17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
545916cd2Sjpk  * Common Development and Distribution License (the "License").
645916cd2Sjpk  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
2177c67f2fSkcpoon 
227c478bd9Sstevel@tonic-gate /*
23*5dd46ab5SKacheong Poon  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
267c478bd9Sstevel@tonic-gate #include <sys/types.h>
277c478bd9Sstevel@tonic-gate #include <sys/systm.h>
287c478bd9Sstevel@tonic-gate #include <sys/stream.h>
297c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h>
307c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
317c478bd9Sstevel@tonic-gate #define	_SUN_TPI_VERSION 2
327c478bd9Sstevel@tonic-gate #include <sys/tihdr.h>
337c478bd9Sstevel@tonic-gate #include <sys/stropts.h>
347c478bd9Sstevel@tonic-gate #include <sys/socket.h>
357c478bd9Sstevel@tonic-gate #include <sys/random.h>
367c478bd9Sstevel@tonic-gate #include <sys/policy.h>
3745916cd2Sjpk #include <sys/tsol/tndb.h>
3845916cd2Sjpk #include <sys/tsol/tnet.h>
397c478bd9Sstevel@tonic-gate 
407c478bd9Sstevel@tonic-gate #include <netinet/in.h>
417c478bd9Sstevel@tonic-gate #include <netinet/ip6.h>
427c478bd9Sstevel@tonic-gate 
437c478bd9Sstevel@tonic-gate #include <inet/common.h>
447c478bd9Sstevel@tonic-gate #include <inet/ip.h>
457c478bd9Sstevel@tonic-gate #include <inet/ip6.h>
467c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h>
477c478bd9Sstevel@tonic-gate #include "sctp_impl.h"
487c478bd9Sstevel@tonic-gate #include "sctp_asconf.h"
497c478bd9Sstevel@tonic-gate #include "sctp_addr.h"
507c478bd9Sstevel@tonic-gate 
51*5dd46ab5SKacheong Poon /*
52*5dd46ab5SKacheong Poon  * Minimum number of associations which can be created per listener.  Used
53*5dd46ab5SKacheong Poon  * when the listener association count is in effect.
54*5dd46ab5SKacheong Poon  */
55*5dd46ab5SKacheong Poon static uint32_t sctp_min_assoc_listener = 2;
56*5dd46ab5SKacheong Poon 
577c478bd9Sstevel@tonic-gate /*
587c478bd9Sstevel@tonic-gate  * Returns 0 on success, EACCES on permission failure.
597c478bd9Sstevel@tonic-gate  */
607c478bd9Sstevel@tonic-gate static int
sctp_select_port(sctp_t * sctp,in_port_t * requested_port,int * user_specified)617c478bd9Sstevel@tonic-gate sctp_select_port(sctp_t *sctp, in_port_t *requested_port, int *user_specified)
627c478bd9Sstevel@tonic-gate {
63f4b3ec61Sdh 	sctp_stack_t	*sctps = sctp->sctp_sctps;
64bd670b35SErik Nordmark 	conn_t		*connp = sctp->sctp_connp;
65f4b3ec61Sdh 
667c478bd9Sstevel@tonic-gate 	/*
677c478bd9Sstevel@tonic-gate 	 * Get a valid port (within the anonymous range and should not
687c478bd9Sstevel@tonic-gate 	 * be a privileged one) to use if the user has not given a port.
697c478bd9Sstevel@tonic-gate 	 * If multiple threads are here, they may all start with
707c478bd9Sstevel@tonic-gate 	 * with the same initial port. But, it should be fine as long as
717c478bd9Sstevel@tonic-gate 	 * sctp_bindi will ensure that no two threads will be assigned
727c478bd9Sstevel@tonic-gate 	 * the same port.
737c478bd9Sstevel@tonic-gate 	 */
747c478bd9Sstevel@tonic-gate 	if (*requested_port == 0) {
75f4b3ec61Sdh 		*requested_port = sctp_update_next_port(
76f4b3ec61Sdh 		    sctps->sctps_next_port_to_try,
77bd670b35SErik Nordmark 		    crgetzone(connp->conn_cred), sctps);
7845916cd2Sjpk 		if (*requested_port == 0)
7945916cd2Sjpk 			return (EACCES);
807c478bd9Sstevel@tonic-gate 		*user_specified = 0;
817c478bd9Sstevel@tonic-gate 	} else {
827c478bd9Sstevel@tonic-gate 		int i;
837c478bd9Sstevel@tonic-gate 		boolean_t priv = B_FALSE;
847c478bd9Sstevel@tonic-gate 
857c478bd9Sstevel@tonic-gate 		/*
867c478bd9Sstevel@tonic-gate 		 * If the requested_port is in the well-known privileged range,
877c478bd9Sstevel@tonic-gate 		 * verify that the stream was opened by a privileged user.
887c478bd9Sstevel@tonic-gate 		 * Note: No locks are held when inspecting sctp_g_*epriv_ports
897c478bd9Sstevel@tonic-gate 		 * but instead the code relies on:
907c478bd9Sstevel@tonic-gate 		 * - the fact that the address of the array and its size never
917c478bd9Sstevel@tonic-gate 		 *   changes
927c478bd9Sstevel@tonic-gate 		 * - the atomic assignment of the elements of the array
937c478bd9Sstevel@tonic-gate 		 */
94f4b3ec61Sdh 		if (*requested_port < sctps->sctps_smallest_nonpriv_port) {
957c478bd9Sstevel@tonic-gate 			priv = B_TRUE;
967c478bd9Sstevel@tonic-gate 		} else {
97f4b3ec61Sdh 			for (i = 0; i < sctps->sctps_g_num_epriv_ports; i++) {
98f4b3ec61Sdh 				if (*requested_port ==
99f4b3ec61Sdh 				    sctps->sctps_g_epriv_ports[i]) {
1007c478bd9Sstevel@tonic-gate 					priv = B_TRUE;
1017c478bd9Sstevel@tonic-gate 					break;
1027c478bd9Sstevel@tonic-gate 				}
1037c478bd9Sstevel@tonic-gate 			}
1047c478bd9Sstevel@tonic-gate 		}
1057c478bd9Sstevel@tonic-gate 		if (priv) {
1067c478bd9Sstevel@tonic-gate 			/*
1077c478bd9Sstevel@tonic-gate 			 * sctp_bind() should take a cred_t argument so that
1087c478bd9Sstevel@tonic-gate 			 * we can use it here.
