17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
2177c67f2fSkcpoon
227c478bd9Sstevel@tonic-gate /*
23*5dd46ab5SKacheong Poon * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
247c478bd9Sstevel@tonic-gate */
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate #include <sys/types.h>
277c478bd9Sstevel@tonic-gate #include <sys/systm.h>
287c478bd9Sstevel@tonic-gate #include <sys/stream.h>
297c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h>
307c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
317c478bd9Sstevel@tonic-gate #define _SUN_TPI_VERSION 2
327c478bd9Sstevel@tonic-gate #include <sys/tihdr.h>
337c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
347c478bd9Sstevel@tonic-gate #include <sys/socket.h>
357c478bd9Sstevel@tonic-gate #include <sys/random.h>
367c478bd9Sstevel@tonic-gate #include <sys/policy.h>
3745916cd2Sjpk #include <sys/tsol/tndb.h>
3845916cd2Sjpk #include <sys/tsol/tnet.h>
397c478bd9Sstevel@tonic-gate
407c478bd9Sstevel@tonic-gate #include <netinet/in.h>
417c478bd9Sstevel@tonic-gate #include <netinet/ip6.h>
427c478bd9Sstevel@tonic-gate
437c478bd9Sstevel@tonic-gate #include <inet/common.h>
447c478bd9Sstevel@tonic-gate #include <inet/ip.h>
457c478bd9Sstevel@tonic-gate #include <inet/ip6.h>
467c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h>
477c478bd9Sstevel@tonic-gate #include "sctp_impl.h"
487c478bd9Sstevel@tonic-gate #include "sctp_asconf.h"
497c478bd9Sstevel@tonic-gate #include "sctp_addr.h"
507c478bd9Sstevel@tonic-gate
51*5dd46ab5SKacheong Poon /*
52*5dd46ab5SKacheong Poon * Minimum number of associations which can be created per listener. Used
53*5dd46ab5SKacheong Poon * when the listener association count is in effect.
54*5dd46ab5SKacheong Poon */
55*5dd46ab5SKacheong Poon static uint32_t sctp_min_assoc_listener = 2;
56*5dd46ab5SKacheong Poon
577c478bd9Sstevel@tonic-gate /*
587c478bd9Sstevel@tonic-gate * Returns 0 on success, EACCES on permission failure.
597c478bd9Sstevel@tonic-gate */
607c478bd9Sstevel@tonic-gate static int
sctp_select_port(sctp_t * sctp,in_port_t * requested_port,int * user_specified)617c478bd9Sstevel@tonic-gate sctp_select_port(sctp_t *sctp, in_port_t *requested_port, int *user_specified)
627c478bd9Sstevel@tonic-gate {
63f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps;
64bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp;
65f4b3ec61Sdh
667c478bd9Sstevel@tonic-gate /*
677c478bd9Sstevel@tonic-gate * Get a valid port (within the anonymous range and should not
687c478bd9Sstevel@tonic-gate * be a privileged one) to use if the user has not given a port.
697c478bd9Sstevel@tonic-gate * If multiple threads are here, they may all start with
707c478bd9Sstevel@tonic-gate * with the same initial port. But, it should be fine as long as
717c478bd9Sstevel@tonic-gate * sctp_bindi will ensure that no two threads will be assigned
727c478bd9Sstevel@tonic-gate * the same port.
737c478bd9Sstevel@tonic-gate */
747c478bd9Sstevel@tonic-gate if (*requested_port == 0) {
75f4b3ec61Sdh *requested_port = sctp_update_next_port(
76f4b3ec61Sdh sctps->sctps_next_port_to_try,
77bd670b35SErik Nordmark crgetzone(connp->conn_cred), sctps);
7845916cd2Sjpk if (*requested_port == 0)
7945916cd2Sjpk return (EACCES);
807c478bd9Sstevel@tonic-gate *user_specified = 0;
817c478bd9Sstevel@tonic-gate } else {
827c478bd9Sstevel@tonic-gate int i;
837c478bd9Sstevel@tonic-gate boolean_t priv = B_FALSE;
847c478bd9Sstevel@tonic-gate
857c478bd9Sstevel@tonic-gate /*
867c478bd9Sstevel@tonic-gate * If the requested_port is in the well-known privileged range,
877c478bd9Sstevel@tonic-gate * verify that the stream was opened by a privileged user.
887c478bd9Sstevel@tonic-gate * Note: No locks are held when inspecting sctp_g_*epriv_ports
897c478bd9Sstevel@tonic-gate * but instead the code relies on:
907c478bd9Sstevel@tonic-gate * - the fact that the address of the array and its size never
917c478bd9Sstevel@tonic-gate * changes
927c478bd9Sstevel@tonic-gate * - the atomic assignment of the elements of the array
937c478bd9Sstevel@tonic-gate */
94f4b3ec61Sdh if (*requested_port < sctps->sctps_smallest_nonpriv_port) {
957c478bd9Sstevel@tonic-gate priv = B_TRUE;
967c478bd9Sstevel@tonic-gate } else {
97f4b3ec61Sdh for (i = 0; i < sctps->sctps_g_num_epriv_ports; i++) {
98f4b3ec61Sdh if (*requested_port ==
99f4b3ec61Sdh sctps->sctps_g_epriv_ports[i]) {
1007c478bd9Sstevel@tonic-gate priv = B_TRUE;
1017c478bd9Sstevel@tonic-gate break;
1027c478bd9Sstevel@tonic-gate }
1037c478bd9Sstevel@tonic-gate }
1047c478bd9Sstevel@tonic-gate }
1057c478bd9Sstevel@tonic-gate if (priv) {
1067c478bd9Sstevel@tonic-gate /*
1077c478bd9Sstevel@tonic-gate * sctp_bind() should take a cred_t argument so that
1087c478bd9Sstevel@tonic-gate * we can use it here.
