1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #pragma ident "%Z%%M% %I% %E% SMI" 28 29 #include <sys/types.h> 30 #include <sys/systm.h> 31 #include <sys/stream.h> 32 #include <sys/cmn_err.h> 33 #include <sys/md5.h> 34 #include <sys/kmem.h> 35 #include <sys/strsubr.h> 36 #include <sys/random.h> 37 #include <sys/tsol/tnet.h> 38 39 #include <netinet/in.h> 40 #include <netinet/ip6.h> 41 42 #include <inet/common.h> 43 #include <inet/ip.h> 44 #include <inet/ip6.h> 45 #include <inet/sctp_ip.h> 46 #include <inet/ipclassifier.h> 47 #include "sctp_impl.h" 48 49 /* 50 * Helper function for SunCluster (PSARC/2005/602) to get the original source 51 * address from the COOKIE 52 */ 53 int cl_sctp_cookie_paddr(sctp_chunk_hdr_t *, in6_addr_t *); 54 55 /* 56 * From RFC 2104. This should probably go into libmd5 (and while 57 * we're at it, maybe we should make a libdigest so we can later 58 * add SHA1 and others, esp. since some weaknesses have been found 59 * with MD5). 60 * 61 * text IN pointer to data stream 62 * text_len IN length of data stream 63 * key IN pointer to authentication key 64 * key_len IN length of authentication key 65 * digest OUT caller digest to be filled in 66 */ 67 static void 68 hmac_md5(uchar_t *text, size_t text_len, uchar_t *key, size_t key_len, 69 uchar_t *digest) 70 { 71 MD5_CTX context; 72 uchar_t k_ipad[65]; /* inner padding - key XORd with ipad */ 73 uchar_t k_opad[65]; /* outer padding - key XORd with opad */ 74 uchar_t tk[16]; 75 int i; 76 77 /* if key is longer than 64 bytes reset it to key=MD5(key) */ 78 if (key_len > 64) { 79 MD5_CTX tctx; 80 81 MD5Init(&tctx); 82 MD5Update(&tctx, key, key_len); 83 MD5Final(tk, &tctx); 84 85 key = tk; 86 key_len = 16; 87 } 88 89 /* 90 * the HMAC_MD5 transform looks like: 91 * 92 * MD5(K XOR opad, MD5(K XOR ipad, text)) 93 * 94 * where K is an n byte key 95 * ipad is the byte 0x36 repeated 64 times 96 * opad is the byte 0x5c repeated 64 times 97 * and text is the data being protected 98 */ 99 100 /* start out by storing key in pads */ 101 bzero(k_ipad, sizeof (k_ipad)); 102 bzero(k_opad, sizeof (k_opad)); 103 bcopy(key, k_ipad, key_len); 104 bcopy(key, k_opad, key_len); 105 106 /* XOR key with ipad and opad values */ 107 for (i = 0; i < 64; i++) { 108 k_ipad[i] ^= 0x36; 109 k_opad[i] ^= 0x5c; 110 } 111 /* 112 * perform inner MD5 113 */ 114 MD5Init(&context); /* init context for 1st */ 115 /* pass */ 116 MD5Update(&context, k_ipad, 64); /* start with inner pad */ 117 MD5Update(&context, text, text_len); /* then text of datagram */ 118 MD5Final(digest, &context); /* finish up 1st pass */ 119 /* 120 * perform outer MD5 121 */ 122 MD5Init(&context); /* init context for 2nd */ 123 /* pass */ 124 MD5Update(&context, k_opad, 64); /* start with outer pad */ 125 MD5Update(&context, digest, 16); /* then results of 1st */ 126 /* hash */ 127 MD5Final(digest, &context); /* finish up 2nd pass */ 128 } 129 130 /* 131 * If inmp is non-NULL, and we need to abort, it will use the IP/SCTP 132 * info in initmp to send the abort. Otherwise, no abort will be sent. 133 * If errmp is non-NULL, a chain of unrecognized parameters will 134 * be created and returned via *errmp. 135 * 136 * Returns 1 if the parameters are OK (or there are no parameters), or 137 * 0 if not. 138 */ 139 static int 140 validate_init_params(sctp_t *sctp, sctp_chunk_hdr_t *ch, 141 sctp_init_chunk_t *init, mblk_t *inmp, sctp_parm_hdr_t **want_cookie, 142 mblk_t **errmp, int *supp_af, uint_t *sctp_options) 143 { 144 sctp_parm_hdr_t *cph; 145 sctp_init_chunk_t *ic; 146 ssize_t remaining; 147 uint16_t serror = 0; 148 char *details = NULL; 149 size_t errlen = 0; 150 boolean_t got_cookie = B_FALSE; 151 uint16_t ptype; 152 153 if (sctp_options != NULL) 154 *sctp_options = 0; 155 156 /* First validate stream parameters */ 157 if (init->sic_instr == 0 || init->sic_outstr == 0) { 158 serror = SCTP_ERR_BAD_MANDPARM; 159 dprint(1, 160 ("validate_init_params: bad sid, is=%d os=%d\n", 161 htons(init->sic_instr), htons(init->sic_outstr))); 162 goto abort; 163 } 164 if (ntohl(init->sic_inittag) == 0) { 165 serror = SCTP_ERR_BAD_MANDPARM; 166 dprint(1, ("validate_init_params: inittag = 0\n")); 167 goto abort; 168 } 169 170 remaining = ntohs(ch->sch_len) - sizeof (*ch); 171 ic = (sctp_init_chunk_t *)(ch + 1); 172 remaining -= sizeof (*ic); 173 if (remaining < sizeof (*cph)) { 174 /* Nothing to validate */ 175 if (want_cookie != NULL) 176 goto cookie_abort; 177 return (1); 178 } 179 180 cph = (sctp_parm_hdr_t *)(ic + 1); 181 182 while (cph != NULL) { 183 ptype = ntohs(cph->sph_type); 184 switch (ptype) { 185 case PARM_HBINFO: 186 case PARM_UNRECOGNIZED: 187 case PARM_ECN: 188 /* just ignore them */ 189 break; 190 case PARM_FORWARD_TSN: 191 if (sctp_options != NULL) 192 *sctp_options |= SCTP_PRSCTP_OPTION; 193 break; 194 case PARM_COOKIE: 195 got_cookie = B_TRUE; 196 if (want_cookie != NULL) { 197 *want_cookie = cph; 198 } 199 break; 200 case PARM_ADDR4: 201 *supp_af |= PARM_SUPP_V4; 202 break; 203 case PARM_ADDR6: 204 *supp_af |= PARM_SUPP_V6; 205 break; 206 case PARM_COOKIE_PRESERVE: 207 case PARM_ADAPT_LAYER_IND: 208 /* These are OK */ 209 break; 210 case PARM_ADDR_HOST_NAME: 211 /* Don't support this; abort the association */ 212 serror = SCTP_ERR_BAD_ADDR; 213 details = (char *)cph; 214 errlen = ntohs(cph->sph_len); 215 dprint(1, ("sctp:validate_init_params: host addr\n")); 216 goto abort; 217 case PARM_SUPP_ADDRS: { 218 /* Make sure we have a supported addr intersection */ 219 uint16_t *p, addrtype; 220 int plen; 221 222 plen = ntohs(cph->sph_len); 223 p = (uint16_t *)(cph + 1); 224 while (plen > 0) { 225 addrtype = ntohs(*p); 226 switch (addrtype) { 227 case PARM_ADDR6: 228 *supp_af |= PARM_SUPP_V6; 229 break; 230 case PARM_ADDR4: 231 *supp_af |= PARM_SUPP_V4; 232 break; 233 default: 234 /* 235 * Do nothing, silently ignore hostname 236 * address. 237 */ 238 break; 239 } 240 p++; 241 plen -= sizeof (*p); 242 } 243 break; 244 } 245 default: 246 /* Unrecognized param; check the high order bits */ 247 if ((ptype & 0xc000) == 0xc000) { 248 /* 249 * report unrecognized param, and 250 * keep processing 251 */ 252 if (errmp != NULL) { 253 if (want_cookie != NULL) { 254 *errmp = sctp_make_err(sctp, 255 PARM_UNRECOGNIZED, 256 (void *)cph, 257 ntohs(cph->sph_len)); 258 } else { 259 sctp_add_unrec_parm(cph, errmp); 260 } 261 } 262 break; 263 } 264 if (ptype & 0x4000) { 265 /* 266 * Stop processing and drop; report 267 * unrecognized param 268 */ 269 serror = SCTP_ERR_UNREC_PARM; 270 details = (char *)cph; 271 errlen = ntohs(cph->sph_len); 272 goto abort; 273 } 274 if (ptype & 0x8000) { 275 /* skip and continue processing */ 276 break; 277 } 278 279 /* 280 * 2 high bits are clear; stop processing and 281 * drop packet 282 */ 283 return (0); 284 } 285 286 cph = sctp_next_parm(cph, &remaining); 287 } 288 /* 289 * Some sanity checks. The following should not fail unless the 290 * other side is broken. 291 * 292 * 1. If this is a V4 endpoint but V4 address is not 293 * supported, abort. 294 * 2. If this is a V6 only endpoint but V6 address is 295 * not supported, abort. This assumes that a V6 296 * endpoint can use both V4 and V6 addresses. 297 * We only care about supp_af when processing INIT, i.e want_cookie 298 * is NULL. 299 */ 300 if (want_cookie == NULL && 301 ((sctp->sctp_family == AF_INET && !(*supp_af & PARM_SUPP_V4)) || 302 (sctp->sctp_family == AF_INET6 && !(*supp_af & PARM_SUPP_V6) && 303 sctp->sctp_connp->conn_ipv6_v6only))) { 304 dprint(1, ("sctp:validate_init_params: supp addr\n")); 305 serror = SCTP_ERR_BAD_ADDR; 306 goto abort; 307 } 308 309 if (want_cookie != NULL && !got_cookie) { 310 cookie_abort: 311 dprint(1, ("validate_init_params: cookie absent\n")); 312 sctp_send_abort(sctp, sctp_init2vtag(ch), SCTP_ERR_MISSING_PARM, 313 details, errlen, inmp, 0, B_FALSE); 314 return (0); 315 } 316 317 /* OK */ 318 return (1); 319 320 abort: 321 if (want_cookie != NULL) 322 return (0); 323 324 sctp_send_abort(sctp, sctp_init2vtag(ch), serror, details, 325 errlen, inmp, 0, B_FALSE); 326 return (0); 327 } 328 329 /* 330 * Initialize params from the INIT and INIT-ACK when the assoc. is 331 * established. 332 */ 333 boolean_t 334 sctp_initialize_params(sctp_t *sctp, sctp_init_chunk_t *init, 335 sctp_init_chunk_t *iack) 336 { 337 /* Get initial TSN */ 338 sctp->sctp_ftsn = ntohl(init->sic_inittsn); 339 sctp->sctp_lastacked = sctp->sctp_ftsn - 1; 340 341 /* Serial number is initialized to the same value as the TSN */ 342 sctp->sctp_fcsn = sctp->sctp_lastacked; 343 344 /* 345 * Get verification tags; no byteordering is necessary, since 346 * verfication tags are never processed except for byte-by-byte 347 * comparisons. 348 */ 349 sctp->sctp_fvtag = init->sic_inittag; 350 sctp->sctp_sctph->sh_verf = init->sic_inittag; 351 sctp->sctp_sctph6->sh_verf = init->sic_inittag; 352 sctp->sctp_lvtag = iack->sic_inittag; 353 354 /* Get the peer's rwnd */ 355 sctp->sctp_frwnd = ntohl(init->sic_a_rwnd); 356 357 /* Allocate the in/out-stream counters */ 358 sctp->sctp_num_ostr = iack->sic_outstr; 359 sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) * 360 sctp->sctp_num_ostr, KM_NOSLEEP); 361 if (sctp->sctp_ostrcntrs == NULL) 362 return (B_FALSE); 363 364 sctp->sctp_num_istr = iack->sic_instr; 365 sctp->sctp_instr = kmem_zalloc(sizeof (*sctp->sctp_instr) * 366 sctp->sctp_num_istr, KM_NOSLEEP); 367 if (sctp->sctp_instr == NULL) { 368 kmem_free(sctp->sctp_ostrcntrs, sizeof (uint16_t) * 369 sctp->sctp_num_ostr); 370 sctp->sctp_ostrcntrs = NULL; 371 return (B_FALSE); 372 } 373 return (B_TRUE); 374 } 375 376 /* 377 * Copy the peer's original source address into addr. This relies on the 378 * following format (see sctp_send_initack() below): 379 * relative timestamp for the cookie (int64_t) + 380 * cookie lifetime (uint32_t) + 381 * local tie-tag (uint32_t) + peer tie-tag (uint32_t) + 382 * Peer's original src ... 