1097c478bd9Sstevel@tonic-gate 			 */
110bd670b35SErik Nordmark 			if (secpolicy_net_privaddr(connp->conn_cred,
111ddf7fe95Scasper 			    *requested_port, IPPROTO_SCTP) != 0) {
1127c478bd9Sstevel@tonic-gate 				dprint(1,
1137c478bd9Sstevel@tonic-gate 				    ("sctp_bind(x): no prive for port %d",
1147c478bd9Sstevel@tonic-gate 				    *requested_port));
11545916cd2Sjpk 				return (EACCES);
1167c478bd9Sstevel@tonic-gate 			}
1177c478bd9Sstevel@tonic-gate 		}
1187c478bd9Sstevel@tonic-gate 		*user_specified = 1;
1197c478bd9Sstevel@tonic-gate 	}
1207c478bd9Sstevel@tonic-gate 
1217c478bd9Sstevel@tonic-gate 	return (0);
1227c478bd9Sstevel@tonic-gate }
1237c478bd9Sstevel@tonic-gate 
1247c478bd9Sstevel@tonic-gate int
sctp_listen(sctp_t * sctp)1257c478bd9Sstevel@tonic-gate sctp_listen(sctp_t *sctp)
1267c478bd9Sstevel@tonic-gate {
1277c478bd9Sstevel@tonic-gate 	sctp_tf_t	*tf;
128f4b3ec61Sdh 	sctp_stack_t	*sctps = sctp->sctp_sctps;
129bd670b35SErik Nordmark 	conn_t		*connp = sctp->sctp_connp;
1307c478bd9Sstevel@tonic-gate 
1317c478bd9Sstevel@tonic-gate 	RUN_SCTP(sctp);
1327c478bd9Sstevel@tonic-gate 	/*
1337c478bd9Sstevel@tonic-gate 	 * TCP handles listen() increasing the backlog, need to check
1341d8c4025Svi 	 * if it should be handled here too
1357c478bd9Sstevel@tonic-gate 	 */
136b34b8d1aSkcpoon 	if (sctp->sctp_state > SCTPS_BOUND ||
137b34b8d1aSkcpoon 	    (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) {
1387c478bd9Sstevel@tonic-gate 		WAKE_SCTP(sctp);
1397c478bd9Sstevel@tonic-gate 		return (EINVAL);
1407c478bd9Sstevel@tonic-gate 	}
1417c478bd9Sstevel@tonic-gate 
1427c478bd9Sstevel@tonic-gate 	/* Do an anonymous bind for unbound socket doing listen(). */
1437c478bd9Sstevel@tonic-gate 	if (sctp->sctp_nsaddrs == 0) {
1447c478bd9Sstevel@tonic-gate 		struct sockaddr_storage ss;
1457c478bd9Sstevel@tonic-gate 		int ret;
1467c478bd9Sstevel@tonic-gate 
1477c478bd9Sstevel@tonic-gate 		bzero(&ss, sizeof (ss));
148bd670b35SErik Nordmark 		ss.ss_family = connp->conn_family;
1497c478bd9Sstevel@tonic-gate 
1507c478bd9Sstevel@tonic-gate 		WAKE_SCTP(sctp);
1517c478bd9Sstevel@tonic-gate 		if ((ret = sctp_bind(sctp, (struct sockaddr *)&ss,
152b34b8d1aSkcpoon 		    sizeof (ss))) != 0)
1537c478bd9Sstevel@tonic-gate 			return (ret);
1547c478bd9Sstevel@tonic-gate 		RUN_SCTP(sctp)
1557c478bd9Sstevel@tonic-gate 	}
1567c478bd9Sstevel@tonic-gate 
157bd670b35SErik Nordmark 	/* Cache things in the ixa without any refhold */
158be4c8f74SErik Nordmark 	ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
159bd670b35SErik Nordmark 	connp->conn_ixa->ixa_cred = connp->conn_cred;
160bd670b35SErik Nordmark 	connp->conn_ixa->ixa_cpid = connp->conn_cpid;
161bd670b35SErik Nordmark 	if (is_system_labeled())
162bd670b35SErik Nordmark 		connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred);
163bd670b35SErik Nordmark 
1647c478bd9Sstevel@tonic-gate 	sctp->sctp_state = SCTPS_LISTEN;
1657c478bd9Sstevel@tonic-gate 	(void) random_get_pseudo_bytes(sctp->sctp_secret, SCTP_SECRET_LEN);
166d3d50737SRafael Vanoni 	sctp->sctp_last_secret_update = ddi_get_lbolt64();
1677c478bd9Sstevel@tonic-gate 	bzero(sctp->sctp_old_secret, SCTP_SECRET_LEN);
168*5dd46ab5SKacheong Poon 
169*5dd46ab5SKacheong Poon 	/*
170*5dd46ab5SKacheong Poon 	 * If there is an association limit, allocate and initialize
171*5dd46ab5SKacheong Poon 	 * the counter struct.  Note that since listen can be called
172*5dd46ab5SKacheong Poon 	 * multiple times, the struct may have been allready allocated.
173*5dd46ab5SKacheong Poon 	 */
174*5dd46ab5SKacheong Poon 	if (!list_is_empty(&sctps->sctps_listener_conf) &&
175*5dd46ab5SKacheong Poon 	    sctp->sctp_listen_cnt == NULL) {
176*5dd46ab5SKacheong Poon 		sctp_listen_cnt_t *slc;
177*5dd46ab5SKacheong Poon 		uint32_t ratio;
178*5dd46ab5SKacheong Poon 
179*5dd46ab5SKacheong Poon 		ratio = sctp_find_listener_conf(sctps,
180*5dd46ab5SKacheong Poon 		    ntohs(connp->conn_lport));
181*5dd46ab5SKacheong Poon 		if (ratio != 0) {
182*5dd46ab5SKacheong Poon 			uint32_t mem_ratio, tot_buf;
183*5dd46ab5SKacheong Poon 
184*5dd46ab5SKacheong Poon 			slc = kmem_alloc(sizeof (sctp_listen_cnt_t), KM_SLEEP);
185*5dd46ab5SKacheong Poon 			/*
186*5dd46ab5SKacheong Poon 			 * Calculate the connection limit based on
187*5dd46ab5SKacheong Poon 			 * the configured ratio and maxusers.  Maxusers
188*5dd46ab5SKacheong Poon 			 * are calculated based on memory size,
189*5dd46ab5SKacheong Poon 			 * ~ 1 user per MB.  Note that the conn_rcvbuf
190*5dd46ab5SKacheong Poon 			 * and conn_sndbuf may change after a
191*5dd46ab5SKacheong Poon 			 * connection is accepted.  So what we have
192*5dd46ab5SKacheong Poon 			 * is only an approximation.
193*5dd46ab5SKacheong Poon 			 */
194*5dd46ab5SKacheong Poon 			if ((tot_buf = connp->conn_rcvbuf +
195*5dd46ab5SKacheong Poon 			    connp->conn_sndbuf) < MB) {
196*5dd46ab5SKacheong Poon 				mem_ratio = MB / tot_buf;
197*5dd46ab5SKacheong Poon 				slc->slc_max = maxusers / ratio * mem_ratio;
198*5dd46ab5SKacheong Poon 			} else {
199*5dd46ab5SKacheong Poon 				mem_ratio = tot_buf / MB;
200*5dd46ab5SKacheong Poon 				slc->slc_max = maxusers / ratio / mem_ratio;
201*5dd46ab5SKacheong Poon 			}
202*5dd46ab5SKacheong Poon 			/* At least we should allow some associations! */
203*5dd46ab5SKacheong Poon 			if (slc->slc_max < sctp_min_assoc_listener)
204*5dd46ab5SKacheong Poon 				slc->slc_max = sctp_min_assoc_listener;
205*5dd46ab5SKacheong Poon 			slc->slc_cnt = 1;
206*5dd46ab5SKacheong Poon 			slc->slc_drop = 0;
207*5dd46ab5SKacheong Poon 			sctp->sctp_listen_cnt = slc;
208*5dd46ab5SKacheong Poon 		}
209*5dd46ab5SKacheong Poon 	}
210*5dd46ab5SKacheong Poon 
211*5dd46ab5SKacheong Poon 
212f4b3ec61Sdh 	tf = &sctps->sctps_listen_fanout[SCTP_LISTEN_HASH(
213bd670b35SErik Nordmark 	    ntohs(connp->conn_lport))];
2147c478bd9Sstevel@tonic-gate 	sctp_listen_hash_insert(tf, sctp);
215*5dd46ab5SKacheong Poon 
2167c478bd9Sstevel@tonic-gate 	WAKE_SCTP(sctp);
2177c478bd9Sstevel@tonic-gate 	return (0);
2187c478bd9Sstevel@tonic-gate }
2197c478bd9Sstevel@tonic-gate 
2207c478bd9Sstevel@tonic-gate /*
2217c478bd9Sstevel@tonic-gate  * Bind the sctp_t to a sockaddr, which includes an address and other
2227c478bd9Sstevel@tonic-gate  * information, such as port or flowinfo.