1097c478bd9Sstevel@tonic-gate */
110bd670b35SErik Nordmark if (secpolicy_net_privaddr(connp->conn_cred,
111ddf7fe95Scasper *requested_port, IPPROTO_SCTP) != 0) {
1127c478bd9Sstevel@tonic-gate dprint(1,
1137c478bd9Sstevel@tonic-gate ("sctp_bind(x): no prive for port %d",
1147c478bd9Sstevel@tonic-gate *requested_port));
11545916cd2Sjpk return (EACCES);
1167c478bd9Sstevel@tonic-gate }
1177c478bd9Sstevel@tonic-gate }
1187c478bd9Sstevel@tonic-gate *user_specified = 1;
1197c478bd9Sstevel@tonic-gate }
1207c478bd9Sstevel@tonic-gate
1217c478bd9Sstevel@tonic-gate return (0);
1227c478bd9Sstevel@tonic-gate }
1237c478bd9Sstevel@tonic-gate
1247c478bd9Sstevel@tonic-gate int
sctp_listen(sctp_t * sctp)1257c478bd9Sstevel@tonic-gate sctp_listen(sctp_t *sctp)
1267c478bd9Sstevel@tonic-gate {
1277c478bd9Sstevel@tonic-gate sctp_tf_t *tf;
128f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps;
129bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp;
1307c478bd9Sstevel@tonic-gate
1317c478bd9Sstevel@tonic-gate RUN_SCTP(sctp);
1327c478bd9Sstevel@tonic-gate /*
1337c478bd9Sstevel@tonic-gate * TCP handles listen() increasing the backlog, need to check
1341d8c4025Svi * if it should be handled here too
1357c478bd9Sstevel@tonic-gate */
136b34b8d1aSkcpoon if (sctp->sctp_state > SCTPS_BOUND ||
137b34b8d1aSkcpoon (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) {
1387c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
1397c478bd9Sstevel@tonic-gate return (EINVAL);
1407c478bd9Sstevel@tonic-gate }
1417c478bd9Sstevel@tonic-gate
1427c478bd9Sstevel@tonic-gate /* Do an anonymous bind for unbound socket doing listen(). */
1437c478bd9Sstevel@tonic-gate if (sctp->sctp_nsaddrs == 0) {
1447c478bd9Sstevel@tonic-gate struct sockaddr_storage ss;
1457c478bd9Sstevel@tonic-gate int ret;
1467c478bd9Sstevel@tonic-gate
1477c478bd9Sstevel@tonic-gate bzero(&ss, sizeof (ss));
148bd670b35SErik Nordmark ss.ss_family = connp->conn_family;
1497c478bd9Sstevel@tonic-gate
1507c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
1517c478bd9Sstevel@tonic-gate if ((ret = sctp_bind(sctp, (struct sockaddr *)&ss,
152b34b8d1aSkcpoon sizeof (ss))) != 0)
1537c478bd9Sstevel@tonic-gate return (ret);
1547c478bd9Sstevel@tonic-gate RUN_SCTP(sctp)
1557c478bd9Sstevel@tonic-gate }
1567c478bd9Sstevel@tonic-gate
157bd670b35SErik Nordmark /* Cache things in the ixa without any refhold */
158be4c8f74SErik Nordmark ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
159bd670b35SErik Nordmark connp->conn_ixa->ixa_cred = connp->conn_cred;
160bd670b35SErik Nordmark connp->conn_ixa->ixa_cpid = connp->conn_cpid;
161bd670b35SErik Nordmark if (is_system_labeled())
162bd670b35SErik Nordmark connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
163bd670b35SErik Nordmark
1647c478bd9Sstevel@tonic-gate sctp->sctp_state = SCTPS_LISTEN;
1657c478bd9Sstevel@tonic-gate (void) random_get_pseudo_bytes(sctp->sctp_secret, SCTP_SECRET_LEN);
166d3d50737SRafael Vanoni sctp->sctp_last_secret_update = ddi_get_lbolt64();
1677c478bd9Sstevel@tonic-gate bzero(sctp->sctp_old_secret, SCTP_SECRET_LEN);
168*5dd46ab5SKacheong Poon
169*5dd46ab5SKacheong Poon /*
170*5dd46ab5SKacheong Poon * If there is an association limit, allocate and initialize
171*5dd46ab5SKacheong Poon * the counter struct. Note that since listen can be called
172*5dd46ab5SKacheong Poon * multiple times, the struct may have been allready allocated.
173*5dd46ab5SKacheong Poon */
174*5dd46ab5SKacheong Poon if (!list_is_empty(&sctps->sctps_listener_conf) &&
175*5dd46ab5SKacheong Poon sctp->sctp_listen_cnt == NULL) {
176*5dd46ab5SKacheong Poon sctp_listen_cnt_t *slc;
177*5dd46ab5SKacheong Poon uint32_t ratio;
178*5dd46ab5SKacheong Poon
179*5dd46ab5SKacheong Poon ratio = sctp_find_listener_conf(sctps,
180*5dd46ab5SKacheong Poon ntohs(connp->conn_lport));
181*5dd46ab5SKacheong Poon if (ratio != 0) {
182*5dd46ab5SKacheong Poon uint32_t mem_ratio, tot_buf;
183*5dd46ab5SKacheong Poon
184*5dd46ab5SKacheong Poon slc = kmem_alloc(sizeof (sctp_listen_cnt_t), KM_SLEEP);
185*5dd46ab5SKacheong Poon /*
186*5dd46ab5SKacheong Poon * Calculate the connection limit based on
187*5dd46ab5SKacheong Poon * the configured ratio and maxusers. Maxusers
188*5dd46ab5SKacheong Poon * are calculated based on memory size,
189*5dd46ab5SKacheong Poon * ~ 1 user per MB. Note that the conn_rcvbuf
190*5dd46ab5SKacheong Poon * and conn_sndbuf may change after a
191*5dd46ab5SKacheong Poon * connection is accepted. So what we have
192*5dd46ab5SKacheong Poon * is only an approximation.
193*5dd46ab5SKacheong Poon */
194*5dd46ab5SKacheong Poon if ((tot_buf = connp->conn_rcvbuf +
195*5dd46ab5SKacheong Poon connp->conn_sndbuf) < MB) {
196*5dd46ab5SKacheong Poon mem_ratio = MB / tot_buf;
197*5dd46ab5SKacheong Poon slc->slc_max = maxusers / ratio * mem_ratio;
198*5dd46ab5SKacheong Poon } else {
199*5dd46ab5SKacheong Poon mem_ratio = tot_buf / MB;
200*5dd46ab5SKacheong Poon slc->slc_max = maxusers / ratio / mem_ratio;
201*5dd46ab5SKacheong Poon }
202*5dd46ab5SKacheong Poon /* At least we should allow some associations! */
203*5dd46ab5SKacheong Poon if (slc->slc_max < sctp_min_assoc_listener)
204*5dd46ab5SKacheong Poon slc->slc_max = sctp_min_assoc_listener;
205*5dd46ab5SKacheong Poon slc->slc_cnt = 1;
206*5dd46ab5SKacheong Poon slc->slc_drop = 0;
207*5dd46ab5SKacheong Poon sctp->sctp_listen_cnt = slc;
208*5dd46ab5SKacheong Poon }
209*5dd46ab5SKacheong Poon }
210*5dd46ab5SKacheong Poon
211*5dd46ab5SKacheong Poon
212f4b3ec61Sdh tf = &sctps->sctps_listen_fanout[SCTP_LISTEN_HASH(
213bd670b35SErik Nordmark ntohs(connp->conn_lport))];
2147c478bd9Sstevel@tonic-gate sctp_listen_hash_insert(tf, sctp);
215*5dd46ab5SKacheong Poon
2167c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
2177c478bd9Sstevel@tonic-gate return (0);
2187c478bd9Sstevel@tonic-gate }
2197c478bd9Sstevel@tonic-gate
2207c478bd9Sstevel@tonic-gate /*
2217c478bd9Sstevel@tonic-gate * Bind the sctp_t to a sockaddr, which includes an address and other
2227c478bd9Sstevel@tonic-gate * information, such as port or flowinfo.
