*details = NULL;
1480Sstevel@tonic-gate 	size_t			errlen = 0;
1490Sstevel@tonic-gate 	boolean_t		got_cookie = B_FALSE;
1500Sstevel@tonic-gate 	uint16_t		ptype;
1510Sstevel@tonic-gate 
1520Sstevel@tonic-gate 	if (sctp_options != NULL)
1530Sstevel@tonic-gate 		*sctp_options = 0;
1540Sstevel@tonic-gate 
1550Sstevel@tonic-gate 	/* First validate stream parameters */
1560Sstevel@tonic-gate 	if (init->sic_instr == 0 || init->sic_outstr == 0) {
1570Sstevel@tonic-gate 		serror = SCTP_ERR_BAD_MANDPARM;
1580Sstevel@tonic-gate 		dprint(1,
1590Sstevel@tonic-gate 		    ("validate_init_params: bad sid, is=%d os=%d\n",
1600Sstevel@tonic-gate 			htons(init->sic_instr), htons(init->sic_outstr)));
1610Sstevel@tonic-gate 		goto abort;
1620Sstevel@tonic-gate 	}
1630Sstevel@tonic-gate 	if (ntohl(init->sic_inittag) == 0) {
1640Sstevel@tonic-gate 		serror = SCTP_ERR_BAD_MANDPARM;
1650Sstevel@tonic-gate 		dprint(1, ("validate_init_params: inittag = 0\n"));
1660Sstevel@tonic-gate 		goto abort;
1670Sstevel@tonic-gate 	}
1680Sstevel@tonic-gate 
1690Sstevel@tonic-gate 	remaining = ntohs(ch->sch_len) - sizeof (*ch);
1700Sstevel@tonic-gate 	ic = (sctp_init_chunk_t *)(ch + 1);
1710Sstevel@tonic-gate 	remaining -= sizeof (*ic);
1720Sstevel@tonic-gate 	if (remaining < sizeof (*cph)) {
1730Sstevel@tonic-gate 		/* Nothing to validate */
1740Sstevel@tonic-gate 		if (want_cookie != NULL)
1750Sstevel@tonic-gate 			goto cookie_abort;
1760Sstevel@tonic-gate 		return (1);
1770Sstevel@tonic-gate 	}
1780Sstevel@tonic-gate 
1790Sstevel@tonic-gate 	cph = (sctp_parm_hdr_t *)(ic + 1);
1800Sstevel@tonic-gate 
1810Sstevel@tonic-gate 	while (cph != NULL) {
1820Sstevel@tonic-gate 		ptype = ntohs(cph->sph_type);
1830Sstevel@tonic-gate 		switch (ptype) {
1840Sstevel@tonic-gate 		case PARM_HBINFO:
1850Sstevel@tonic-gate 		case PARM_UNRECOGNIZED:
1860Sstevel@tonic-gate 		case PARM_ECN:
1870Sstevel@tonic-gate 			/* just ignore them */
1880Sstevel@tonic-gate 			break;
1890Sstevel@tonic-gate 		case PARM_FORWARD_TSN:
1900Sstevel@tonic-gate 			if (sctp_options != NULL)
1910Sstevel@tonic-gate 				*sctp_options |= SCTP_PRSCTP_OPTION;
1920Sstevel@tonic-gate 			break;
1930Sstevel@tonic-gate 		case PARM_COOKIE:
1940Sstevel@tonic-gate 			got_cookie = B_TRUE;
1950Sstevel@tonic-gate 			if (want_cookie != NULL) {
1960Sstevel@tonic-gate 				*want_cookie = cph;
1970Sstevel@tonic-gate 			}
1980Sstevel@tonic-gate 			break;
1990Sstevel@tonic-gate 		case PARM_ADDR4:
200432Svi117747 			*supp_af |= PARM_SUPP_V4;
201432Svi117747 			break;
2020Sstevel@tonic-gate 		case PARM_ADDR6:
203432Svi117747 			*supp_af |= PARM_SUPP_V6;
204432Svi117747 			break;
2050Sstevel@tonic-gate 		case PARM_COOKIE_PRESERVE:
2060Sstevel@tonic-gate 		case PARM_ADAPT_LAYER_IND:
2070Sstevel@tonic-gate 			/* These are OK */
2080Sstevel@tonic-gate 			break;
2090Sstevel@tonic-gate 		case PARM_ADDR_HOST_NAME:
2100Sstevel@tonic-gate 			/* Don't support this; abort the association */
2110Sstevel@tonic-gate 			serror = SCTP_ERR_BAD_ADDR;
2120Sstevel@tonic-gate 			details = (char *)cph;
2130Sstevel@tonic-gate 			errlen = ntohs(cph->sph_len);
2140Sstevel@tonic-gate 			dprint(1, ("sctp:validate_init_params: host addr\n"));
2150Sstevel@tonic-gate 			goto abort;
2160Sstevel@tonic-gate 		case PARM_SUPP_ADDRS: {
2170Sstevel@tonic-gate 			/* Make sure we have a supported addr intersection */
2180Sstevel@tonic-gate 			uint16_t *p, addrtype;
2190Sstevel@tonic-gate 			int plen;
2200Sstevel@tonic-gate 
2210Sstevel@tonic-gate 			plen = ntohs(cph->sph_len);
2220Sstevel@tonic-gate 			p = (uint16_t *)(cph + 1);
2230Sstevel@tonic-gate 			while (plen > 0) {
2240Sstevel@tonic-gate 				addrtype = ntohs(*p);
2250Sstevel@tonic-gate 				switch (addrtype) {
2260Sstevel@tonic-gate 				case PARM_ADDR6:
2270Sstevel@tonic-gate 					*supp_af |= PARM_SUPP_V6;
2280Sstevel@tonic-gate 					break;
2290Sstevel@tonic-gate 				case PARM_ADDR4:
2300Sstevel@tonic-gate 					*supp_af |= PARM_SUPP_V4;
2310Sstevel@tonic-gate 					break;
2320Sstevel@tonic-gate 				default:
2330Sstevel@tonic-gate 					/*
2340Sstevel@tonic-gate 					 * Do nothing, silently ignore hostname
2350Sstevel@tonic-gate 					 * address.
2360Sstevel@tonic-gate 					 */
2370Sstevel@tonic-gate 					break;
2380Sstevel@tonic-gate 				}
2390Sstevel@tonic-gate 				p++;
2400Sstevel@tonic-gate 				plen -= sizeof (*p);
2410Sstevel@tonic-gate 			}
2420Sstevel@tonic-gate 			break;
2430Sstevel@tonic-gate 		}
2440Sstevel@tonic-gate 		default:
2450Sstevel@tonic-gate 			/* Unrecognized param; check the high order bits */
2460Sstevel@tonic-gate 			if ((ptype & 0xc000) == 0xc000) {
2470Sstevel@tonic-gate 				/*
2480Sstevel@tonic-gate 				 * report unrecognized param, and
2490Sstevel@tonic-gate 				 * keep processing
2500Sstevel@tonic-gate 				 */
2510Sstevel@tonic-gate 				if (errmp != NULL) {
2520Sstevel@tonic-gate 					if (want_cookie != NULL) {
2530Sstevel@tonic-gate 						*errmp = sctp_make_err(sctp,
2540Sstevel@tonic-gate 						    PARM_UNRECOGNIZED,
2550Sstevel@tonic-gate 						    (void *)cph,
2560Sstevel@tonic-gate 						    ntohs(cph->sph_len));
2570Sstevel@tonic-gate 					} else {
2580Sstevel@tonic-gate 						sctp_add_unrec_parm(cph, errmp);
2590Sstevel@tonic-gate 					}
2600Sstevel@tonic-gate 				}
2610Sstevel@tonic-gate 				break;
2620Sstevel@tonic-gate 			}
2630Sstevel@tonic-gate 			if (ptype & 0x4000) {
2640Sstevel@tonic-gate 				/*
2650Sstevel@tonic-gate 				 * Stop processing and drop; report
2660Sstevel@tonic-gate 				 * unrecognized param
2670Sstevel@tonic-gate 				 */
2680Sstevel@tonic-gate 				serror = SCTP_ERR_UNREC_PARM;
2690Sstevel@tonic-gate 				details = (char *)cph;
2700Sstevel@tonic-gate 				errlen = ntohs(cph->sph_len);
2710Sstevel@tonic-gate 				goto abort;
2720Sstevel@tonic-gate 			}
2730Sstevel@tonic-gate 			if (ptype & 0x8000) {
2740Sstevel@tonic-gate 				/* skip and continue processing */
2750Sstevel@tonic-gate 				break;
2760Sstevel@tonic-gate 			}
2770Sstevel@tonic-gate 
2780Sstevel@tonic-gate 			/*
2790Sstevel@tonic-gate 			 * 2 high bits are clear; stop processing and
2800Sstevel@tonic-gate 			 * drop packet
2810Sstevel@tonic-gate 			 */
2820Sstevel@tonic-gate 			return (0);
2830Sstevel@tonic-gate 		}
2840Sstevel@tonic-gate 
2850Sstevel@tonic-gate 		cph = sctp_next_parm(cph, &remaining);
2860Sstevel@tonic-gate 	}
287432Svi117747 	/*
288432Svi117747 	 * Some sanity checks.  The following should not fail unless the
289432Svi117747 	 * other side is broken.
290432Svi117747 	 *
291432Svi117747 	 * 1. If this is a V4 endpoint but V4 address is not
292432Svi117747 	 * supported, abort.
293432Svi117747 	 * 2. If this is a V6 only endpoint but V6 address is
294432Svi117747 	 * not supported, abort.  This assumes that a V6
295432Svi117747 	 * endpoint can use both V4 and V6 addresses.
296432Svi117747 	 * We only care about supp_af when processing INIT, i.e want_cookie
297432Svi117747 	 * is NULL.
298432Svi117747 	 */
299432Svi117747 	if (want_cookie == NULL &&
300432Svi117747 	    ((sctp->sctp_family == AF_INET && !(*supp_af & PARM_SUPP_V4)) ||
301432Svi117747 	    (sctp->sctp_family == AF_INET6 && !(*supp_af & PARM_SUPP_V6) &&
302432Svi117747 	    sctp->sctp_connp->conn_ipv6_v6only))) {
303432Svi117747 		dprint(1, ("sctp:validate_init_params: supp addr\n"));
304432Svi117747 		serror = SCTP_ERR_BAD_ADDR;
305432Svi117747 		goto abort;
306432Svi117747 	}
3070Sstevel@tonic-gate 
3080Sstevel@tonic-gate 	if (want_cookie != NULL && !got_cookie) {
3090Sstevel@tonic-gate cookie_abort:
3100Sstevel@tonic-gate 		dprint(1, ("validate_init_params: cookie absent\n"));
3110Sstevel@tonic-gate 		sctp_send_abort(sctp, sctp_init2vtag(ch), SCTP_ERR_MISSING_PARM,
3120Sstevel@tonic-gate 		    details, errlen, inmp, 0, B_FALSE);
3130Sstevel@tonic-gate 		return (0);
3140Sstevel@tonic-gate 	}
3150Sstevel@tonic-gate 
3160Sstevel@tonic-gate 	/* OK */
3170Sstevel@tonic-gate 	return (1);
3180Sstevel@tonic-gate 
3190Sstevel@tonic-gate abort:
3200Sstevel@tonic-gate 	if (want_cookie != NULL)
3210Sstevel@tonic-gate 		return (0);
3220Sstevel@tonic-gate 
3230Sstevel@tonic-gate 	sctp_send_abort(sctp, sctp_init2vtag(ch), serror, details,
3240Sstevel@tonic-gate 	    errlen, inmp, 0, B_FALSE);
3250Sstevel@tonic-gate 	return (0);
3260Sstevel@tonic-gate }
3270Sstevel@tonic-gate 
3280Sstevel@tonic-gate /*
3290Sstevel@tonic-gate  * Initialize params from the INIT and INIT-ACK when the assoc. is
3300Sstevel@tonic-gate  * established.