383 */ 384 int 385 cl_sctp_cookie_paddr(sctp_chunk_hdr_t *ch, in6_addr_t *addr) 386 { 387 uchar_t *off; 388 389 ASSERT(addr != NULL); 390 391 if (ch->sch_id != CHUNK_COOKIE) 392 return (EINVAL); 393 394 off = (uchar_t *)ch + sizeof (*ch) + sizeof (int64_t) + 395 sizeof (uint32_t) + sizeof (uint32_t) + sizeof (uint32_t); 396 397 bcopy(off, addr, sizeof (*addr)); 398 399 return (0); 400 } 401 402 #define SCTP_CALC_COOKIE_LEN(initcp) \ 403 sizeof (int64_t) + /* timestamp */ \ 404 sizeof (uint32_t) + /* cookie lifetime */ \ 405 sizeof (sctp_init_chunk_t) + /* INIT ACK */ \ 406 sizeof (in6_addr_t) + /* peer's original source */ \ 407 ntohs((initcp)->sch_len) + /* peer's INIT */ \ 408 sizeof (uint32_t) + /* local tie-tag */ \ 409 sizeof (uint32_t) + /* peer tie-tag */ \ 410 sizeof (sctp_parm_hdr_t) + /* param header */ \ 411 16 /* MD5 hash */ 412 413 void 414 sctp_send_initack(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *initmp) 415 { 416 ipha_t *initiph; 417 ip6_t *initip6h; 418 ipha_t *iackiph; 419 ip6_t *iackip6h; 420 sctp_chunk_hdr_t *iack_ch; 421 sctp_init_chunk_t *iack; 422 sctp_init_chunk_t *init; 423 sctp_hdr_t *iacksh; 424 sctp_hdr_t *initsh; 425 size_t cookielen; 426 size_t iacklen; 427 size_t ipsctplen; 428 size_t errlen = 0; 429 sctp_parm_hdr_t *cookieph; 430 mblk_t *iackmp; 431 uint32_t itag; 432 uint32_t itsn; 433 int64_t *now; 434 int64_t nowt; 435 uint32_t *lifetime; 436 char *p; 437 boolean_t isv4; 438 int supp_af = 0; 439 uint_t sctp_options; 440 uint32_t *ttag; 441 int pad; 442 mblk_t *errmp = NULL; 443 boolean_t initcollision = B_FALSE; 444 boolean_t linklocal = B_FALSE; 445 cred_t *cr; 446 447 BUMP_LOCAL(sctp->sctp_ibchunks); 448 isv4 = (IPH_HDR_VERSION(initmp->b_rptr) == IPV4_VERSION); 449 450 /* Extract the INIT chunk */ 451 if (isv4) { 452 initiph = (ipha_t *)initmp->b_rptr; 453 initsh = (sctp_hdr_t *)((char *)initiph + 454 IPH_HDR_LENGTH(initmp->b_rptr)); 455 ipsctplen = sctp->sctp_ip_hdr_len; 456 supp_af |= PARM_SUPP_V4; 457 } else { 458 initip6h = (ip6_t *)initmp->b_rptr; 459 initsh = (sctp_hdr_t *)(initip6h + 1); 460 ipsctplen = sctp->sctp_ip_hdr6_len; 461 if (IN6_IS_ADDR_LINKLOCAL(&initip6h->ip6_src)) 462 linklocal = B_TRUE; 463 supp_af |= PARM_SUPP_V6; 464 } 465 ASSERT(OK_32PTR(initsh)); 466 init = (sctp_init_chunk_t *)((char *)(initsh + 1) + sizeof (*iack_ch)); 467 468 /* Make sure we like the peer's parameters */ 469 if (validate_init_params(sctp, ch, init, initmp, NULL, &errmp, 470 &supp_af, &sctp_options) == 0) { 471 return; 472 } 473 if (errmp != NULL) 474 errlen = msgdsize(errmp); 475 if (sctp->sctp_family == AF_INET) { 476 /* 477 * Irregardless of the supported address in the INIT, v4 478 * must be supported. 479 */ 480 supp_af = PARM_SUPP_V4; 481 } 482 if (sctp->sctp_state <= SCTPS_LISTEN) { 483 /* normal, expected INIT: generate new vtag and itsn */ 484 (void) random_get_pseudo_bytes((uint8_t *)&itag, sizeof (itag)); 485 if (itag == 0) 486 itag = (uint32_t)gethrtime(); 487 itsn = itag + 1; 488 itag = htonl(itag); 489 } else if (sctp->sctp_state == SCTPS_COOKIE_WAIT || 490 sctp->sctp_state == SCTPS_COOKIE_ECHOED) { 491 /* init collision; copy vtag and itsn from sctp */ 492 itag = sctp->sctp_lvtag; 493 itsn = sctp->sctp_ltsn; 494 /* 495 * In addition we need to send all the params that was sent 496 * in our INIT chunk. Essentially, it is only the supported 497 * address params that we need to add. 498 */ 499 initcollision = B_TRUE; 500 /* 501 * When we sent the INIT, we should have set linklocal in 502 * the sctp which should be good enough. 503 */ 504 if (linklocal) 505 linklocal = B_FALSE; 506 } else { 507 /* peer restart; generate new vtag but keep everything else */ 508 (void) random_get_pseudo_bytes((uint8_t *)&itag, sizeof (itag)); 509 if (itag == 0) 510 itag = (uint32_t)gethrtime(); 511 itag = htonl(itag); 512 itsn = sctp->sctp_ltsn; 513 } 514 515 /* 516 * Allocate a mblk for the INIT ACK, consisting of the link layer 517 * header, the IP header, the SCTP common header, and INIT ACK chunk, 518 * and finally the COOKIE parameter. 519 */ 520 cookielen = SCTP_CALC_COOKIE_LEN(ch); 521 iacklen = sizeof (*iack_ch) + sizeof (*iack) + cookielen; 522 if (sctp->sctp_send_adaption) 523 iacklen += (sizeof (sctp_parm_hdr_t) + sizeof (uint32_t)); 524 if (((sctp_options & SCTP_PRSCTP_OPTION) || initcollision) && 525 sctp->sctp_prsctp_aware && sctp_prsctp_enabled) { 526 iacklen += sctp_options_param_len(sctp, SCTP_PRSCTP_OPTION); 527 } 528 if (initcollision) 529 iacklen += sctp_supaddr_param_len(sctp); 530 if (!linklocal) 531 iacklen += sctp_addr_params_len(sctp, supp_af, B_FALSE); 532 ipsctplen += sizeof (*iacksh) + iacklen; 533 iacklen += errlen; 534 if ((pad = ipsctplen % 4) != 0) { 535 pad = 4 - pad; 536 ipsctplen += pad; 537 } 538 iackmp = allocb_cred(ipsctplen + sctp_wroff_xtra, 539 CONN_CRED(sctp->sctp_connp)); 540 if (iackmp == NULL) { 541 sctp_send_abort(sctp, sctp_init2vtag(ch), 542 SCTP_ERR_NO_RESOURCES, NULL, 0, initmp, 0, B_FALSE); 543 return; 544 } 545 546 /* Copy in the [imcomplete] IP/SCTP composite header */ 547 p = (char *)(iackmp->b_rptr + sctp_wroff_xtra); 548 iackmp->b_rptr = (uchar_t *)p; 549 if (isv4) { 550 