10Sstevel@tonic-gate /* 20Sstevel@tonic-gate * CDDL HEADER START 30Sstevel@tonic-gate * 40Sstevel@tonic-gate * The contents of this file are subject to the terms of the 50Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 60Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 70Sstevel@tonic-gate * with the License. 80Sstevel@tonic-gate * 90Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 100Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 110Sstevel@tonic-gate * See the License for the specific language governing permissions 120Sstevel@tonic-gate * and limitations under the License. 130Sstevel@tonic-gate * 140Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 150Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 160Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 170Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 180Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 190Sstevel@tonic-gate * 200Sstevel@tonic-gate * CDDL HEADER END 210Sstevel@tonic-gate */ 220Sstevel@tonic-gate /* 230Sstevel@tonic-gate * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 240Sstevel@tonic-gate * Use is subject to license terms. 250Sstevel@tonic-gate */ 260Sstevel@tonic-gate 270Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 280Sstevel@tonic-gate 290Sstevel@tonic-gate #include <sys/types.h> 300Sstevel@tonic-gate #include <sys/systm.h> 310Sstevel@tonic-gate #include <sys/stream.h> 320Sstevel@tonic-gate #include <sys/cmn_err.h> 330Sstevel@tonic-gate #include <sys/md5.h> 340Sstevel@tonic-gate #include <sys/kmem.h> 350Sstevel@tonic-gate #include <sys/strsubr.h> 360Sstevel@tonic-gate #include <sys/random.h> 370Sstevel@tonic-gate 380Sstevel@tonic-gate #include <netinet/in.h> 390Sstevel@tonic-gate #include <netinet/ip6.h> 400Sstevel@tonic-gate 410Sstevel@tonic-gate #include <inet/common.h> 420Sstevel@tonic-gate #include <inet/ip.h> 430Sstevel@tonic-gate #include <inet/ip6.h> 440Sstevel@tonic-gate #include <inet/sctp_ip.h> 450Sstevel@tonic-gate #include <inet/ipclassifier.h> 460Sstevel@tonic-gate #include "sctp_impl.h" 470Sstevel@tonic-gate 480Sstevel@tonic-gate /* 49*852Svi117747 * Helper function for SunCluster (PSARC/2005/602) to get the original source 50*852Svi117747 * address from the COOKIE 51*852Svi117747 */ 52*852Svi117747 int cl_sctp_cookie_paddr(sctp_chunk_hdr_t *, in6_addr_t *); 53*852Svi117747 54*852Svi117747 /* 550Sstevel@tonic-gate * From RFC 2104. This should probably go into libmd5 (and while 560Sstevel@tonic-gate * we're at it, maybe we should make a libdigest so we can later 570Sstevel@tonic-gate * add SHA1 and others, esp. since some weaknesses have been found 580Sstevel@tonic-gate * with MD5). 590Sstevel@tonic-gate * 600Sstevel@tonic-gate * text IN pointer to data stream 610Sstevel@tonic-gate * text_len IN length of data stream 620Sstevel@tonic-gate * key IN pointer to authentication key 630Sstevel@tonic-gate * key_len IN length of authentication key 640Sstevel@tonic-gate * digest OUT caller digest to be filled in 650Sstevel@tonic-gate */ 660Sstevel@tonic-gate static void 670Sstevel@tonic-gate hmac_md5(uchar_t *text, size_t text_len, uchar_t *key, size_t key_len, 680Sstevel@tonic-gate uchar_t *digest) 690Sstevel@tonic-gate { 700Sstevel@tonic-gate MD5_CTX context; 710Sstevel@tonic-gate uchar_t k_ipad[65]; /* inner padding - key XORd with ipad */ 720Sstevel@tonic-gate uchar_t k_opad[65]; /* outer padding - key XORd with opad */ 730Sstevel@tonic-gate uchar_t tk[16]; 740Sstevel@tonic-gate int i; 750Sstevel@tonic-gate 760Sstevel@tonic-gate /* if key is longer than 64 bytes reset it to key=MD5(key) */ 770Sstevel@tonic-gate if (key_len > 64) { 780Sstevel@tonic-gate MD5_CTX tctx; 790Sstevel@tonic-gate 800Sstevel@tonic-gate MD5Init(&tctx); 810Sstevel@tonic-gate MD5Update(&tctx, key, key_len); 820Sstevel@tonic-gate MD5Final(tk, &tctx); 830Sstevel@tonic-gate 840Sstevel@tonic-gate key = tk; 850Sstevel@tonic-gate key_len = 16; 860Sstevel@tonic-gate } 870Sstevel@tonic-gate 880Sstevel@tonic-gate /* 890Sstevel@tonic-gate * the HMAC_MD5 transform looks like: 900Sstevel@tonic-gate * 910Sstevel@tonic-gate * MD5(K XOR opad, MD5(K XOR ipad, text)) 920Sstevel@tonic-gate * 930Sstevel@tonic-gate * where K is an n byte key 940Sstevel@tonic-gate * ipad is the byte 0x36 repeated 64 times 950Sstevel@tonic-gate * opad is the byte 0x5c repeated 64 times 960Sstevel@tonic-gate * and text is the data being protected 970Sstevel@tonic-gate */ 980Sstevel@tonic-gate 990Sstevel@tonic-gate /* start out by storing key in pads */ 1000Sstevel@tonic-gate bzero(k_ipad, sizeof (k_ipad)); 1010Sstevel@tonic-gate bzero(k_opad, sizeof (k_opad)); 1020Sstevel@tonic-gate bcopy(key, k_ipad, key_len); 1030Sstevel@tonic-gate bcopy(key, k_opad, key_len); 1040Sstevel@tonic-gate 1050Sstevel@tonic-gate /* XOR key with ipad and opad values */ 1060Sstevel@tonic-gate for (i = 0; i < 64; i++) { 1070Sstevel@tonic-gate k_ipad[i] ^= 0x36; 1080Sstevel@tonic-gate k_opad[i] ^= 0x5c; 1090Sstevel@tonic-gate } 1100Sstevel@tonic-gate /* 1110Sstevel@tonic-gate * perform inner MD5 1120Sstevel@tonic-gate */ 1130Sstevel@tonic-gate MD5Init(&context); /* init context for 1st */ 1140Sstevel@tonic-gate /* pass */ 1150Sstevel@tonic-gate MD5Update(&context, k_ipad, 64); /* start with inner pad */ 1160Sstevel@tonic-gate MD5Update(&context, text, text_len); /* then text of datagram */ 1170Sstevel@tonic-gate MD5Final(digest, &context); /* finish up 1st pass */ 1180Sstevel@tonic-gate /* 1190Sstevel@tonic-gate * perform outer MD5 1200Sstevel@tonic-gate */ 1210Sstevel@tonic-gate MD5Init(&context); /* init context for 2nd */ 1220Sstevel@tonic-gate /* pass */ 1230Sstevel@tonic-gate MD5Update(&context, k_opad, 64); /* start with outer pad */ 1240Sstevel@tonic-gate MD5Update(&context, digest, 16); /* then results of 1st */ 1250Sstevel@tonic-gate /* hash */ 1260Sstevel@tonic-gate MD5Final(digest, &context); /* finish up 2nd pass */ 1270Sstevel@tonic-gate } 1280Sstevel@tonic-gate 1290Sstevel@tonic-gate /* 1300Sstevel@tonic-gate * If inmp is non-NULL, and we need to abort, it will use the IP/SCTP 1310Sstevel@tonic-gate * info in initmp to send the abort. Otherwise, no abort will be sent. 1320Sstevel@tonic-gate * If errmp is non-NULL, a chain of unrecognized parameters will 1330Sstevel@tonic-gate * be created and returned via *errmp. 1340Sstevel@tonic-gate * 1350Sstevel@tonic-gate * Returns 1 if the parameters are OK (or there are no parameters), or 1360Sstevel@tonic-gate * 0 if not. 1370Sstevel@tonic-gate */ 1380Sstevel@tonic-gate static int 1390Sstevel@tonic-gate validate_init_params(sctp_t *sctp, sctp_chunk_hdr_t *ch, 1400Sstevel@tonic-gate sctp_init_chunk_t *init, mblk_t *inmp, sctp_parm_hdr_t **want_cookie, 1410Sstevel@tonic-gate mblk_t **errmp, int *supp_af, uint_t *sctp_options) 1420Sstevel@tonic-gate { 1430Sstevel@tonic-gate sctp_parm_hdr_t *cph; 1440Sstevel@tonic-gate sctp_init_chunk_t *ic; 1450Sstevel@tonic-gate ssize_t remaining; 1460Sstevel@tonic-gate uint16_t serror = 0; 1470Sstevel@tonic-gate char *details = NULL; 1480Sstevel@tonic-gate size_t errlen = 0; 1490Sstevel@tonic-gate boolean_t got_cookie = B_FALSE; 1500Sstevel@tonic-gate uint16_t ptype; 1510Sstevel@tonic-gate 1520Sstevel@tonic-gate if (sctp_options != NULL) 1530Sstevel@tonic-gate *sctp_options = 0; 1540Sstevel@tonic-gate 1550Sstevel@tonic-gate /* First validate stream parameters */ 1560Sstevel@tonic-gate if (init->sic_instr == 0 || init->sic_outstr == 0) { 1570Sstevel@tonic-gate serror = SCTP_ERR_BAD_MANDPARM; 1580Sstevel@tonic-gate dprint(1, 1590Sstevel@tonic-gate ("validate_init_params: bad sid, is=%d os=%d\n", 1600Sstevel@tonic-gate htons(init->sic_instr), htons(init->sic_outstr))); 1610Sstevel@tonic-gate goto abort; 1620Sstevel@tonic-gate } 1630Sstevel@tonic-gate if (ntohl(init->sic_inittag) == 0) { 1640Sstevel@tonic-gate serror = SCTP_ERR_BAD_MANDPARM; 1650Sstevel@tonic-gate dprint(1, ("validate_init_params: inittag = 0\n")); 1660Sstevel@tonic-gate goto abort; 1670Sstevel@tonic-gate } 1680Sstevel@tonic-gate 1690Sstevel@tonic-gate remaining = ntohs(ch->sch_len) - sizeof (*ch); 1700Sstevel@tonic-gate ic = (sctp_init_chunk_t *)(ch + 1); 1710Sstevel@tonic-gate remaining -= sizeof (*ic); 1720Sstevel@tonic-gate if (remaining < sizeof (*cph)) { 1730Sstevel@tonic-gate /* Nothing to validate */ 1740Sstevel@tonic-gate if (want_cookie != NULL) 1750Sstevel@tonic-gate goto cookie_abort; 1760Sstevel@tonic-gate return (1); 1770Sstevel@tonic-gate } 1780Sstevel@tonic-gate 1790Sstevel@tonic-gate cph = (sctp_parm_hdr_t *)(ic + 1); 1800Sstevel@tonic-gate 1810Sstevel@tonic-gate while (cph != NULL) { 1820Sstevel@tonic-gate ptype = ntohs(cph->sph_type); 1830Sstevel@tonic-gate switch (ptype) { 1840Sstevel@tonic-gate case PARM_HBINFO: 1850Sstevel@tonic-gate case PARM_UNRECOGNIZED: 1860Sstevel@tonic-gate case PARM_ECN: 1870Sstevel@tonic-gate /* just ignore them */ 1880Sstevel@tonic-gate break; 1890Sstevel@tonic-gate case PARM_FORWARD_TSN: 1900Sstevel@tonic-gate if (sctp_options != NULL) 1910Sstevel@tonic-gate *sctp_options |= SCTP_PRSCTP_OPTION; 1920Sstevel@tonic-gate break; 1930Sstevel@tonic-gate case PARM_COOKIE: 1940Sstevel@tonic-gate got_cookie = B_TRUE; 1950Sstevel@tonic-gate if (want_cookie != NULL) { 1960Sstevel@tonic-gate *want_cookie = cph; 1970Sstevel@tonic-gate } 1980Sstevel@tonic-gate break; 1990Sstevel@tonic-gate case PARM_ADDR4: 200432Svi117747 *supp_af |= PARM_SUPP_V4; 201432Svi117747 break; 2020Sstevel@tonic-gate case PARM_ADDR6: 203432Svi117747 *supp_af |= PARM_SUPP_V6; 204432Svi117747 break; 2050Sstevel@tonic-gate case PARM_COOKIE_PRESERVE: 2060Sstevel@tonic-gate case PARM_ADAPT_LAYER_IND: 2070Sstevel@tonic-gate /* These are OK */ 2080Sstevel@tonic-gate break; 2090Sstevel@tonic-gate case PARM_ADDR_HOST_NAME: 2100Sstevel@tonic-gate /* Don't support this; abort the association */ 2110Sstevel@tonic-gate serror = SCTP_ERR_BAD_ADDR; 2120Sstevel@tonic-gate details = (char *)cph; 2130Sstevel@tonic-gate errlen = ntohs(cph->sph_len); 2140Sstevel@tonic-gate dprint(1, ("sctp:validate_init_params: host addr\n")); 2150Sstevel@tonic-gate goto abort; 2160Sstevel@tonic-gate case PARM_SUPP_ADDRS: { 2170Sstevel@tonic-gate /* Make sure we have a supported addr intersection */ 2180Sstevel@tonic-gate uint16_t *p, addrtype; 2190Sstevel@tonic-gate int plen; 2200Sstevel@tonic-gate 2210Sstevel@tonic-gate plen = ntohs(cph->sph_len); 2220Sstevel@tonic-gate p = (uint16_t *)(cph + 1); 2230Sstevel@tonic-gate while (plen > 0) { 2240Sstevel@tonic-gate addrtype = ntohs(*p); 2250Sstevel@tonic-gate switch (addrtype) { 2260Sstevel@tonic-gate case PARM_ADDR6: 2270Sstevel@tonic-gate *supp_af |= PARM_SUPP_V6; 2280Sstevel@tonic-gate break; 2290Sstevel@tonic-gate case PARM_ADDR4: 2300Sstevel@tonic-gate *supp_af |= PARM_SUPP_V4; 2310Sstevel@tonic-gate break; 2320Sstevel@tonic-gate default: 2330Sstevel@tonic-gate /* 2340Sstevel@tonic-gate * Do nothing, silently ignore hostname 2350Sstevel@tonic-gate * address. 2360Sstevel@tonic-gate */ 2370Sstevel@tonic-gate break; 2380Sstevel@tonic-gate } 2390Sstevel@tonic-gate p++; 2400Sstevel@tonic-gate plen -= sizeof (*p); 2410Sstevel@tonic-gate } 2420Sstevel@tonic-gate break; 2430Sstevel@tonic-gate } 2440Sstevel@tonic-gate default: 2450Sstevel@tonic-gate /* Unrecognized param; check the high order bits */ 2460Sstevel@tonic-gate if ((ptype & 0xc000) == 0xc000) { 2470Sstevel@tonic-gate /* 2480Sstevel@tonic-gate * report unrecognized param, and 2490Sstevel@tonic-gate * keep processing 2500Sstevel@tonic-gate */ 2510Sstevel@tonic-gate if (errmp != NULL) { 2520Sstevel@tonic-gate if (want_cookie != NULL) { 2530Sstevel@tonic-gate *errmp = sctp_make_err(sctp, 2540Sstevel@tonic-gate PARM_UNRECOGNIZED, 2550Sstevel@tonic-gate (void *)cph, 2560Sstevel@tonic-gate ntohs(cph->sph_len)); 2570Sstevel@tonic-gate } else { 2580Sstevel@tonic-gate sctp_add_unrec_parm(cph, errmp); 2590Sstevel@tonic-gate } 2600Sstevel@tonic-gate } 2610Sstevel@tonic-gate break; 2620Sstevel@tonic-gate } 2630Sstevel@tonic-gate if (ptype & 0x4000) { 2640Sstevel@tonic-gate /* 2650Sstevel@tonic-gate * Stop processing and drop; report 2660Sstevel@tonic-gate * unrecognized param 2670Sstevel@tonic-gate */ 2680Sstevel@tonic-gate serror = SCTP_ERR_UNREC_PARM; 2690Sstevel@tonic-gate details = (char *)cph; 2700Sstevel@tonic-gate errlen = ntohs(cph->sph_len); 2710Sstevel@tonic-gate goto abort; 2720Sstevel@tonic-gate } 2730Sstevel@tonic-gate if (ptype & 0x8000) { 2740Sstevel@tonic-gate /* skip and continue processing */ 2750Sstevel@tonic-gate break; 2760Sstevel@tonic-gate } 2770Sstevel@tonic-gate 2780Sstevel@tonic-gate /* 2790Sstevel@tonic-gate * 2 high bits are clear; stop processing and 2800Sstevel@tonic-gate * drop packet 2810Sstevel@tonic-gate */ 2820Sstevel@tonic-gate return (0); 2830Sstevel@tonic-gate } 2840Sstevel@tonic-gate 2850Sstevel@tonic-gate cph = sctp_next_parm(cph, &remaining); 2860Sstevel@tonic-gate } 287432Svi117747 /* 288432Svi117747 * Some sanity checks. The following should not fail unless the 289432Svi117747 * other side is broken. 290432Svi117747 * 291432Svi117747 * 1. If this is a V4 endpoint but V4 address is not 292432Svi117747 * supported, abort. 293432Svi117747 * 2. If this is a V6 only endpoint but V6 address is 294432Svi117747 * not supported, abort. This assumes that a V6 295432Svi117747 * endpoint can use both V4 and V6 addresses. 296432Svi117747 * We only care about supp_af when processing INIT, i.e want_cookie 297432Svi117747 * is NULL. 298432Svi117747 */ 299432Svi117747 if (want_cookie == NULL && 300432Svi117747 ((sctp->sctp_family == AF_INET && !(*supp_af & PARM_SUPP_V4)) || 301432Svi117747 (sctp->sctp_family == AF_INET6 && !(*supp_af & PARM_SUPP_V6) && 302432Svi117747 sctp->sctp_connp->conn_ipv6_v6only))) { 303432Svi117747 dprint(1, ("sctp:validate_init_params: supp addr\n")); 304432Svi117747 serror = SCTP_ERR_BAD_ADDR; 305432Svi117747 goto abort; 306432Svi117747 } 3070Sstevel@tonic-gate 3080Sstevel@tonic-gate if (want_cookie != NULL && !got_cookie) { 3090Sstevel@tonic-gate cookie_abort: 3100Sstevel@tonic-gate dprint(1, ("validate_init_params: cookie absent\n")); 3110Sstevel@tonic-gate sctp_send_abort(sctp, sctp_init2vtag(ch), SCTP_ERR_MISSING_PARM, 3120Sstevel@tonic-gate details, errlen, inmp, 0, B_FALSE); 3130Sstevel@tonic-gate return (0); 3140Sstevel@tonic-gate } 3150Sstevel@tonic-gate 3160Sstevel@tonic-gate /* OK */ 3170Sstevel@tonic-gate return (1); 3180Sstevel@tonic-gate 3190Sstevel@tonic-gate abort: 3200Sstevel@tonic-gate if (want_cookie != NULL) 3210Sstevel@tonic-gate return (0); 3220Sstevel@tonic-gate 3230Sstevel@tonic-gate sctp_send_abort(sctp, sctp_init2vtag(ch), serror, details, 3240Sstevel@tonic-gate errlen, inmp, 0, B_FALSE); 3250Sstevel@tonic-gate return (0); 3260Sstevel@tonic-gate } 3270Sstevel@tonic-gate 3280Sstevel@tonic-gate /* 3290Sstevel@tonic-gate * Initialize params from the INIT and INIT-ACK when the assoc. is 3300Sstevel@tonic-gate * established. 3310Sstevel@tonic-gate */ 3320Sstevel@tonic-gate boolean_t 3330Sstevel@tonic-gate sctp_initialize_params(sctp_t *sctp, sctp_init_chunk_t *init, 3340Sstevel@tonic-gate sctp_init_chunk_t *iack) 3350Sstevel@tonic-gate { 3360Sstevel@tonic-gate /* Get initial TSN */ 3370Sstevel@tonic-gate sctp->sctp_ftsn = ntohl(init->sic_inittsn); 3380Sstevel@tonic-gate sctp->sctp_lastacked = sctp->sctp_ftsn - 1; 3390Sstevel@tonic-gate 3400Sstevel@tonic-gate /* Serial number is initialized to the same value as the TSN */ 3410Sstevel@tonic-gate sctp->sctp_fcsn = sctp->sctp_lastacked; 3420Sstevel@tonic-gate 3430Sstevel@tonic-gate /* 3440Sstevel@tonic-gate * Get verification tags; no byteordering is necessary, since 3450Sstevel@tonic-gate * verfication tags are never processed except for byte-by-byte 3460Sstevel@tonic-gate * comparisons. 