3310Sstevel@tonic-gate  */
3320Sstevel@tonic-gate boolean_t
3330Sstevel@tonic-gate sctp_initialize_params(sctp_t *sctp, sctp_init_chunk_t *init,
3340Sstevel@tonic-gate     sctp_init_chunk_t *iack)
3350Sstevel@tonic-gate {
3360Sstevel@tonic-gate 	/* Get initial TSN */
3370Sstevel@tonic-gate 	sctp->sctp_ftsn = ntohl(init->sic_inittsn);
3380Sstevel@tonic-gate 	sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
3390Sstevel@tonic-gate 
3400Sstevel@tonic-gate 	/* Serial number is initialized to the same value as the TSN */
3410Sstevel@tonic-gate 	sctp->sctp_fcsn = sctp->sctp_lastacked;
3420Sstevel@tonic-gate 
3430Sstevel@tonic-gate 	/*
3440Sstevel@tonic-gate 	 * Get verification tags; no byteordering is necessary, since
3450Sstevel@tonic-gate 	 * verfication tags are never processed except for byte-by-byte
3460Sstevel@tonic-gate 	 * comparisons.
3470Sstevel@tonic-gate 	 */
3480Sstevel@tonic-gate 	sctp->sctp_fvtag = init->sic_inittag;
3490Sstevel@tonic-gate 	sctp->sctp_sctph->sh_verf = init->sic_inittag;
3500Sstevel@tonic-gate 	sctp->sctp_sctph6->sh_verf = init->sic_inittag;
3510Sstevel@tonic-gate 	sctp->sctp_lvtag = iack->sic_inittag;
3520Sstevel@tonic-gate 
3530Sstevel@tonic-gate 	/* Get the peer's rwnd */
3540Sstevel@tonic-gate 	sctp->sctp_frwnd = ntohl(init->sic_a_rwnd);
3550Sstevel@tonic-gate 
3560Sstevel@tonic-gate 	/* Allocate the in/out-stream counters */
3570Sstevel@tonic-gate 	sctp->sctp_num_ostr = iack->sic_outstr;
3580Sstevel@tonic-gate 	sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) *
3590Sstevel@tonic-gate 	    sctp->sctp_num_ostr, KM_NOSLEEP);
3600Sstevel@tonic-gate 	if (sctp->sctp_ostrcntrs == NULL)
3610Sstevel@tonic-gate 		return (B_FALSE);
3620Sstevel@tonic-gate 
3630Sstevel@tonic-gate 	sctp->sctp_num_istr = iack->sic_instr;
3640Sstevel@tonic-gate 	sctp->sctp_instr = kmem_zalloc(sizeof (*sctp->sctp_instr) *
3650Sstevel@tonic-gate 	    sctp->sctp_num_istr, KM_NOSLEEP);
3660Sstevel@tonic-gate 	if (sctp->sctp_instr == NULL) {
3670Sstevel@tonic-gate 		kmem_free(sctp->sctp_ostrcntrs, sizeof (uint16_t) *
3680Sstevel@tonic-gate 		    sctp->sctp_num_ostr);
3690Sstevel@tonic-gate 		sctp->sctp_ostrcntrs = NULL;
3700Sstevel@tonic-gate 		return (B_FALSE);
3710Sstevel@tonic-gate 	}
3720Sstevel@tonic-gate 	return (B_TRUE);
3730Sstevel@tonic-gate }
3740Sstevel@tonic-gate 
375*852Svi117747 /*
376*852Svi117747  * Copy the peer's original source address into addr. This relies on the
377*852Svi117747  * following format (see sctp_send_initack() below):
378*852Svi117747  * 	relative timestamp for the cookie (int64_t) +
379*852Svi117747  * 	cookie lifetime (uint32_t) +
380*852Svi117747  * 	local tie-tag (uint32_t) +  peer tie-tag (uint32_t) +
381*852Svi117747  * 	Peer's original src ...
382*852Svi117747  */
383*852Svi117747 int
384*852Svi117747 cl_sctp_cookie_paddr(sctp_chunk_hdr_t *ch, in6_addr_t *addr)
385*852Svi117747 {
386*852Svi117747 	uchar_t	*off;
387*852Svi117747 
388*852Svi117747 	ASSERT(addr != NULL);
389*852Svi117747 
390*852Svi117747 	if (ch->sch_id != CHUNK_COOKIE)
391*852Svi117747 		return (EINVAL);
392*852Svi117747 
393*852Svi117747 	off = (uchar_t *)ch + sizeof (*ch) + sizeof (int64_t) +
394*852Svi117747 	    sizeof (uint32_t) + sizeof (uint32_t) + sizeof (uint32_t);
395*852Svi117747 
396*852Svi117747 	bcopy(off, addr, sizeof (*addr));
397*852Svi117747 
398*852Svi117747 	return (0);
399*852Svi117747 }
400*852Svi117747 
4010Sstevel@tonic-gate #define	SCTP_CALC_COOKIE_LEN(initcp) \
4020Sstevel@tonic-gate 	sizeof (int64_t) +		/* timestamp */			\
4030Sstevel@tonic-gate 	sizeof (uint32_t) +		/* cookie lifetime */		\
4040Sstevel@tonic-gate 	sizeof (sctp_init_chunk_t) +	/* INIT ACK */			\
4050Sstevel@tonic-gate 	sizeof (in6_addr_t) +		/* peer's original source */ 	\
4060Sstevel@tonic-gate 	ntohs((initcp)->sch_len) +	/* peer's INIT */		\
4070Sstevel@tonic-gate 	sizeof (uint32_t) +		/* local tie-tag */		\
4080Sstevel@tonic-gate 	sizeof (uint32_t) +		/* peer tie-tag */		\
4090Sstevel@tonic-gate 	sizeof (sctp_parm_hdr_t) +	/* param header */		\
4100Sstevel@tonic-gate 	16				/* MD5 hash */
4110Sstevel@tonic-gate 
4120Sstevel@tonic-gate void
4130Sstevel@tonic-gate sctp_send_initack(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *initmp)
4140Sstevel@tonic-gate {
4150Sstevel@tonic-gate 	ipha_t			*initiph;
4160Sstevel@tonic-gate 	ip6_t			*initip6h;
4170Sstevel@tonic-gate 	ipha_t			*iackiph;
4180Sstevel@tonic-gate 	ip6_t			*iackip6h;
4190Sstevel@tonic-gate 	sctp_chunk_hdr_t	*iack_ch;
4200Sstevel@tonic-gate 	sctp_init_chunk_t	*iack;
4210Sstevel@tonic-gate 	sctp_init_chunk_t	*init;
4220Sstevel@tonic-gate 	sctp_hdr_t		*iacksh;
4230Sstevel@tonic-gate 	sctp_hdr_t		*initsh;
4240Sstevel@tonic-gate 	size_t			cookielen;
4250Sstevel@tonic-gate 	size_t			iacklen;
4260Sstevel@tonic-gate 	size_t			ipsctplen;
4270Sstevel@tonic-gate 	size_t			errlen = 0;
4280Sstevel@tonic-gate 	sctp_parm_hdr_t		*cookieph;
4290Sstevel@tonic-gate 	mblk_t			*iackmp;
4300Sstevel@tonic-gate 	uint32_t		itag;
4310Sstevel@tonic-gate 	uint32_t		itsn;
4320Sstevel@tonic-gate 	int64_t			*now;
4330Sstevel@tonic-gate 	int64_t			nowt;
4340Sstevel@tonic-gate 	uint32_t		*lifetime;
4350Sstevel@tonic-gate 	char			*p;
4360Sstevel@tonic-gate 	boolean_t		 isv4;
437432Svi117747 	int			supp_af = 0;
4380Sstevel@tonic-gate 	uint_t			sctp_options;
4390Sstevel@tonic-gate 	uint32_t		*ttag;
4400Sstevel@tonic-gate 	int			pad;
4410Sstevel@tonic-gate 	mblk_t			*errmp = NULL;
4420Sstevel@tonic-gate 	boolean_t		initcollision = B_FALSE;
443432Svi117747 	boolean_t		linklocal = B_FALSE;
4440Sstevel@tonic-gate 
4450Sstevel@tonic-gate 	BUMP_LOCAL(sctp->sctp_ibchunks);
4460Sstevel@tonic-gate 	isv4 = (IPH_HDR_VERSION(initmp->b_rptr) == IPV4_VERSION);
4470Sstevel@tonic-gate 
4480Sstevel@tonic-gate 	/* Extract the INIT chunk */
4490Sstevel@tonic-gate 	if (isv4) {
4500Sstevel@tonic-gate 		initiph = (ipha_t *)initmp->b_rptr;
4510Sstevel@tonic-gate 		initsh = (sctp_hdr_t *)((char *)initiph +
4520Sstevel@tonic-gate 		    IPH_HDR_LENGTH(initmp->b_rptr));
4530Sstevel@tonic-gate 		ipsctplen = sctp->sctp_ip_hdr_len;
454432Svi117747 		supp_af |= PARM_SUPP_V4;
4550Sstevel@tonic-gate 	} else {
4560Sstevel@tonic-gate 		initip6h = (ip6_t *)initmp->b_rptr;
4570Sstevel@tonic-gate 		initsh = (sctp_hdr_t *)(initip6h + 1);
4580Sstevel@tonic-gate 		ipsctplen = sctp->sctp_ip_hdr6_len;
459432Svi117747 		if (IN6_IS_ADDR_LINKLOCAL(&initip6h->ip6_src))
460432Svi117747 			linklocal = B_TRUE;
461432Svi117747 		supp_af |= PARM_SUPP_V6;
4620Sstevel@tonic-gate 	}
4630Sstevel@tonic-gate 	ASSERT(OK_32PTR(initsh));
4640Sstevel@tonic-gate 	init = (sctp_init_chunk_t *)((char *)(initsh + 1) + sizeof (*iack_ch));
4650Sstevel@tonic-gate 
4660Sstevel@tonic-gate 	/* Make sure we like the peer's parameters */
4670Sstevel@tonic-gate 	if (validate_init_params(sctp, ch, init, initmp, NULL, &errmp,
4680Sstevel@tonic-gate 		&supp_af, &sctp_options) == 0) {
4690Sstevel@tonic-gate 		return;
4700Sstevel@tonic-gate 	}
4710Sstevel@tonic-gate 	if (errmp != NULL)
4720Sstevel@tonic-gate 		errlen = msgdsize(errmp);
4730Sstevel@tonic-gate 	if (sctp->sctp_family == AF_INET) {
4740Sstevel@tonic-gate 		/*
4750Sstevel@tonic-gate 		 * Irregardless of the supported address in the INIT, v4
4760Sstevel@tonic-gate 		 * must be supported.