2237c478bd9Sstevel@tonic-gate  */
2247c478bd9Sstevel@tonic-gate int
sctp_bind(sctp_t * sctp,struct sockaddr * sa,socklen_t len)2257c478bd9Sstevel@tonic-gate sctp_bind(sctp_t *sctp, struct sockaddr *sa, socklen_t len)
2267c478bd9Sstevel@tonic-gate {
2277c478bd9Sstevel@tonic-gate 	int		user_specified;
2287c478bd9Sstevel@tonic-gate 	boolean_t	bind_to_req_port_only;
2297c478bd9Sstevel@tonic-gate 	in_port_t	requested_port;
2307c478bd9Sstevel@tonic-gate 	in_port_t	allocated_port;
2317c478bd9Sstevel@tonic-gate 	int		err = 0;
232bd670b35SErik Nordmark 	conn_t		*connp = sctp->sctp_connp;
233bd670b35SErik Nordmark 	uint_t		scope_id;
234bd670b35SErik Nordmark 	sin_t		*sin;
235bd670b35SErik Nordmark 	sin6_t		*sin6;
2367c478bd9Sstevel@tonic-gate 
2377c478bd9Sstevel@tonic-gate 	ASSERT(sctp != NULL);
2387c478bd9Sstevel@tonic-gate 
2397c478bd9Sstevel@tonic-gate 	RUN_SCTP(sctp);
2407c478bd9Sstevel@tonic-gate 
2410f1702c5SYu Xiangning 	if ((sctp->sctp_state >= SCTPS_BOUND) ||
2420f1702c5SYu Xiangning 	    (sctp->sctp_connp->conn_state_flags & CONN_CLOSING) ||
2430f1702c5SYu Xiangning 	    (sa == NULL || len == 0)) {
2440f1702c5SYu Xiangning 		/*
2450f1702c5SYu Xiangning 		 * Multiple binds not allowed for any SCTP socket
2460f1702c5SYu Xiangning 		 * Also binding with null address is not supported.
2470f1702c5SYu Xiangning 		 */
2487c478bd9Sstevel@tonic-gate 		err = EINVAL;
2497c478bd9Sstevel@tonic-gate 		goto done;
2507c478bd9Sstevel@tonic-gate 	}
2517c478bd9Sstevel@tonic-gate 
2527c478bd9Sstevel@tonic-gate 	switch (sa->sa_family) {
2537c478bd9Sstevel@tonic-gate 	case AF_INET:
254bd670b35SErik Nordmark 		sin = (sin_t *)sa;
2557c478bd9Sstevel@tonic-gate 		if (len < sizeof (struct sockaddr_in) ||
256bd670b35SErik Nordmark 		    connp->conn_family == AF_INET6) {
2577c478bd9Sstevel@tonic-gate 			err = EINVAL;
2587c478bd9Sstevel@tonic-gate 			goto done;
2597c478bd9Sstevel@tonic-gate 		}
260bd670b35SErik Nordmark 		requested_port = ntohs(sin->sin_port);
2617c478bd9Sstevel@tonic-gate 		break;
2627c478bd9Sstevel@tonic-gate 	case AF_INET6:
263bd670b35SErik Nordmark 		sin6 = (sin6_t *)sa;
2647c478bd9Sstevel@tonic-gate 		if (len < sizeof (struct sockaddr_in6) ||
265bd670b35SErik Nordmark 		    connp->conn_family == AF_INET) {
2667c478bd9Sstevel@tonic-gate 			err = EINVAL;
2677c478bd9Sstevel@tonic-gate 			goto done;
2687c478bd9Sstevel@tonic-gate 		}
269bd670b35SErik Nordmark 		requested_port = ntohs(sin6->sin6_port);
2707c478bd9Sstevel@tonic-gate 		/* Set the flowinfo. */
271bd670b35SErik Nordmark 		connp->conn_flowinfo =
272bd670b35SErik Nordmark 		    sin6->sin6_flowinfo & ~IPV6_VERS_AND_FLOW_MASK;
273bd670b35SErik Nordmark 
274bd670b35SErik Nordmark 		scope_id = sin6->sin6_scope_id;
275bd670b35SErik Nordmark 		if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(&sin6->sin6_addr)) {
276bd670b35SErik Nordmark 			connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
277bd670b35SErik Nordmark 			connp->conn_ixa->ixa_scopeid = scope_id;
278bd670b35SErik Nordmark 			connp->conn_incoming_ifindex = scope_id;
279bd670b35SErik Nordmark 		} else {
280bd670b35SErik Nordmark 			connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
281bd670b35SErik Nordmark 			connp->conn_incoming_ifindex = connp->conn_bound_if;
282bd670b35SErik Nordmark 		}
2837c478bd9Sstevel@tonic-gate 		break;
2847c478bd9Sstevel@tonic-gate 	default:
2857c478bd9Sstevel@tonic-gate 		err = EAFNOSUPPORT;
2867c478bd9Sstevel@tonic-gate 		goto done;
2877c478bd9Sstevel@tonic-gate 	}
2887c478bd9Sstevel@tonic-gate 	bind_to_req_port_only = requested_port == 0 ? B_FALSE : B_TRUE;
2897c478bd9Sstevel@tonic-gate 
29045916cd2Sjpk 	err = sctp_select_port(sctp, &requested_port, &user_specified);
29145916cd2Sjpk 	if (err != 0)
2927c478bd9Sstevel@tonic-gate 		goto done;
2937c478bd9Sstevel@tonic-gate 
2941d8c4025Svi 	if ((err = sctp_bind_add(sctp, sa, 1, B_TRUE,
2951d8c4025Svi 	    user_specified == 1 ? htons(requested_port) : 0)) != 0) {
2967c478bd9Sstevel@tonic-gate 		goto done;
2971d8c4025Svi 	}
29845916cd2Sjpk 	err = sctp_bindi(sctp, requested_port, bind_to_req_port_only,
29945916cd2Sjpk 	    user_specified, &allocated_port);
30045916cd2Sjpk 	if (err != 0) {
3017c478bd9Sstevel@tonic-gate 		sctp_free_saddrs(sctp);
30245916cd2Sjpk 	} else {
30345916cd2Sjpk 		ASSERT(sctp->sctp_state == SCTPS_BOUND);
3047c478bd9Sstevel@tonic-gate 	}
3057c478bd9Sstevel@tonic-gate done:
3067c478bd9Sstevel@tonic-gate 	WAKE_SCTP(sctp);
3077c478bd9Sstevel@tonic-gate 	return (err);
3087c478bd9Sstevel@tonic-gate }
3097c478bd9Sstevel@tonic-gate 
3107c478bd9Sstevel@tonic-gate /*
3117c478bd9Sstevel@tonic-gate  * Perform bind/unbind operation of a list of addresses on a sctp_t
3127c478bd9Sstevel@tonic-gate  */
3137c478bd9Sstevel@tonic-gate int
sctp_bindx(sctp_t * sctp,const void * addrs,int addrcnt,int bindop)3147c478bd9Sstevel@tonic-gate sctp_bindx(sctp_t *sctp, const void *addrs, int addrcnt, int bindop)
3157c478bd9Sstevel@tonic-gate {
3167c478bd9Sstevel@tonic-gate 	ASSERT(sctp != NULL);
3177c478bd9Sstevel@tonic-gate 	ASSERT(addrs != NULL);
3187c478bd9Sstevel@tonic-gate 	ASSERT(addrcnt > 0);
3197c478bd9Sstevel@tonic-gate 
3207c478bd9Sstevel@tonic-gate 	switch (bindop) {
3217c478bd9Sstevel@tonic-gate 	case SCTP_BINDX_ADD_ADDR:
3221d8c4025Svi 		return (sctp_bind_add(sctp, addrs, addrcnt, B_FALSE,
323bd670b35SErik Nordmark 		    sctp->sctp_connp->conn_lport));
3247c478bd9Sstevel@tonic-gate 	case SCTP_BINDX_REM_ADDR:
3257c478bd9Sstevel@tonic-gate 		return (sctp_bind_del(sctp, addrs, addrcnt, B_FALSE));
3267c478bd9Sstevel@tonic-gate 	default:
3277c478bd9Sstevel@tonic-gate 		return (EINVAL);
3287c478bd9Sstevel@tonic-gate 	}
3297c478bd9Sstevel@tonic-gate }
3307c478bd9Sstevel@tonic-gate 
3317c478bd9Sstevel@tonic-gate /*
3327c478bd9Sstevel@tonic-gate  * Add a list of addresses to a sctp_t.