3470Sstevel@tonic-gate */ 3480Sstevel@tonic-gate sctp->sctp_fvtag = init->sic_inittag; 3490Sstevel@tonic-gate sctp->sctp_sctph->sh_verf = init->sic_inittag; 3500Sstevel@tonic-gate sctp->sctp_sctph6->sh_verf = init->sic_inittag; 3510Sstevel@tonic-gate sctp->sctp_lvtag = iack->sic_inittag; 3520Sstevel@tonic-gate 3530Sstevel@tonic-gate /* Get the peer's rwnd */ 3540Sstevel@tonic-gate sctp->sctp_frwnd = ntohl(init->sic_a_rwnd); 3550Sstevel@tonic-gate 3560Sstevel@tonic-gate /* Allocate the in/out-stream counters */ 3570Sstevel@tonic-gate sctp->sctp_num_ostr = iack->sic_outstr; 3580Sstevel@tonic-gate sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) * 3590Sstevel@tonic-gate sctp->sctp_num_ostr, KM_NOSLEEP); 3600Sstevel@tonic-gate if (sctp->sctp_ostrcntrs == NULL) 3610Sstevel@tonic-gate return (B_FALSE); 3620Sstevel@tonic-gate 3630Sstevel@tonic-gate sctp->sctp_num_istr = iack->sic_instr; 3640Sstevel@tonic-gate sctp->sctp_instr = kmem_zalloc(sizeof (*sctp->sctp_instr) * 3650Sstevel@tonic-gate sctp->sctp_num_istr, KM_NOSLEEP); 3660Sstevel@tonic-gate if (sctp->sctp_instr == NULL) { 3670Sstevel@tonic-gate kmem_free(sctp->sctp_ostrcntrs, sizeof (uint16_t) * 3680Sstevel@tonic-gate sctp->sctp_num_ostr); 3690Sstevel@tonic-gate sctp->sctp_ostrcntrs = NULL; 3700Sstevel@tonic-gate return (B_FALSE); 3710Sstevel@tonic-gate } 3720Sstevel@tonic-gate return (B_TRUE); 3730Sstevel@tonic-gate } 3740Sstevel@tonic-gate 375*852Svi117747 /* 376*852Svi117747 * Copy the peer's original source address into addr. This relies on the 377*852Svi117747 * following format (see sctp_send_initack() below): 378*852Svi117747 * relative timestamp for the cookie (int64_t) + 379*852Svi117747 * cookie lifetime (uint32_t) + 380*852Svi117747 * local tie-tag (uint32_t) + peer tie-tag (uint32_t) + 381*852Svi117747 * Peer's original src ... 382*852Svi117747 */ 383*852Svi117747 int 384*852Svi117747 cl_sctp_cookie_paddr(sctp_chunk_hdr_t *ch, in6_addr_t *addr) 385*852Svi117747 { 386*852Svi117747 uchar_t *off; 387*852Svi117747 388*852Svi117747 ASSERT(addr != NULL); 389*852Svi117747 390*852Svi117747 if (ch->sch_id != CHUNK_COOKIE) 391*852Svi117747 return (EINVAL); 392*852Svi117747 393*852Svi117747 off = (uchar_t *)ch + sizeof (*ch) + sizeof (int64_t) + 394*852Svi117747 sizeof (uint32_t) + sizeof (uint32_t) + sizeof (uint32_t); 395*852Svi117747 396*852Svi117747 bcopy(off, addr, sizeof (*addr)); 397*852Svi117747 398*852Svi117747 return (0); 399*852Svi117747 } 400*852Svi117747 4010Sstevel@tonic-gate #define SCTP_CALC_COOKIE_LEN(initcp) \ 4020Sstevel@tonic-gate sizeof (int64_t) + /* timestamp */ \ 4030Sstevel@tonic-gate sizeof (uint32_t) + /* cookie lifetime */ \ 4040Sstevel@tonic-gate sizeof (sctp_init_chunk_t) + /* INIT ACK */ \ 4050Sstevel@tonic-gate sizeof (in6_addr_t) + /* peer's original source */ \ 4060Sstevel@tonic-gate ntohs((initcp)->sch_len) + /* peer's INIT */ \ 4070Sstevel@tonic-gate sizeof (uint32_t) + /* local tie-tag */ \ 4080Sstevel@tonic-gate sizeof (uint32_t) + /* peer tie-tag */ \ 4090Sstevel@tonic-gate sizeof (sctp_parm_hdr_t) + /* param header */ \ 4100Sstevel@tonic-gate 16 /* MD5 hash */ 4110Sstevel@tonic-gate 4120Sstevel@tonic-gate void 4130Sstevel@tonic-gate sctp_send_initack(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *initmp) 4140Sstevel@tonic-gate { 4150Sstevel@tonic-gate ipha_t *initiph; 4160Sstevel@tonic-gate ip6_t *initip6h; 4170Sstevel@tonic-gate ipha_t *iackiph; 4180Sstevel@tonic-gate ip6_t *iackip6h; 4190Sstevel@tonic-gate sctp_chunk_hdr_t *iack_ch; 4200Sstevel@tonic-gate sctp_init_chunk_t *iack; 4210Sstevel@tonic-gate sctp_init_chunk_t *init; 4220Sstevel@tonic-gate sctp_hdr_t *iacksh; 4230Sstevel@tonic-gate sctp_hdr_t *initsh; 4240Sstevel@tonic-gate size_t cookielen; 4250Sstevel@tonic-gate size_t iacklen; 4260Sstevel@tonic-gate size_t ipsctplen; 4270Sstevel@tonic-gate size_t errlen = 0; 4280Sstevel@tonic-gate sctp_parm_hdr_t *cookieph; 4290Sstevel@tonic-gate mblk_t *iackmp; 4300Sstevel@tonic-gate uint32_t itag; 4310Sstevel@tonic-gate uint32_t itsn; 4320Sstevel@tonic-gate int64_t *now; 4330Sstevel@tonic-gate int64_t nowt; 4340Sstevel@tonic-gate uint32_t *lifetime; 4350Sstevel@tonic-gate char *p; 4360Sstevel@tonic-gate boolean_t isv4; 437432Svi117747 int supp_af = 0; 4380Sstevel@tonic-gate uint_t sctp_options; 4390Sstevel@tonic-gate uint32_t *ttag; 4400Sstevel@tonic-gate int pad; 4410Sstevel@tonic-gate mblk_t *errmp = NULL; 4420Sstevel@tonic-gate boolean_t initcollision = B_FALSE; 443432Svi117747 boolean_t linklocal = B_FALSE; 4440Sstevel@tonic-gate 4450Sstevel@tonic-gate BUMP_LOCAL(sctp->sctp_ibchunks); 4460Sstevel@tonic-gate isv4 = (IPH_HDR_VERSION(initmp->b_rptr) == IPV4_VERSION); 4470Sstevel@tonic-gate 4480Sstevel@tonic-gate /* Extract the INIT chunk */ 4490Sstevel@tonic-gate if (isv4) { 4500Sstevel@tonic-gate initiph = (ipha_t *)initmp->b_rptr; 4510Sstevel@tonic-gate initsh = (sctp_hdr_t *)((char *)initiph + 4520Sstevel@tonic-gate IPH_HDR_LENGTH(initmp->b_rptr)); 4530Sstevel@tonic-gate ipsctplen = sctp->sctp_ip_hdr_len; 454432Svi117747 supp_af |= PARM_SUPP_V4; 4550Sstevel@tonic-gate } else { 4560Sstevel@tonic-gate initip6h = (ip6_t *)initmp->b_rptr; 4570Sstevel@tonic-gate initsh = (sctp_hdr_t *)(initip6h + 1); 4580Sstevel@tonic-gate ipsctplen = sctp->sctp_ip_hdr6_len; 459432Svi117747 if (IN6_IS_ADDR_LINKLOCAL(&initip6h->ip6_src)) 460432Svi117747 linklocal = B_TRUE; 461432Svi117747 supp_af |= PARM_SUPP_V6; 4620Sstevel@tonic-gate } 4630Sstevel@tonic-gate ASSERT(OK_32PTR(initsh)); 4640Sstevel@tonic-gate init = (sctp_init_chunk_t *)((char *)(initsh + 1) + sizeof (*iack_ch)); 4650Sstevel@tonic-gate 4660Sstevel@tonic-gate /* Make sure we like the peer's parameters */ 4670Sstevel@tonic-gate if (validate_init_params(sctp, ch, init, initmp, NULL, &errmp, 4680Sstevel@tonic-gate &supp_af, &sctp_options) == 0) { 4690Sstevel@tonic-gate return; 4700Sstevel@tonic-gate } 4710Sstevel@tonic-gate if (errmp != NULL) 4720Sstevel@tonic-gate errlen = msgdsize(errmp); 4730Sstevel@tonic-gate if (sctp->sctp_family == AF_INET) { 4740Sstevel@tonic-gate /* 4750Sstevel@tonic-gate * Irregardless of the supported address in the INIT, v4 4760Sstevel@tonic-gate * must be supported. 4770Sstevel@tonic-gate */ 4780Sstevel@tonic-gate supp_af = PARM_SUPP_V4; 4790Sstevel@tonic-gate } 4800Sstevel@tonic-gate if (sctp->sctp_state <= SCTPS_LISTEN) { 4810Sstevel@tonic-gate /* normal, expected INIT: generate new vtag and itsn */ 4820Sstevel@tonic-gate (void) random_get_pseudo_bytes((uint8_t *)&itag, sizeof (itag)); 4830Sstevel@tonic-gate if (itag == 0) 4840Sstevel@tonic-gate itag = (uint32_t)gethrtime(); 4850Sstevel@tonic-gate itsn = itag + 1; 4860Sstevel@tonic-gate itag = htonl(itag); 4870Sstevel@tonic-gate } else if (sctp->sctp_state == SCTPS_COOKIE_WAIT || 4880Sstevel@tonic-gate sctp->sctp_state == SCTPS_COOKIE_ECHOED) { 4890Sstevel@tonic-gate /* init collision; copy vtag and itsn from sctp */ 4900Sstevel@tonic-gate itag = sctp->sctp_lvtag; 4910Sstevel@tonic-gate itsn = sctp->sctp_ltsn; 4920Sstevel@tonic-gate /* 4930Sstevel@tonic-gate * In addition we need to send all the params that was sent 4940Sstevel@tonic-gate * in our INIT chunk. Essentially, it is only the supported 4950Sstevel@tonic-gate * address params that we need to add. 4960Sstevel@tonic-gate */ 4970Sstevel@tonic-gate initcollision = B_TRUE; 498432Svi117747 /* 499432Svi117747 * When we sent the INIT, we should have set linklocal in 500432Svi117747 * the sctp which should be good enough. 501432Svi117747 */ 502432Svi117747 if (linklocal) 503432Svi117747 linklocal = B_FALSE; 5040Sstevel@tonic-gate } else { 5050Sstevel@tonic-gate /* peer restart; generate new vtag but keep everything else */ 5060Sstevel@tonic-gate (void) random_get_pseudo_bytes((uint8_t *)&itag, sizeof (itag)); 5070Sstevel@tonic-gate if (itag == 0) 5080Sstevel@tonic-gate itag = (uint32_t)gethrtime(); 5090Sstevel@tonic-gate itag = htonl(itag); 5100Sstevel@tonic-gate itsn = sctp->sctp_ltsn; 5110Sstevel@tonic-gate } 5120Sstevel@tonic-gate 5130Sstevel@tonic-gate /* 5140Sstevel@tonic-gate * Allocate a mblk for the INIT ACK, consisting of the link layer 5150Sstevel@tonic-gate * header, the IP header, the SCTP common header, and INIT ACK chunk, 5160Sstevel@tonic-gate * and finally the COOKIE parameter. 