2237c478bd9Sstevel@tonic-gate */
2247c478bd9Sstevel@tonic-gate int
sctp_bind(sctp_t * sctp,struct sockaddr * sa,socklen_t len)2257c478bd9Sstevel@tonic-gate sctp_bind(sctp_t *sctp, struct sockaddr *sa, socklen_t len)
2267c478bd9Sstevel@tonic-gate {
2277c478bd9Sstevel@tonic-gate int user_specified;
2287c478bd9Sstevel@tonic-gate boolean_t bind_to_req_port_only;
2297c478bd9Sstevel@tonic-gate in_port_t requested_port;
2307c478bd9Sstevel@tonic-gate in_port_t allocated_port;
2317c478bd9Sstevel@tonic-gate int err = 0;
232bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp;
233bd670b35SErik Nordmark uint_t scope_id;
234bd670b35SErik Nordmark sin_t *sin;
235bd670b35SErik Nordmark sin6_t *sin6;
2367c478bd9Sstevel@tonic-gate
2377c478bd9Sstevel@tonic-gate ASSERT(sctp != NULL);
2387c478bd9Sstevel@tonic-gate
2397c478bd9Sstevel@tonic-gate RUN_SCTP(sctp);
2407c478bd9Sstevel@tonic-gate
2410f1702c5SYu Xiangning if ((sctp->sctp_state >= SCTPS_BOUND) ||
2420f1702c5SYu Xiangning (sctp->sctp_connp->conn_state_flags & CONN_CLOSING) ||
2430f1702c5SYu Xiangning (sa == NULL || len == 0)) {
2440f1702c5SYu Xiangning /*
2450f1702c5SYu Xiangning * Multiple binds not allowed for any SCTP socket
2460f1702c5SYu Xiangning * Also binding with null address is not supported.
2470f1702c5SYu Xiangning */
2487c478bd9Sstevel@tonic-gate err = EINVAL;
2497c478bd9Sstevel@tonic-gate goto done;
2507c478bd9Sstevel@tonic-gate }
2517c478bd9Sstevel@tonic-gate
2527c478bd9Sstevel@tonic-gate switch (sa->sa_family) {
2537c478bd9Sstevel@tonic-gate case AF_INET:
254bd670b35SErik Nordmark sin = (sin_t *)sa;
2557c478bd9Sstevel@tonic-gate if (len < sizeof (struct sockaddr_in) ||
256bd670b35SErik Nordmark connp->conn_family == AF_INET6) {
2577c478bd9Sstevel@tonic-gate err = EINVAL;
2587c478bd9Sstevel@tonic-gate goto done;
2597c478bd9Sstevel@tonic-gate }
260bd670b35SErik Nordmark requested_port = ntohs(sin->sin_port);
2617c478bd9Sstevel@tonic-gate break;
2627c478bd9Sstevel@tonic-gate case AF_INET6:
263bd670b35SErik Nordmark sin6 = (sin6_t *)sa;
2647c478bd9Sstevel@tonic-gate if (len < sizeof (struct sockaddr_in6) ||
265bd670b35SErik Nordmark connp->conn_family == AF_INET) {
2667c478bd9Sstevel@tonic-gate err = EINVAL;
2677c478bd9Sstevel@tonic-gate goto done;
2687c478bd9Sstevel@tonic-gate }
269bd670b35SErik Nordmark requested_port = ntohs(sin6->sin6_port);
2707c478bd9Sstevel@tonic-gate /* Set the flowinfo. */
271bd670b35SErik Nordmark connp->conn_flowinfo =
272bd670b35SErik Nordmark sin6->sin6_flowinfo & ~IPV6_VERS_AND_FLOW_MASK;
273bd670b35SErik Nordmark
274bd670b35SErik Nordmark scope_id = sin6->sin6_scope_id;
275bd670b35SErik Nordmark if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(&sin6->sin6_addr)) {
276bd670b35SErik Nordmark connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
277bd670b35SErik Nordmark connp->conn_ixa->ixa_scopeid = scope_id;
278bd670b35SErik Nordmark connp->conn_incoming_ifindex = scope_id;
279bd670b35SErik Nordmark } else {
280bd670b35SErik Nordmark connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
281bd670b35SErik Nordmark connp->conn_incoming_ifindex = connp->conn_bound_if;
282bd670b35SErik Nordmark }
2837c478bd9Sstevel@tonic-gate break;
2847c478bd9Sstevel@tonic-gate default:
2857c478bd9Sstevel@tonic-gate err = EAFNOSUPPORT;
2867c478bd9Sstevel@tonic-gate goto done;
2877c478bd9Sstevel@tonic-gate }
2887c478bd9Sstevel@tonic-gate bind_to_req_port_only = requested_port == 0 ? B_FALSE : B_TRUE;
2897c478bd9Sstevel@tonic-gate
29045916cd2Sjpk err = sctp_select_port(sctp, &requested_port, &user_specified);
29145916cd2Sjpk if (err != 0)
2927c478bd9Sstevel@tonic-gate goto done;
2937c478bd9Sstevel@tonic-gate
2941d8c4025Svi if ((err = sctp_bind_add(sctp, sa, 1, B_TRUE,
2951d8c4025Svi user_specified == 1 ? htons(requested_port) : 0)) != 0) {
2967c478bd9Sstevel@tonic-gate goto done;
2971d8c4025Svi }
29845916cd2Sjpk err = sctp_bindi(sctp, requested_port, bind_to_req_port_only,
29945916cd2Sjpk user_specified, &allocated_port);
30045916cd2Sjpk if (err != 0) {
3017c478bd9Sstevel@tonic-gate sctp_free_saddrs(sctp);
30245916cd2Sjpk } else {
30345916cd2Sjpk ASSERT(sctp->sctp_state == SCTPS_BOUND);
3047c478bd9Sstevel@tonic-gate }