3337c478bd9Sstevel@tonic-gate  */
3347c478bd9Sstevel@tonic-gate int
sctp_bind_add(sctp_t * sctp,const void * addrs,uint32_t addrcnt,boolean_t caller_hold_lock,in_port_t port)3357c478bd9Sstevel@tonic-gate sctp_bind_add(sctp_t *sctp, const void *addrs, uint32_t addrcnt,
3361d8c4025Svi     boolean_t caller_hold_lock, in_port_t port)
3377c478bd9Sstevel@tonic-gate {
3387c478bd9Sstevel@tonic-gate 	int		err = 0;
3397c478bd9Sstevel@tonic-gate 	boolean_t	do_asconf = B_FALSE;
340f4b3ec61Sdh 	sctp_stack_t	*sctps = sctp->sctp_sctps;
341bd670b35SErik Nordmark 	conn_t		*connp = sctp->sctp_connp;
3427c478bd9Sstevel@tonic-gate 
3437c478bd9Sstevel@tonic-gate 	if (!caller_hold_lock)
3447c478bd9Sstevel@tonic-gate 		RUN_SCTP(sctp);
3457c478bd9Sstevel@tonic-gate 
346b34b8d1aSkcpoon 	if (sctp->sctp_state > SCTPS_ESTABLISHED ||
347b34b8d1aSkcpoon 	    (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) {
3487c478bd9Sstevel@tonic-gate 		if (!caller_hold_lock)
3497c478bd9Sstevel@tonic-gate 			WAKE_SCTP(sctp);
3507c478bd9Sstevel@tonic-gate 		return (EINVAL);
3517c478bd9Sstevel@tonic-gate 	}
352df19b344Svi 
353df19b344Svi 	if (sctp->sctp_state > SCTPS_LISTEN) {
354df19b344Svi 		/*
355df19b344Svi 		 * Let's do some checking here rather than undoing the
356df19b344Svi 		 * add later (for these reasons).
357df19b344Svi 		 */
358f4b3ec61Sdh 		if (!sctps->sctps_addip_enabled ||
359f4b3ec61Sdh 		    !sctp->sctp_understands_asconf ||
360df19b344Svi 		    !sctp->sctp_understands_addip) {
361df19b344Svi 			if (!caller_hold_lock)
362df19b344Svi 				WAKE_SCTP(sctp);
363df19b344Svi 			return (EINVAL);
364df19b344Svi 		}
3657c478bd9Sstevel@tonic-gate 		do_asconf = B_TRUE;
366df19b344Svi 	}
3671d8c4025Svi 	/*
3681d8c4025Svi 	 * On a clustered node, for an inaddr_any bind, we will pass the list
3691d8c4025Svi 	 * of all the addresses in the global list, minus any address on the
3701d8c4025Svi 	 * loopback interface, and expect the clustering susbsystem to give us
3711d8c4025Svi 	 * the correct list for the 'port'. For explicit binds we give the
3721d8c4025Svi 	 * list of addresses  and the clustering module validates it for the
3731d8c4025Svi 	 * 'port'.
3741d8c4025Svi 	 *
3751d8c4025Svi 	 * On a non-clustered node, cl_sctp_check_addrs will be NULL and
3761d8c4025Svi 	 * we proceed as usual.
3771d8c4025Svi 	 */
3781d8c4025Svi 	if (cl_sctp_check_addrs != NULL) {
3791d8c4025Svi 		uchar_t		*addrlist = NULL;
3801d8c4025Svi 		size_t		size = 0;
3811d8c4025Svi 		int		unspec = 0;
3821d8c4025Svi 		boolean_t	do_listen;
3831d8c4025Svi 		uchar_t		*llist = NULL;
3841d8c4025Svi 		size_t		lsize = 0;
3851d8c4025Svi 
3861d8c4025Svi 		/*
3871d8c4025Svi 		 * If we are adding addresses after listening, but before
3881d8c4025Svi 		 * an association is established, we need to update the
3891d8c4025Svi 		 * clustering module with this info.