bcopy(sctp->sctp_iphc, p, sctp->sctp_hdr_len); 551 iackiph = (ipha_t *)p; 552 553 /* Copy the peer's IP addr */ 554 iackiph->ipha_dst = initiph->ipha_src; 555 iackiph->ipha_src = initiph->ipha_dst; 556 iackiph->ipha_length = htons(ipsctplen + errlen); 557 iacksh = (sctp_hdr_t *)(p + sctp->sctp_ip_hdr_len); 558 } else { 559 bcopy(sctp->sctp_iphc6, p, sctp->sctp_hdr6_len); 560 iackip6h = (ip6_t *)p; 561 562 /* Copy the peer's IP addr */ 563 iackip6h->ip6_dst = initip6h->ip6_src; 564 iackip6h->ip6_src = initip6h->ip6_dst; 565 iackip6h->ip6_plen = htons(ipsctplen - sizeof (*iackip6h) + 566 errlen); 567 iacksh = (sctp_hdr_t *)(p + sctp->sctp_ip_hdr6_len); 568 } 569 ASSERT(OK_32PTR(iacksh)); 570 571 /* Fill in the holes in the SCTP common header */ 572 iacksh->sh_sport = initsh->sh_dport; 573 iacksh->sh_dport = initsh->sh_sport; 574 iacksh->sh_verf = init->sic_inittag; 575 576 /* INIT ACK chunk header */ 577 iack_ch = (sctp_chunk_hdr_t *)(iacksh + 1); 578 iack_ch->sch_id = CHUNK_INIT_ACK; 579 iack_ch->sch_flags = 0; 580 iack_ch->sch_len = htons(iacklen); 581 582 /* The INIT ACK itself */ 583 iack = (sctp_init_chunk_t *)(iack_ch + 1); 584 iack->sic_inittag = itag; /* already in network byteorder */ 585 iack->sic_inittsn = htonl(itsn); 586 587 iack->sic_a_rwnd = htonl(sctp->sctp_rwnd); 588 /* Advertise what we would want to have as stream #'s */ 589 iack->sic_outstr = htons(MIN(sctp->sctp_num_ostr, 590 ntohs(init->sic_instr))); 591 iack->sic_instr = htons(sctp->sctp_num_istr); 592 593 p = (char *)(iack + 1); 594 p += sctp_adaption_code_param(sctp, (uchar_t *)p); 595 if (initcollision) 596 p += sctp_supaddr_param(sctp, (uchar_t *)p); 597 if (!linklocal) 598 p += sctp_addr_params(sctp, supp_af, (uchar_t *)p); 599 if (((sctp_options & SCTP_PRSCTP_OPTION) || initcollision) && 600 sctp->sctp_prsctp_aware && sctp_prsctp_enabled) { 601 p += sctp_options_param(sctp, p, SCTP_PRSCTP_OPTION); 602 } 603 /* 604 * Generate and lay in the COOKIE parameter. 605 * 606 * Any change here that results in a change of location for 607 * the peer's orig source address must be propagated to the fn 608 * cl_sctp_cookie_paddr() above. 609 * 610 * The cookie consists of: 611 * 1. The relative timestamp for the cookie (lbolt64) 612 * 2. The cookie lifetime (uint32_t) in tick 613 * 3. The local tie-tag 614 * 4. The peer tie-tag 615 * 5. Peer's original src, used to confirm the validity of address. 616 * 6. Our INIT ACK chunk, less any parameters 617 * 7. The INIT chunk (may contain parameters) 618 * 8. 128-bit MD5 signature. 619 * 620 * Since the timestamp values will only be evaluated locally, we 621 * don't need to worry about byte-ordering them. 622 */ 623 cookieph = (sctp_parm_hdr_t *)p; 624 cookieph->sph_type = htons(PARM_COOKIE); 625 cookieph->sph_len = htons(cookielen); 626 627 /* timestamp */ 628 now = (int64_t *)(cookieph + 1); 629 nowt = lbolt64; 630 bcopy(&nowt, now, sizeof (*now)); 631 632 /* cookie lifetime -- need configuration */ 633 lifetime = (uint32_t *)(now + 1); 634 *lifetime = sctp->sctp_cookie_lifetime; 635 636 /* Set the tie-tags */ 637 ttag = (uint32_t *)(lifetime + 1); 638 if (sctp->sctp_state <= SCTPS_COOKIE_WAIT) { 639 *ttag = 0; 640 ttag++; 641 *ttag = 0; 642 ttag++; 643 } else { 644 /* local tie-tag (network byte-order) */ 645 *ttag = sctp->sctp_lvtag; 646 ttag++; 647 /* peer tie-tag (network byte-order) */ 648 *ttag = sctp->sctp_fvtag; 649 ttag++; 650 } 651 /* 652 * Copy in peer's original source address so that we can confirm 653 * the reachability later. 654 */ 655 p = (char *)ttag; 656 if (isv4) { 657 in6_addr_t peer_addr; 658 659 IN6_IPADDR_TO_V4MAPPED(iackiph->ipha_dst, &peer_addr); 660 bcopy(&peer_addr, p, sizeof (in6_addr_t)); 661 } else { 662 bcopy(&iackip6h->ip6_dst, p, sizeof (in6_addr_t)); 663 } 664 p += sizeof (in6_addr_t); 665 /* Copy in our INIT ACK chunk */ 666 bcopy(iack, p, sizeof (*iack)); 667 iack = (sctp_init_chunk_t *)p; 668 /* Set the # of streams we'll end up using */ 669 iack->sic_outstr = MIN(sctp->sctp_num_ostr, ntohs(init->sic_instr)); 670 iack->sic_instr = MIN(sctp->sctp_num_istr, ntohs(init->sic_outstr)); 671 p += sizeof (*iack); 672 673 /* Copy in the peer's INIT chunk */ 674 bcopy(ch, p, ntohs(ch->sch_len)); 675 p += ntohs(ch->sch_len); 676 677 /* 678 * Calculate the HMAC ICV into the digest slot in buf. 679 * First, generate a new secret if the current secret is 680 * older than the new secret lifetime parameter permits, 681 * copying the current secret to sctp_old_secret. 