4770Sstevel@tonic-gate 		 */
4780Sstevel@tonic-gate 		supp_af = PARM_SUPP_V4;
4790Sstevel@tonic-gate 	}
4800Sstevel@tonic-gate 	if (sctp->sctp_state <= SCTPS_LISTEN) {
4810Sstevel@tonic-gate 		/* normal, expected INIT: generate new vtag and itsn */
4820Sstevel@tonic-gate 		(void) random_get_pseudo_bytes((uint8_t *)&itag, sizeof (itag));
4830Sstevel@tonic-gate 		if (itag == 0)
4840Sstevel@tonic-gate 			itag = (uint32_t)gethrtime();
4850Sstevel@tonic-gate 		itsn = itag + 1;
4860Sstevel@tonic-gate 		itag = htonl(itag);
4870Sstevel@tonic-gate 	} else if (sctp->sctp_state == SCTPS_COOKIE_WAIT ||
4880Sstevel@tonic-gate 	    sctp->sctp_state == SCTPS_COOKIE_ECHOED) {
4890Sstevel@tonic-gate 		/* init collision; copy vtag and itsn from sctp */
4900Sstevel@tonic-gate 		itag = sctp->sctp_lvtag;
4910Sstevel@tonic-gate 		itsn = sctp->sctp_ltsn;
4920Sstevel@tonic-gate 		/*
4930Sstevel@tonic-gate 		 * In addition we need to send all the params that was sent
4940Sstevel@tonic-gate 		 * in our INIT chunk. Essentially, it is only the supported
4950Sstevel@tonic-gate 		 * address params that we need to add.
4960Sstevel@tonic-gate 		 */
4970Sstevel@tonic-gate 		initcollision = B_TRUE;
498432Svi117747 		/*
499432Svi117747 		 * When we sent the INIT, we should have set linklocal in
500432Svi117747 		 * the sctp which should be good enough.
501432Svi117747 		 */
502432Svi117747 		if (linklocal)
503432Svi117747 			linklocal = B_FALSE;
5040Sstevel@tonic-gate 	} else {
5050Sstevel@tonic-gate 		/* peer restart; generate new vtag but keep everything else */
5060Sstevel@tonic-gate 		(void) random_get_pseudo_bytes((uint8_t *)&itag, sizeof (itag));
5070Sstevel@tonic-gate 		if (itag == 0)
5080Sstevel@tonic-gate 			itag = (uint32_t)gethrtime();
5090Sstevel@tonic-gate 		itag = htonl(itag);
5100Sstevel@tonic-gate 		itsn = sctp->sctp_ltsn;
5110Sstevel@tonic-gate 	}
5120Sstevel@tonic-gate 
5130Sstevel@tonic-gate 	/*
5140Sstevel@tonic-gate 	 * Allocate a mblk for the INIT ACK, consisting of the link layer
5150Sstevel@tonic-gate 	 * header, the IP header, the SCTP common header, and INIT ACK chunk,
5160Sstevel@tonic-gate 	 * and finally the COOKIE parameter.
5170Sstevel@tonic-gate 	 */
5180Sstevel@tonic-gate 	cookielen = SCTP_CALC_COOKIE_LEN(ch);
5190Sstevel@tonic-gate 	iacklen = sizeof (*iack_ch) + sizeof (*iack) + cookielen;
5200Sstevel@tonic-gate 	if (sctp->sctp_send_adaption)
5210Sstevel@tonic-gate 		iacklen += (sizeof (sctp_parm_hdr_t) + sizeof (uint32_t));
5220Sstevel@tonic-gate 	if (((sctp_options & SCTP_PRSCTP_OPTION) || initcollision) &&
5230Sstevel@tonic-gate 	    sctp->sctp_prsctp_aware && sctp_prsctp_enabled) {
5240Sstevel@tonic-gate 		iacklen += sctp_options_param_len(sctp, SCTP_PRSCTP_OPTION);
5250Sstevel@tonic-gate 	}
5260Sstevel@tonic-gate 	if (initcollision)
5270Sstevel@tonic-gate 		iacklen += sctp_supaddr_param_len(sctp);
528432Svi117747 	if (!linklocal)
529432Svi117747 		iacklen += sctp_addr_params_len(sctp, supp_af, B_FALSE);
5300Sstevel@tonic-gate 	ipsctplen += sizeof (*iacksh) + iacklen;
5310Sstevel@tonic-gate 	iacklen += errlen;
5320Sstevel@tonic-gate 	if ((pad = ipsctplen % 4) != 0) {
5330Sstevel@tonic-gate 		pad = 4 - pad;
5340Sstevel@tonic-gate 		ipsctplen += pad;
5350Sstevel@tonic-gate 	}
5360Sstevel@tonic-gate 	iackmp = allocb(ipsctplen + sctp_wroff_xtra, BPRI_MED);
5370Sstevel@tonic-gate 	if (iackmp == NULL) {
5380Sstevel@tonic-gate 		sctp_send_abort(sctp, sctp_init2vtag(ch),
5390Sstevel@tonic-gate 		    SCTP_ERR_NO_RESOURCES, NULL, 0, initmp, 0, B_FALSE);
5400Sstevel@tonic-gate 		return;
5410Sstevel@tonic-gate 	}
5420Sstevel@tonic-gate 
5430Sstevel@tonic-gate 	/* Copy in the [imcomplete] IP/SCTP composite header */
5440Sstevel@tonic-gate 	p = (char *)(iackmp->b_rptr + sctp_wroff_xtra);
5450Sstevel@tonic-gate 	iackmp->b_rptr = (uchar_t *)p;
5460Sstevel@tonic-gate 	if (isv4) {
5470Sstevel@tonic-gate 		bcopy(sctp->sctp_iphc, p, sctp->sctp_hdr_len);
5480Sstevel@tonic-gate 		iackiph = (ipha_t *)p;
5490Sstevel@tonic-gate 
5500Sstevel@tonic-gate 		/* Copy the peer's IP addr */
5510Sstevel@tonic-gate 		iackiph->ipha_dst = initiph->ipha_src;
5520Sstevel@tonic-gate 		iackiph->ipha_src = initiph->ipha_dst;
5530Sstevel@tonic-gate 		iackiph->ipha_length = htons(ipsctplen + errlen);
5540Sstevel@tonic-gate 		iacksh = (sctp_hdr_t *)(p + sctp->sctp_ip_hdr_len);
5550Sstevel@tonic-gate 	} else {
5560Sstevel@tonic-gate 		bcopy(sctp->sctp_iphc6, p, sctp->sctp_hdr6_len);
5570Sstevel@tonic-gate 		iackip6h = (ip6_t *)p;
5580Sstevel@tonic-gate 
5590Sstevel@tonic-gate 		/* Copy the peer's IP addr */
5600Sstevel@tonic-gate 		iackip6h->ip6_dst = initip6h->ip6_src;
5610Sstevel@tonic-gate 		iackip6h->ip6_src = initip6h->ip6_dst;
5620Sstevel@tonic-gate 		iackip6h->ip6_plen = htons(ipsctplen - sizeof (*iackip6h) +
5630Sstevel@tonic-gate 		    errlen);
5640Sstevel@tonic-gate 		iacksh = (sctp_hdr_t *)(p + sctp->sctp_ip_hdr6_len);
5650Sstevel@tonic-gate 	}
5660Sstevel@tonic-gate 	ASSERT(OK_32PTR(iacksh));
5670Sstevel@tonic-gate 
5680Sstevel@tonic-gate 	/* Fill in the holes in the SCTP common header */
5690Sstevel@tonic-gate 	iacksh->sh_sport = initsh->sh_dport;
5700Sstevel@tonic-gate 	iacksh->sh_dport = initsh->sh_sport;
5710Sstevel@tonic-gate 	iacksh->sh_verf = init->sic_inittag;
5720Sstevel@tonic-gate 
5730Sstevel@tonic-gate 	/* INIT ACK chunk header */
5740Sstevel@tonic-gate 	iack_ch = (sctp_chunk_hdr_t *)(iacksh + 1);
5750Sstevel@tonic-gate 	iack_ch->sch_id = CHUNK_INIT_ACK;
5760Sstevel@tonic-gate 	iack_ch->sch_flags = 0;
5770Sstevel@tonic-gate 	iack_ch->sch_len = htons(iacklen);
5780Sstevel@tonic-gate 
5790Sstevel@tonic-gate 	/* The INIT ACK itself */
5800Sstevel@tonic-gate 	iack = (sctp_init_chunk_t *)(iack_ch + 1);
5810Sstevel@tonic-gate 	iack->sic_inittag = itag;	/* already in network byteorder */
5820Sstevel@tonic-gate 	iack->sic_inittsn = htonl(itsn);
5830Sstevel@tonic-gate 
5840Sstevel@tonic-gate 	iack->sic_a_rwnd = htonl(sctp->sctp_rwnd);
5850Sstevel@tonic-gate 	/* Advertise what we would want to have as stream #'s */
5860Sstevel@tonic-gate 	iack->sic_outstr = htons(MIN(sctp->sctp_num_ostr,
5870Sstevel@tonic-gate 	    ntohs(init->sic_instr)));
5880Sstevel@tonic-gate 	iack->sic_instr = htons(sctp->sctp_num_istr);
5890Sstevel@tonic-gate 
5900Sstevel@tonic-gate 	p = (char *)(iack + 1);
5910Sstevel@tonic-gate 	p += sctp_adaption_code_param(sctp, (uchar_t *)p);
5920Sstevel@tonic-gate 	if (initcollision)
5930Sstevel@tonic-gate 		p += sctp_supaddr_param(sctp, (uchar_t *)p);
594432Svi117747 	if (!linklocal)
595432Svi117747 		p += sctp_addr_params(sctp, supp_af, (uchar_t *)p);
5960Sstevel@tonic-gate 	if (((sctp_options & SCTP_PRSCTP_OPTION) || initcollision) &&
5970Sstevel@tonic-gate 	    sctp->sctp_prsctp_aware && sctp_prsctp_enabled) {
5980Sstevel@tonic-gate 		p += sctp_options_param(sctp, p, SCTP_PRSCTP_OPTION);
5990Sstevel@tonic-gate 	}
6000Sstevel@tonic-gate 	/*
6010Sstevel@tonic-gate 	 * Generate and lay in the COOKIE parameter.