3057c478bd9Sstevel@tonic-gate done:
3067c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
3077c478bd9Sstevel@tonic-gate return (err);
3087c478bd9Sstevel@tonic-gate }
3097c478bd9Sstevel@tonic-gate
3107c478bd9Sstevel@tonic-gate /*
3117c478bd9Sstevel@tonic-gate * Perform bind/unbind operation of a list of addresses on a sctp_t
3127c478bd9Sstevel@tonic-gate */
3137c478bd9Sstevel@tonic-gate int
sctp_bindx(sctp_t * sctp,const void * addrs,int addrcnt,int bindop)3147c478bd9Sstevel@tonic-gate sctp_bindx(sctp_t *sctp, const void *addrs, int addrcnt, int bindop)
3157c478bd9Sstevel@tonic-gate {
3167c478bd9Sstevel@tonic-gate ASSERT(sctp != NULL);
3177c478bd9Sstevel@tonic-gate ASSERT(addrs != NULL);
3187c478bd9Sstevel@tonic-gate ASSERT(addrcnt > 0);
3197c478bd9Sstevel@tonic-gate
3207c478bd9Sstevel@tonic-gate switch (bindop) {
3217c478bd9Sstevel@tonic-gate case SCTP_BINDX_ADD_ADDR:
3221d8c4025Svi return (sctp_bind_add(sctp, addrs, addrcnt, B_FALSE,
323bd670b35SErik Nordmark sctp->sctp_connp->conn_lport));
3247c478bd9Sstevel@tonic-gate case SCTP_BINDX_REM_ADDR:
3257c478bd9Sstevel@tonic-gate return (sctp_bind_del(sctp, addrs, addrcnt, B_FALSE));
3267c478bd9Sstevel@tonic-gate default:
3277c478bd9Sstevel@tonic-gate return (EINVAL);
3287c478bd9Sstevel@tonic-gate }
3297c478bd9Sstevel@tonic-gate }
3307c478bd9Sstevel@tonic-gate
3317c478bd9Sstevel@tonic-gate /*
3327c478bd9Sstevel@tonic-gate * Add a list of addresses to a sctp_t.
3337c478bd9Sstevel@tonic-gate */
3347c478bd9Sstevel@tonic-gate int
sctp_bind_add(sctp_t * sctp,const void * addrs,uint32_t addrcnt,boolean_t caller_hold_lock,in_port_t port)3357c478bd9Sstevel@tonic-gate sctp_bind_add(sctp_t *sctp, const void *addrs, uint32_t addrcnt,
3361d8c4025Svi boolean_t caller_hold_lock, in_port_t port)
3377c478bd9Sstevel@tonic-gate {
3387c478bd9Sstevel@tonic-gate int err = 0;
3397c478bd9Sstevel@tonic-gate boolean_t do_asconf = B_FALSE;
340f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps;
341bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp;
3427c478bd9Sstevel@tonic-gate
3437c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
3447c478bd9Sstevel@tonic-gate RUN_SCTP(sctp);
3457c478bd9Sstevel@tonic-gate
346b34b8d1aSkcpoon if (sctp->sctp_state > SCTPS_ESTABLISHED ||
347b34b8d1aSkcpoon (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) {
3487c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
3497c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
3507c478bd9Sstevel@tonic-gate return (EINVAL);
3517c478bd9Sstevel@tonic-gate }
352df19b344Svi
353df19b344Svi if (sctp->sctp_state > SCTPS_LISTEN) {
354df19b344Svi /*
355df19b344Svi * Let's do some checking here rather than undoing the
356df19b344Svi * add later (for these reasons).
357df19b344Svi */
358f4b3ec61Sdh if (!sctps->sctps_addip_enabled ||
359f4b3ec61Sdh !sctp->sctp_understands_asconf ||
360df19b344Svi !sctp->sctp_understands_addip) {
361df19b344Svi if (!caller_hold_lock)
362df19b344Svi WAKE_SCTP(sctp);
363df19b344Svi return (EINVAL);
364df19b344Svi }
3657c478bd9Sstevel@tonic-gate do_asconf = B_TRUE;
366df19b344Svi }
3671d8c4025Svi /*
3681d8c4025Svi * On a clustered node, for an inaddr_any bind, we will pass the list
3691d8c4025Svi * of all the addresses in the global list, minus any address on the
3701d8c4025Svi * loopback interface, and expect the clustering susbsystem to give us
3711d8c4025Svi * the correct list for the 'port'. For explicit binds we give the
3721d8c4025Svi * list of addresses and the clustering module validates it for the
3731d8c4025Svi * 'port'.
3741d8c4025Svi *
3751d8c4025Svi * On a non-clustered node, cl_sctp_check_addrs will be NULL and
3761d8c4025Svi * we proceed as usual.
3771d8c4025Svi */
3781d8c4025Svi if (cl_sctp_check_addrs != NULL) {
3791d8c4025Svi uchar_t *addrlist = NULL;
3801d8c4025Svi size_t size = 0;
3811d8c4025Svi int unspec = 0;
3821d8c4025Svi boolean_t do_listen;
3831d8c4025Svi uchar_t *llist = NULL;
3841d8c4025Svi size_t lsize = 0;
3851d8c4025Svi
3861d8c4025Svi /*
3871d8c4025Svi * If we are adding addresses after listening, but before
3881d8c4025Svi * an association is established, we need to update the
3891d8c4025Svi * clustering module with this info.