5170Sstevel@tonic-gate */ 5180Sstevel@tonic-gate cookielen = SCTP_CALC_COOKIE_LEN(ch); 5190Sstevel@tonic-gate iacklen = sizeof (*iack_ch) + sizeof (*iack) + cookielen; 5200Sstevel@tonic-gate if (sctp->sctp_send_adaption) 5210Sstevel@tonic-gate iacklen += (sizeof (sctp_parm_hdr_t) + sizeof (uint32_t)); 5220Sstevel@tonic-gate if (((sctp_options & SCTP_PRSCTP_OPTION) || initcollision) && 5230Sstevel@tonic-gate sctp->sctp_prsctp_aware && sctp_prsctp_enabled) { 5240Sstevel@tonic-gate iacklen += sctp_options_param_len(sctp, SCTP_PRSCTP_OPTION); 5250Sstevel@tonic-gate } 5260Sstevel@tonic-gate if (initcollision) 5270Sstevel@tonic-gate iacklen += sctp_supaddr_param_len(sctp); 528432Svi117747 if (!linklocal) 529432Svi117747 iacklen += sctp_addr_params_len(sctp, supp_af, B_FALSE); 5300Sstevel@tonic-gate ipsctplen += sizeof (*iacksh) + iacklen; 5310Sstevel@tonic-gate iacklen += errlen; 5320Sstevel@tonic-gate if ((pad = ipsctplen % 4) != 0) { 5330Sstevel@tonic-gate pad = 4 - pad; 5340Sstevel@tonic-gate ipsctplen += pad; 5350Sstevel@tonic-gate } 5360Sstevel@tonic-gate iackmp = allocb(ipsctplen + sctp_wroff_xtra, BPRI_MED); 5370Sstevel@tonic-gate if (iackmp == NULL) { 5380Sstevel@tonic-gate sctp_send_abort(sctp, sctp_init2vtag(ch), 5390Sstevel@tonic-gate SCTP_ERR_NO_RESOURCES, NULL, 0, initmp, 0, B_FALSE); 5400Sstevel@tonic-gate return; 5410Sstevel@tonic-gate } 5420Sstevel@tonic-gate 5430Sstevel@tonic-gate /* Copy in the [imcomplete] IP/SCTP composite header */ 5440Sstevel@tonic-gate p = (char *)(iackmp->b_rptr + sctp_wroff_xtra); 5450Sstevel@tonic-gate iackmp->b_rptr = (uchar_t *)p; 5460Sstevel@tonic-gate if (isv4) { 5470Sstevel@tonic-gate bcopy(sctp->sctp_iphc, p, sctp->sctp_hdr_len); 5480Sstevel@tonic-gate iackiph = (ipha_t *)p; 5490Sstevel@tonic-gate 5500Sstevel@tonic-gate /* Copy the peer's IP addr */ 5510Sstevel@tonic-gate iackiph->ipha_dst = initiph->ipha_src; 5520Sstevel@tonic-gate iackiph->ipha_src = initiph->ipha_dst; 5530Sstevel@tonic-gate iackiph->ipha_length = htons(ipsctplen + errlen); 5540Sstevel@tonic-gate iacksh = (sctp_hdr_t *)(p + sctp->sctp_ip_hdr_len); 5550Sstevel@tonic-gate } else { 5560Sstevel@tonic-gate bcopy(sctp->sctp_iphc6, p, sctp->sctp_hdr6_len); 5570Sstevel@tonic-gate iackip6h = (ip6_t *)p; 5580Sstevel@tonic-gate 5590Sstevel@tonic-gate /* Copy the peer's IP addr */ 5600Sstevel@tonic-gate iackip6h->ip6_dst = initip6h->ip6_src; 5610Sstevel@tonic-gate iackip6h->ip6_src = initip6h->ip6_dst; 5620Sstevel@tonic-gate iackip6h->ip6_plen = htons(ipsctplen - sizeof (*iackip6h) + 5630Sstevel@tonic-gate errlen); 5640Sstevel@tonic-gate iacksh = (sctp_hdr_t *)(p + sctp->sctp_ip_hdr6_len); 5650Sstevel@tonic-gate } 5660Sstevel@tonic-gate ASSERT(OK_32PTR(iacksh)); 5670Sstevel@tonic-gate 5680Sstevel@tonic-gate /* Fill in the holes in the SCTP common header */ 5690Sstevel@tonic-gate iacksh->sh_sport = initsh->sh_dport; 5700Sstevel@tonic-gate iacksh->sh_dport = initsh->sh_sport; 5710Sstevel@tonic-gate iacksh->sh_verf = init->sic_inittag; 5720Sstevel@tonic-gate 5730Sstevel@tonic-gate /* INIT ACK chunk header */ 5740Sstevel@tonic-gate iack_ch = (sctp_chunk_hdr_t *)(iacksh + 1); 5750Sstevel@tonic-gate iack_ch->sch_id = CHUNK_INIT_ACK; 5760Sstevel@tonic-gate iack_ch->sch_flags = 0; 5770Sstevel@tonic-gate iack_ch->sch_len = htons(iacklen); 5780Sstevel@tonic-gate 5790Sstevel@tonic-gate /* The INIT ACK itself */ 5800Sstevel@tonic-gate iack = (sctp_init_chunk_t *)(iack_ch + 1); 5810Sstevel@tonic-gate iack->sic_inittag = itag; /* already in network byteorder */ 5820Sstevel@tonic-gate iack->sic_inittsn = htonl(itsn); 5830Sstevel@tonic-gate 5840Sstevel@tonic-gate iack->sic_a_rwnd = htonl(sctp->sctp_rwnd); 5850Sstevel@tonic-gate /* Advertise what we would want to have as stream #'s */ 5860Sstevel@tonic-gate iack->sic_outstr = htons(MIN(sctp->sctp_num_ostr, 5870Sstevel@tonic-gate ntohs(init->sic_instr))); 5880Sstevel@tonic-gate iack->sic_instr = htons(sctp->sctp_num_istr); 5890Sstevel@tonic-gate 5900Sstevel@tonic-gate p = (char *)(iack + 1); 5910Sstevel@tonic-gate p += sctp_adaption_code_param(sctp, (uchar_t *)p); 5920Sstevel@tonic-gate if (initcollision) 5930Sstevel@tonic-gate p += sctp_supaddr_param(sctp, (uchar_t *)p); 594432Svi117747 if (!linklocal) 595432Svi117747 p += sctp_addr_params(sctp, supp_af, (uchar_t *)p); 5960Sstevel@tonic-gate if (((sctp_options & SCTP_PRSCTP_OPTION) || initcollision) && 5970Sstevel@tonic-gate sctp->sctp_prsctp_aware && sctp_prsctp_enabled) { 5980Sstevel@tonic-gate p += sctp_options_param(sctp, p, SCTP_PRSCTP_OPTION); 5990Sstevel@tonic-gate } 6000Sstevel@tonic-gate /* 6010Sstevel@tonic-gate * Generate and lay in the COOKIE parameter. 6020Sstevel@tonic-gate * 603*852Svi117747 * Any change here that results in a change of location for 604*852Svi117747 * the peer's orig source address must be propagated to the fn 605*852Svi117747 * cl_sctp_cookie_paddr() above. 606*852Svi117747 * 6070Sstevel@tonic-gate * The cookie consists of: 6080Sstevel@tonic-gate * 1. The relative timestamp for the cookie (lbolt64) 6090Sstevel@tonic-gate * 2. The cookie lifetime (uint32_t) in tick 6100Sstevel@tonic-gate * 3. The local tie-tag 6110Sstevel@tonic-gate * 4. The peer tie-tag 6120Sstevel@tonic-gate * 5. Peer's original src, used to confirm the validity of address. 6130Sstevel@tonic-gate * 6. Our INIT ACK chunk, less any parameters 6140Sstevel@tonic-gate * 7. The INIT chunk (may contain parameters) 6150Sstevel@tonic-gate * 8. 128-bit MD5 signature. 6160Sstevel@tonic-gate * 6170Sstevel@tonic-gate * Since the timestamp values will only be evaluated locally, we 6180Sstevel@tonic-gate * don't need to worry about byte-ordering them. 6190Sstevel@tonic-gate */ 6200Sstevel@tonic-gate cookieph = (sctp_parm_hdr_t *)p; 6210Sstevel@tonic-gate cookieph->sph_type = htons(PARM_COOKIE); 6220Sstevel@tonic-gate cookieph->sph_len = htons(cookielen); 6230Sstevel@tonic-gate 6240Sstevel@tonic-gate /* timestamp */ 6250Sstevel@tonic-gate now = (int64_t *)(cookieph + 1); 6260Sstevel@tonic-gate nowt = lbolt64; 6270Sstevel@tonic-gate bcopy(&nowt, now, sizeof (*now)); 6280Sstevel@tonic-gate 6290Sstevel@tonic-gate /* cookie lifetime -- need configuration */ 6300Sstevel@tonic-gate lifetime = (uint32_t *)(now + 1); 6310Sstevel@tonic-gate *lifetime = sctp->sctp_cookie_lifetime; 6320Sstevel@tonic-gate 6330Sstevel@tonic-gate /* Set the tie-tags */ 6340Sstevel@tonic-gate ttag = (uint32_t *)(lifetime + 1); 6350Sstevel@tonic-gate if (sctp->sctp_state <= SCTPS_COOKIE_WAIT) { 6360Sstevel@tonic-gate *ttag = 0; 6370Sstevel@tonic-gate ttag++; 6380Sstevel@tonic-gate *ttag = 0; 6390Sstevel@tonic-gate ttag++; 6400Sstevel@tonic-gate } else { 6410Sstevel@tonic-gate /* local tie-tag (network byte-order) */ 6420Sstevel@tonic-gate *ttag = sctp->sctp_lvtag; 6430Sstevel@tonic-gate ttag++; 6440Sstevel@tonic-gate /* peer tie-tag (network byte-order) */ 6450Sstevel@tonic-gate *ttag = sctp->sctp_fvtag; 6460Sstevel@tonic-gate ttag++; 6470Sstevel@tonic-gate } 6480Sstevel@tonic-gate /* 6490Sstevel@tonic-gate * Copy in peer's original source address so that we can confirm 6500Sstevel@tonic-gate * the reachability later. 6510Sstevel@tonic-gate */ 6520Sstevel@tonic-gate p = (char *)ttag; 6530Sstevel@tonic-gate if (isv4) { 6540Sstevel@tonic-gate in6_addr_t peer_addr; 6550Sstevel@tonic-gate 6560Sstevel@tonic-gate IN6_IPADDR_TO_V4MAPPED(iackiph->ipha_dst, &peer_addr); 6570Sstevel@tonic-gate bcopy(&peer_addr, p, sizeof (in6_addr_t)); 6580Sstevel@tonic-gate } else { 6590Sstevel@tonic-gate bcopy(&iackip6h->ip6_dst, p, sizeof (in6_addr_t)); 6600Sstevel@tonic-gate } 6610Sstevel@tonic-gate p += sizeof (in6_addr_t); 6620Sstevel@tonic-gate /* Copy in our INIT ACK chunk */ 6630Sstevel@tonic-gate bcopy(iack, p, sizeof (*iack)); 6640Sstevel@tonic-gate iack = (sctp_init_chunk_t *)p; 6650Sstevel@tonic-gate /* Set the # of streams we'll end up using */ 6660Sstevel@tonic-gate iack->sic_outstr = MIN(sctp->sctp_num_ostr, ntohs(init->sic_instr)); 6670Sstevel@tonic-gate iack->sic_instr = MIN(sctp->sctp_num_istr, ntohs(init->sic_outstr)); 6680Sstevel@tonic-gate p += sizeof (*iack); 6690Sstevel@tonic-gate 6700Sstevel@tonic-gate /* Copy in the peer's INIT chunk */ 6710Sstevel@tonic-gate bcopy(ch, p, ntohs(ch->sch_len)); 6720Sstevel@tonic-gate p += ntohs(ch->sch_len); 6730Sstevel@tonic-gate 6740Sstevel@tonic-gate /* 6750Sstevel@tonic-gate * Calculate the HMAC ICV into the digest slot in buf. 6760Sstevel@tonic-gate * First, generate a new secret if the current secret is 6770Sstevel@tonic-gate * older than the new secret lifetime parameter permits, 6780Sstevel@tonic-gate * copying the current secret to sctp_old_secret. 