6020Sstevel@tonic-gate 	 *
603*852Svi117747 	 * Any change here that results in a change of location for
604*852Svi117747 	 * the peer's orig source address must be propagated to the fn
605*852Svi117747 	 * cl_sctp_cookie_paddr() above.
606*852Svi117747 	 *
6070Sstevel@tonic-gate 	 * The cookie consists of:
6080Sstevel@tonic-gate 	 * 1. The relative timestamp for the cookie (lbolt64)
6090Sstevel@tonic-gate 	 * 2. The cookie lifetime (uint32_t) in tick
6100Sstevel@tonic-gate 	 * 3. The local tie-tag
6110Sstevel@tonic-gate 	 * 4. The peer tie-tag
6120Sstevel@tonic-gate 	 * 5. Peer's original src, used to confirm the validity of address.
6130Sstevel@tonic-gate 	 * 6. Our INIT ACK chunk, less any parameters
6140Sstevel@tonic-gate 	 * 7. The INIT chunk (may contain parameters)
6150Sstevel@tonic-gate 	 * 8. 128-bit MD5 signature.
6160Sstevel@tonic-gate 	 *
6170Sstevel@tonic-gate 	 * Since the timestamp values will only be evaluated locally, we
6180Sstevel@tonic-gate 	 * don't need to worry about byte-ordering them.
6190Sstevel@tonic-gate 	 */
6200Sstevel@tonic-gate 	cookieph = (sctp_parm_hdr_t *)p;
6210Sstevel@tonic-gate 	cookieph->sph_type = htons(PARM_COOKIE);
6220Sstevel@tonic-gate 	cookieph->sph_len = htons(cookielen);
6230Sstevel@tonic-gate 
6240Sstevel@tonic-gate 	/* timestamp */
6250Sstevel@tonic-gate 	now = (int64_t *)(cookieph + 1);
6260Sstevel@tonic-gate 	nowt = lbolt64;
6270Sstevel@tonic-gate 	bcopy(&nowt, now, sizeof (*now));
6280Sstevel@tonic-gate 
6290Sstevel@tonic-gate 	/* cookie lifetime -- need configuration */
6300Sstevel@tonic-gate 	lifetime = (uint32_t *)(now + 1);
6310Sstevel@tonic-gate 	*lifetime = sctp->sctp_cookie_lifetime;
6320Sstevel@tonic-gate 
6330Sstevel@tonic-gate 	/* Set the tie-tags */
6340Sstevel@tonic-gate 	ttag = (uint32_t *)(lifetime + 1);
6350Sstevel@tonic-gate 	if (sctp->sctp_state <= SCTPS_COOKIE_WAIT) {
6360Sstevel@tonic-gate 		*ttag = 0;
6370Sstevel@tonic-gate 		ttag++;
6380Sstevel@tonic-gate 		*ttag = 0;
6390Sstevel@tonic-gate 		ttag++;
6400Sstevel@tonic-gate 	} else {
6410Sstevel@tonic-gate 		/* local tie-tag (network byte-order) */
6420Sstevel@tonic-gate 		*ttag = sctp->sctp_lvtag;
6430Sstevel@tonic-gate 		ttag++;
6440Sstevel@tonic-gate 		/* peer tie-tag (network byte-order) */
6450Sstevel@tonic-gate 		*ttag = sctp->sctp_fvtag;
6460Sstevel@tonic-gate 		ttag++;
6470Sstevel@tonic-gate 	}
6480Sstevel@tonic-gate 	/*
6490Sstevel@tonic-gate 	 * Copy in peer's original source address so that we can confirm
6500Sstevel@tonic-gate 	 * the reachability later.
6510Sstevel@tonic-gate 	 */
6520Sstevel@tonic-gate 	p = (char *)ttag;
6530Sstevel@tonic-gate 	if (isv4) {
6540Sstevel@tonic-gate 		in6_addr_t peer_addr;
6550Sstevel@tonic-gate 
6560Sstevel@tonic-gate 		IN6_IPADDR_TO_V4MAPPED(iackiph->ipha_dst, &peer_addr);
6570Sstevel@tonic-gate 		bcopy(&peer_addr, p, sizeof (in6_addr_t));
6580Sstevel@tonic-gate 	} else {
6590Sstevel@tonic-gate 		bcopy(&iackip6h->ip6_dst, p, sizeof (in6_addr_t));
6600Sstevel@tonic-gate 	}
6610Sstevel@tonic-gate 	p += sizeof (in6_addr_t);
6620Sstevel@tonic-gate 	/* Copy in our INIT ACK chunk */
6630Sstevel@tonic-gate 	bcopy(iack, p, sizeof (*iack));
6640Sstevel@tonic-gate 	iack = (sctp_init_chunk_t *)p;
6650Sstevel@tonic-gate 	/* Set the # of streams we'll end up using */
6660Sstevel@tonic-gate 	iack->sic_outstr = MIN(sctp->sctp_num_ostr, ntohs(init->sic_instr));
6670Sstevel@tonic-gate 	iack->sic_instr = MIN(sctp->sctp_num_istr, ntohs(init->sic_outstr));
6680Sstevel@tonic-gate 	p += sizeof (*iack);
6690Sstevel@tonic-gate 
6700Sstevel@tonic-gate 	/* Copy in the peer's INIT chunk */
6710Sstevel@tonic-gate 	bcopy(ch, p, ntohs(ch->sch_len));
6720Sstevel@tonic-gate 	p += ntohs(ch->sch_len);
6730Sstevel@tonic-gate 
6740Sstevel@tonic-gate 	/*
6750Sstevel@tonic-gate 	 * Calculate the HMAC ICV into the digest slot in buf.
6760Sstevel@tonic-gate 	 * First, generate a new secret if the current secret is
6770Sstevel@tonic-gate 	 * older than the new secret lifetime parameter permits,
6780Sstevel@tonic-gate 	 * copying the current secret to sctp_old_secret.
6790Sstevel@tonic-gate 	 */
6800Sstevel@tonic-gate 	if (sctp_new_secret_interval > 0 &&
6810Sstevel@tonic-gate 	    (sctp->sctp_last_secret_update +
6820Sstevel@tonic-gate 	    MSEC_TO_TICK(sctp_new_secret_interval)) <= nowt) {
6830Sstevel@tonic-gate 		bcopy(sctp->sctp_secret, sctp->sctp_old_secret,
6840Sstevel@tonic-gate 		    SCTP_SECRET_LEN);
6850Sstevel@tonic-gate 		(void) random_get_pseudo_bytes(sctp->sctp_secret,
6860Sstevel@tonic-gate 		    SCTP_SECRET_LEN);
6870Sstevel@tonic-gate 		sctp->sctp_last_secret_update = nowt;
6880Sstevel@tonic-gate 	}
6890Sstevel@tonic-gate 
6900Sstevel@tonic-gate 	hmac_md5((uchar_t *)now, cookielen - sizeof (*cookieph) - 16,
6910Sstevel@tonic-gate 	    (uchar_t *)sctp->sctp_secret, SCTP_SECRET_LEN, (uchar_t *)p);
6920Sstevel@tonic-gate 
6930Sstevel@tonic-gate 	iackmp->b_wptr = iackmp->b_rptr + ipsctplen;
6940Sstevel@tonic-gate 	iackmp->b_cont = errmp;		/*  OK if NULL */
6950Sstevel@tonic-gate 
6960Sstevel@tonic-gate 	/*
6970Sstevel@tonic-gate 	 * Stash the conn ptr info. for IP only as e don't have any
6980Sstevel@tonic-gate 	 * cached IRE.
6990Sstevel@tonic-gate 	 */
7000Sstevel@tonic-gate 	SCTP_STASH_IPINFO(iackmp, (ire_t *)NULL);
7010Sstevel@tonic-gate 
7020Sstevel@tonic-gate 	/* XXX sctp == sctp_g_q, so using its obchunks is valid */
7030Sstevel@tonic-gate 	BUMP_LOCAL(sctp->sctp_opkts);
7040Sstevel@tonic-gate 	BUMP_LOCAL(sctp->sctp_obchunks);
7050Sstevel@tonic-gate 
7060Sstevel@tonic-gate 	/* OK to call IP_PUT() here instead of sctp_add_sendq(). */
7070Sstevel@tonic-gate 	CONN_INC_REF(sctp->sctp_connp);
7080Sstevel@tonic-gate 	iackmp->b_flag |= MSGHASREF;
7090Sstevel@tonic-gate 	IP_PUT(iackmp, sctp->sctp_connp, isv4);
7100Sstevel@tonic-gate }
7110Sstevel@tonic-gate 
7120Sstevel@tonic-gate void
7130Sstevel@tonic-gate sctp_send_cookie_ack(sctp_t *sctp)
7140Sstevel@tonic-gate {
7150Sstevel@tonic-gate 	sctp_chunk_hdr_t *cach;
7160Sstevel@tonic-gate 	mblk_t *camp;
7170Sstevel@tonic-gate 
7180Sstevel@tonic-gate 	camp = sctp_make_mp(sctp, NULL, sizeof (*cach));
7190Sstevel@tonic-gate 	if (camp == NULL) {
7200Sstevel@tonic-gate 		/* XXX should abort, but don't have the inmp anymore */
7210Sstevel@tonic-gate 		return;
7220Sstevel@tonic-gate 	}
7230Sstevel@tonic-gate 
7240Sstevel@tonic-gate 	cach = (sctp_chunk_hdr_t *)camp->b_wptr;
7250Sstevel@tonic-gate 	camp->b_wptr = (uchar_t *)(cach + 1);
7260Sstevel@tonic-gate 	cach->sch_id = CHUNK_COOKIE_ACK;
7270Sstevel@tonic-gate 	cach->sch_flags = 0;
7280Sstevel@tonic-gate 	cach->sch_len = htons(sizeof (*cach));
7290Sstevel@tonic-gate 
7300Sstevel@tonic-gate 	sctp_set_iplen(sctp, camp);
7310Sstevel@tonic-gate 
7320Sstevel@tonic-gate 	BUMP_LOCAL(sctp->sctp_obchunks);
7330Sstevel@tonic-gate 
7340Sstevel@tonic-gate 	sctp_add_sendq(sctp, camp);
7350Sstevel@tonic-gate }
7360Sstevel@tonic-gate 
7370Sstevel@tonic-gate static int
7380Sstevel@tonic-gate sctp_find_al_ind(sctp_parm_hdr_t *sph, ssize_t len, uint32_t *adaption_code)
7390Sstevel@tonic-gate {
7400Sstevel@tonic-gate 
7410Sstevel@tonic-gate 	if (len < sizeof (*sph))
7420Sstevel@tonic-gate 		return (-1);