682 */ 683 if (sctp_new_secret_interval > 0 && 684 (sctp->sctp_last_secret_update + 685 MSEC_TO_TICK(sctp_new_secret_interval)) <= nowt) { 686 bcopy(sctp->sctp_secret, sctp->sctp_old_secret, 687 SCTP_SECRET_LEN); 688 (void) random_get_pseudo_bytes(sctp->sctp_secret, 689 SCTP_SECRET_LEN); 690 sctp->sctp_last_secret_update = nowt; 691 } 692 693 hmac_md5((uchar_t *)now, cookielen - sizeof (*cookieph) - 16, 694 (uchar_t *)sctp->sctp_secret, SCTP_SECRET_LEN, (uchar_t *)p); 695 696 iackmp->b_wptr = iackmp->b_rptr + ipsctplen; 697 iackmp->b_cont = errmp; /* OK if NULL */ 698 699 if (is_system_labeled() && (cr = DB_CRED(initmp)) != NULL && 700 crgetlabel(cr) != NULL) { 701 conn_t *connp = sctp->sctp_connp; 702 int err, adjust; 703 704 if (isv4) 705 err = tsol_check_label(cr, &iackmp, &adjust, 706 connp->conn_mac_exempt); 707 else 708 err = tsol_check_label_v6(cr, &iackmp, &adjust, 709 connp->conn_mac_exempt); 710 if (err != 0) { 711 sctp_send_abort(sctp, sctp_init2vtag(ch), 712 SCTP_ERR_AUTH_ERR, NULL, 0, initmp, 0, B_FALSE); 713 freemsg(iackmp); 714 return; 715 } 716 if (isv4) { 717 iackiph = (ipha_t *)iackmp->b_rptr; 718 adjust += ntohs(iackiph->ipha_length); 719 iackiph->ipha_length = htons(adjust); 720 } 721 } 722 723 /* 724 * Stash the conn ptr info. for IP only as e don't have any 725 * cached IRE. 726 */ 727 SCTP_STASH_IPINFO(iackmp, (ire_t *)NULL); 728 729 /* XXX sctp == sctp_g_q, so using its obchunks is valid */ 730 BUMP_LOCAL(sctp->sctp_opkts); 731 BUMP_LOCAL(sctp->sctp_obchunks); 732 733 /* OK to call IP_PUT() here instead of sctp_add_sendq(). */ 734 CONN_INC_REF(sctp->sctp_connp); 735 iackmp->b_flag |= MSGHASREF; 736 IP_PUT(iackmp, sctp->sctp_connp, isv4); 737 } 738 739 void 740 sctp_send_cookie_ack(sctp_t *sctp) 741 { 742 sctp_chunk_hdr_t *cach; 743 mblk_t *camp; 744 745 camp = sctp_make_mp(sctp, NULL, sizeof (*cach)); 746 if (camp == NULL) { 747 /* XXX should abort, but don't have the inmp anymore */ 748 SCTP_KSTAT(sctp_send_cookie_ack_failed); 749 return; 750 } 751 752 cach = (sctp_chunk_hdr_t *)camp->b_wptr; 753 camp->b_wptr = (uchar_t *)(cach + 1); 754 cach->sch_id = CHUNK_COOKIE_ACK; 755 cach->sch_flags = 0; 756 cach->sch_len = htons(sizeof (*cach)); 757 758 sctp_set_iplen(sctp, camp); 759 760 BUMP_LOCAL(sctp->sctp_obchunks); 761 762 sctp_add_sendq(sctp, camp); 763 } 764 765 static int 766 sctp_find_al_ind(sctp_parm_hdr_t *sph, ssize_t len, uint32_t *adaption_code) 767 { 768 769 if (len < sizeof (*sph)) 770 return (-1); 771 while (sph != NULL) { 772 if (sph->sph_type == htons(PARM_ADAPT_LAYER_IND) && 773 ntohs(sph->sph_len) >= (sizeof (*sph) + 774 sizeof (uint32_t))) { 775 *adaption_code = *(uint32_t *)(sph + 1); 776 return (0); 777 } 778 sph = sctp_next_parm(sph, &len); 779 } 780 return (-1); 781 } 782 783 void 784 sctp_send_cookie_echo(sctp_t *sctp, sctp_chunk_hdr_t *iackch, mblk_t *iackmp) 785 { 786 mblk_t *cemp; 787 mblk_t *mp = NULL; 788 mblk_t *head; 789 mblk_t *meta; 790 sctp_faddr_t *fp; 791 sctp_chunk_hdr_t *cech; 792 sctp_init_chunk_t *iack; 793 int32_t cansend; 794 int32_t seglen; 795 size_t ceclen; 796 sctp_parm_hdr_t *cph; 797 sctp_data_hdr_t *sdc; 798 sctp_tf_t *tf; 799 int pad = 0; 800 int hdrlen; 801 mblk_t *errmp = NULL; 802 uint_t sctp_options; 803 int error; 804 uint16_t old_num_str; 805 806 iack = (sctp_init_chunk_t *)(iackch + 1); 807 808 cph = NULL; 809 if (validate_init_params(sctp, iackch, iack, iackmp, &cph, &errmp, 810 &pad, &sctp_options) == 0) { /* result in 'pad' ignored */ 811 BUMP_MIB(&sctp_mib, sctpAborted); 812 sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0, NULL); 813 sctp_clean_death(sctp, ECONNABORTED); 814 return; 815 } 816 ASSERT(cph != NULL); 817 818 ASSERT(sctp->sctp_cookie_mp == NULL); 819 820 /* Got a cookie to echo back; allocate an mblk */ 821 ceclen = sizeof (*cech) + ntohs(cph->sph_len) - sizeof (*cph); 822 if ((pad = ceclen & (SCTP_ALIGN - 1)) != 0) 823 pad = SCTP_ALIGN - pad; 824 825 if (IPH_HDR_VERSION(iackmp->b_rptr) == IPV4_VERSION) 826 hdrlen = sctp->sctp_hdr_len; 827 else 828 hdrlen = sctp->sctp_hdr6_len; 829 830 cemp = allocb(sctp_wroff_xtra + hdrlen + ceclen + pad, BPRI_MED); 831 if (cemp == NULL) { 832 SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current, 833 sctp->sctp_current->rto); 834 if (errmp != NULL) 835 freeb(errmp); 836 return; 837 } 838 cemp->b_rptr += (sctp_wroff_xtra + hdrlen); 839 840 /* Process the INIT ACK */ 841 sctp->sctp_sctph->sh_verf = iack->sic_inittag; 842 sctp->sctp_sctph6->sh_verf = iack->sic_inittag; 843 sctp->sctp_fvtag = iack->sic_inittag; 844 sctp->sctp_ftsn = ntohl(iack->sic_inittsn); 845 sctp->sctp_lastacked = sctp->sctp_ftsn - 1; 846 sctp->sctp_fcsn = sctp->sctp_lastacked; 847 sctp->sctp_frwnd = ntohl(iack->sic_a_rwnd); 848 849 /* 850 * Populate sctp with addresses given in the INIT ACK or IP header. 851 * Need to set the df bit in the current fp as it has been cleared 852 * in sctp_connect(). 853 */ 854 sctp->sctp_current->df = B_TRUE; 855 /* 856 * Since IP uses this info during the fanout process, we need to hold 857 * the lock for this hash line while performing this operation. 858 */ 859 /* XXX sctp_conn_fanout + SCTP_CONN_HASH(sctp->sctp_ports); */ 860 ASSERT(sctp->sctp_conn_tfp != NULL); 861 tf = sctp->sctp_conn_tfp; 862 /* sctp isn't a listener so only need to hold conn fanout lock */ 863 mutex_enter(&tf->tf_lock); 864 if (sctp_get_addrparams(sctp, NULL, iackmp, iackch, NULL) != 0) { 865 mutex_exit(&tf->tf_lock); 866 freeb(cemp); 867 SCTP_FADDR_TIMER_RESTART(sctp, sctp->sctp_current, 868 sctp->sctp_current->rto); 869 if (errmp != NULL) 870 freeb(errmp); 871 return; 872 } 873 mutex_exit(&tf->tf_lock); 874 875 fp = sctp->sctp_current; 876 877 /* 878 * There could be a case when we get an INIT-ACK again, if the INIT 879 * is re-transmitted, for e.g., which means we would have already 880 * allocated this resource earlier (also for sctp_instr). In this 881 * case we check and re-allocate, if necessary. 