6790Sstevel@tonic-gate */ 6800Sstevel@tonic-gate if (sctp_new_secret_interval > 0 && 6810Sstevel@tonic-gate (sctp->sctp_last_secret_update + 6820Sstevel@tonic-gate MSEC_TO_TICK(sctp_new_secret_interval)) <= nowt) { 6830Sstevel@tonic-gate bcopy(sctp->sctp_secret, sctp->sctp_old_secret, 6840Sstevel@tonic-gate SCTP_SECRET_LEN); 6850Sstevel@tonic-gate (void) random_get_pseudo_bytes(sctp->sctp_secret, 6860Sstevel@tonic-gate SCTP_SECRET_LEN); 6870Sstevel@tonic-gate sctp->sctp_last_secret_update = nowt; 6880Sstevel@tonic-gate } 6890Sstevel@tonic-gate 6900Sstevel@tonic-gate hmac_md5((uchar_t *)now, cookielen - sizeof (*cookieph) - 16, 6910Sstevel@tonic-gate (uchar_t *)sctp->sctp_secret, SCTP_SECRET_LEN, (uchar_t *)p); 6920Sstevel@tonic-gate 6930Sstevel@tonic-gate iackmp->b_wptr = iackmp->b_rptr + ipsctplen; 6940Sstevel@tonic-gate iackmp->b_cont = errmp; /* OK if NULL */ 6950Sstevel@tonic-gate 6960Sstevel@tonic-gate /* 6970Sstevel@tonic-gate * Stash the conn ptr info. for IP only as e don't have any 6980Sstevel@tonic-gate * cached IRE. 6990Sstevel@tonic-gate */ 7000Sstevel@tonic-gate SCTP_STASH_IPINFO(iackmp, (ire_t *)NULL); 7010Sstevel@tonic-gate 7020Sstevel@tonic-gate /* XXX sctp == sctp_g_q, so using its obchunks is valid */ 7030Sstevel@tonic-gate BUMP_LOCAL(sctp->sctp_opkts); 7040Sstevel@tonic-gate BUMP_LOCAL(sctp->sctp_obchunks); 7050Sstevel@tonic-gate 7060Sstevel@tonic-gate /* OK to call IP_PUT() here instead of sctp_add_sendq(). */ 7070Sstevel@tonic-gate CONN_INC_REF(sctp->sctp_connp); 7080Sstevel@tonic-gate iackmp->b_flag |= MSGHASREF; 7090Sstevel@tonic-gate IP_PUT(iackmp, sctp->sctp_connp, isv4); 7100Sstevel@tonic-gate } 7110Sstevel@tonic-gate 7120Sstevel@tonic-gate void 7130Sstevel@tonic-gate sctp_send_cookie_ack(sctp_t *sctp) 7140Sstevel@tonic-gate { 7150Sstevel@tonic-gate sctp_chunk_hdr_t *cach; 7160Sstevel@tonic-gate mblk_t *camp; 7170Sstevel@tonic-gate 7180Sstevel@tonic-gate camp = sctp_make_mp(sctp, NULL, sizeof (*cach)); 7190Sstevel@tonic-gate if (camp == NULL) { 7200Sstevel@tonic-gate /* XXX should abort, but don't have the inmp anymore */ 7210Sstevel@tonic-gate return; 7220Sstevel@tonic-gate } 7230Sstevel@tonic-gate 7240Sstevel@tonic-gate cach = (sctp_chunk_hdr_t *)camp->b_wptr; 7250Sstevel@tonic-gate camp->b_wptr = (uchar_t *)(cach + 1); 7260Sstevel@tonic-gate cach->sch_id = CHUNK_COOKIE_ACK; 7270Sstevel@tonic-gate cach->sch_flags = 0; 7280Sstevel@tonic-gate cach->sch_len = htons(sizeof (*cach)); 7290Sstevel@tonic-gate 7300Sstevel@tonic-gate sctp_set_iplen(sctp, camp); 7310Sstevel@tonic-gate 7320Sstevel@tonic-gate BUMP_LOCAL(sctp->sctp_obchunks); 7330Sstevel@tonic-gate 7340Sstevel@tonic-gate sctp_add_sendq(sctp, camp); 7350Sstevel@tonic-gate } 7360Sstevel@tonic-gate 7370Sstevel@tonic-gate static int 7380Sstevel@tonic-gate sctp_find_al_ind(sctp_parm_hdr_t *sph, ssize_t len, uint32_t *adaption_code) 7390Sstevel@tonic-gate { 7400Sstevel@tonic-gate 7410Sstevel@tonic-gate if (len < sizeof (*sph)) 7420Sstevel@tonic-gate return (-1); 7430Sstevel@tonic-gate while (sph != NULL) { 7440Sstevel@tonic-gate if (sph->sph_type == htons(PARM_ADAPT_LAYER_IND) && 7450Sstevel@tonic-gate ntohs(sph->sph_len) >= (sizeof (*sph) + 7460Sstevel@tonic-gate sizeof (uint32_t))) { 7470Sstevel@tonic-gate *adaption_code = *(uint32_t *)(sph + 1); 7480Sstevel@tonic-gate return (0); 7490Sstevel@tonic-gate } 7500Sstevel@tonic-gate sph = sctp_next_parm(sph, &len); 7510Sstevel@tonic-gate } 7520Sstevel@tonic-gate return (-1); 7530Sstevel@tonic-gate } 7540Sstevel@tonic-gate 7550Sstevel@tonic-gate void 7560Sstevel@tonic-gate sctp_send_cookie_echo(sctp_t *sctp, sctp_chunk_hdr_t *iackch, mblk_t *iackmp) 7570Sstevel@tonic-gate { 7580Sstevel@tonic-gate mblk_t *cemp; 7590Sstevel@tonic-gate mblk_t *mp = NULL; 7600Sstevel@tonic-gate mblk_t *head; 7610Sstevel@tonic-gate mblk_t *meta; 7620Sstevel@tonic-gate sctp_faddr_t *fp; 7630Sstevel@tonic-gate sctp_chunk_hdr_t *cech; 7640Sstevel@tonic-gate sctp_init_chunk_t *iack; 7650Sstevel@tonic-gate int32_t cansend; 7660Sstevel@tonic-gate int32_t seglen; 7670Sstevel@tonic-gate size_t ceclen; 7680Sstevel@tonic-gate sctp_parm_hdr_t *cph; 7690Sstevel@tonic-gate sctp_data_hdr_t *sdc; 7700Sstevel@tonic-gate sctp_tf_t *tf; 771432Svi117747 int pad = 0; 7720Sstevel@tonic-gate int hdrlen; 7730Sstevel@tonic-gate mblk_t *errmp = NULL; 7740Sstevel@tonic-gate uint_t sctp_options; 7750Sstevel@tonic-gate int error; 7760Sstevel@tonic-gate uint16_t old_num_str; 7770Sstevel@tonic-gate 7780Sstevel@tonic-gate iack = (sctp_init_chunk_t *)(iackch + 1); 7790Sstevel@tonic-gate 7800Sstevel@tonic-gate cph = NULL; 7810Sstevel@tonic-gate if (validate_init_params(sctp, iackch, iack, iackmp, &cph, &errmp, 7820Sstevel@tonic-gate &pad, &sctp_options) == 0) { /* result in 'pad' ignored */ 7830Sstevel@tonic-gate BUMP_MIB(&sctp_mib, sctpAborted); 7840Sstevel@tonic-gate sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL); 7850Sstevel@tonic-gate sctp_clean_death(sctp, ECONNABORTED); 7860Sstevel@tonic-gate return; 7870Sstevel@tonic-gate } 7880Sstevel@tonic-gate ASSERT(cph != NULL); 7890Sstevel@tonic-gate 7900Sstevel@tonic-gate ASSERT(sctp->sctp_cookie_mp == NULL); 7910Sstevel@tonic-gate 7920Sstevel@tonic-gate /* Got a cookie to echo back; allocate an mblk */ 7930Sstevel@tonic-gate ceclen = sizeof (*cech) + ntohs(cph->sph_len) - sizeof (*cph); 7940Sstevel@tonic-gate if ((pad = ceclen & (SCTP_ALIGN - 1)) != 0) 7950Sstevel@tonic-gate pad = SCTP_ALIGN - pad; 7960Sstevel@tonic-gate 7970Sstevel@tonic-gate if (IPH_HDR_VERSION(iackmp->b_rptr) == IPV4_VERSION) 7980Sstevel@tonic-gate hdrlen = sctp->sctp_hdr_len; 7990Sstevel@tonic-gate else 8000Sstevel@tonic-gate hdrlen = sctp->sctp_hdr6_len; 8010Sstevel@tonic-gate 8020Sstevel@tonic-gate cemp = allocb(sctp_wroff_xtra + hdrlen + ceclen + pad, BPRI_MED); 8030Sstevel@tonic-gate if (cemp == NULL) { 8040Sstevel@tonic-gate SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current, 8050Sstevel@tonic-gate sctp->sctp_current->rto); 8060Sstevel@tonic-gate if (errmp != NULL) 8070Sstevel@tonic-gate freeb(errmp); 8080Sstevel@tonic-gate return; 8090Sstevel@tonic-gate } 8100Sstevel@tonic-gate cemp->b_rptr += (sctp_wroff_xtra + hdrlen); 8110Sstevel@tonic-gate 8120Sstevel@tonic-gate /* Process the INIT ACK */ 8130Sstevel@tonic-gate sctp->sctp_sctph->sh_verf = iack->sic_inittag; 8140Sstevel@tonic-gate sctp->sctp_sctph6->sh_verf = iack->sic_inittag; 8150Sstevel@tonic-gate sctp->sctp_fvtag = iack->sic_inittag; 8160Sstevel@tonic-gate sctp->sctp_ftsn = ntohl(iack->sic_inittsn); 8170Sstevel@tonic-gate sctp->sctp_lastacked = sctp->sctp_ftsn - 1; 8180Sstevel@tonic-gate sctp->sctp_fcsn = sctp->sctp_lastacked; 8190Sstevel@tonic-gate sctp->sctp_frwnd = ntohl(iack->sic_a_rwnd); 8200Sstevel@tonic-gate 8210Sstevel@tonic-gate /* 8220Sstevel@tonic-gate * Populate sctp with addresses given in the INIT ACK or IP header. 8230Sstevel@tonic-gate * Need to set the df bit in the current fp as it has been cleared 8240Sstevel@tonic-gate * in sctp_connect(). 8250Sstevel@tonic-gate */ 8260Sstevel@tonic-gate sctp->sctp_current->df = B_TRUE; 8270Sstevel@tonic-gate /* 8280Sstevel@tonic-gate * Since IP uses this info during the fanout process, we need to hold 8290Sstevel@tonic-gate * the lock for this hash line while performing this operation. 