7430Sstevel@tonic-gate 	while (sph != NULL) {
7440Sstevel@tonic-gate 		if (sph->sph_type == htons(PARM_ADAPT_LAYER_IND) &&
7450Sstevel@tonic-gate 		    ntohs(sph->sph_len) >= (sizeof (*sph) +
7460Sstevel@tonic-gate 			sizeof (uint32_t))) {
7470Sstevel@tonic-gate 			*adaption_code = *(uint32_t *)(sph + 1);
7480Sstevel@tonic-gate 			return (0);
7490Sstevel@tonic-gate 		}
7500Sstevel@tonic-gate 		sph = sctp_next_parm(sph, &len);
7510Sstevel@tonic-gate 	}
7520Sstevel@tonic-gate 	return (-1);
7530Sstevel@tonic-gate }
7540Sstevel@tonic-gate 
7550Sstevel@tonic-gate void
7560Sstevel@tonic-gate sctp_send_cookie_echo(sctp_t *sctp, sctp_chunk_hdr_t *iackch, mblk_t *iackmp)
7570Sstevel@tonic-gate {
7580Sstevel@tonic-gate 	mblk_t			*cemp;
7590Sstevel@tonic-gate 	mblk_t			*mp = NULL;
7600Sstevel@tonic-gate 	mblk_t			*head;
7610Sstevel@tonic-gate 	mblk_t			*meta;
7620Sstevel@tonic-gate 	sctp_faddr_t		*fp;
7630Sstevel@tonic-gate 	sctp_chunk_hdr_t	*cech;
7640Sstevel@tonic-gate 	sctp_init_chunk_t	 *iack;
7650Sstevel@tonic-gate 	int32_t			cansend;
7660Sstevel@tonic-gate 	int32_t			seglen;
7670Sstevel@tonic-gate 	size_t			ceclen;
7680Sstevel@tonic-gate 	sctp_parm_hdr_t		*cph;
7690Sstevel@tonic-gate 	sctp_data_hdr_t		*sdc;
7700Sstevel@tonic-gate 	sctp_tf_t		*tf;
771432Svi117747 	int			pad = 0;
7720Sstevel@tonic-gate 	int			hdrlen;
7730Sstevel@tonic-gate 	mblk_t			*errmp = NULL;
7740Sstevel@tonic-gate 	uint_t			sctp_options;
7750Sstevel@tonic-gate 	int			error;
7760Sstevel@tonic-gate 	uint16_t		old_num_str;
7770Sstevel@tonic-gate 
7780Sstevel@tonic-gate 	iack = (sctp_init_chunk_t *)(iackch + 1);
7790Sstevel@tonic-gate 
7800Sstevel@tonic-gate 	cph = NULL;
7810Sstevel@tonic-gate 	if (validate_init_params(sctp, iackch, iack, iackmp, &cph, &errmp,
7820Sstevel@tonic-gate 	    &pad, &sctp_options) == 0) { /* result in 'pad' ignored */
7830Sstevel@tonic-gate 		BUMP_MIB(&sctp_mib, sctpAborted);
7840Sstevel@tonic-gate 		sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL);
7850Sstevel@tonic-gate 		sctp_clean_death(sctp, ECONNABORTED);
7860Sstevel@tonic-gate 		return;
7870Sstevel@tonic-gate 	}
7880Sstevel@tonic-gate 	ASSERT(cph != NULL);
7890Sstevel@tonic-gate 
7900Sstevel@tonic-gate 	ASSERT(sctp->sctp_cookie_mp == NULL);
7910Sstevel@tonic-gate 
7920Sstevel@tonic-gate 	/* Got a cookie to echo back; allocate an mblk */
7930Sstevel@tonic-gate 	ceclen = sizeof (*cech) + ntohs(cph->sph_len) - sizeof (*cph);
7940Sstevel@tonic-gate 	if ((pad = ceclen & (SCTP_ALIGN - 1)) != 0)
7950Sstevel@tonic-gate 		pad = SCTP_ALIGN - pad;
7960Sstevel@tonic-gate 
7970Sstevel@tonic-gate 	if (IPH_HDR_VERSION(iackmp->b_rptr) == IPV4_VERSION)
7980Sstevel@tonic-gate 		hdrlen = sctp->sctp_hdr_len;
7990Sstevel@tonic-gate 	else
8000Sstevel@tonic-gate 		hdrlen = sctp->sctp_hdr6_len;
8010Sstevel@tonic-gate 
8020Sstevel@tonic-gate 	cemp = allocb(sctp_wroff_xtra + hdrlen + ceclen + pad, BPRI_MED);
8030Sstevel@tonic-gate 	if (cemp == NULL) {
8040Sstevel@tonic-gate 		SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
8050Sstevel@tonic-gate 		    sctp->sctp_current->rto);
8060Sstevel@tonic-gate 		if (errmp != NULL)
8070Sstevel@tonic-gate 			freeb(errmp);
8080Sstevel@tonic-gate 		return;
8090Sstevel@tonic-gate 	}
8100Sstevel@tonic-gate 	cemp->b_rptr += (sctp_wroff_xtra + hdrlen);
8110Sstevel@tonic-gate 
8120Sstevel@tonic-gate 	/* Process the INIT ACK */
8130Sstevel@tonic-gate 	sctp->sctp_sctph->sh_verf = iack->sic_inittag;
8140Sstevel@tonic-gate 	sctp->sctp_sctph6->sh_verf = iack->sic_inittag;
8150Sstevel@tonic-gate 	sctp->sctp_fvtag = iack->sic_inittag;
8160Sstevel@tonic-gate 	sctp->sctp_ftsn = ntohl(iack->sic_inittsn);
8170Sstevel@tonic-gate 	sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
8180Sstevel@tonic-gate 	sctp->sctp_fcsn = sctp->sctp_lastacked;
8190Sstevel@tonic-gate 	sctp->sctp_frwnd = ntohl(iack->sic_a_rwnd);
8200Sstevel@tonic-gate 
8210Sstevel@tonic-gate 	/*
8220Sstevel@tonic-gate 	 * Populate sctp with addresses given in the INIT ACK or IP header.
8230Sstevel@tonic-gate 	 * Need to set the df bit in the current fp as it has been cleared
8240Sstevel@tonic-gate 	 * in sctp_connect().
8250Sstevel@tonic-gate 	 */
8260Sstevel@tonic-gate 	sctp->sctp_current->df = B_TRUE;
8270Sstevel@tonic-gate 	/*
8280Sstevel@tonic-gate 	 * Since IP uses this info during the fanout process, we need to hold
8290Sstevel@tonic-gate 	 * the lock for this hash line while performing this operation.
8300Sstevel@tonic-gate 	 */
8310Sstevel@tonic-gate 	/* XXX sctp_conn_fanout + SCTP_CONN_HASH(sctp->sctp_ports); */
8320Sstevel@tonic-gate 	ASSERT(sctp->sctp_conn_tfp != NULL);
8330Sstevel@tonic-gate 	tf = sctp->sctp_conn_tfp;
8340Sstevel@tonic-gate 	/* sctp isn't a listener so only need to hold conn fanout lock */
8350Sstevel@tonic-gate 	mutex_enter(&tf->tf_lock);
8360Sstevel@tonic-gate 	if (sctp_get_addrparams(sctp, NULL, iackmp, iackch, NULL) != 0) {
8370Sstevel@tonic-gate 		mutex_exit(&tf->tf_lock);
8380Sstevel@tonic-gate 		freeb(cemp);
8390Sstevel@tonic-gate 		SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current,
8400Sstevel@tonic-gate 		    sctp->sctp_current->rto);
8410Sstevel@tonic-gate 		if (errmp != NULL)
8420Sstevel@tonic-gate 			freeb(errmp);
8430Sstevel@tonic-gate 		return;
8440Sstevel@tonic-gate 	}
8450Sstevel@tonic-gate 	mutex_exit(&tf->tf_lock);
8460Sstevel@tonic-gate 
8470Sstevel@tonic-gate 	fp = sctp->sctp_current;
8480Sstevel@tonic-gate 
8490Sstevel@tonic-gate 	/*
8500Sstevel@tonic-gate 	 * There could be a case when we get an INIT-ACK again, if the INIT
8510Sstevel@tonic-gate 	 * is re-transmitted, for e.g., which means we would have already
8520Sstevel@tonic-gate 	 * allocated this resource earlier (also for sctp_instr). In this
8530Sstevel@tonic-gate 	 * case we check and re-allocate, if necessary.
8540Sstevel@tonic-gate 	 */
8550Sstevel@tonic-gate 	old_num_str = sctp->sctp_num_ostr;
8560Sstevel@tonic-gate 	if (ntohs(iack->sic_instr) < sctp->sctp_num_ostr)
8570Sstevel@tonic-gate 		sctp->sctp_num_ostr = ntohs(iack->sic_instr);
8580Sstevel@tonic-gate 	if (sctp->sctp_ostrcntrs == NULL) {
8590Sstevel@tonic-gate 		sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) *
8600Sstevel@tonic-gate 		    sctp->sctp_num_ostr, KM_NOSLEEP);
8610Sstevel@tonic-gate 	} else {
8620Sstevel@tonic-gate 		ASSERT(old_num_str > 0);
8630Sstevel@tonic-gate 		if (old_num_str != sctp->sctp_num_ostr) {
8640Sstevel@tonic-gate 			kmem_free(sctp->sctp_ostrcntrs, sizeof (uint16_t) *
8650Sstevel@tonic-gate 			    old_num_str);
8660Sstevel@tonic-gate 			sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) *
8670Sstevel@tonic-gate 			    sctp->sctp_num_ostr, KM_NOSLEEP);
8680Sstevel@tonic-gate 		}
8690Sstevel@tonic-gate 	}
8700Sstevel@tonic-gate 	if (sctp->sctp_ostrcntrs == NULL) {
8710Sstevel@tonic-gate 		freeb(cemp);
8720Sstevel@tonic-gate 		SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
8730Sstevel@tonic-gate 		if (errmp != NULL)
8740Sstevel@tonic-gate 			freeb(errmp);
8750Sstevel@tonic-gate 		return;
8760Sstevel@tonic-gate 	}
8770Sstevel@tonic-gate 
8780Sstevel@tonic-gate 	/*
8790Sstevel@tonic-gate 	 * Allocate the in stream tracking array. Comments for sctp_ostrcntrs
8800Sstevel@tonic-gate 	 * hold here too.