3901d8c4025Svi 		 */
3911d8c4025Svi 		do_listen = !do_asconf && sctp->sctp_state > SCTPS_BOUND &&
3921d8c4025Svi 		    cl_sctp_listen != NULL;
3931d8c4025Svi 
3941d8c4025Svi 		err = sctp_get_addrlist(sctp, addrs, &addrcnt, &addrlist,
3951d8c4025Svi 		    &unspec, &size);
3961d8c4025Svi 		if (err != 0) {
3971d8c4025Svi 			ASSERT(addrlist == NULL);
3981d8c4025Svi 			ASSERT(addrcnt == 0);
3991d8c4025Svi 			ASSERT(size == 0);
4001d8c4025Svi 			if (!caller_hold_lock)
4011d8c4025Svi 				WAKE_SCTP(sctp);
402f4b3ec61Sdh 			SCTP_KSTAT(sctps, sctp_cl_check_addrs);
4031d8c4025Svi 			return (err);
4041d8c4025Svi 		}
4051d8c4025Svi 		ASSERT(addrlist != NULL);
406bd670b35SErik Nordmark 		(*cl_sctp_check_addrs)(connp->conn_family, port, &addrlist,
4071d8c4025Svi 		    size, &addrcnt, unspec == 1);
4081d8c4025Svi 		if (addrcnt == 0) {
4091d8c4025Svi 			/* We free the list */
4101d8c4025Svi 			kmem_free(addrlist, size);
4111d8c4025Svi 			if (!caller_hold_lock)
4121d8c4025Svi 				WAKE_SCTP(sctp);
4131d8c4025Svi 			return (EINVAL);
4141d8c4025Svi 		}
4151d8c4025Svi 		if (do_listen) {
4161d8c4025Svi 			lsize = sizeof (in6_addr_t) * addrcnt;
4171d8c4025Svi 			llist = kmem_alloc(lsize, KM_SLEEP);
4181d8c4025Svi 		}
4191d8c4025Svi 		err = sctp_valid_addr_list(sctp, addrlist, addrcnt, llist,
4201d8c4025Svi 		    lsize);
4211d8c4025Svi 		if (err == 0 && do_listen) {
422bd670b35SErik Nordmark 			(*cl_sctp_listen)(connp->conn_family, llist,
423bd670b35SErik Nordmark 			    addrcnt, connp->conn_lport);
4241d8c4025Svi 			/* list will be freed by the clustering module */
4251d8c4025Svi 		} else if (err != 0 && llist != NULL) {
4261d8c4025Svi 			kmem_free(llist, lsize);
4271d8c4025Svi 		}
4281d8c4025Svi 		/* free the list we allocated */
4291d8c4025Svi 		kmem_free(addrlist, size);
4301d8c4025Svi 	} else {
4311d8c4025Svi 		err = sctp_valid_addr_list(sctp, addrs, addrcnt, NULL, 0);
4321d8c4025Svi 	}
4337c478bd9Sstevel@tonic-gate 	if (err != 0) {
4347c478bd9Sstevel@tonic-gate 		if (!caller_hold_lock)
4357c478bd9Sstevel@tonic-gate 			WAKE_SCTP(sctp);
4367c478bd9Sstevel@tonic-gate 		return (err);
4377c478bd9Sstevel@tonic-gate 	}
4387c478bd9Sstevel@tonic-gate 	/* Need to send  ASCONF messages */
4397c478bd9Sstevel@tonic-gate 	if (do_asconf) {
4407c478bd9Sstevel@tonic-gate 		err = sctp_add_ip(sctp, addrs, addrcnt);
4417c478bd9Sstevel@tonic-gate 		if (err != 0) {
4427c478bd9Sstevel@tonic-gate 			sctp_del_saddr_list(sctp, addrs, addrcnt, B_FALSE);
4437c478bd9Sstevel@tonic-gate 			if (!caller_hold_lock)
4447c478bd9Sstevel@tonic-gate 				WAKE_SCTP(sctp);
4457c478bd9Sstevel@tonic-gate 			return (err);
4467c478bd9Sstevel@tonic-gate 		}
4477c478bd9Sstevel@tonic-gate 	}
4487c478bd9Sstevel@tonic-gate 	if (!caller_hold_lock)
4497c478bd9Sstevel@tonic-gate 		WAKE_SCTP(sctp);
4507c478bd9Sstevel@tonic-gate 	return (0);
4517c478bd9Sstevel@tonic-gate }
4527c478bd9Sstevel@tonic-gate 
4537c478bd9Sstevel@tonic-gate /*
4547c478bd9Sstevel@tonic-gate  * Remove one or more addresses bound to the sctp_t.
4557c478bd9Sstevel@tonic-gate  */
4567c478bd9Sstevel@tonic-gate int
sctp_bind_del(sctp_t * sctp,const void * addrs,uint32_t addrcnt,boolean_t caller_hold_lock)4577c478bd9Sstevel@tonic-gate sctp_bind_del(sctp_t *sctp, const void *addrs, uint32_t addrcnt,
4587c478bd9Sstevel@tonic-gate     boolean_t caller_hold_lock)
4597c478bd9Sstevel@tonic-gate {
4607c478bd9Sstevel@tonic-gate 	int		error = 0;
4617c478bd9Sstevel@tonic-gate 	boolean_t	do_asconf = B_FALSE;
4621d8c4025Svi 	uchar_t		*ulist = NULL;
4631d8c4025Svi 	size_t		usize = 0;
464f4b3ec61Sdh 	sctp_stack_t	*sctps = sctp->sctp_sctps;
465bd670b35SErik Nordmark 	conn_t		*connp = sctp->sctp_connp;
4667c478bd9Sstevel@tonic-gate 
4677c478bd9Sstevel@tonic-gate 	if (!caller_hold_lock)
4687c478bd9Sstevel@tonic-gate 		RUN_SCTP(sctp);
4697c478bd9Sstevel@tonic-gate 
470b34b8d1aSkcpoon 	if (sctp->sctp_state > SCTPS_ESTABLISHED ||
471b34b8d1aSkcpoon 	    (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) {
4727c478bd9Sstevel@tonic-gate 		if (!caller_hold_lock)
4737c478bd9Sstevel@tonic-gate 			WAKE_SCTP(sctp);
4747c478bd9Sstevel@tonic-gate 		return (EINVAL);
4757c478bd9Sstevel@tonic-gate 	}
476df19b344Svi 	/*
477df19b344Svi 	 * Fail the remove if we are beyond listen, but can't send this
478df19b344Svi 	 * to the peer.
479df19b344Svi 	 */
480df19b344Svi 	if (sctp->sctp_state > SCTPS_LISTEN) {
481f4b3ec61Sdh 		if (!sctps->sctps_addip_enabled ||
482f4b3ec61Sdh 		    !sctp->sctp_understands_asconf ||
483df19b344Svi 		    !sctp->sctp_understands_addip) {
484df19b344Svi 			if (!caller_hold_lock)
485df19b344Svi 				WAKE_SCTP(sctp);
486df19b344Svi 			return (EINVAL);
487df19b344Svi 		}
4887c478bd9Sstevel@tonic-gate 		do_asconf = B_TRUE;
489df19b344Svi 	}
4907c478bd9Sstevel@tonic-gate 
4917c478bd9Sstevel@tonic-gate 	/* Can't delete the last address nor all of the addresses */
4927c478bd9Sstevel@tonic-gate 	if (sctp->sctp_nsaddrs == 1 || addrcnt >= sctp->sctp_nsaddrs) {
4937c478bd9Sstevel@tonic-gate 		if (!caller_hold_lock)
4947c478bd9Sstevel@tonic-gate 			WAKE_SCTP(sctp);
4957c478bd9Sstevel@tonic-gate 		return (EINVAL);
4967c478bd9Sstevel@tonic-gate 	}
4977c478bd9Sstevel@tonic-gate 
4981d8c4025Svi 	if (cl_sctp_unlisten != NULL && !do_asconf &&
4991d8c4025Svi 	    sctp->sctp_state > SCTPS_BOUND) {
5001d8c4025Svi 		usize = sizeof (in6_addr_t) * addrcnt;
5011d8c4025Svi 		ulist = kmem_alloc(usize, KM_SLEEP);
5021d8c4025Svi 	}
5031d8c4025Svi 
5041d8c4025Svi 	error = sctp_del_ip(sctp, addrs, addrcnt, ulist, usize);
5051d8c4025Svi 	if (error != 0) {
5061d8c4025Svi 		if (ulist != NULL)
5071d8c4025Svi 			kmem_free(ulist, usize);
5081d8c4025Svi 		if (!caller_hold_lock)
5091d8c4025Svi 			WAKE_SCTP(sctp);
5101d8c4025Svi 		return (error);
5111d8c4025Svi 	}
5121d8c4025Svi 	/* ulist will be non-NULL only if cl_sctp_unlisten is non-NULL */
5131d8c4025Svi 	if (ulist != NULL) {
5141d8c4025Svi 		ASSERT(cl_sctp_unlisten != NULL);
515bd670b35SErik Nordmark 		(*cl_sctp_unlisten)(connp->conn_family, ulist, addrcnt,
516bd670b35SErik Nordmark 		    connp->conn_lport);
5171d8c4025Svi 		/* ulist will be freed by the clustering module */
5181d8c4025Svi 	}
5197c478bd9Sstevel@tonic-gate 	if (!caller_hold_lock)
5207c478bd9Sstevel@tonic-gate 		WAKE_SCTP(sctp);
5217c478bd9Sstevel@tonic-gate 	return (error);
5227c478bd9Sstevel@tonic-gate }
5237c478bd9Sstevel@tonic-gate 
5247c478bd9Sstevel@tonic-gate /*
52545916cd2Sjpk  * Returns 0 for success, errno value otherwise.