882 */ 883 old_num_str = sctp->sctp_num_ostr; 884 if (ntohs(iack->sic_instr) < sctp->sctp_num_ostr) 885 sctp->sctp_num_ostr = ntohs(iack->sic_instr); 886 if (sctp->sctp_ostrcntrs == NULL) { 887 sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) * 888 sctp->sctp_num_ostr, KM_NOSLEEP); 889 } else { 890 ASSERT(old_num_str > 0); 891 if (old_num_str != sctp->sctp_num_ostr) { 892 kmem_free(sctp->sctp_ostrcntrs, sizeof (uint16_t) * 893 old_num_str); 894 sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) * 895 sctp->sctp_num_ostr, KM_NOSLEEP); 896 } 897 } 898 if (sctp->sctp_ostrcntrs == NULL) { 899 freeb(cemp); 900 SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 901 if (errmp != NULL) 902 freeb(errmp); 903 return; 904 } 905 906 /* 907 * Allocate the in stream tracking array. Comments for sctp_ostrcntrs 908 * hold here too. 909 */ 910 old_num_str = sctp->sctp_num_istr; 911 if (ntohs(iack->sic_outstr) < sctp->sctp_num_istr) 912 sctp->sctp_num_istr = ntohs(iack->sic_outstr); 913 if (sctp->sctp_instr == NULL) { 914 sctp->sctp_instr = kmem_zalloc(sizeof (*sctp->sctp_instr) * 915 sctp->sctp_num_istr, KM_NOSLEEP); 916 } else { 917 ASSERT(old_num_str > 0); 918 if (old_num_str != sctp->sctp_num_istr) { 919 kmem_free(sctp->sctp_instr, 920 sizeof (*sctp->sctp_instr) * old_num_str); 921 sctp->sctp_instr = kmem_zalloc( 922 sizeof (*sctp->sctp_instr) * sctp->sctp_num_istr, 923 KM_NOSLEEP); 924 } 925 } 926 if (sctp->sctp_instr == NULL) { 927 kmem_free(sctp->sctp_ostrcntrs, 928 sizeof (uint16_t) * sctp->sctp_num_ostr); 929 freeb(cemp); 930 SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 931 if (errmp != NULL) 932 freeb(errmp); 933 return; 934 } 935 936 if (!(sctp_options & SCTP_PRSCTP_OPTION) && sctp->sctp_prsctp_aware) 937 sctp->sctp_prsctp_aware = B_FALSE; 938 939 if (sctp_find_al_ind((sctp_parm_hdr_t *)(iack + 1), 940 ntohs(iackch->sch_len) - (sizeof (*iackch) + sizeof (*iack)), 941 &sctp->sctp_rx_adaption_code) == 0) { 942 sctp->sctp_recv_adaption = 1; 943 } 944 945 cech = (sctp_chunk_hdr_t *)cemp->b_rptr; 946 ASSERT(OK_32PTR(cech)); 947 cech->sch_id = CHUNK_COOKIE; 948 cech->sch_flags = 0; 949 cech->sch_len = htons(ceclen); 950 951 /* Copy the cookie (less the parm hdr) to the chunk */ 952 bcopy(cph + 1, cech + 1, ceclen - sizeof (*cph)); 953 954 cemp->b_wptr = cemp->b_rptr + ceclen; 955 956 if (sctp->sctp_unsent > 0) { 957 sctp_msg_hdr_t *smh; 958 mblk_t *prev = NULL; 959 uint32_t unsent = 0; 960 961 mp = sctp->sctp_xmit_unsent; 962 do { 963 smh = (sctp_msg_hdr_t *)mp->b_rptr; 964 if (smh->smh_sid >= sctp->sctp_num_ostr) { 965 unsent += smh->smh_msglen; 966 if (prev != NULL) 967 prev->b_next = mp->b_next; 968 else 969 sctp->sctp_xmit_unsent = mp->b_next; 970 mp->b_next = NULL; 971 sctp_sendfail_event(sctp, mp, SCTP_ERR_BAD_SID, 972 B_FALSE); 973 if (prev != NULL) 974 mp = prev->b_next; 975 else 976 mp = sctp->sctp_xmit_unsent; 977 } else { 978 prev = mp; 979 mp = mp->b_next; 980 } 981 } while (mp != NULL); 982 if (unsent > 0) { 983 ASSERT(sctp->sctp_unsent >= unsent); 984 sctp->sctp_unsent -= unsent; 985 /* 986 * Update ULP the amount of queued data, which is 987 * sent-unack'ed + unsent. 988 * This is not necessary, but doesn't harm, we 989 * just use unsent instead of sent-unack'ed + 990 * unsent, since there won't be any sent-unack'ed 991 * here. 992 */ 993 if (!SCTP_IS_DETACHED(sctp)) { 994 sctp->sctp_ulp_xmitted(sctp->sctp_ulpd, 995 sctp->sctp_unsent); 996 } 997 } 998 if (sctp->sctp_xmit_unsent == NULL) 999 sctp->sctp_xmit_unsent_tail = NULL; 1000 } 1001 ceclen += pad; 1002 cansend = MIN(sctp->sctp_unsent, sctp->sctp_frwnd); 1003 meta = sctp_get_msg_to_send(sctp, &mp, NULL, &error, ceclen, 1004 cansend, NULL); 1005 /* 1006 * The error cannot be anything else since we could have an non-zero 1007 * error only if sctp_get_msg_to_send() tries to send a Forward 1008 * TSN which will not happen here. 1009 */ 1010 ASSERT(error == 0); 1011 if (meta == NULL) 1012 goto sendcookie; 1013 sctp->sctp_xmit_tail = meta; 1014 sdc = (sctp_data_hdr_t *)mp->b_rptr; 1015 seglen = ntohs(sdc->sdh_len); 1016 if ((ceclen + seglen) > fp->sfa_pmss || 1017 (seglen - sizeof (*sdc)) > cansend) { 1018 goto sendcookie; 1019 } 1020 /* OK, if this fails */ 1021 cemp->b_cont = dupmsg(mp); 1022 sendcookie: 1023 head = sctp_add_proto_hdr(sctp, fp, cemp, 0, NULL); 1024 if (head == NULL) { 1025 freemsg(cemp); 1026 SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 1027 if (errmp != NULL) 1028 freeb(errmp); 1029 SCTP_KSTAT(sctp_send_cookie_failed); 1030 return; 1031 } 1032 /* 1033 * Even if cookie-echo exceeds MTU for one of the hops, it'll 1034 * have a chance of getting there. 