8810Sstevel@tonic-gate 	 */
8820Sstevel@tonic-gate 	old_num_str = sctp->sctp_num_istr;
8830Sstevel@tonic-gate 	if (ntohs(iack->sic_outstr) < sctp->sctp_num_istr)
8840Sstevel@tonic-gate 		sctp->sctp_num_istr = ntohs(iack->sic_outstr);
8850Sstevel@tonic-gate 	if (sctp->sctp_instr == NULL) {
8860Sstevel@tonic-gate 		sctp->sctp_instr = kmem_zalloc(sizeof (*sctp->sctp_instr) *
8870Sstevel@tonic-gate 		    sctp->sctp_num_istr, KM_NOSLEEP);
8880Sstevel@tonic-gate 	} else {
8890Sstevel@tonic-gate 		ASSERT(old_num_str > 0);
8900Sstevel@tonic-gate 		if (old_num_str != sctp->sctp_num_istr) {
8910Sstevel@tonic-gate 			kmem_free(sctp->sctp_instr,
8920Sstevel@tonic-gate 			    sizeof (*sctp->sctp_instr) * old_num_str);
8930Sstevel@tonic-gate 			sctp->sctp_instr = kmem_zalloc(
8940Sstevel@tonic-gate 			    sizeof (*sctp->sctp_instr) * sctp->sctp_num_istr,
8950Sstevel@tonic-gate 			    KM_NOSLEEP);
8960Sstevel@tonic-gate 		}
8970Sstevel@tonic-gate 	}
8980Sstevel@tonic-gate 	if (sctp->sctp_instr == NULL) {
8990Sstevel@tonic-gate 		kmem_free(sctp->sctp_ostrcntrs,
9000Sstevel@tonic-gate 		    sizeof (uint16_t) * sctp->sctp_num_ostr);
9010Sstevel@tonic-gate 		freeb(cemp);
9020Sstevel@tonic-gate 		SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
9030Sstevel@tonic-gate 		if (errmp != NULL)
9040Sstevel@tonic-gate 			freeb(errmp);
9050Sstevel@tonic-gate 		return;
9060Sstevel@tonic-gate 	}
9070Sstevel@tonic-gate 
9080Sstevel@tonic-gate 	if (!(sctp_options & SCTP_PRSCTP_OPTION) && sctp->sctp_prsctp_aware)
9090Sstevel@tonic-gate 		sctp->sctp_prsctp_aware = B_FALSE;
9100Sstevel@tonic-gate 
9110Sstevel@tonic-gate 	if (sctp_find_al_ind((sctp_parm_hdr_t *)(iack + 1),
9120Sstevel@tonic-gate 		ntohs(iackch->sch_len) - (sizeof (*iackch) + sizeof (*iack)),
9130Sstevel@tonic-gate 		&sctp->sctp_rx_adaption_code) == 0) {
9140Sstevel@tonic-gate 		sctp->sctp_recv_adaption = 1;
9150Sstevel@tonic-gate 	}
9160Sstevel@tonic-gate 
9170Sstevel@tonic-gate 	cech = (sctp_chunk_hdr_t *)cemp->b_rptr;
9180Sstevel@tonic-gate 	ASSERT(OK_32PTR(cech));
9190Sstevel@tonic-gate 	cech->sch_id = CHUNK_COOKIE;
9200Sstevel@tonic-gate 	cech->sch_flags = 0;
9210Sstevel@tonic-gate 	cech->sch_len = htons(ceclen);
9220Sstevel@tonic-gate 
9230Sstevel@tonic-gate 	/* Copy the cookie (less the parm hdr) to the chunk */
9240Sstevel@tonic-gate 	bcopy(cph + 1, cech + 1, ceclen - sizeof (*cph));
9250Sstevel@tonic-gate 
9260Sstevel@tonic-gate 	cemp->b_wptr = cemp->b_rptr + ceclen;
9270Sstevel@tonic-gate 
928252Svi117747 	if (sctp->sctp_unsent > 0) {
9290Sstevel@tonic-gate 		sctp_msg_hdr_t	*smh;
9300Sstevel@tonic-gate 		mblk_t		*prev = NULL;
9310Sstevel@tonic-gate 		uint32_t	unsent = 0;
9320Sstevel@tonic-gate 
9330Sstevel@tonic-gate 		mp = sctp->sctp_xmit_unsent;
9340Sstevel@tonic-gate 		do {
9350Sstevel@tonic-gate 			smh = (sctp_msg_hdr_t *)mp->b_rptr;
9360Sstevel@tonic-gate 			if (smh->smh_sid >= sctp->sctp_num_ostr) {
9370Sstevel@tonic-gate 				unsent += smh->smh_msglen;
9380Sstevel@tonic-gate 				if (prev != NULL)
9390Sstevel@tonic-gate 					prev->b_next = mp->b_next;
9400Sstevel@tonic-gate 				else
9410Sstevel@tonic-gate 					sctp->sctp_xmit_unsent = mp->b_next;
9420Sstevel@tonic-gate 				mp->b_next = NULL;
9430Sstevel@tonic-gate 				sctp_sendfail_event(sctp, mp, SCTP_ERR_BAD_SID,
9440Sstevel@tonic-gate 				    B_FALSE);
9450Sstevel@tonic-gate 				if (prev != NULL)
9460Sstevel@tonic-gate 					mp = prev->b_next;
9470Sstevel@tonic-gate 				else
9480Sstevel@tonic-gate 					mp = sctp->sctp_xmit_unsent;
9490Sstevel@tonic-gate 			} else {
9500Sstevel@tonic-gate 				prev = mp;
9510Sstevel@tonic-gate 				mp = mp->b_next;
9520Sstevel@tonic-gate 			}
9530Sstevel@tonic-gate 		} while (mp != NULL);
9540Sstevel@tonic-gate 		if (unsent > 0) {
9550Sstevel@tonic-gate 			ASSERT(sctp->sctp_unsent >= unsent);
9560Sstevel@tonic-gate 			sctp->sctp_unsent -= unsent;
9570Sstevel@tonic-gate 			/*
9580Sstevel@tonic-gate 			 * Update ULP the amount of queued data, which is
9590Sstevel@tonic-gate 			 * sent-unack'ed + unsent.
9600Sstevel@tonic-gate 			 * This is not necessary, but doesn't harm, we
9610Sstevel@tonic-gate 			 * just use unsent instead of sent-unack'ed +
9620Sstevel@tonic-gate 			 * unsent, since there won't be any sent-unack'ed
9630Sstevel@tonic-gate 			 * here.
9640Sstevel@tonic-gate 			 */
9650Sstevel@tonic-gate 			if (!SCTP_IS_DETACHED(sctp)) {
9660Sstevel@tonic-gate 				sctp->sctp_ulp_xmitted(sctp->sctp_ulpd,
9670Sstevel@tonic-gate 				    sctp->sctp_unsent);
9680Sstevel@tonic-gate 			}
9690Sstevel@tonic-gate 		}
9700Sstevel@tonic-gate 		if (sctp->sctp_xmit_unsent == NULL)
9710Sstevel@tonic-gate 			sctp->sctp_xmit_unsent_tail = NULL;
9720Sstevel@tonic-gate 	}
9730Sstevel@tonic-gate 	ceclen += pad;
9740Sstevel@tonic-gate 	cansend = MIN(sctp->sctp_unsent, sctp->sctp_frwnd);
9750Sstevel@tonic-gate 	meta = sctp_get_msg_to_send(sctp, &mp, NULL, &error, ceclen,
9760Sstevel@tonic-gate 	    cansend,  NULL);
9770Sstevel@tonic-gate 	/*
9780Sstevel@tonic-gate 	 * The error cannot be anything else since we could have an non-zero
9790Sstevel@tonic-gate 	 * error only if sctp_get_msg_to_send() tries to send a Forward
9800Sstevel@tonic-gate 	 * TSN which will not happen here.
9810Sstevel@tonic-gate 	 */
9820Sstevel@tonic-gate 	ASSERT(error == 0);
9830Sstevel@tonic-gate 	if (meta == NULL)
9840Sstevel@tonic-gate 		goto sendcookie;
9850Sstevel@tonic-gate 	sctp->sctp_xmit_tail = meta;
9860Sstevel@tonic-gate 	sdc = (sctp_data_hdr_t *)mp->b_rptr;
9870Sstevel@tonic-gate 	seglen = ntohs(sdc->sdh_len);
9880Sstevel@tonic-gate 	if ((ceclen + seglen) > fp->sfa_pmss ||
9890Sstevel@tonic-gate 	    (seglen - sizeof (*sdc)) > cansend) {
9900Sstevel@tonic-gate 		goto sendcookie;
9910Sstevel@tonic-gate 	}
9920Sstevel@tonic-gate 	/* OK, if this fails */
9930Sstevel@tonic-gate 	cemp->b_cont = dupmsg(mp);
9940Sstevel@tonic-gate sendcookie:
995252Svi117747 	head = sctp_add_proto_hdr(sctp, fp, cemp, 0, NULL);
996252Svi117747 	if (head == NULL) {
997252Svi117747 		freemsg(cemp);
998252Svi117747 		SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
999252Svi117747 		if (errmp != NULL)
1000252Svi117747 			freeb(errmp);
1001252Svi117747 		return;
1002252Svi117747 	}
10030Sstevel@tonic-gate 	/*
10040Sstevel@tonic-gate 	 * Even if cookie-echo exceeds MTU for one of the hops, it'll
10050Sstevel@tonic-gate 	 * have a chance of getting there.