3901d8c4025Svi */
3911d8c4025Svi do_listen = !do_asconf && sctp->sctp_state > SCTPS_BOUND &&
3921d8c4025Svi cl_sctp_listen != NULL;
3931d8c4025Svi
3941d8c4025Svi err = sctp_get_addrlist(sctp, addrs, &addrcnt, &addrlist,
3951d8c4025Svi &unspec, &size);
3961d8c4025Svi if (err != 0) {
3971d8c4025Svi ASSERT(addrlist == NULL);
3981d8c4025Svi ASSERT(addrcnt == 0);
3991d8c4025Svi ASSERT(size == 0);
4001d8c4025Svi if (!caller_hold_lock)
4011d8c4025Svi WAKE_SCTP(sctp);
402f4b3ec61Sdh SCTP_KSTAT(sctps, sctp_cl_check_addrs);
4031d8c4025Svi return (err);
4041d8c4025Svi }
4051d8c4025Svi ASSERT(addrlist != NULL);
406bd670b35SErik Nordmark (*cl_sctp_check_addrs)(connp->conn_family, port, &addrlist,
4071d8c4025Svi size, &addrcnt, unspec == 1);
4081d8c4025Svi if (addrcnt == 0) {
4091d8c4025Svi /* We free the list */
4101d8c4025Svi kmem_free(addrlist, size);
4111d8c4025Svi if (!caller_hold_lock)
4121d8c4025Svi WAKE_SCTP(sctp);
4131d8c4025Svi return (EINVAL);
4141d8c4025Svi }
4151d8c4025Svi if (do_listen) {
4161d8c4025Svi lsize = sizeof (in6_addr_t) * addrcnt;
4171d8c4025Svi llist = kmem_alloc(lsize, KM_SLEEP);
4181d8c4025Svi }
4191d8c4025Svi err = sctp_valid_addr_list(sctp, addrlist, addrcnt, llist,
4201d8c4025Svi lsize);
4211d8c4025Svi if (err == 0 && do_listen) {
422bd670b35SErik Nordmark (*cl_sctp_listen)(connp->conn_family, llist,
423bd670b35SErik Nordmark addrcnt, connp->conn_lport);
4241d8c4025Svi /* list will be freed by the clustering module */
4251d8c4025Svi } else if (err != 0 && llist != NULL) {
4261d8c4025Svi kmem_free(llist, lsize);
4271d8c4025Svi }
4281d8c4025Svi /* free the list we allocated */
4291d8c4025Svi kmem_free(addrlist, size);
4301d8c4025Svi } else {
4311d8c4025Svi err = sctp_valid_addr_list(sctp, addrs, addrcnt, NULL, 0);
4321d8c4025Svi }
4337c478bd9Sstevel@tonic-gate if (err != 0) {
4347c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
4357c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
4367c478bd9Sstevel@tonic-gate return (err);
4377c478bd9Sstevel@tonic-gate }
4387c478bd9Sstevel@tonic-gate /* Need to send ASCONF messages */
4397c478bd9Sstevel@tonic-gate if (do_asconf) {
4407c478bd9Sstevel@tonic-gate err = sctp_add_ip(sctp, addrs, addrcnt);
4417c478bd9Sstevel@tonic-gate if (err != 0) {
4427c478bd9Sstevel@tonic-gate sctp_del_saddr_list(sctp, addrs, addrcnt, B_FALSE);
4437c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
4447c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
4457c478bd9Sstevel@tonic-gate return (err);
4467c478bd9Sstevel@tonic-gate }
4477c478bd9Sstevel@tonic-gate }
4487c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
4497c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
4507c478bd9Sstevel@tonic-gate return (0);
4517c478bd9Sstevel@tonic-gate }
4527c478bd9Sstevel@tonic-gate
4537c478bd9Sstevel@tonic-gate /*
4547c478bd9Sstevel@tonic-gate * Remove one or more addresses bound to the sctp_t.
4557c478bd9Sstevel@tonic-gate */
4567c478bd9Sstevel@tonic-gate int
sctp_bind_del(sctp_t * sctp,const void * addrs,uint32_t addrcnt,boolean_t caller_hold_lock)4577c478bd9Sstevel@tonic-gate sctp_bind_del(sctp_t *sctp, const void *addrs, uint32_t addrcnt,
4587c478bd9Sstevel@tonic-gate boolean_t caller_hold_lock)
4597c478bd9Sstevel@tonic-gate {
4607c478bd9Sstevel@tonic-gate int error = 0;
4617c478bd9Sstevel@tonic-gate boolean_t do_asconf = B_FALSE;
4621d8c4025Svi uchar_t *ulist = NULL;
4631d8c4025Svi size_t usize = 0;
464f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps;
465bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp;
4667c478bd9Sstevel@tonic-gate
4677c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
4687c478bd9Sstevel@tonic-gate RUN_SCTP(sctp);
4697c478bd9Sstevel@tonic-gate
470b34b8d1aSkcpoon if (sctp->sctp_state > SCTPS_ESTABLISHED ||
471b34b8d1aSkcpoon (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) {
4727c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
4737c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
4747c478bd9Sstevel@tonic-gate return (EINVAL);
4757c478bd9Sstevel@tonic-gate }
476df19b344Svi /*
477df19b344Svi * Fail the remove if we are beyond listen, but can't send this
478df19b344Svi * to the peer.
479df19b344Svi */
480df19b344Svi if (sctp->sctp_state > SCTPS_LISTEN) {
481f4b3ec61Sdh if (!sctps->sctps_addip_enabled ||
482f4b3ec61Sdh !sctp->sctp_understands_asconf ||
483df19b344Svi !sctp->sctp_understands_addip) {
484df19b344Svi if (!caller_hold_lock)
485df19b344Svi WAKE_SCTP(sctp);
486df19b344Svi return (EINVAL);
487df19b344Svi }
4887c478bd9Sstevel@tonic-gate do_asconf = B_TRUE;
489df19b344Svi }
4907c478bd9Sstevel@tonic-gate
4917c478bd9Sstevel@tonic-gate /* Can't delete the last address nor all of the addresses */
4927c478bd9Sstevel@tonic-gate if (sctp->sctp_nsaddrs == 1 || addrcnt >= sctp->sctp_nsaddrs) {
4937c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
4947c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
4957c478bd9Sstevel@tonic-gate return (EINVAL);
4967c478bd9Sstevel@tonic-gate }
4977c478bd9Sstevel@tonic-gate
4981d8c4025Svi if (cl_sctp_unlisten != NULL && !do_asconf &&
4991d8c4025Svi sctp->sctp_state > SCTPS_BOUND) {
5001d8c4025Svi usize = sizeof (in6_addr_t) * addrcnt;
5011d8c4025Svi ulist = kmem_alloc(usize, KM_SLEEP);
5021d8c4025Svi }
5031d8c4025Svi
5041d8c4025Svi error = sctp_del_ip(sctp, addrs, addrcnt, ulist, usize);
5051d8c4025Svi if (error != 0) {
5061d8c4025Svi if (ulist != NULL)
5071d8c4025Svi kmem_free(ulist, usize);
5081d8c4025Svi if (!caller_hold_lock)
5091d8c4025Svi WAKE_SCTP(sctp);
5101d8c4025Svi return (error);
5111d8c4025Svi }
5121d8c4025Svi /* ulist will be non-NULL only if cl_sctp_unlisten is non-NULL */
5131d8c4025Svi if (ulist != NULL) {
5141d8c4025Svi ASSERT(cl_sctp_unlisten != NULL);
515bd670b35SErik Nordmark (*cl_sctp_unlisten)(connp->conn_family, ulist, addrcnt,
516bd670b35SErik Nordmark connp->conn_lport);
5171d8c4025Svi /* ulist will be freed by the clustering module */
5181d8c4025Svi }
5197c478bd9Sstevel@tonic-gate if (!caller_hold_lock)
5207c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp);
5217c478bd9Sstevel@tonic-gate return (error);
5227c478bd9Sstevel@tonic-gate }
5237c478bd9Sstevel@tonic-gate
5247c478bd9Sstevel@tonic-gate /*
52545916cd2Sjpk * Returns 0 for success, errno value otherwise.