1035 */ 1036 if (fp->isv4) { 1037 ipha_t *iph = (ipha_t *)head->b_rptr; 1038 iph->ipha_fragment_offset_and_flags = 0; 1039 } 1040 BUMP_LOCAL(sctp->sctp_obchunks); 1041 1042 sctp->sctp_cookie_mp = dupmsg(head); 1043 /* Don't bundle, we will just resend init if this cookie is lost. */ 1044 if (sctp->sctp_cookie_mp == NULL) { 1045 if (cemp->b_cont != NULL) { 1046 freemsg(cemp->b_cont); 1047 cemp->b_cont = NULL; 1048 } 1049 } else if (cemp->b_cont != NULL) { 1050 ASSERT(mp != NULL && mp == meta->b_cont); 1051 SCTP_CHUNK_CLEAR_FLAGS(cemp->b_cont); 1052 cemp->b_wptr += pad; 1053 seglen -= sizeof (*sdc); 1054 SCTP_CHUNK_SENT(sctp, mp, sdc, fp, seglen, meta); 1055 } 1056 if (errmp != NULL) 1057 linkb(head, errmp); 1058 sctp->sctp_state = SCTPS_COOKIE_ECHOED; 1059 SCTP_FADDR_TIMER_RESTART(sctp, fp, fp->rto); 1060 1061 sctp_set_iplen(sctp, head); 1062 sctp_add_sendq(sctp, head); 1063 } 1064 1065 int 1066 sctp_process_cookie(sctp_t *sctp, sctp_chunk_hdr_t *ch, mblk_t *cmp, 1067 sctp_init_chunk_t **iackpp, sctp_hdr_t *insctph, int *recv_adaption, 1068 in6_addr_t *peer_addr) 1069 { 1070 int32_t clen; 1071 size_t initplen; 1072 uchar_t *p; 1073 uchar_t *given_hash; 1074 uchar_t needed_hash[16]; 1075 int64_t ts; 1076 int64_t diff; 1077 uint32_t *lt; 1078 sctp_init_chunk_t *iack; 1079 sctp_chunk_hdr_t *initch; 1080 sctp_init_chunk_t *init; 1081 uint32_t *lttag; 1082 uint32_t *fttag; 1083 uint32_t ports; 1084 1085 BUMP_LOCAL(sctp->sctp_ibchunks); 1086 /* Verify the ICV */ 1087 clen = ntohs(ch->sch_len) - sizeof (*ch) - 16; 1088 if (clen < 0) { 1089 dprint(1, ("invalid cookie chunk length %d\n", 1090 ntohs(ch->sch_len))); 1091 1092 return (-1); 1093 } 1094 p = (uchar_t *)(ch + 1); 1095 1096 hmac_md5(p, clen, (uchar_t *)sctp->sctp_secret, SCTP_SECRET_LEN, 1097 needed_hash); 1098 1099 /* The given hash follows the cookie data */ 1100 given_hash = p + clen; 1101 1102 if (bcmp(given_hash, needed_hash, 16) != 0) { 1103 /* The secret may have changed; try the old secret */ 1104 hmac_md5(p, clen, (uchar_t *)sctp->sctp_old_secret, 1105 SCTP_SECRET_LEN, needed_hash); 1106 if (bcmp(given_hash, needed_hash, 16) != 0) { 1107 return (-1); 1108 } 1109 } 1110 1111 /* Timestamp is int64_t, and we only guarantee 32-bit alignment */ 1112 bcopy(p, &ts, sizeof (ts)); 1113 /* Cookie life time, int32_t */ 1114 lt = (uint32_t *)(p + sizeof (ts)); 1115 1116 /* 1117 * To quote PRC, "this is our baby", so let's continue. 1118 * We need to pull out the encapsulated INIT ACK and 1119 * INIT chunks. Note that we don't process these until 1120 * we have verified the timestamp, but we need them before 1121 * processing the timestamp since if the time check fails, 1122 * we need to get the verification tag from the INIT in order 1123 * to send a stale cookie error. 1124 */ 1125 lttag = (uint32_t *)(lt + 1); 1126 fttag = lttag + 1; 1127 if (peer_addr != NULL) 1128 bcopy(fttag + 1, peer_addr, sizeof (in6_addr_t)); 1129 iack = (sctp_init_chunk_t *)((char *)(fttag + 1) + sizeof (in6_addr_t)); 1130 initch = (sctp_chunk_hdr_t *)(iack + 1); 1131 init = (sctp_init_chunk_t *)(initch + 1); 1132 initplen = ntohs(initch->sch_len) - (sizeof (*init) + sizeof (*initch)); 1133 *iackpp = iack; 1134 *recv_adaption = 0; 1135 1136 /* Check the timestamp */ 1137 diff = lbolt64 - ts; 1138 if (diff > *lt && (init->sic_inittag != sctp->sctp_fvtag || 1139 iack->sic_inittag != sctp->sctp_lvtag)) { 1140 1141 uint32_t staleness; 1142 1143 staleness = TICK_TO_USEC(diff); 1144 staleness = htonl(staleness); 1145 sctp_send_abort(sctp, init->sic_inittag, SCTP_ERR_STALE_COOKIE, 1146 (char *)&staleness, sizeof (staleness), cmp, 1, B_FALSE); 1147 1148 dprint(1, ("stale cookie %d\n", staleness)); 1149 1150 return (-1); 1151 } 1152 1153 /* Check for attack by adding addresses to a restart */ 1154 bcopy(insctph, &ports, sizeof (ports)); 1155 if (sctp_secure_restart_check(cmp, initch, ports, KM_NOSLEEP) != 1) { 1156 return (-1); 1157 } 1158 1159 /* Look for adaptation code if there any parms in the INIT chunk */ 1160 if ((initplen >= sizeof (sctp_parm_hdr_t)) && 1161 (sctp_find_al_ind((sctp_parm_hdr_t *)(init + 1), initplen, 1162 &sctp->sctp_rx_adaption_code) == 0)) { 1163 *recv_adaption = 1; 1164 } 1165 1166 /* Examine tie-tags */ 1167 1168 if (sctp->sctp_state >= SCTPS_COOKIE_WAIT) { 1169 if (sctp->sctp_state == SCTPS_ESTABLISHED && 1170 init->sic_inittag == sctp->sctp_fvtag && 1171 iack->sic_inittag == sctp->sctp_lvtag && 1172 *fttag == 0 && *lttag == 0) { 1173 1174 dprint(1, ("duplicate cookie from %x:%x:%x:%x (%d)\n", 1175 SCTP_PRINTADDR(sctp->sctp_current->faddr), 1176 (int)(sctp->sctp_fport))); 1177 return (-1); 1178 } 1179 1180 if (init->sic_inittag != sctp->sctp_fvtag && 1181 iack->sic_inittag != sctp->sctp_lvtag && 1182 *fttag == sctp->sctp_fvtag && 1183 *lttag == sctp->sctp_lvtag) { 1184 int i; 1185 1186 /* Section 5.2.4 case A: restart */ 1187 sctp->sctp_fvtag = init->sic_inittag; 1188 sctp->sctp_lvtag = iack->sic_inittag; 1189 1190 sctp->sctp_sctph->sh_verf = init->sic_inittag; 