10060Sstevel@tonic-gate 	 */
10070Sstevel@tonic-gate 	if (fp->isv4) {
10080Sstevel@tonic-gate 		ipha_t *iph = (ipha_t *)head->b_rptr;
10090Sstevel@tonic-gate 		iph->ipha_fragment_offset_and_flags = 0;
10100Sstevel@tonic-gate 	}
10110Sstevel@tonic-gate 	BUMP_LOCAL(sctp->sctp_obchunks);
10120Sstevel@tonic-gate 
10130Sstevel@tonic-gate 	sctp->sctp_cookie_mp = dupmsg(head);
10140Sstevel@tonic-gate 	/* Don't bundle, we will just resend init if this cookie is lost. */
10150Sstevel@tonic-gate 	if (sctp->sctp_cookie_mp == NULL) {
10160Sstevel@tonic-gate 		if (cemp->b_cont != NULL) {
10170Sstevel@tonic-gate 			freemsg(cemp->b_cont);
10180Sstevel@tonic-gate 			cemp->b_cont = NULL;
10190Sstevel@tonic-gate 		}
10200Sstevel@tonic-gate 	} else if (cemp->b_cont != NULL) {
10210Sstevel@tonic-gate 		ASSERT(mp != NULL && mp == meta->b_cont);
10220Sstevel@tonic-gate 		SCTP_CHUNK_CLEAR_FLAGS(cemp->b_cont);
10230Sstevel@tonic-gate 		cemp->b_wptr += pad;
10240Sstevel@tonic-gate 		seglen -= sizeof (*sdc);
10250Sstevel@tonic-gate 		SCTP_CHUNK_SENT(sctp, mp, sdc, fp, seglen, meta);
10260Sstevel@tonic-gate 	}
10270Sstevel@tonic-gate 	if (errmp != NULL)
10280Sstevel@tonic-gate 		linkb(head, errmp);
10290Sstevel@tonic-gate 	sctp->sctp_state = SCTPS_COOKIE_ECHOED;
10300Sstevel@tonic-gate 	SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto);
10310Sstevel@tonic-gate 
10320Sstevel@tonic-gate 	sctp_set_iplen(sctp, head);
10330Sstevel@tonic-gate 	sctp_add_sendq(sctp, head);
10340Sstevel@tonic-gate }
10350Sstevel@tonic-gate 
10360Sstevel@tonic-gate int
10370Sstevel@tonic-gate sctp_process_cookie(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *cmp,
10380Sstevel@tonic-gate     sctp_init_chunk_t **iackpp, sctp_hdr_t *insctph, int *recv_adaption,
10390Sstevel@tonic-gate     in6_addr_t *peer_addr)
10400Sstevel@tonic-gate {
10410Sstevel@tonic-gate 	int32_t			clen;
10420Sstevel@tonic-gate 	size_t			initplen;
10430Sstevel@tonic-gate 	uchar_t			*p;
10440Sstevel@tonic-gate 	uchar_t			*given_hash;
10450Sstevel@tonic-gate 	uchar_t			needed_hash[16];
10460Sstevel@tonic-gate 	int64_t			ts;
10470Sstevel@tonic-gate 	int64_t			diff;
10480Sstevel@tonic-gate 	uint32_t		*lt;
10490Sstevel@tonic-gate 	sctp_init_chunk_t	*iack;
10500Sstevel@tonic-gate 	sctp_chunk_hdr_t	*initch;
10510Sstevel@tonic-gate 	sctp_init_chunk_t	*init;
10520Sstevel@tonic-gate 	uint32_t		*lttag;
10530Sstevel@tonic-gate 	uint32_t		*fttag;
10540Sstevel@tonic-gate 	uint32_t		ports;
10550Sstevel@tonic-gate 
10560Sstevel@tonic-gate 	BUMP_LOCAL(sctp->sctp_ibchunks);
10570Sstevel@tonic-gate 	/* Verify the ICV */
10580Sstevel@tonic-gate 	clen = ntohs(ch->sch_len) - sizeof (*ch) - 16;
10590Sstevel@tonic-gate 	if (clen < 0) {
10600Sstevel@tonic-gate 		dprint(1, ("invalid cookie chunk length %d\n",
10610Sstevel@tonic-gate 		    ntohs(ch->sch_len)));
10620Sstevel@tonic-gate 
10630Sstevel@tonic-gate 		return (-1);
10640Sstevel@tonic-gate 	}
10650Sstevel@tonic-gate 	p = (uchar_t *)(ch + 1);
10660Sstevel@tonic-gate 
10670Sstevel@tonic-gate 	hmac_md5(p, clen, (uchar_t *)sctp->sctp_secret, SCTP_SECRET_LEN,
10680Sstevel@tonic-gate 	    needed_hash);
10690Sstevel@tonic-gate 
10700Sstevel@tonic-gate 	/* The given hash follows the cookie data */
10710Sstevel@tonic-gate 	given_hash = p + clen;
10720Sstevel@tonic-gate 
10730Sstevel@tonic-gate 	if (bcmp(given_hash, needed_hash, 16) != 0) {
10740Sstevel@tonic-gate 		/* The secret may have changed; try the old secret */
10750Sstevel@tonic-gate 		hmac_md5(p, clen, (uchar_t *)sctp->sctp_old_secret,
10760Sstevel@tonic-gate 		    SCTP_SECRET_LEN, needed_hash);
10770Sstevel@tonic-gate 		if (bcmp(given_hash, needed_hash, 16) != 0) {
10780Sstevel@tonic-gate 			return (-1);
10790Sstevel@tonic-gate 		}
10800Sstevel@tonic-gate 	}
10810Sstevel@tonic-gate 
10820Sstevel@tonic-gate 	/* Timestamp is int64_t, and we only guarantee 32-bit alignment */
10830Sstevel@tonic-gate 	bcopy(p, &ts, sizeof (ts));
10840Sstevel@tonic-gate 	/* Cookie life time, int32_t */
10850Sstevel@tonic-gate 	lt = (uint32_t *)(p + sizeof (ts));
10860Sstevel@tonic-gate 
10870Sstevel@tonic-gate 	/*
10880Sstevel@tonic-gate 	 * To quote PRC, "this is our baby", so let's continue.
10890Sstevel@tonic-gate 	 * We need to pull out the encapsulated INIT ACK and
10900Sstevel@tonic-gate 	 * INIT chunks. Note that we don't process these until
10910Sstevel@tonic-gate 	 * we have verified the timestamp, but we need them before
10920Sstevel@tonic-gate 	 * processing the timestamp since if the time check fails,
10930Sstevel@tonic-gate 	 * we need to get the verification tag from the INIT in order
10940Sstevel@tonic-gate 	 * to send a stale cookie error.
10950Sstevel@tonic-gate 	 */
10960Sstevel@tonic-gate 	lttag = (uint32_t *)(lt + 1);
10970Sstevel@tonic-gate 	fttag = lttag + 1;
10980Sstevel@tonic-gate 	if (peer_addr != NULL)
10990Sstevel@tonic-gate 		bcopy(fttag + 1, peer_addr, sizeof (in6_addr_t));
11000Sstevel@tonic-gate 	iack = (sctp_init_chunk_t *)((char *)(fttag + 1) + sizeof (in6_addr_t));
11010Sstevel@tonic-gate 	initch = (sctp_chunk_hdr_t *)(iack + 1);
11020Sstevel@tonic-gate 	init = (sctp_init_chunk_t *)(initch + 1);
11030Sstevel@tonic-gate 	initplen = ntohs(initch->sch_len) - (sizeof (*init) + sizeof (*initch));
11040Sstevel@tonic-gate 	*iackpp = iack;
11050Sstevel@tonic-gate 	*recv_adaption = 0;
11060Sstevel@tonic-gate 
11070Sstevel@tonic-gate 	/* Check the timestamp */
11080Sstevel@tonic-gate 	diff = lbolt64 - ts;
11090Sstevel@tonic-gate 	if (diff > *lt && (init->sic_inittag != sctp->sctp_fvtag ||
11100Sstevel@tonic-gate 	    iack->sic_inittag != sctp->sctp_lvtag)) {
11110Sstevel@tonic-gate 
11120Sstevel@tonic-gate 		uint32_t staleness;
11130Sstevel@tonic-gate 
11140Sstevel@tonic-gate 		staleness = TICK_TO_USEC(diff);
11150Sstevel@tonic-gate 		staleness = htonl(staleness);
11160Sstevel@tonic-gate 		sctp_send_abort(sctp, init->sic_inittag, SCTP_ERR_STALE_COOKIE,
11170Sstevel@tonic-gate 		    (char *)&staleness, sizeof (staleness), cmp, 1, B_FALSE);
11180Sstevel@tonic-gate 
11190Sstevel@tonic-gate 		dprint(1, ("stale cookie %d\n", staleness));
11200Sstevel@tonic-gate 
11210Sstevel@tonic-gate 		return (-1);
11220Sstevel@tonic-gate 	}
11230Sstevel@tonic-gate 
11240Sstevel@tonic-gate 	/* Check for attack by adding addresses to a restart */
11250Sstevel@tonic-gate 	bcopy(insctph, &ports, sizeof (ports));
11260Sstevel@tonic-gate 	if (sctp_secure_restart_check(cmp, initch, ports, KM_NOSLEEP) != 1) {
11270Sstevel@tonic-gate 		return (-1);
11280Sstevel@tonic-gate 	}
11290Sstevel@tonic-gate 
11300Sstevel@tonic-gate 	/* Look for adaptation code if there any parms in the INIT chunk */
11310Sstevel@tonic-gate 	if ((initplen >= sizeof (sctp_parm_hdr_t)) &&
11320Sstevel@tonic-gate 	    (sctp_find_al_ind((sctp_parm_hdr_t *)(init + 1), initplen,
11330Sstevel@tonic-gate 	    &sctp->sctp_rx_adaption_code) == 0)) {
11340Sstevel@tonic-gate 		*recv_adaption = 1;
11350Sstevel@tonic-gate 	}
11360Sstevel@tonic-gate 
11370Sstevel@tonic-gate 	/* Examine tie-tags */
11380Sstevel@tonic-gate 
11390Sstevel@tonic-gate 	if (sctp->sctp_state >= SCTPS_COOKIE_WAIT) {
11400Sstevel@tonic-gate 		if (sctp->sctp_state == SCTPS_ESTABLISHED &&
11410Sstevel@tonic-gate 		    init->sic_inittag == sctp->sctp_fvtag &&
11420Sstevel@tonic-gate 		    iack->sic_inittag == sctp->sctp_lvtag &&
11430Sstevel@tonic-gate 		    *fttag == 0 && *lttag == 0) {
11440Sstevel@tonic-gate 
11450Sstevel@tonic-gate 			dprint(1, ("duplicate cookie from %x:%x:%x:%x (%d)\n",
11460Sstevel@tonic-gate 			    SCTP_PRINTADDR(sctp->sctp_current->faddr),
11470Sstevel@tonic-gate 			    (int)(sctp->sctp_fport)));
11480Sstevel@tonic-gate 			return (-1);
11490Sstevel@tonic-gate 		}
11500Sstevel@tonic-gate 
11510Sstevel@tonic-gate 		if (init->sic_inittag != sctp->sctp_fvtag &&
11520Sstevel@tonic-gate 		    iack->sic_inittag != sctp->sctp_lvtag &&
11530Sstevel@tonic-gate 		    *fttag == sctp->sctp_fvtag &&
11540Sstevel@tonic-gate 		    *lttag == sctp->sctp_lvtag) {
11550Sstevel@tonic-gate 			int i;
11560Sstevel@tonic-gate 
11570Sstevel@tonic-gate 			/* Section 5.2.4 case A: restart */
11580Sstevel@tonic-gate 			sctp->sctp_fvtag = init->sic_inittag;
11590Sstevel@tonic-gate 			sctp->sctp_lvtag = iack->sic_inittag;
11600Sstevel@tonic-gate 
11610Sstevel@tonic-gate 			sctp->sctp_sctph->sh_verf = init->sic_inittag;
11620Sstevel@tonic-gate 			sctp->sctp_sctph6->sh_verf = init->sic_inittag;
11630Sstevel@tonic-gate 
11640Sstevel@tonic-gate 			sctp->sctp_ftsn = ntohl(init->sic_inittsn);