5267c478bd9Sstevel@tonic-gate *
52745916cd2Sjpk * If the "bind_to_req_port_only" parameter is set and the requested port
52845916cd2Sjpk * number is available, then set allocated_port to it. If not available,
52945916cd2Sjpk * return an error.
5307c478bd9Sstevel@tonic-gate *
53145916cd2Sjpk * If the "bind_to_req_port_only" parameter is not set and the requested port
53245916cd2Sjpk * number is available, then set allocated_port to it. If not available,
53345916cd2Sjpk * find the first anonymous port we can and set allocated_port to that. If no
53445916cd2Sjpk * anonymous ports are available, return an error.
53545916cd2Sjpk *
53645916cd2Sjpk * In either case, when succeeding, update the sctp_t to record the port number
5377c478bd9Sstevel@tonic-gate * and insert it in the bind hash table.
5387c478bd9Sstevel@tonic-gate */
53945916cd2Sjpk int
sctp_bindi(sctp_t * sctp,in_port_t port,boolean_t bind_to_req_port_only,int user_specified,in_port_t * allocated_port)54045916cd2Sjpk sctp_bindi(sctp_t *sctp, in_port_t port, boolean_t bind_to_req_port_only,
54145916cd2Sjpk int user_specified, in_port_t *allocated_port)
5427c478bd9Sstevel@tonic-gate {
5437c478bd9Sstevel@tonic-gate /* number of times we have run around the loop */
5447c478bd9Sstevel@tonic-gate int count = 0;
5457c478bd9Sstevel@tonic-gate /* maximum number of times to run around the loop */
5467c478bd9Sstevel@tonic-gate int loopmax;
547f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps;
548bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp;
549bd670b35SErik Nordmark zone_t *zone = crgetzone(connp->conn_cred);
550bd670b35SErik Nordmark zoneid_t zoneid = connp->conn_zoneid;
5517c478bd9Sstevel@tonic-gate
5527c478bd9Sstevel@tonic-gate /*
5537c478bd9Sstevel@tonic-gate * Lookup for free addresses is done in a loop and "loopmax"
5547c478bd9Sstevel@tonic-gate * influences how long we spin in the loop
5557c478bd9Sstevel@tonic-gate */
5567c478bd9Sstevel@tonic-gate if (bind_to_req_port_only) {
5577c478bd9Sstevel@tonic-gate /*
5587c478bd9Sstevel@tonic-gate * If the requested port is busy, don't bother to look
5597c478bd9Sstevel@tonic-gate * for a new one. Setting loop maximum count to 1 has
5607c478bd9Sstevel@tonic-gate * that effect.
5617c478bd9Sstevel@tonic-gate */
5627c478bd9Sstevel@tonic-gate loopmax = 1;
5637c478bd9Sstevel@tonic-gate } else {
5647c478bd9Sstevel@tonic-gate /*
5657c478bd9Sstevel@tonic-gate * If the requested port is busy, look for a free one
5667c478bd9Sstevel@tonic-gate * in the anonymous port range.
5677c478bd9Sstevel@tonic-gate * Set loopmax appropriately so that one does not look
5687c478bd9Sstevel@tonic-gate * forever in the case all of the anonymous ports are in use.
5697c478bd9Sstevel@tonic-gate */
570f4b3ec61Sdh loopmax = (sctps->sctps_largest_anon_port -
571f4b3ec61Sdh sctps->sctps_smallest_anon_port + 1);
5727c478bd9Sstevel@tonic-gate }
5737c478bd9Sstevel@tonic-gate do {
5747c478bd9Sstevel@tonic-gate uint16_t lport;
5757c478bd9Sstevel@tonic-gate sctp_tf_t *tbf;
5767c478bd9Sstevel@tonic-gate sctp_t *lsctp;
5777c478bd9Sstevel@tonic-gate int addrcmp;
5787c478bd9Sstevel@tonic-gate
5797c478bd9Sstevel@tonic-gate lport = htons(port);
5807c478bd9Sstevel@tonic-gate
5817c478bd9Sstevel@tonic-gate /*
5827c478bd9Sstevel@tonic-gate * Ensure that the sctp_t is not currently in the bind hash.
5837c478bd9Sstevel@tonic-gate * Hold the lock on the hash bucket to ensure that
5847c478bd9Sstevel@tonic-gate * the duplicate check plus the insertion is an atomic
5857c478bd9Sstevel@tonic-gate * operation.
5867c478bd9Sstevel@tonic-gate *
5877c478bd9Sstevel@tonic-gate * This function does an inline lookup on the bind hash list
5887c478bd9Sstevel@tonic-gate * Make sure that we access only members of sctp_t
5897c478bd9Sstevel@tonic-gate * and that we don't look at sctp_sctp, since we are not
5907c478bd9Sstevel@tonic-gate * doing a SCTPB_REFHOLD. For more details please see the notes
5917c478bd9Sstevel@tonic-gate * in sctp_compress()
5927c478bd9Sstevel@tonic-gate */
5937c478bd9Sstevel@tonic-gate sctp_bind_hash_remove(sctp);
594f4b3ec61Sdh tbf = &sctps->sctps_bind_fanout[SCTP_BIND_HASH(port)];
5957c478bd9Sstevel@tonic-gate mutex_enter(&tbf->tf_lock);
5967c478bd9Sstevel@tonic-gate for (lsctp = tbf->tf_sctp; lsctp != NULL;
5977c478bd9Sstevel@tonic-gate lsctp = lsctp->sctp_bind_hash) {
598bd670b35SErik Nordmark conn_t *lconnp = lsctp->sctp_connp;
5997c478bd9Sstevel@tonic-gate
600bd670b35SErik Nordmark if (lport != lconnp->conn_lport ||
6017c478bd9Sstevel@tonic-gate lsctp->sctp_state < SCTPS_BOUND)
6027c478bd9Sstevel@tonic-gate continue;
6037c478bd9Sstevel@tonic-gate
60445916cd2Sjpk /*
60545916cd2Sjpk * On a labeled system, we must treat bindings to ports
60645916cd2Sjpk * on shared IP addresses by sockets with MAC exemption
60745916cd2Sjpk * privilege as being in all zones, as there's
60845916cd2Sjpk * otherwise no way to identify the right receiver.