8300Sstevel@tonic-gate */ 8310Sstevel@tonic-gate /* XXX sctp_conn_fanout + SCTP_CONN_HASH(sctp->sctp_ports); */ 8320Sstevel@tonic-gate ASSERT(sctp->sctp_conn_tfp != NULL); 8330Sstevel@tonic-gate tf = sctp->sctp_conn_tfp; 8340Sstevel@tonic-gate /* sctp isn't a listener so only need to hold conn fanout lock */ 8350Sstevel@tonic-gate mutex_enter(&tf->tf_lock); 8360Sstevel@tonic-gate if (sctp_get_addrparams(sctp, NULL, iackmp, iackch, NULL) != 0) { 8370Sstevel@tonic-gate mutex_exit(&tf->tf_lock); 8380Sstevel@tonic-gate freeb(cemp); 8390Sstevel@tonic-gate SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current, 8400Sstevel@tonic-gate sctp->sctp_current->rto); 8410Sstevel@tonic-gate if (errmp != NULL) 8420Sstevel@tonic-gate freeb(errmp); 8430Sstevel@tonic-gate return; 8440Sstevel@tonic-gate } 8450Sstevel@tonic-gate mutex_exit(&tf->tf_lock); 8460Sstevel@tonic-gate 8470Sstevel@tonic-gate fp = sctp->sctp_current; 8480Sstevel@tonic-gate 8490Sstevel@tonic-gate /* 8500Sstevel@tonic-gate * There could be a case when we get an INIT-ACK again, if the INIT 8510Sstevel@tonic-gate * is re-transmitted, for e.g., which means we would have already 8520Sstevel@tonic-gate * allocated this resource earlier (also for sctp_instr). In this 8530Sstevel@tonic-gate * case we check and re-allocate, if necessary. 8540Sstevel@tonic-gate */ 8550Sstevel@tonic-gate old_num_str = sctp->sctp_num_ostr; 8560Sstevel@tonic-gate if (ntohs(iack->sic_instr) < sctp->sctp_num_ostr) 8570Sstevel@tonic-gate sctp->sctp_num_ostr = ntohs(iack->sic_instr); 8580Sstevel@tonic-gate if (sctp->sctp_ostrcntrs == NULL) { 8590Sstevel@tonic-gate sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) * 8600Sstevel@tonic-gate sctp->sctp_num_ostr, KM_NOSLEEP); 8610Sstevel@tonic-gate } else { 8620Sstevel@tonic-gate ASSERT(old_num_str > 0); 8630Sstevel@tonic-gate if (old_num_str != sctp->sctp_num_ostr) { 8640Sstevel@tonic-gate kmem_free(sctp->sctp_ostrcntrs, sizeof (uint16_t) * 8650Sstevel@tonic-gate old_num_str); 8660Sstevel@tonic-gate sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) * 8670Sstevel@tonic-gate sctp->sctp_num_ostr, KM_NOSLEEP); 8680Sstevel@tonic-gate } 8690Sstevel@tonic-gate } 8700Sstevel@tonic-gate if (sctp->sctp_ostrcntrs == NULL) { 8710Sstevel@tonic-gate freeb(cemp); 8720Sstevel@tonic-gate SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 8730Sstevel@tonic-gate if (errmp != NULL) 8740Sstevel@tonic-gate freeb(errmp); 8750Sstevel@tonic-gate return; 8760Sstevel@tonic-gate } 8770Sstevel@tonic-gate 8780Sstevel@tonic-gate /* 8790Sstevel@tonic-gate * Allocate the in stream tracking array. Comments for sctp_ostrcntrs 8800Sstevel@tonic-gate * hold here too. 8810Sstevel@tonic-gate */ 8820Sstevel@tonic-gate old_num_str = sctp->sctp_num_istr; 8830Sstevel@tonic-gate if (ntohs(iack->sic_outstr) < sctp->sctp_num_istr) 8840Sstevel@tonic-gate sctp->sctp_num_istr = ntohs(iack->sic_outstr); 8850Sstevel@tonic-gate if (sctp->sctp_instr == NULL) { 8860Sstevel@tonic-gate sctp->sctp_instr = kmem_zalloc(sizeof (*sctp->sctp_instr) * 8870Sstevel@tonic-gate sctp->sctp_num_istr, KM_NOSLEEP); 8880Sstevel@tonic-gate } else { 8890Sstevel@tonic-gate ASSERT(old_num_str > 0); 8900Sstevel@tonic-gate if (old_num_str != sctp->sctp_num_istr) { 8910Sstevel@tonic-gate kmem_free(sctp->sctp_instr, 8920Sstevel@tonic-gate sizeof (*sctp->sctp_instr) * old_num_str); 8930Sstevel@tonic-gate sctp->sctp_instr = kmem_zalloc( 8940Sstevel@tonic-gate sizeof (*sctp->sctp_instr) * sctp->sctp_num_istr, 8950Sstevel@tonic-gate KM_NOSLEEP); 8960Sstevel@tonic-gate } 8970Sstevel@tonic-gate } 8980Sstevel@tonic-gate if (sctp->sctp_instr == NULL) { 8990Sstevel@tonic-gate kmem_free(sctp->sctp_ostrcntrs, 9000Sstevel@tonic-gate sizeof (uint16_t) * sctp->sctp_num_ostr); 9010Sstevel@tonic-gate freeb(cemp); 9020Sstevel@tonic-gate SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 9030Sstevel@tonic-gate if (errmp != NULL) 9040Sstevel@tonic-gate freeb(errmp); 9050Sstevel@tonic-gate return; 9060Sstevel@tonic-gate } 9070Sstevel@tonic-gate 9080Sstevel@tonic-gate if (!(sctp_options & SCTP_PRSCTP_OPTION) && sctp->sctp_prsctp_aware) 9090Sstevel@tonic-gate sctp->sctp_prsctp_aware = B_FALSE; 9100Sstevel@tonic-gate 9110Sstevel@tonic-gate if (sctp_find_al_ind((sctp_parm_hdr_t *)(iack + 1), 9120Sstevel@tonic-gate ntohs(iackch->sch_len) - (sizeof (*iackch) + sizeof (*iack)), 9130Sstevel@tonic-gate &sctp->sctp_rx_adaption_code) == 0) { 9140Sstevel@tonic-gate sctp->sctp_recv_adaption = 1; 9150Sstevel@tonic-gate } 9160Sstevel@tonic-gate 9170Sstevel@tonic-gate cech = (sctp_chunk_hdr_t *)cemp->b_rptr; 9180Sstevel@tonic-gate ASSERT(OK_32PTR(cech)); 9190Sstevel@tonic-gate cech->sch_id = CHUNK_COOKIE; 9200Sstevel@tonic-gate cech->sch_flags = 0; 9210Sstevel@tonic-gate cech->sch_len = htons(ceclen); 9220Sstevel@tonic-gate 9230Sstevel@tonic-gate /* Copy the cookie (less the parm hdr) to the chunk */ 9240Sstevel@tonic-gate bcopy(cph + 1, cech + 1, ceclen - sizeof (*cph)); 9250Sstevel@tonic-gate 9260Sstevel@tonic-gate cemp->b_wptr = cemp->b_rptr + ceclen; 9270Sstevel@tonic-gate 928252Svi117747 if (sctp->sctp_unsent > 0) { 9290Sstevel@tonic-gate sctp_msg_hdr_t *smh; 9300Sstevel@tonic-gate mblk_t *prev = NULL; 9310Sstevel@tonic-gate uint32_t unsent = 0; 9320Sstevel@tonic-gate 9330Sstevel@tonic-gate mp = sctp->sctp_xmit_unsent; 9340Sstevel@tonic-gate do { 9350Sstevel@tonic-gate smh = (sctp_msg_hdr_t *)mp->b_rptr; 9360Sstevel@tonic-gate if (smh->smh_sid >= sctp->sctp_num_ostr) { 9370Sstevel@tonic-gate unsent += smh->smh_msglen; 9380Sstevel@tonic-gate if (prev != NULL) 9390Sstevel@tonic-gate prev->b_next = mp->b_next; 9400Sstevel@tonic-gate else 9410Sstevel@tonic-gate sctp->sctp_xmit_unsent = mp->b_next; 9420Sstevel@tonic-gate mp->b_next = NULL; 9430Sstevel@tonic-gate sctp_sendfail_event(sctp, mp, SCTP_ERR_BAD_SID, 9440Sstevel@tonic-gate B_FALSE); 9450Sstevel@tonic-gate if (prev != NULL) 9460Sstevel@tonic-gate mp = prev->b_next; 9470Sstevel@tonic-gate else 9480Sstevel@tonic-gate mp = sctp->sctp_xmit_unsent; 9490Sstevel@tonic-gate } else { 9500Sstevel@tonic-gate prev = mp; 9510Sstevel@tonic-gate mp = mp->b_next; 9520Sstevel@tonic-gate } 9530Sstevel@tonic-gate } while (mp != NULL); 9540Sstevel@tonic-gate if (unsent > 0) { 9550Sstevel@tonic-gate ASSERT(sctp->sctp_unsent >= unsent); 9560Sstevel@tonic-gate sctp->sctp_unsent -= unsent; 9570Sstevel@tonic-gate /* 9580Sstevel@tonic-gate * Update ULP the amount of queued data, which is 9590Sstevel@tonic-gate * sent-unack'ed + unsent. 9600Sstevel@tonic-gate * This is not necessary, but doesn't harm, we 9610Sstevel@tonic-gate * just use unsent instead of sent-unack'ed + 9620Sstevel@tonic-gate * unsent, since there won't be any sent-unack'ed 9630Sstevel@tonic-gate * here. 9640Sstevel@tonic-gate */ 9650Sstevel@tonic-gate if (!SCTP_IS_DETACHED(sctp)) { 9660Sstevel@tonic-gate sctp->sctp_ulp_xmitted(sctp->sctp_ulpd, 9670Sstevel@tonic-gate sctp->sctp_unsent); 9680Sstevel@tonic-gate } 9690Sstevel@tonic-gate } 9700Sstevel@tonic-gate if (sctp->sctp_xmit_unsent == NULL) 9710Sstevel@tonic-gate sctp->sctp_xmit_unsent_tail = NULL; 9720Sstevel@tonic-gate } 9730Sstevel@tonic-gate ceclen += pad; 9740Sstevel@tonic-gate cansend = MIN(sctp->sctp_unsent, sctp->sctp_frwnd); 9750Sstevel@tonic-gate meta = sctp_get_msg_to_send(sctp, &mp, NULL, &error, ceclen, 9760Sstevel@tonic-gate cansend, NULL); 9770Sstevel@tonic-gate /* 9780Sstevel@tonic-gate * The error cannot be anything else since we could have an non-zero 9790Sstevel@tonic-gate * error only if sctp_get_msg_to_send() tries to send a Forward 9800Sstevel@tonic-gate * TSN which will not happen here. 9810Sstevel@tonic-gate */ 9820Sstevel@tonic-gate ASSERT(error == 0); 9830Sstevel@tonic-gate if (meta == NULL) 9840Sstevel@tonic-gate goto sendcookie; 9850Sstevel@tonic-gate sctp->sctp_xmit_tail = meta; 9860Sstevel@tonic-gate sdc = (sctp_data_hdr_t *)mp->b_rptr; 9870Sstevel@tonic-gate seglen = ntohs(sdc->sdh_len); 9880Sstevel@tonic-gate if ((ceclen + seglen) > fp->sfa_pmss || 9890Sstevel@tonic-gate (seglen - sizeof (*sdc)) > cansend) { 9900Sstevel@tonic-gate goto sendcookie; 9910Sstevel@tonic-gate } 9920Sstevel@tonic-gate /* OK, if this fails */ 9930Sstevel@tonic-gate cemp->b_cont = dupmsg(mp); 9940Sstevel@tonic-gate sendcookie: 995252Svi117747 head = sctp_add_proto_hdr(sctp, fp, cemp, 0, NULL); 996252Svi117747 if (head == NULL) { 997252Svi117747 freemsg(cemp); 998252Svi117747 SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 999252Svi117747 if (errmp != NULL) 1000252Svi117747 freeb(errmp); 1001252Svi117747 return; 1002252Svi117747 } 10030Sstevel@tonic-gate /* 10040Sstevel@tonic-gate * Even if cookie-echo exceeds MTU for one of the hops, it'll 10050Sstevel@tonic-gate * have a chance of getting there. 