5267c478bd9Sstevel@tonic-gate  *
52745916cd2Sjpk  * If the "bind_to_req_port_only" parameter is set and the requested port
52845916cd2Sjpk  * number is available, then set allocated_port to it.  If not available,
52945916cd2Sjpk  * return an error.
5307c478bd9Sstevel@tonic-gate  *
53145916cd2Sjpk  * If the "bind_to_req_port_only" parameter is not set and the requested port
53245916cd2Sjpk  * number is available, then set allocated_port to it.  If not available,
53345916cd2Sjpk  * find the first anonymous port we can and set allocated_port to that.  If no
53445916cd2Sjpk  * anonymous ports are available, return an error.
53545916cd2Sjpk  *
53645916cd2Sjpk  * In either case, when succeeding, update the sctp_t to record the port number
5377c478bd9Sstevel@tonic-gate  * and insert it in the bind hash table.
5387c478bd9Sstevel@tonic-gate  */
53945916cd2Sjpk int
sctp_bindi(sctp_t * sctp,in_port_t port,boolean_t bind_to_req_port_only,int user_specified,in_port_t * allocated_port)54045916cd2Sjpk sctp_bindi(sctp_t *sctp, in_port_t port, boolean_t bind_to_req_port_only,
54145916cd2Sjpk     int user_specified, in_port_t *allocated_port)
5427c478bd9Sstevel@tonic-gate {
5437c478bd9Sstevel@tonic-gate 	/* number of times we have run around the loop */
5447c478bd9Sstevel@tonic-gate 	int count = 0;
5457c478bd9Sstevel@tonic-gate 	/* maximum number of times to run around the loop */
5467c478bd9Sstevel@tonic-gate 	int loopmax;
547f4b3ec61Sdh 	sctp_stack_t	*sctps = sctp->sctp_sctps;
548bd670b35SErik Nordmark 	conn_t		*connp = sctp->sctp_connp;
549bd670b35SErik Nordmark 	zone_t *zone = crgetzone(connp->conn_cred);
550bd670b35SErik Nordmark 	zoneid_t zoneid = connp->conn_zoneid;
5517c478bd9Sstevel@tonic-gate 
5527c478bd9Sstevel@tonic-gate 	/*
5537c478bd9Sstevel@tonic-gate 	 * Lookup for free addresses is done in a loop and "loopmax"
5547c478bd9Sstevel@tonic-gate 	 * influences how long we spin in the loop
5557c478bd9Sstevel@tonic-gate 	 */
5567c478bd9Sstevel@tonic-gate 	if (bind_to_req_port_only) {
5577c478bd9Sstevel@tonic-gate 		/*
5587c478bd9Sstevel@tonic-gate 		 * If the requested port is busy, don't bother to look
5597c478bd9Sstevel@tonic-gate 		 * for a new one. Setting loop maximum count to 1 has
5607c478bd9Sstevel@tonic-gate 		 * that effect.
5617c478bd9Sstevel@tonic-gate 		 */
5627c478bd9Sstevel@tonic-gate 		loopmax = 1;
5637c478bd9Sstevel@tonic-gate 	} else {
5647c478bd9Sstevel@tonic-gate 		/*
5657c478bd9Sstevel@tonic-gate 		 * If the requested port is busy, look for a free one
5667c478bd9Sstevel@tonic-gate 		 * in the anonymous port range.
5677c478bd9Sstevel@tonic-gate 		 * Set loopmax appropriately so that one does not look
5687c478bd9Sstevel@tonic-gate 		 * forever in the case all of the anonymous ports are in use.
5697c478bd9Sstevel@tonic-gate 		 */
570f4b3ec61Sdh 		loopmax = (sctps->sctps_largest_anon_port -
571f4b3ec61Sdh 		    sctps->sctps_smallest_anon_port + 1);
5727c478bd9Sstevel@tonic-gate 	}
5737c478bd9Sstevel@tonic-gate 	do {
5747c478bd9Sstevel@tonic-gate 		uint16_t	lport;
5757c478bd9Sstevel@tonic-gate 		sctp_tf_t	*tbf;
5767c478bd9Sstevel@tonic-gate 		sctp_t		*lsctp;
5777c478bd9Sstevel@tonic-gate 		int		addrcmp;
5787c478bd9Sstevel@tonic-gate 
5797c478bd9Sstevel@tonic-gate 		lport = htons(port);
5807c478bd9Sstevel@tonic-gate 
5817c478bd9Sstevel@tonic-gate 		/*
5827c478bd9Sstevel@tonic-gate 		 * Ensure that the sctp_t is not currently in the bind hash.
5837c478bd9Sstevel@tonic-gate 		 * Hold the lock on the hash bucket to ensure that
5847c478bd9Sstevel@tonic-gate 		 * the duplicate check plus the insertion is an atomic
5857c478bd9Sstevel@tonic-gate 		 * operation.
5867c478bd9Sstevel@tonic-gate 		 *
5877c478bd9Sstevel@tonic-gate 		 * This function does an inline lookup on the bind hash list
5887c478bd9Sstevel@tonic-gate 		 * Make sure that we access only members of sctp_t
5897c478bd9Sstevel@tonic-gate 		 * and that we don't look at sctp_sctp, since we are not
5907c478bd9Sstevel@tonic-gate 		 * doing a SCTPB_REFHOLD. For more details please see the notes
5917c478bd9Sstevel@tonic-gate 		 * in sctp_compress()
5927c478bd9Sstevel@tonic-gate 		 */
5937c478bd9Sstevel@tonic-gate 		sctp_bind_hash_remove(sctp);
594f4b3ec61Sdh 		tbf = &sctps->sctps_bind_fanout[SCTP_BIND_HASH(port)];
5957c478bd9Sstevel@tonic-gate 		mutex_enter(&tbf->tf_lock);
5967c478bd9Sstevel@tonic-gate 		for (lsctp = tbf->tf_sctp; lsctp != NULL;
5977c478bd9Sstevel@tonic-gate 		    lsctp = lsctp->sctp_bind_hash) {
598bd670b35SErik Nordmark 			conn_t *lconnp = lsctp->sctp_connp;
5997c478bd9Sstevel@tonic-gate 
600bd670b35SErik Nordmark 			if (lport != lconnp->conn_lport ||
6017c478bd9Sstevel@tonic-gate 			    lsctp->sctp_state < SCTPS_BOUND)
6027c478bd9Sstevel@tonic-gate 				continue;
6037c478bd9Sstevel@tonic-gate 
60445916cd2Sjpk 			/*
60545916cd2Sjpk 			 * On a labeled system, we must treat bindings to ports
60645916cd2Sjpk 			 * on shared IP addresses by sockets with MAC exemption
60745916cd2Sjpk 			 * privilege as being in all zones, as there's
60845916cd2Sjpk 			 * otherwise no way to identify the right receiver.