60945916cd2Sjpk */
610bd670b35SErik Nordmark if (lconnp->conn_zoneid != zoneid &&
611bd670b35SErik Nordmark lconnp->conn_mac_mode == CONN_MAC_DEFAULT &&
612bd670b35SErik Nordmark connp->conn_mac_mode == CONN_MAC_DEFAULT)
61345916cd2Sjpk continue;
61445916cd2Sjpk
6157c478bd9Sstevel@tonic-gate addrcmp = sctp_compare_saddrs(sctp, lsctp);
6167c478bd9Sstevel@tonic-gate if (addrcmp != SCTP_ADDR_DISJOINT) {
617bd670b35SErik Nordmark if (!connp->conn_reuseaddr) {
6187c478bd9Sstevel@tonic-gate /* in use */
6197c478bd9Sstevel@tonic-gate break;
6207c478bd9Sstevel@tonic-gate } else if (lsctp->sctp_state == SCTPS_BOUND ||
6217c478bd9Sstevel@tonic-gate lsctp->sctp_state == SCTPS_LISTEN) {
6227c478bd9Sstevel@tonic-gate /*
6237c478bd9Sstevel@tonic-gate * socket option SO_REUSEADDR is set
6247c478bd9Sstevel@tonic-gate * on the binding sctp_t.
6257c478bd9Sstevel@tonic-gate *
6267c478bd9Sstevel@tonic-gate * We have found a match of IP source
6277c478bd9Sstevel@tonic-gate * address and source port, which is
6287c478bd9Sstevel@tonic-gate * refused regardless of the
6297c478bd9Sstevel@tonic-gate * SO_REUSEADDR setting, so we break.
6307c478bd9Sstevel@tonic-gate */
6317c478bd9Sstevel@tonic-gate break;
6327c478bd9Sstevel@tonic-gate }
6337c478bd9Sstevel@tonic-gate }
6347c478bd9Sstevel@tonic-gate }
6357c478bd9Sstevel@tonic-gate if (lsctp != NULL) {
6367c478bd9Sstevel@tonic-gate /* The port number is busy */
6377c478bd9Sstevel@tonic-gate mutex_exit(&tbf->tf_lock);
6387c478bd9Sstevel@tonic-gate } else {
63945916cd2Sjpk if (is_system_labeled()) {
64045916cd2Sjpk mlp_type_t addrtype, mlptype;
641bd670b35SErik Nordmark uint_t ipversion;
64245916cd2Sjpk
64345916cd2Sjpk /*
64445916cd2Sjpk * On a labeled system we must check the type
64545916cd2Sjpk * of the binding requested by the user (either
64645916cd2Sjpk * MLP or SLP on shared and private addresses),
64745916cd2Sjpk * and that the user's requested binding
64845916cd2Sjpk * is permitted.
64945916cd2Sjpk */
650bd670b35SErik Nordmark if (connp->conn_family == AF_INET)
651bd670b35SErik Nordmark ipversion = IPV4_VERSION;
652bd670b35SErik Nordmark else
653bd670b35SErik Nordmark ipversion = IPV6_VERSION;
654bd670b35SErik Nordmark
6554d6131f6SDan McDonald addrtype = tsol_mlp_addr_type(
6564d6131f6SDan McDonald connp->conn_allzones ? ALL_ZONES :
6574d6131f6SDan McDonald zone->zone_id,
658bd670b35SErik Nordmark ipversion,
659bd670b35SErik Nordmark connp->conn_family == AF_INET ?
66045916cd2Sjpk (void *)&sctp->sctp_ipha->ipha_src :
661f4b3ec61Sdh (void *)&sctp->sctp_ip6h->ip6_src,
662f4b3ec61Sdh sctps->sctps_netstack->netstack_ip);
66345916cd2Sjpk
66445916cd2Sjpk /*
66545916cd2Sjpk * tsol_mlp_addr_type returns the possibilities
66645916cd2Sjpk * for the selected address. Since all local
66745916cd2Sjpk * addresses are either private or shared, the
66845916cd2Sjpk * return value mlptSingle means "local address
66945916cd2Sjpk * not valid (interface not present)."
67045916cd2Sjpk */
67145916cd2Sjpk if (addrtype == mlptSingle) {
67245916cd2Sjpk mutex_exit(&tbf->tf_lock);
67345916cd2Sjpk return (EADDRNOTAVAIL);
67445916cd2Sjpk }
67545916cd2Sjpk mlptype = tsol_mlp_port_type(zone, IPPROTO_SCTP,
67645916cd2Sjpk port, addrtype);
67745916cd2Sjpk if (mlptype != mlptSingle) {
67845916cd2Sjpk if (secpolicy_net_bindmlp(connp->
67945916cd2Sjpk conn_cred) != 0) {
68045916cd2Sjpk mutex_exit(&tbf->tf_lock);
68145916cd2Sjpk return (EACCES);
68245916cd2Sjpk }
68345916cd2Sjpk /*
68445916cd2Sjpk * If we're binding a shared MLP, then
68545916cd2Sjpk * make sure that this zone is the one
68645916cd2Sjpk * that owns that MLP. Shared MLPs can
68745916cd2Sjpk * be owned by at most one zone.
688f4b3ec61Sdh *
689f4b3ec61Sdh * No need to handle exclusive-stack
690f4b3ec61Sdh * zones since ALL_ZONES only applies
691f4b3ec61Sdh * to the shared stack.
69245916cd2Sjpk */
69345916cd2Sjpk
69445916cd2Sjpk if (mlptype == mlptShared &&
69545916cd2Sjpk addrtype == mlptShared &&
69645916cd2Sjpk connp->conn_zoneid !=
69745916cd2Sjpk tsol_mlp_findzone(IPPROTO_SCTP,
69845916cd2Sjpk lport)) {
69945916cd2Sjpk mutex_exit(&tbf->tf_lock);
70045916cd2Sjpk return (EACCES);
70145916cd2Sjpk }
70245916cd2Sjpk connp->conn_mlp_type = mlptype;
70345916cd2Sjpk }
70445916cd2Sjpk }
7057c478bd9Sstevel@tonic-gate /*
7067c478bd9Sstevel@tonic-gate * This port is ours. Insert in fanout and mark as
7077c478bd9Sstevel@tonic-gate * bound to prevent others from getting the port
7087c478bd9Sstevel@tonic-gate * number.