10060Sstevel@tonic-gate */ 10070Sstevel@tonic-gate if (fp->isv4) { 10080Sstevel@tonic-gate ipha_t *iph = (ipha_t *)head->b_rptr; 10090Sstevel@tonic-gate iph->ipha_fragment_offset_and_flags = 0; 10100Sstevel@tonic-gate } 10110Sstevel@tonic-gate BUMP_LOCAL(sctp->sctp_obchunks); 10120Sstevel@tonic-gate 10130Sstevel@tonic-gate sctp->sctp_cookie_mp = dupmsg(head); 10140Sstevel@tonic-gate /* Don't bundle, we will just resend init if this cookie is lost. */ 10150Sstevel@tonic-gate if (sctp->sctp_cookie_mp == NULL) { 10160Sstevel@tonic-gate if (cemp->b_cont != NULL) { 10170Sstevel@tonic-gate freemsg(cemp->b_cont); 10180Sstevel@tonic-gate cemp->b_cont = NULL; 10190Sstevel@tonic-gate } 10200Sstevel@tonic-gate } else if (cemp->b_cont != NULL) { 10210Sstevel@tonic-gate ASSERT(mp != NULL && mp == meta->b_cont); 10220Sstevel@tonic-gate SCTP_CHUNK_CLEAR_FLAGS(cemp->b_cont); 10230Sstevel@tonic-gate cemp->b_wptr += pad; 10240Sstevel@tonic-gate seglen -= sizeof (*sdc); 10250Sstevel@tonic-gate SCTP_CHUNK_SENT(sctp, mp, sdc, fp, seglen, meta); 10260Sstevel@tonic-gate } 10270Sstevel@tonic-gate if (errmp != NULL) 10280Sstevel@tonic-gate linkb(head, errmp); 10290Sstevel@tonic-gate sctp->sctp_state = SCTPS_COOKIE_ECHOED; 10300Sstevel@tonic-gate SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 10310Sstevel@tonic-gate 10320Sstevel@tonic-gate sctp_set_iplen(sctp, head); 10330Sstevel@tonic-gate sctp_add_sendq(sctp, head); 10340Sstevel@tonic-gate } 10350Sstevel@tonic-gate 10360Sstevel@tonic-gate int 10370Sstevel@tonic-gate sctp_process_cookie(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *cmp, 10380Sstevel@tonic-gate sctp_init_chunk_t **iackpp, sctp_hdr_t *insctph, int *recv_adaption, 10390Sstevel@tonic-gate in6_addr_t *peer_addr) 10400Sstevel@tonic-gate { 10410Sstevel@tonic-gate int32_t clen; 10420Sstevel@tonic-gate size_t initplen; 10430Sstevel@tonic-gate uchar_t *p; 10440Sstevel@tonic-gate uchar_t *given_hash; 10450Sstevel@tonic-gate uchar_t needed_hash[16]; 10460Sstevel@tonic-gate int64_t ts; 10470Sstevel@tonic-gate int64_t diff; 10480Sstevel@tonic-gate uint32_t *lt; 10490Sstevel@tonic-gate sctp_init_chunk_t *iack; 10500Sstevel@tonic-gate sctp_chunk_hdr_t *initch; 10510Sstevel@tonic-gate sctp_init_chunk_t *init; 10520Sstevel@tonic-gate uint32_t *lttag; 10530Sstevel@tonic-gate uint32_t *fttag; 10540Sstevel@tonic-gate uint32_t ports; 10550Sstevel@tonic-gate 10560Sstevel@tonic-gate BUMP_LOCAL(sctp->sctp_ibchunks); 10570Sstevel@tonic-gate /* Verify the ICV */ 10580Sstevel@tonic-gate clen = ntohs(ch->sch_len) - sizeof (*ch) - 16; 10590Sstevel@tonic-gate if (clen < 0) { 10600Sstevel@tonic-gate dprint(1, ("invalid cookie chunk length %d\n", 10610Sstevel@tonic-gate ntohs(ch->sch_len))); 10620Sstevel@tonic-gate 10630Sstevel@tonic-gate return (-1); 10640Sstevel@tonic-gate } 10650Sstevel@tonic-gate p = (uchar_t *)(ch + 1); 10660Sstevel@tonic-gate 10670Sstevel@tonic-gate hmac_md5(p, clen, (uchar_t *)sctp->sctp_secret, SCTP_SECRET_LEN, 10680Sstevel@tonic-gate needed_hash); 10690Sstevel@tonic-gate 10700Sstevel@tonic-gate /* The given hash follows the cookie data */ 10710Sstevel@tonic-gate given_hash = p + clen; 10720Sstevel@tonic-gate 10730Sstevel@tonic-gate if (bcmp(given_hash, needed_hash, 16) != 0) { 10740Sstevel@tonic-gate /* The secret may have changed; try the old secret */ 10750Sstevel@tonic-gate hmac_md5(p, clen, (uchar_t *)sctp->sctp_old_secret, 10760Sstevel@tonic-gate SCTP_SECRET_LEN, needed_hash); 10770Sstevel@tonic-gate if (bcmp(given_hash, needed_hash, 16) != 0) { 10780Sstevel@tonic-gate return (-1); 10790Sstevel@tonic-gate } 10800Sstevel@tonic-gate } 10810Sstevel@tonic-gate 10820Sstevel@tonic-gate /* Timestamp is int64_t, and we only guarantee 32-bit alignment */ 10830Sstevel@tonic-gate bcopy(p, &ts, sizeof (ts)); 10840Sstevel@tonic-gate /* Cookie life time, int32_t */ 10850Sstevel@tonic-gate lt = (uint32_t *)(p + sizeof (ts)); 10860Sstevel@tonic-gate 10870Sstevel@tonic-gate /* 10880Sstevel@tonic-gate * To quote PRC, "this is our baby", so let's continue. 10890Sstevel@tonic-gate * We need to pull out the encapsulated INIT ACK and 10900Sstevel@tonic-gate * INIT chunks. Note that we don't process these until 10910Sstevel@tonic-gate * we have verified the timestamp, but we need them before 10920Sstevel@tonic-gate * processing the timestamp since if the time check fails, 10930Sstevel@tonic-gate * we need to get the verification tag from the INIT in order 10940Sstevel@tonic-gate * to send a stale cookie error. 10950Sstevel@tonic-gate */ 10960Sstevel@tonic-gate lttag = (uint32_t *)(lt + 1); 10970Sstevel@tonic-gate fttag = lttag + 1; 10980Sstevel@tonic-gate if (peer_addr != NULL) 10990Sstevel@tonic-gate bcopy(fttag + 1, peer_addr, sizeof (in6_addr_t)); 11000Sstevel@tonic-gate iack = (sctp_init_chunk_t *)((char *)(fttag + 1) + sizeof (in6_addr_t)); 11010Sstevel@tonic-gate initch = (sctp_chunk_hdr_t *)(iack + 1); 11020Sstevel@tonic-gate init = (sctp_init_chunk_t *)(initch + 1); 11030Sstevel@tonic-gate initplen = ntohs(initch->sch_len) - (sizeof (*init) + sizeof (*initch)); 11040Sstevel@tonic-gate *iackpp = iack; 11050Sstevel@tonic-gate *recv_adaption = 0; 11060Sstevel@tonic-gate 11070Sstevel@tonic-gate /* Check the timestamp */ 11080Sstevel@tonic-gate diff = lbolt64 - ts; 11090Sstevel@tonic-gate if (diff > *lt && (init->sic_inittag != sctp->sctp_fvtag || 11100Sstevel@tonic-gate iack->sic_inittag != sctp->sctp_lvtag)) { 11110Sstevel@tonic-gate 11120Sstevel@tonic-gate uint32_t staleness; 11130Sstevel@tonic-gate 11140Sstevel@tonic-gate staleness = TICK_TO_USEC(diff); 11150Sstevel@tonic-gate staleness = htonl(staleness); 11160Sstevel@tonic-gate sctp_send_abort(sctp, init->sic_inittag, SCTP_ERR_STALE_COOKIE, 11170Sstevel@tonic-gate (char *)&staleness, sizeof (staleness), cmp, 1, B_FALSE); 11180Sstevel@tonic-gate 11190Sstevel@tonic-gate dprint(1, ("stale cookie %d\n", staleness)); 11200Sstevel@tonic-gate 11210Sstevel@tonic-gate return (-1); 11220Sstevel@tonic-gate } 11230Sstevel@tonic-gate 11240Sstevel@tonic-gate /* Check for attack by adding addresses to a restart */ 11250Sstevel@tonic-gate bcopy(insctph, &ports, sizeof (ports)); 11260Sstevel@tonic-gate if (sctp_secure_restart_check(cmp, initch, ports, KM_NOSLEEP) != 1) { 11270Sstevel@tonic-gate return (-1); 11280Sstevel@tonic-gate } 11290Sstevel@tonic-gate 11300Sstevel@tonic-gate /* Look for adaptation code if there any parms in the INIT chunk */ 11310Sstevel@tonic-gate if ((initplen >= sizeof (sctp_parm_hdr_t)) && 11320Sstevel@tonic-gate (sctp_find_al_ind((sctp_parm_hdr_t *)(init + 1), initplen, 11330Sstevel@tonic-gate &sctp->sctp_rx_adaption_code) == 0)) { 11340Sstevel@tonic-gate *recv_adaption = 1; 11350Sstevel@tonic-gate } 11360Sstevel@tonic-gate 11370Sstevel@tonic-gate /* Examine tie-tags */ 11380Sstevel@tonic-gate 11390Sstevel@tonic-gate if (sctp->sctp_state >= SCTPS_COOKIE_WAIT) { 11400Sstevel@tonic-gate if (sctp->sctp_state == SCTPS_ESTABLISHED && 11410Sstevel@tonic-gate init->sic_inittag == sctp->sctp_fvtag && 11420Sstevel@tonic-gate iack->sic_inittag == sctp->sctp_lvtag && 11430Sstevel@tonic-gate *fttag == 0 && *lttag == 0) { 11440Sstevel@tonic-gate 11450Sstevel@tonic-gate dprint(1, ("duplicate cookie from %x:%x:%x:%x (%d)\n", 11460Sstevel@tonic-gate SCTP_PRINTADDR(sctp->sctp_current->faddr), 11470Sstevel@tonic-gate (int)(sctp->sctp_fport))); 11480Sstevel@tonic-gate return (-1); 11490Sstevel@tonic-gate } 11500Sstevel@tonic-gate 11510Sstevel@tonic-gate if (init->sic_inittag != sctp->sctp_fvtag && 11520Sstevel@tonic-gate iack->sic_inittag != sctp->sctp_lvtag && 11530Sstevel@tonic-gate *fttag == sctp->sctp_fvtag && 11540Sstevel@tonic-gate *lttag == sctp->sctp_lvtag) { 11550Sstevel@tonic-gate int i; 11560Sstevel@tonic-gate 11570Sstevel@tonic-gate /* Section 5.2.4 case A: restart */ 11580Sstevel@tonic-gate sctp->sctp_fvtag = init->sic_inittag; 11590Sstevel@tonic-gate sctp->sctp_lvtag = iack->sic_inittag; 11600Sstevel@tonic-gate 11610Sstevel@tonic-gate sctp->sctp_sctph->sh_verf = init->sic_inittag; 11620Sstevel@tonic-gate sctp->sctp_sctph6->sh_verf = init->sic_inittag; 11630Sstevel@tonic-gate 11640Sstevel@tonic-gate