60945916cd2Sjpk 			 */
610bd670b35SErik Nordmark 			if (lconnp->conn_zoneid != zoneid &&
611bd670b35SErik Nordmark 			    lconnp->conn_mac_mode == CONN_MAC_DEFAULT &&
612bd670b35SErik Nordmark 			    connp->conn_mac_mode == CONN_MAC_DEFAULT)
61345916cd2Sjpk 				continue;
61445916cd2Sjpk 
6157c478bd9Sstevel@tonic-gate 			addrcmp = sctp_compare_saddrs(sctp, lsctp);
6167c478bd9Sstevel@tonic-gate 			if (addrcmp != SCTP_ADDR_DISJOINT) {
617bd670b35SErik Nordmark 				if (!connp->conn_reuseaddr) {
6187c478bd9Sstevel@tonic-gate 					/* in use */
6197c478bd9Sstevel@tonic-gate 					break;
6207c478bd9Sstevel@tonic-gate 				} else if (lsctp->sctp_state == SCTPS_BOUND ||
6217c478bd9Sstevel@tonic-gate 				    lsctp->sctp_state == SCTPS_LISTEN) {
6227c478bd9Sstevel@tonic-gate 					/*
6237c478bd9Sstevel@tonic-gate 					 * socket option SO_REUSEADDR is set
6247c478bd9Sstevel@tonic-gate 					 * on the binding sctp_t.
6257c478bd9Sstevel@tonic-gate 					 *
6267c478bd9Sstevel@tonic-gate 					 * We have found a match of IP source
6277c478bd9Sstevel@tonic-gate 					 * address and source port, which is
6287c478bd9Sstevel@tonic-gate 					 * refused regardless of the
6297c478bd9Sstevel@tonic-gate 					 * SO_REUSEADDR setting, so we break.
6307c478bd9Sstevel@tonic-gate 					 */
6317c478bd9Sstevel@tonic-gate 					break;
6327c478bd9Sstevel@tonic-gate 				}
6337c478bd9Sstevel@tonic-gate 			}
6347c478bd9Sstevel@tonic-gate 		}
6357c478bd9Sstevel@tonic-gate 		if (lsctp != NULL) {
6367c478bd9Sstevel@tonic-gate 			/* The port number is busy */
6377c478bd9Sstevel@tonic-gate 			mutex_exit(&tbf->tf_lock);
6387c478bd9Sstevel@tonic-gate 		} else {
63945916cd2Sjpk 			if (is_system_labeled()) {
64045916cd2Sjpk 				mlp_type_t addrtype, mlptype;
641bd670b35SErik Nordmark 				uint_t ipversion;
64245916cd2Sjpk 
64345916cd2Sjpk 				/*
64445916cd2Sjpk 				 * On a labeled system we must check the type
64545916cd2Sjpk 				 * of the binding requested by the user (either
64645916cd2Sjpk 				 * MLP or SLP on shared and private addresses),
64745916cd2Sjpk 				 * and that the user's requested binding
64845916cd2Sjpk 				 * is permitted.
64945916cd2Sjpk 				 */
650bd670b35SErik Nordmark 				if (connp->conn_family == AF_INET)
651bd670b35SErik Nordmark 					ipversion = IPV4_VERSION;
652bd670b35SErik Nordmark 				else
653bd670b35SErik Nordmark 					ipversion = IPV6_VERSION;
654bd670b35SErik Nordmark 
6554d6131f6SDan McDonald 				addrtype = tsol_mlp_addr_type(
6564d6131f6SDan McDonald 				    connp->conn_allzones ? ALL_ZONES :
6574d6131f6SDan McDonald 				    zone->zone_id,
658bd670b35SErik Nordmark 				    ipversion,
659bd670b35SErik Nordmark 				    connp->conn_family == AF_INET ?
66045916cd2Sjpk 				    (void *)&sctp->sctp_ipha->ipha_src :
661f4b3ec61Sdh 				    (void *)&sctp->sctp_ip6h->ip6_src,
662f4b3ec61Sdh 				    sctps->sctps_netstack->netstack_ip);
66345916cd2Sjpk 
66445916cd2Sjpk 				/*
66545916cd2Sjpk 				 * tsol_mlp_addr_type returns the possibilities
66645916cd2Sjpk 				 * for the selected address.  Since all local
66745916cd2Sjpk 				 * addresses are either private or shared, the
66845916cd2Sjpk 				 * return value mlptSingle means "local address
66945916cd2Sjpk 				 * not valid (interface not present)."
67045916cd2Sjpk 				 */
67145916cd2Sjpk 				if (addrtype == mlptSingle) {
67245916cd2Sjpk 					mutex_exit(&tbf->tf_lock);
67345916cd2Sjpk 					return (EADDRNOTAVAIL);
67445916cd2Sjpk 				}
67545916cd2Sjpk 				mlptype = tsol_mlp_port_type(zone, IPPROTO_SCTP,
67645916cd2Sjpk 				    port, addrtype);
67745916cd2Sjpk 				if (mlptype != mlptSingle) {
67845916cd2Sjpk 					if (secpolicy_net_bindmlp(connp->
67945916cd2Sjpk 					    conn_cred) != 0) {
68045916cd2Sjpk 						mutex_exit(&tbf->tf_lock);
68145916cd2Sjpk 						return (EACCES);
68245916cd2Sjpk 					}
68345916cd2Sjpk 					/*
68445916cd2Sjpk 					 * If we're binding a shared MLP, then
68545916cd2Sjpk 					 * make sure that this zone is the one
68645916cd2Sjpk 					 * that owns that MLP.  Shared MLPs can
68745916cd2Sjpk 					 * be owned by at most one zone.
688f4b3ec61Sdh 					 *
689f4b3ec61Sdh 					 * No need to handle exclusive-stack
690f4b3ec61Sdh 					 * zones since ALL_ZONES only applies
691f4b3ec61Sdh 					 * to the shared stack.
69245916cd2Sjpk 					 */
69345916cd2Sjpk 
69445916cd2Sjpk 					if (mlptype == mlptShared &&
69545916cd2Sjpk 					    addrtype == mlptShared &&
69645916cd2Sjpk 					    connp->conn_zoneid !=
69745916cd2Sjpk 					    tsol_mlp_findzone(IPPROTO_SCTP,
69845916cd2Sjpk 					    lport)) {
69945916cd2Sjpk 						mutex_exit(&tbf->tf_lock);
70045916cd2Sjpk 						return (EACCES);
70145916cd2Sjpk 					}
70245916cd2Sjpk 					connp->conn_mlp_type = mlptype;
70345916cd2Sjpk 				}
70445916cd2Sjpk 			}
7057c478bd9Sstevel@tonic-gate 			/*
7067c478bd9Sstevel@tonic-gate 			 * This port is ours. Insert in fanout and mark as
7077c478bd9Sstevel@tonic-gate 			 * bound to prevent others from getting the port
7087c478bd9Sstevel@tonic-gate 			 * number.