7097c478bd9Sstevel@tonic-gate */
7107c478bd9Sstevel@tonic-gate sctp->sctp_state = SCTPS_BOUND;
711bd670b35SErik Nordmark connp->conn_lport = lport;
7127c478bd9Sstevel@tonic-gate
713f4b3ec61Sdh ASSERT(&sctps->sctps_bind_fanout[
714b34b8d1aSkcpoon SCTP_BIND_HASH(port)] == tbf);
7157c478bd9Sstevel@tonic-gate sctp_bind_hash_insert(tbf, sctp, 1);
7167c478bd9Sstevel@tonic-gate
7177c478bd9Sstevel@tonic-gate mutex_exit(&tbf->tf_lock);
7187c478bd9Sstevel@tonic-gate
7197c478bd9Sstevel@tonic-gate /*
7207c478bd9Sstevel@tonic-gate * We don't want sctp_next_port_to_try to "inherit"
7217c478bd9Sstevel@tonic-gate * a port number supplied by the user in a bind.
72245916cd2Sjpk *
7237c478bd9Sstevel@tonic-gate * This is the only place where sctp_next_port_to_try
7247c478bd9Sstevel@tonic-gate * is updated. After the update, it may or may not
7257c478bd9Sstevel@tonic-gate * be in the valid range.
7267c478bd9Sstevel@tonic-gate */
72745916cd2Sjpk if (user_specified == 0)
728f4b3ec61Sdh sctps->sctps_next_port_to_try = port + 1;
72945916cd2Sjpk
73045916cd2Sjpk *allocated_port = port;
73145916cd2Sjpk
73245916cd2Sjpk return (0);
7337c478bd9Sstevel@tonic-gate }
7347c478bd9Sstevel@tonic-gate
7357c478bd9Sstevel@tonic-gate if ((count == 0) && (user_specified)) {
7367c478bd9Sstevel@tonic-gate /*
7377c478bd9Sstevel@tonic-gate * We may have to return an anonymous port. So
7387c478bd9Sstevel@tonic-gate * get one to start with.
7397c478bd9Sstevel@tonic-gate */
740f4b3ec61Sdh port = sctp_update_next_port(
741f4b3ec61Sdh sctps->sctps_next_port_to_try,
742f4b3ec61Sdh zone, sctps);
7437c478bd9Sstevel@tonic-gate user_specified = 0;
7447c478bd9Sstevel@tonic-gate } else {
745f4b3ec61Sdh port = sctp_update_next_port(port + 1, zone, sctps);
7467c478bd9Sstevel@tonic-gate }
74745916cd2Sjpk if (port == 0)
74845916cd2Sjpk break;
7497c478bd9Sstevel@tonic-gate
7507c478bd9Sstevel@tonic-gate /*
7517c478bd9Sstevel@tonic-gate * Don't let this loop run forever in the case where
7527c478bd9Sstevel@tonic-gate * all of the anonymous ports are in use.
7537c478bd9Sstevel@tonic-gate */
7547c478bd9Sstevel@tonic-gate } while (++count < loopmax);
75545916cd2Sjpk
75645916cd2Sjpk return (bind_to_req_port_only ? EADDRINUSE : EADDRNOTAVAIL);
7577c478bd9Sstevel@tonic-gate }
7587c478bd9Sstevel@tonic-gate
7597c478bd9Sstevel@tonic-gate /*
7607c478bd9Sstevel@tonic-gate * Don't let port fall into the privileged range.
7617c478bd9Sstevel@tonic-gate * Since the extra privileged ports can be arbitrary we also
7627c478bd9Sstevel@tonic-gate * ensure that we exclude those from consideration.
7637c478bd9Sstevel@tonic-gate * sctp_g_epriv_ports is not sorted thus we loop over it until
7647c478bd9Sstevel@tonic-gate * there are no changes.
7657c478bd9Sstevel@tonic-gate *
7667c478bd9Sstevel@tonic-gate * Note: No locks are held when inspecting sctp_g_*epriv_ports
7677c478bd9Sstevel@tonic-gate * but instead the code relies on:
7687c478bd9Sstevel@tonic-gate * - the fact that the address of the array and its size never changes
7697c478bd9Sstevel@tonic-gate * - the atomic assignment of the elements of the array
7707c478bd9Sstevel@tonic-gate */
7717c478bd9Sstevel@tonic-gate in_port_t
sctp_update_next_port(in_port_t port,zone_t * zone,sctp_stack_t * sctps)772f4b3ec61Sdh sctp_update_next_port(in_port_t port, zone_t *zone, sctp_stack_t *sctps)
7737c478bd9Sstevel@tonic-gate {
7747c478bd9Sstevel@tonic-gate int i;
77545916cd2Sjpk boolean_t restart = B_FALSE;
7767c478bd9Sstevel@tonic-gate
7777c478bd9Sstevel@tonic-gate retry:
778f4b3ec61Sdh if (port < sctps->sctps_smallest_anon_port)
779f4b3ec61Sdh port = sctps->sctps_smallest_anon_port;
78045916cd2Sjpk
781f4b3ec61Sdh if (port > sctps->sctps_largest_anon_port) {
78245916cd2Sjpk if (restart)
78345916cd2Sjpk return (0);
78445916cd2Sjpk restart = B_TRUE;
785f4b3ec61Sdh port = sctps->sctps_smallest_anon_port;
78645916cd2Sjpk }
7877c478bd9Sstevel@tonic-gate
788f4b3ec61Sdh if (port < sctps->sctps_smallest_nonpriv_port)
789f4b3ec61Sdh port = sctps->sctps_smallest_nonpriv_port;
7907c478bd9Sstevel@tonic-gate
791f4b3ec61Sdh for (i = 0; i < sctps->sctps_g_num_epriv_ports; i++) {
792f4b3ec61Sdh if (port == sctps->sctps_g_epriv_ports[i]) {
7937c478bd9Sstevel@tonic-gate port++;
7947c478bd9Sstevel@tonic-gate /*
7957c478bd9Sstevel@tonic-gate * Make sure whether the port is in the
7967c478bd9Sstevel@tonic-gate * valid range.
7977c478bd9Sstevel@tonic-gate *
7987c478bd9Sstevel@tonic-gate * XXX Note that if sctp_g_epriv_ports contains
7997c478bd9Sstevel@tonic-gate * all the anonymous ports this will be an
8007c478bd9Sstevel@tonic-gate * infinite loop.
8017c478bd9Sstevel@tonic-gate */
8027c478bd9Sstevel@tonic-gate goto retry;
8037c478bd9Sstevel@tonic-gate }
8047c478bd9Sstevel@tonic-gate }
80545916cd2Sjpk
80645916cd2Sjpk if (is_system_labeled() &&
80745916cd2Sjpk (i = tsol_next_port(zone, port, IPPROTO_SCTP, B_TRUE)) != 0) {
80845916cd2Sjpk port = i;
80945916cd2Sjpk goto retry;
81045916cd2Sjpk }
81145916cd2Sjpk
8127c478bd9Sstevel@tonic-gate return (port);
8137c478bd9Sstevel@tonic-gate }
814