sctp->sctp_ftsn = ntohl(init->sic_inittsn); 11650Sstevel@tonic-gate sctp->sctp_lastacked = sctp->sctp_ftsn - 1; 11660Sstevel@tonic-gate sctp->sctp_frwnd = ntohl(init->sic_a_rwnd); 11670Sstevel@tonic-gate sctp->sctp_fcsn = sctp->sctp_lastacked; 11680Sstevel@tonic-gate 11690Sstevel@tonic-gate if (sctp->sctp_state < SCTPS_ESTABLISHED) { 11700Sstevel@tonic-gate sctp->sctp_state = SCTPS_ESTABLISHED; 11710Sstevel@tonic-gate sctp->sctp_assoc_start_time = (uint32_t)lbolt; 11720Sstevel@tonic-gate } 11730Sstevel@tonic-gate 11740Sstevel@tonic-gate dprint(1, ("sctp peer %x:%x:%x:%x (%d) restarted\n", 11750Sstevel@tonic-gate SCTP_PRINTADDR(sctp->sctp_current->faddr), 11760Sstevel@tonic-gate (int)(sctp->sctp_fport))); 11770Sstevel@tonic-gate /* reset parameters */ 11780Sstevel@tonic-gate sctp_congest_reset(sctp); 11790Sstevel@tonic-gate 11800Sstevel@tonic-gate /* reset stream bookkeeping */ 11810Sstevel@tonic-gate sctp_instream_cleanup(sctp, B_FALSE); 11820Sstevel@tonic-gate 11830Sstevel@tonic-gate sctp->sctp_istr_nmsgs = 0; 11840Sstevel@tonic-gate sctp->sctp_rxqueued = 0; 11850Sstevel@tonic-gate for (i = 0; i < sctp->sctp_num_ostr; i++) { 11860Sstevel@tonic-gate sctp->sctp_ostrcntrs[i] = 0; 11870Sstevel@tonic-gate } 11880Sstevel@tonic-gate /* XXX flush xmit_list? */ 11890Sstevel@tonic-gate 11900Sstevel@tonic-gate return (0); 11910Sstevel@tonic-gate } else if (init->sic_inittag != sctp->sctp_fvtag && 11920Sstevel@tonic-gate iack->sic_inittag == sctp->sctp_lvtag) { 11930Sstevel@tonic-gate 11940Sstevel@tonic-gate /* Section 5.2.4 case B: INIT collision */ 11950Sstevel@tonic-gate if (sctp->sctp_state < SCTPS_ESTABLISHED) { 11960Sstevel@tonic-gate if (!sctp_initialize_params(sctp, init, iack)) 11970Sstevel@tonic-gate return (-1); /* Drop? */ 11980Sstevel@tonic-gate sctp->sctp_state = SCTPS_ESTABLISHED; 11990Sstevel@tonic-gate sctp->sctp_assoc_start_time = (uint32_t)lbolt; 12000Sstevel@tonic-gate } 12010Sstevel@tonic-gate 12020Sstevel@tonic-gate dprint(1, ("init collision with %x:%x:%x:%x (%d)\n", 12030Sstevel@tonic-gate SCTP_PRINTADDR(sctp->sctp_current->faddr), 12040Sstevel@tonic-gate (int)(sctp->sctp_fport))); 12050Sstevel@tonic-gate 12060Sstevel@tonic-gate return (0); 12070Sstevel@tonic-gate } else if (iack->sic_inittag != sctp->sctp_lvtag && 12080Sstevel@tonic-gate init->sic_inittag == sctp->sctp_fvtag && 12090Sstevel@tonic-gate *fttag == 0 && *lttag == 0) { 12100Sstevel@tonic-gate 12110Sstevel@tonic-gate /* Section 5.2.4 case C: late COOKIE */ 12120Sstevel@tonic-gate dprint(1, ("late cookie from %x:%x:%x:%x (%d)\n", 12130Sstevel@tonic-gate SCTP_PRINTADDR(sctp->sctp_current->faddr), 12140Sstevel@tonic-gate (int)(sctp->sctp_fport))); 12150Sstevel@tonic-gate return (-1); 12160Sstevel@tonic-gate } else if (init->sic_inittag == sctp->sctp_fvtag && 12170Sstevel@tonic-gate iack->sic_inittag == sctp->sctp_lvtag) { 12180Sstevel@tonic-gate 12190Sstevel@tonic-gate /* 12200Sstevel@tonic-gate * Section 5.2.4 case D: COOKIE ECHO retransmit 12210Sstevel@tonic-gate * Don't check cookie lifetime 12220Sstevel@tonic-gate */ 12230Sstevel@tonic-gate dprint(1, ("cookie tags match from %x:%x:%x:%x (%d)\n", 12240Sstevel@tonic-gate SCTP_PRINTADDR(sctp->sctp_current->faddr), 12250Sstevel@tonic-gate (int)(sctp->sctp_fport))); 12260Sstevel@tonic-gate if (sctp->sctp_state < SCTPS_ESTABLISHED) { 12270Sstevel@tonic-gate if (!sctp_initialize_params(sctp, init, iack)) 12280Sstevel@tonic-gate return (-1); /* Drop? */ 12290Sstevel@tonic-gate sctp->sctp_state = SCTPS_ESTABLISHED; 12300Sstevel@tonic-gate sctp->sctp_assoc_start_time = (uint32_t)lbolt; 12310Sstevel@tonic-gate } 12320Sstevel@tonic-gate return (0); 12330Sstevel@tonic-gate } else { 12340Sstevel@tonic-gate /* unrecognized case -- silently drop it */ 12350Sstevel@tonic-gate return (-1); 12360Sstevel@tonic-gate } 12370Sstevel@tonic-gate } 12380Sstevel@tonic-gate 12390Sstevel@tonic-gate return (0); 12400Sstevel@tonic-gate } 12410Sstevel@tonic-gate 12420Sstevel@tonic-gate /* 12430Sstevel@tonic-gate * Similar to ip_fanout_sctp, except that the src addr(s) are drawn 12440Sstevel@tonic-gate * from address parameters in an INIT ACK's address list. This 12450Sstevel@tonic-gate * function is used when an INIT ACK is received but IP's fanout 12460Sstevel@tonic-gate * function could not find a sctp via the normal lookup routine. 12470Sstevel@tonic-gate * This can happen when a host sends an INIT ACK from a different 12480Sstevel@tonic-gate * address than the INIT was sent to. 12490Sstevel@tonic-gate * 12500Sstevel@tonic-gate * Returns the sctp_t if found, or NULL if not found. 12510Sstevel@tonic-gate */ 12520Sstevel@tonic-gate sctp_t * 12530Sstevel@tonic-gate sctp_addrlist2sctp(mblk_t *mp, sctp_hdr_t *sctph, sctp_chunk_hdr_t *ich, 12540Sstevel@tonic-gate uint_t ipif_seqid, zoneid_t zoneid) 12550Sstevel@tonic-gate { 12560Sstevel@tonic-gate int isv4; 12570Sstevel@tonic-gate ipha_t *iph; 12580Sstevel@tonic-gate ip6_t *ip6h; 12590Sstevel@tonic-gate in6_addr_t dst; 12600Sstevel@tonic-gate in6_addr_t src; 12610Sstevel@tonic-gate sctp_parm_hdr_t *ph; 12620Sstevel@tonic-gate ssize_t remaining; 12630Sstevel@tonic-gate sctp_init_chunk_t *iack; 12640Sstevel@tonic-gate uint32_t ports; 12650Sstevel@tonic-gate sctp_t *sctp = NULL; 12660Sstevel@tonic-gate 12670Sstevel@tonic-gate ASSERT(ich->sch_id == CHUNK_INIT_ACK); 12680Sstevel@tonic-gate 12690Sstevel@tonic-gate isv4 = (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION); 12700Sstevel@tonic-gate if (isv4) { 12710Sstevel@tonic-gate iph = (ipha_t *)mp->b_rptr; 12720Sstevel@tonic-gate IN6_IPADDR_TO_V4MAPPED(iph->ipha_dst, &dst); 12730Sstevel@tonic-gate } else { 12740Sstevel@tonic-gate ip6h = (ip6_t *)mp->b_rptr; 12750Sstevel@tonic-gate dst = ip6h->ip6_dst; 12760Sstevel@tonic-gate } 12770Sstevel@tonic-gate 12780Sstevel@tonic-gate ports = *(uint32_t *)sctph; 12790Sstevel@tonic-gate 12800Sstevel@tonic-gate dprint(1, ("sctp_addrlist2sctp: ports=%u, dst = %x:%x:%x:%x\n", 12810Sstevel@tonic-gate ports, SCTP_PRINTADDR(dst))); 12820Sstevel@tonic-gate 12830Sstevel@tonic-gate /* pull out any address parameters */ 12840Sstevel@tonic-gate remaining = ntohs(ich->sch_len) - sizeof (*ich) - sizeof (*iack); 12850Sstevel@tonic-gate if (remaining < sizeof (*ph)) { 12860Sstevel@tonic-gate return (NULL); 12870Sstevel@tonic-gate } 12880Sstevel@tonic-gate 12890Sstevel@tonic-gate iack = (sctp_init_chunk_t *)(ich + 1); 12900Sstevel@tonic-gate ph = (sctp_parm_hdr_t *)(iack + 1); 12910Sstevel@tonic-gate 12920Sstevel@tonic-gate while (ph != NULL) { 12930Sstevel@tonic-gate /* 12940Sstevel@tonic-gate * params have been put in host byteorder by 12950Sstevel@tonic-gate * sctp_check_input() 12960Sstevel@tonic-gate */ 12970Sstevel@tonic-gate if (ph->sph_type == PARM_ADDR4) { 12980Sstevel@tonic-gate IN6_INADDR_TO_V4MAPPED((struct in_addr *)(ph + 1), 12990Sstevel@tonic-gate &src); 13000Sstevel@tonic-gate 13010Sstevel@tonic-gate sctp = sctp_conn_match(&src, &dst, ports, ipif_seqid, 13020Sstevel@tonic-gate zoneid); 13030Sstevel@tonic-gate 13040Sstevel@tonic-gate dprint(1, 13050Sstevel@tonic-gate ("sctp_addrlist2sctp: src=%x:%x:%x:%x, sctp=%p\n", 13060Sstevel@tonic-gate SCTP_PRINTADDR(src), sctp)); 13070Sstevel@tonic-gate 13080Sstevel@tonic-gate 13090Sstevel@tonic-gate if (sctp != NULL) { 13100Sstevel@tonic-gate return (sctp); 13110Sstevel@tonic-gate } 13120Sstevel@tonic-gate } else if (ph->sph_type == PARM_ADDR6) { 13130Sstevel@tonic-gate src = *(in6_addr_t *)(ph + 1); 13140Sstevel@tonic-gate sctp = sctp_conn_match(&src, &dst, ports, ipif_seqid, 13150Sstevel@tonic-gate zoneid); 13160Sstevel@tonic-gate 13170Sstevel@tonic-gate dprint(1, 13180Sstevel@tonic-gate ("sctp_addrlist2sctp: src=%x:%x:%x:%x, sctp=%p\n", 13190Sstevel@tonic-gate SCTP_PRINTADDR(src), sctp)); 13200Sstevel@tonic-gate 13210Sstevel@tonic-gate if (sctp != NULL) { 13220Sstevel@tonic-gate return (sctp); 13230Sstevel@tonic-gate } 13240Sstevel@tonic-gate } 13250Sstevel@tonic-gate 13260Sstevel@tonic-gate ph = sctp_next_parm(ph, &remaining); 13270Sstevel@tonic-gate } 13280Sstevel@tonic-gate 13290Sstevel@tonic-gate return (NULL); 13300Sstevel@tonic-gate } 1331