11650Sstevel@tonic-gate 			sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
11660Sstevel@tonic-gate 			sctp->sctp_frwnd = ntohl(init->sic_a_rwnd);
11670Sstevel@tonic-gate 			sctp->sctp_fcsn = sctp->sctp_lastacked;
11680Sstevel@tonic-gate 
11690Sstevel@tonic-gate 			if (sctp->sctp_state < SCTPS_ESTABLISHED) {
11700Sstevel@tonic-gate 				sctp->sctp_state = SCTPS_ESTABLISHED;
11710Sstevel@tonic-gate 				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
11720Sstevel@tonic-gate 			}
11730Sstevel@tonic-gate 
11740Sstevel@tonic-gate 			dprint(1, ("sctp peer %x:%x:%x:%x (%d) restarted\n",
11750Sstevel@tonic-gate 			    SCTP_PRINTADDR(sctp->sctp_current->faddr),
11760Sstevel@tonic-gate 			    (int)(sctp->sctp_fport)));
11770Sstevel@tonic-gate 			/* reset parameters */
11780Sstevel@tonic-gate 			sctp_congest_reset(sctp);
11790Sstevel@tonic-gate 
11800Sstevel@tonic-gate 			/* reset stream bookkeeping */
11810Sstevel@tonic-gate 			sctp_instream_cleanup(sctp, B_FALSE);
11820Sstevel@tonic-gate 
11830Sstevel@tonic-gate 			sctp->sctp_istr_nmsgs = 0;
11840Sstevel@tonic-gate 			sctp->sctp_rxqueued = 0;
11850Sstevel@tonic-gate 			for (i = 0; i < sctp->sctp_num_ostr; i++) {
11860Sstevel@tonic-gate 				sctp->sctp_ostrcntrs[i] = 0;
11870Sstevel@tonic-gate 			}
11880Sstevel@tonic-gate 			/* XXX flush xmit_list? */
11890Sstevel@tonic-gate 
11900Sstevel@tonic-gate 			return (0);
11910Sstevel@tonic-gate 		} else if (init->sic_inittag != sctp->sctp_fvtag &&
11920Sstevel@tonic-gate 		    iack->sic_inittag == sctp->sctp_lvtag) {
11930Sstevel@tonic-gate 
11940Sstevel@tonic-gate 			/* Section 5.2.4 case B: INIT collision */
11950Sstevel@tonic-gate 			if (sctp->sctp_state < SCTPS_ESTABLISHED) {
11960Sstevel@tonic-gate 				if (!sctp_initialize_params(sctp, init, iack))
11970Sstevel@tonic-gate 					return (-1);	/* Drop? */
11980Sstevel@tonic-gate 				sctp->sctp_state = SCTPS_ESTABLISHED;
11990Sstevel@tonic-gate 				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
12000Sstevel@tonic-gate 			}
12010Sstevel@tonic-gate 
12020Sstevel@tonic-gate 			dprint(1, ("init collision with %x:%x:%x:%x (%d)\n",
12030Sstevel@tonic-gate 			    SCTP_PRINTADDR(sctp->sctp_current->faddr),
12040Sstevel@tonic-gate 			    (int)(sctp->sctp_fport)));
12050Sstevel@tonic-gate 
12060Sstevel@tonic-gate 			return (0);
12070Sstevel@tonic-gate 		} else if (iack->sic_inittag != sctp->sctp_lvtag &&
12080Sstevel@tonic-gate 		    init->sic_inittag == sctp->sctp_fvtag &&
12090Sstevel@tonic-gate 		    *fttag == 0 && *lttag == 0) {
12100Sstevel@tonic-gate 
12110Sstevel@tonic-gate 			/* Section 5.2.4 case C: late COOKIE */
12120Sstevel@tonic-gate 			dprint(1, ("late cookie from %x:%x:%x:%x (%d)\n",
12130Sstevel@tonic-gate 			    SCTP_PRINTADDR(sctp->sctp_current->faddr),
12140Sstevel@tonic-gate 			    (int)(sctp->sctp_fport)));
12150Sstevel@tonic-gate 			return (-1);
12160Sstevel@tonic-gate 		} else if (init->sic_inittag == sctp->sctp_fvtag &&
12170Sstevel@tonic-gate 		    iack->sic_inittag == sctp->sctp_lvtag) {
12180Sstevel@tonic-gate 
12190Sstevel@tonic-gate 			/*
12200Sstevel@tonic-gate 			 * Section 5.2.4 case D: COOKIE ECHO retransmit
12210Sstevel@tonic-gate 			 * Don't check cookie lifetime
12220Sstevel@tonic-gate 			 */
12230Sstevel@tonic-gate 			dprint(1, ("cookie tags match from %x:%x:%x:%x (%d)\n",
12240Sstevel@tonic-gate 			    SCTP_PRINTADDR(sctp->sctp_current->faddr),
12250Sstevel@tonic-gate 			    (int)(sctp->sctp_fport)));
12260Sstevel@tonic-gate 			if (sctp->sctp_state < SCTPS_ESTABLISHED) {
12270Sstevel@tonic-gate 				if (!sctp_initialize_params(sctp, init, iack))
12280Sstevel@tonic-gate 					return (-1);	/* Drop? */
12290Sstevel@tonic-gate 				sctp->sctp_state = SCTPS_ESTABLISHED;
12300Sstevel@tonic-gate 				sctp->sctp_assoc_start_time = (uint32_t)lbolt;
12310Sstevel@tonic-gate 			}
12320Sstevel@tonic-gate 			return (0);
12330Sstevel@tonic-gate 		} else {
12340Sstevel@tonic-gate 			/* unrecognized case -- silently drop it */
12350Sstevel@tonic-gate 			return (-1);
12360Sstevel@tonic-gate 		}
12370Sstevel@tonic-gate 	}
12380Sstevel@tonic-gate 
12390Sstevel@tonic-gate 	return (0);
12400Sstevel@tonic-gate }
12410Sstevel@tonic-gate 
12420Sstevel@tonic-gate /*
12430Sstevel@tonic-gate  * Similar to ip_fanout_sctp, except that the src addr(s) are drawn
12440Sstevel@tonic-gate  * from address parameters in an INIT ACK's address list. This
12450Sstevel@tonic-gate  * function is used when an INIT ACK is received but IP's fanout
12460Sstevel@tonic-gate  * function could not find a sctp via the normal lookup routine.
12470Sstevel@tonic-gate  * This can happen when a host sends an INIT ACK from a different
12480Sstevel@tonic-gate  * address than the INIT was sent to.
12490Sstevel@tonic-gate  *
12500Sstevel@tonic-gate  * Returns the sctp_t if found, or NULL if not found.
12510Sstevel@tonic-gate  */
12520Sstevel@tonic-gate sctp_t *
12530Sstevel@tonic-gate sctp_addrlist2sctp(mblk_t *mp, sctp_hdr_t *sctph, sctp_chunk_hdr_t *ich,
12540Sstevel@tonic-gate     uint_t ipif_seqid, zoneid_t zoneid)
12550Sstevel@tonic-gate {
12560Sstevel@tonic-gate 	int isv4;
12570Sstevel@tonic-gate 	ipha_t *iph;
12580Sstevel@tonic-gate 	ip6_t *ip6h;
12590Sstevel@tonic-gate 	in6_addr_t dst;
12600Sstevel@tonic-gate 	in6_addr_t src;
12610Sstevel@tonic-gate 	sctp_parm_hdr_t *ph;
12620Sstevel@tonic-gate 	ssize_t remaining;
12630Sstevel@tonic-gate 	sctp_init_chunk_t *iack;
12640Sstevel@tonic-gate 	uint32_t ports;
12650Sstevel@tonic-gate 	sctp_t *sctp = NULL;
12660Sstevel@tonic-gate 
12670Sstevel@tonic-gate 	ASSERT(ich->sch_id == CHUNK_INIT_ACK);
12680Sstevel@tonic-gate 
12690Sstevel@tonic-gate 	isv4 = (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
12700Sstevel@tonic-gate 	if (isv4) {
12710Sstevel@tonic-gate 		iph = (ipha_t *)mp->b_rptr;
12720Sstevel@tonic-gate 		IN6_IPADDR_TO_V4MAPPED(iph->ipha_dst, &dst);
12730Sstevel@tonic-gate 	} else {
12740Sstevel@tonic-gate 		ip6h = (ip6_t *)mp->b_rptr;
12750Sstevel@tonic-gate 		dst = ip6h->ip6_dst;
12760Sstevel@tonic-gate 	}
12770Sstevel@tonic-gate 
12780Sstevel@tonic-gate 	ports = *(uint32_t *)sctph;
12790Sstevel@tonic-gate 
12800Sstevel@tonic-gate 	dprint(1, ("sctp_addrlist2sctp: ports=%u, dst = %x:%x:%x:%x\n",
12810Sstevel@tonic-gate 	    ports, SCTP_PRINTADDR(dst)));
12820Sstevel@tonic-gate 
12830Sstevel@tonic-gate 	/* pull out any address parameters */
12840Sstevel@tonic-gate 	remaining = ntohs(ich->sch_len) - sizeof (*ich) - sizeof (*iack);
12850Sstevel@tonic-gate 	if (remaining < sizeof (*ph)) {
12860Sstevel@tonic-gate 		return (NULL);
12870Sstevel@tonic-gate 	}
12880Sstevel@tonic-gate 
12890Sstevel@tonic-gate 	iack = (sctp_init_chunk_t *)(ich + 1);
12900Sstevel@tonic-gate 	ph = (sctp_parm_hdr_t *)(iack + 1);
12910Sstevel@tonic-gate 
12920Sstevel@tonic-gate 	while (ph != NULL) {
12930Sstevel@tonic-gate 		/*
12940Sstevel@tonic-gate 		 * params have been put in host byteorder by
12950Sstevel@tonic-gate 		 * sctp_check_input()
12960Sstevel@tonic-gate 		 */
12970Sstevel@tonic-gate 		if (ph->sph_type == PARM_ADDR4) {
12980Sstevel@tonic-gate 			IN6_INADDR_TO_V4MAPPED((struct in_addr *)(ph + 1),
12990Sstevel@tonic-gate 			    &src);
13000Sstevel@tonic-gate 
13010Sstevel@tonic-gate 			sctp = sctp_conn_match(&src, &dst, ports, ipif_seqid,
13020Sstevel@tonic-gate 			    zoneid);
13030Sstevel@tonic-gate 
13040Sstevel@tonic-gate 			dprint(1,
13050Sstevel@tonic-gate 			    ("sctp_addrlist2sctp: src=%x:%x:%x:%x, sctp=%p\n",
13060Sstevel@tonic-gate 			    SCTP_PRINTADDR(src), sctp));
13070Sstevel@tonic-gate 
13080Sstevel@tonic-gate 
13090Sstevel@tonic-gate 			if (sctp != NULL) {
13100Sstevel@tonic-gate 				return (sctp);
13110Sstevel@tonic-gate 			}
13120Sstevel@tonic-gate 		} else if (ph->sph_type == PARM_ADDR6) {
13130Sstevel@tonic-gate 			src = *(in6_addr_t *)(ph + 1);
13140Sstevel@tonic-gate 			sctp = sctp_conn_match(&src, &dst, ports, ipif_seqid,
13150Sstevel@tonic-gate 			    zoneid);
13160Sstevel@tonic-gate 
13170Sstevel@tonic-gate 			dprint(1,
13180Sstevel@tonic-gate 			    ("sctp_addrlist2sctp: src=%x:%x:%x:%x, sctp=%p\n",
13190Sstevel@tonic-gate 			    SCTP_PRINTADDR(src), sctp));
13200Sstevel@tonic-gate 
13210Sstevel@tonic-gate 			if (sctp != NULL) {
13220Sstevel@tonic-gate 				return (sctp);
13230Sstevel@tonic-gate 			}
13240Sstevel@tonic-gate 		}
13250Sstevel@tonic-gate 
13260Sstevel@tonic-gate 		ph = sctp_next_parm(ph, &remaining);
13270Sstevel@tonic-gate 	}
13280Sstevel@tonic-gate 
13290Sstevel@tonic-gate 	return (NULL);
13300Sstevel@tonic-gate }
1331