1191 sctp->sctp_sctph6->sh_verf = init->sic_inittag; 1192 1193 sctp->sctp_ftsn = ntohl(init->sic_inittsn); 1194 sctp->sctp_lastacked = sctp->sctp_ftsn - 1; 1195 sctp->sctp_frwnd = ntohl(init->sic_a_rwnd); 1196 sctp->sctp_fcsn = sctp->sctp_lastacked; 1197 1198 if (sctp->sctp_state < SCTPS_ESTABLISHED) { 1199 sctp->sctp_state = SCTPS_ESTABLISHED; 1200 sctp->sctp_assoc_start_time = (uint32_t)lbolt; 1201 } 1202 1203 dprint(1, ("sctp peer %x:%x:%x:%x (%d) restarted\n", 1204 SCTP_PRINTADDR(sctp->sctp_current->faddr), 1205 (int)(sctp->sctp_fport))); 1206 /* reset parameters */ 1207 sctp_congest_reset(sctp); 1208 1209 /* reset stream bookkeeping */ 1210 sctp_instream_cleanup(sctp, B_FALSE); 1211 1212 sctp->sctp_istr_nmsgs = 0; 1213 sctp->sctp_rxqueued = 0; 1214 for (i = 0; i < sctp->sctp_num_ostr; i++) { 1215 sctp->sctp_ostrcntrs[i] = 0; 1216 } 1217 /* XXX flush xmit_list? */ 1218 1219 return (0); 1220 } else if (init->sic_inittag != sctp->sctp_fvtag && 1221 iack->sic_inittag == sctp->sctp_lvtag) { 1222 1223 /* Section 5.2.4 case B: INIT collision */ 1224 if (sctp->sctp_state < SCTPS_ESTABLISHED) { 1225 if (!sctp_initialize_params(sctp, init, iack)) 1226 return (-1); /* Drop? */ 1227 sctp->sctp_state = SCTPS_ESTABLISHED; 1228 sctp->sctp_assoc_start_time = (uint32_t)lbolt; 1229 } 1230 1231 dprint(1, ("init collision with %x:%x:%x:%x (%d)\n", 1232 SCTP_PRINTADDR(sctp->sctp_current->faddr), 1233 (int)(sctp->sctp_fport))); 1234 1235 return (0); 1236 } else if (iack->sic_inittag != sctp->sctp_lvtag && 1237 init->sic_inittag == sctp->sctp_fvtag && 1238 *fttag == 0 && *lttag == 0) { 1239 1240 /* Section 5.2.4 case C: late COOKIE */ 1241 dprint(1, ("late cookie from %x:%x:%x:%x (%d)\n", 1242 SCTP_PRINTADDR(sctp->sctp_current->faddr), 1243 (int)(sctp->sctp_fport))); 1244 return (-1); 1245 } else if (init->sic_inittag == sctp->sctp_fvtag && 1246 iack->sic_inittag == sctp->sctp_lvtag) { 1247 1248 /* 1249 * Section 5.2.4 case D: COOKIE ECHO retransmit 1250 * Don't check cookie lifetime 1251 */ 1252 dprint(1, ("cookie tags match from %x:%x:%x:%x (%d)\n", 1253 SCTP_PRINTADDR(sctp->sctp_current->faddr), 1254 (int)(sctp->sctp_fport))); 1255 if (sctp->sctp_state < SCTPS_ESTABLISHED) { 1256 if (!sctp_initialize_params(sctp, init, iack)) 1257 return (-1); /* Drop? */ 1258 sctp->sctp_state = SCTPS_ESTABLISHED; 1259 sctp->sctp_assoc_start_time = (uint32_t)lbolt; 1260 } 1261 return (0); 1262 } else { 1263 /* unrecognized case -- silently drop it */ 1264 return (-1); 1265 } 1266 } 1267 1268 return (0); 1269 } 1270 1271 /* 1272 * Similar to ip_fanout_sctp, except that the src addr(s) are drawn 1273 * from address parameters in an INIT ACK's address list. This 1274 * function is used when an INIT ACK is received but IP's fanout 1275 * function could not find a sctp via the normal lookup routine. 1276 * This can happen when a host sends an INIT ACK from a different 1277 * address than the INIT was sent to. 1278 * 1279 * Returns the sctp_t if found, or NULL if not found. 1280 */ 1281 sctp_t * 1282 sctp_addrlist2sctp(mblk_t *mp, sctp_hdr_t *sctph, sctp_chunk_hdr_t *ich, 1283 uint_t ipif_seqid, zoneid_t zoneid) 1284 { 1285 int isv4; 1286 ipha_t *iph; 1287 ip6_t *ip6h; 1288 in6_addr_t dst; 1289 in6_addr_t src; 1290 sctp_parm_hdr_t *ph; 1291 ssize_t remaining; 1292 sctp_init_chunk_t *iack; 1293 uint32_t ports; 1294 sctp_t *sctp = NULL; 1295 1296 ASSERT(ich->sch_id == CHUNK_INIT_ACK); 1297 1298 isv4 = (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION); 1299 if (isv4) { 1300 iph = (ipha_t *)mp->b_rptr; 1301 IN6_IPADDR_TO_V4MAPPED(iph->ipha_dst, &dst); 1302 } else { 1303 ip6h = (ip6_t *)mp->b_rptr; 1304 dst = ip6h->ip6_dst; 1305 } 1306 1307 ports = *(uint32_t *)sctph; 1308 1309 dprint(1, ("sctp_addrlist2sctp: ports=%u, dst = %x:%x:%x:%x\n", 1310 ports, SCTP_PRINTADDR(dst))); 1311 1312 /* pull out any address parameters */ 1313 remaining = ntohs(ich->sch_len) - sizeof (*ich) - sizeof (*iack); 1314 if (remaining < sizeof (*ph)) { 1315 return (NULL); 1316 } 1317 1318 iack = (sctp_init_chunk_t *)(ich + 1); 1319 ph = (sctp_parm_hdr_t *)(iack + 1); 1320 1321 while (ph != NULL) { 1322 /* 1323 * params have been put in host byteorder by 1324 * sctp_check_input() 1325 */ 1326 if (ph->sph_type == PARM_ADDR4) { 1327 IN6_INADDR_TO_V4MAPPED((struct in_addr *)(ph + 1), 1328 &src); 1329 1330 sctp = sctp_conn_match(&src, &dst, ports, ipif_seqid, 1331 zoneid); 1332 1333 dprint(1, 1334 ("sctp_addrlist2sctp: src=%x:%x:%x:%x, sctp=%p\n", 1335 SCTP_PRINTADDR(src), (void *)sctp)); 1336 1337 1338 if (sctp != NULL) { 1339 return (sctp); 1340 } 1341 } else if (ph->sph_type == PARM_ADDR6) { 1342 src = *(in6_addr_t *)(ph + 1); 1343 sctp = sctp_conn_match(&src, &dst, ports, ipif_seqid, 1344 zoneid); 1345 1346 dprint(1, 1347 ("sctp_addrlist2sctp: src=%x:%x:%x:%x, sctp=%p\n", 1348 SCTP_PRINTADDR(src), (void *)sctp)); 1349 1350 if (sctp != NULL) { 1351 return (sctp); 1352 } 1353 } 1354 1355 ph = sctp_next_parm(ph, &remaining); 1356 } 1357 1358 return (NULL); 1359 } 1360