7097c478bd9Sstevel@tonic-gate 			 */
7107c478bd9Sstevel@tonic-gate 			sctp->sctp_state = SCTPS_BOUND;
711bd670b35SErik Nordmark 			connp->conn_lport = lport;
7127c478bd9Sstevel@tonic-gate 
713f4b3ec61Sdh 			ASSERT(&sctps->sctps_bind_fanout[
714b34b8d1aSkcpoon 			    SCTP_BIND_HASH(port)] == tbf);
7157c478bd9Sstevel@tonic-gate 			sctp_bind_hash_insert(tbf, sctp, 1);
7167c478bd9Sstevel@tonic-gate 
7177c478bd9Sstevel@tonic-gate 			mutex_exit(&tbf->tf_lock);
7187c478bd9Sstevel@tonic-gate 
7197c478bd9Sstevel@tonic-gate 			/*
7207c478bd9Sstevel@tonic-gate 			 * We don't want sctp_next_port_to_try to "inherit"
7217c478bd9Sstevel@tonic-gate 			 * a port number supplied by the user in a bind.
72245916cd2Sjpk 			 *
7237c478bd9Sstevel@tonic-gate 			 * This is the only place where sctp_next_port_to_try
7247c478bd9Sstevel@tonic-gate 			 * is updated. After the update, it may or may not
7257c478bd9Sstevel@tonic-gate 			 * be in the valid range.
7267c478bd9Sstevel@tonic-gate 			 */
72745916cd2Sjpk 			if (user_specified == 0)
728f4b3ec61Sdh 				sctps->sctps_next_port_to_try = port + 1;
72945916cd2Sjpk 
73045916cd2Sjpk 			*allocated_port = port;
73145916cd2Sjpk 
73245916cd2Sjpk 			return (0);
7337c478bd9Sstevel@tonic-gate 		}
7347c478bd9Sstevel@tonic-gate 
7357c478bd9Sstevel@tonic-gate 		if ((count == 0) && (user_specified)) {
7367c478bd9Sstevel@tonic-gate 			/*
7377c478bd9Sstevel@tonic-gate 			 * We may have to return an anonymous port. So
7387c478bd9Sstevel@tonic-gate 			 * get one to start with.
7397c478bd9Sstevel@tonic-gate 			 */
740f4b3ec61Sdh 			port = sctp_update_next_port(
741f4b3ec61Sdh 			    sctps->sctps_next_port_to_try,
742f4b3ec61Sdh 			    zone, sctps);
7437c478bd9Sstevel@tonic-gate 			user_specified = 0;
7447c478bd9Sstevel@tonic-gate 		} else {
745f4b3ec61Sdh 			port = sctp_update_next_port(port + 1, zone, sctps);
7467c478bd9Sstevel@tonic-gate 		}
74745916cd2Sjpk 		if (port == 0)
74845916cd2Sjpk 			break;
7497c478bd9Sstevel@tonic-gate 
7507c478bd9Sstevel@tonic-gate 		/*
7517c478bd9Sstevel@tonic-gate 		 * Don't let this loop run forever in the case where
7527c478bd9Sstevel@tonic-gate 		 * all of the anonymous ports are in use.
7537c478bd9Sstevel@tonic-gate 		 */
7547c478bd9Sstevel@tonic-gate 	} while (++count < loopmax);
75545916cd2Sjpk 
75645916cd2Sjpk 	return (bind_to_req_port_only ? EADDRINUSE : EADDRNOTAVAIL);
7577c478bd9Sstevel@tonic-gate }
7587c478bd9Sstevel@tonic-gate 
7597c478bd9Sstevel@tonic-gate /*
7607c478bd9Sstevel@tonic-gate  * Don't let port fall into the privileged range.
7617c478bd9Sstevel@tonic-gate  * Since the extra privileged ports can be arbitrary we also
7627c478bd9Sstevel@tonic-gate  * ensure that we exclude those from consideration.
7637c478bd9Sstevel@tonic-gate  * sctp_g_epriv_ports is not sorted thus we loop over it until
7647c478bd9Sstevel@tonic-gate  * there are no changes.
7657c478bd9Sstevel@tonic-gate  *
7667c478bd9Sstevel@tonic-gate  * Note: No locks are held when inspecting sctp_g_*epriv_ports
7677c478bd9Sstevel@tonic-gate  * but instead the code relies on:
7687c478bd9Sstevel@tonic-gate  * - the fact that the address of the array and its size never changes
7697c478bd9Sstevel@tonic-gate  * - the atomic assignment of the elements of the array
7707c478bd9Sstevel@tonic-gate  */
7717c478bd9Sstevel@tonic-gate in_port_t
sctp_update_next_port(in_port_t port,zone_t * zone,sctp_stack_t * sctps)772f4b3ec61Sdh sctp_update_next_port(in_port_t port, zone_t *zone, sctp_stack_t *sctps)
7737c478bd9Sstevel@tonic-gate {
7747c478bd9Sstevel@tonic-gate 	int i;
77545916cd2Sjpk 	boolean_t restart = B_FALSE;
7767c478bd9Sstevel@tonic-gate 
7777c478bd9Sstevel@tonic-gate retry:
778f4b3ec61Sdh 	if (port < sctps->sctps_smallest_anon_port)
779f4b3ec61Sdh 		port = sctps->sctps_smallest_anon_port;
78045916cd2Sjpk 
781f4b3ec61Sdh 	if (port > sctps->sctps_largest_anon_port) {
78245916cd2Sjpk 		if (restart)
78345916cd2Sjpk 			return (0);
78445916cd2Sjpk 		restart = B_TRUE;
785f4b3ec61Sdh 		port = sctps->sctps_smallest_anon_port;
78645916cd2Sjpk 	}
7877c478bd9Sstevel@tonic-gate 
788f4b3ec61Sdh 	if (port < sctps->sctps_smallest_nonpriv_port)
789f4b3ec61Sdh 		port = sctps->sctps_smallest_nonpriv_port;
7907c478bd9Sstevel@tonic-gate 
791f4b3ec61Sdh 	for (i = 0; i < sctps->sctps_g_num_epriv_ports; i++) {
792f4b3ec61Sdh 		if (port == sctps->sctps_g_epriv_ports[i]) {
7937c478bd9Sstevel@tonic-gate 			port++;
7947c478bd9Sstevel@tonic-gate 			/*
7957c478bd9Sstevel@tonic-gate 			 * Make sure whether the port is in the
7967c478bd9Sstevel@tonic-gate 			 * valid range.
7977c478bd9Sstevel@tonic-gate 			 *
7987c478bd9Sstevel@tonic-gate 			 * XXX Note that if sctp_g_epriv_ports contains
7997c478bd9Sstevel@tonic-gate 			 * all the anonymous ports this will be an
8007c478bd9Sstevel@tonic-gate 			 * infinite loop.
8017c478bd9Sstevel@tonic-gate 			 */
8027c478bd9Sstevel@tonic-gate 			goto retry;
8037c478bd9Sstevel@tonic-gate 		}
8047c478bd9Sstevel@tonic-gate 	}
80545916cd2Sjpk 
80645916cd2Sjpk 	if (is_system_labeled() &&
80745916cd2Sjpk 	    (i = tsol_next_port(zone, port, IPPROTO_SCTP, B_TRUE)) != 0) {
80845916cd2Sjpk 		port = i;
80945916cd2Sjpk 		goto retry;
81045916cd2Sjpk 	}
81145916cd2Sjpk 
8127c478bd9Sstevel@tonic-gate 	return (port);
8137c478bd9Sstevel@tonic-gate }
814