17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 545916cd2Sjpk * Common Development and Distribution License (the "License"). 645916cd2Sjpk * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 2177c67f2fSkcpoon 227c478bd9Sstevel@tonic-gate /* 23*5dd46ab5SKacheong Poon * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate #include <sys/types.h> 277c478bd9Sstevel@tonic-gate #include <sys/systm.h> 287c478bd9Sstevel@tonic-gate #include <sys/stream.h> 297c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> 307c478bd9Sstevel@tonic-gate #include <sys/kmem.h> 317c478bd9Sstevel@tonic-gate #define _SUN_TPI_VERSION 2 327c478bd9Sstevel@tonic-gate #include <sys/tihdr.h> 337c478bd9Sstevel@tonic-gate #include <sys/stropts.h> 347c478bd9Sstevel@tonic-gate #include <sys/socket.h> 357c478bd9Sstevel@tonic-gate #include <sys/random.h> 367c478bd9Sstevel@tonic-gate #include <sys/policy.h> 3745916cd2Sjpk #include <sys/tsol/tndb.h> 3845916cd2Sjpk #include <sys/tsol/tnet.h> 397c478bd9Sstevel@tonic-gate 407c478bd9Sstevel@tonic-gate #include <netinet/in.h> 417c478bd9Sstevel@tonic-gate #include <netinet/ip6.h> 427c478bd9Sstevel@tonic-gate 437c478bd9Sstevel@tonic-gate #include <inet/common.h> 447c478bd9Sstevel@tonic-gate #include <inet/ip.h> 457c478bd9Sstevel@tonic-gate #include <inet/ip6.h> 467c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h> 477c478bd9Sstevel@tonic-gate #include "sctp_impl.h" 487c478bd9Sstevel@tonic-gate #include "sctp_asconf.h" 497c478bd9Sstevel@tonic-gate #include "sctp_addr.h" 507c478bd9Sstevel@tonic-gate 51*5dd46ab5SKacheong Poon /* 52*5dd46ab5SKacheong Poon * Minimum number of associations which can be created per listener. Used 53*5dd46ab5SKacheong Poon * when the listener association count is in effect. 54*5dd46ab5SKacheong Poon */ 55*5dd46ab5SKacheong Poon static uint32_t sctp_min_assoc_listener = 2; 56*5dd46ab5SKacheong Poon 577c478bd9Sstevel@tonic-gate /* 587c478bd9Sstevel@tonic-gate * Returns 0 on success, EACCES on permission failure. 597c478bd9Sstevel@tonic-gate */ 607c478bd9Sstevel@tonic-gate static int 617c478bd9Sstevel@tonic-gate sctp_select_port(sctp_t *sctp, in_port_t *requested_port, int *user_specified) 627c478bd9Sstevel@tonic-gate { 63f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps; 64bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp; 65f4b3ec61Sdh 667c478bd9Sstevel@tonic-gate /* 677c478bd9Sstevel@tonic-gate * Get a valid port (within the anonymous range and should not 687c478bd9Sstevel@tonic-gate * be a privileged one) to use if the user has not given a port. 697c478bd9Sstevel@tonic-gate * If multiple threads are here, they may all start with 707c478bd9Sstevel@tonic-gate * with the same initial port. But, it should be fine as long as 717c478bd9Sstevel@tonic-gate * sctp_bindi will ensure that no two threads will be assigned 727c478bd9Sstevel@tonic-gate * the same port. 737c478bd9Sstevel@tonic-gate */ 747c478bd9Sstevel@tonic-gate if (*requested_port == 0) { 75f4b3ec61Sdh *requested_port = sctp_update_next_port( 76f4b3ec61Sdh sctps->sctps_next_port_to_try, 77bd670b35SErik Nordmark crgetzone(connp->conn_cred), sctps); 7845916cd2Sjpk if (*requested_port == 0) 7945916cd2Sjpk return (EACCES); 807c478bd9Sstevel@tonic-gate *user_specified = 0; 817c478bd9Sstevel@tonic-gate } else { 827c478bd9Sstevel@tonic-gate int i; 837c478bd9Sstevel@tonic-gate boolean_t priv = B_FALSE; 847c478bd9Sstevel@tonic-gate 857c478bd9Sstevel@tonic-gate /* 867c478bd9Sstevel@tonic-gate * If the requested_port is in the well-known privileged range, 877c478bd9Sstevel@tonic-gate * verify that the stream was opened by a privileged user. 887c478bd9Sstevel@tonic-gate * Note: No locks are held when inspecting sctp_g_*epriv_ports 897c478bd9Sstevel@tonic-gate * but instead the code relies on: 907c478bd9Sstevel@tonic-gate * - the fact that the address of the array and its size never 917c478bd9Sstevel@tonic-gate * changes 927c478bd9Sstevel@tonic-gate * - the atomic assignment of the elements of the array 937c478bd9Sstevel@tonic-gate */ 94f4b3ec61Sdh if (*requested_port < sctps->sctps_smallest_nonpriv_port) { 957c478bd9Sstevel@tonic-gate priv = B_TRUE; 967c478bd9Sstevel@tonic-gate } else { 97f4b3ec61Sdh for (i = 0; i < sctps->sctps_g_num_epriv_ports; i++) { 98f4b3ec61Sdh if (*requested_port == 99f4b3ec61Sdh sctps->sctps_g_epriv_ports[i]) { 1007c478bd9Sstevel@tonic-gate priv = B_TRUE; 1017c478bd9Sstevel@tonic-gate break; 1027c478bd9Sstevel@tonic-gate } 1037c478bd9Sstevel@tonic-gate } 1047c478bd9Sstevel@tonic-gate } 1057c478bd9Sstevel@tonic-gate if (priv) { 1067c478bd9Sstevel@tonic-gate /* 1077c478bd9Sstevel@tonic-gate * sctp_bind() should take a cred_t argument so that 1087c478bd9Sstevel@tonic-gate * we can use it here. 1097c478bd9Sstevel@tonic-gate */ 110bd670b35SErik Nordmark if (secpolicy_net_privaddr(connp->conn_cred, 111ddf7fe95Scasper *requested_port, IPPROTO_SCTP) != 0) { 1127c478bd9Sstevel@tonic-gate dprint(1, 1137c478bd9Sstevel@tonic-gate ("sctp_bind(x): no prive for port %d", 1147c478bd9Sstevel@tonic-gate *requested_port)); 11545916cd2Sjpk return (EACCES); 1167c478bd9Sstevel@tonic-gate } 1177c478bd9Sstevel@tonic-gate } 1187c478bd9Sstevel@tonic-gate *user_specified = 1; 1197c478bd9Sstevel@tonic-gate } 1207c478bd9Sstevel@tonic-gate 1217c478bd9Sstevel@tonic-gate return (0); 1227c478bd9Sstevel@tonic-gate } 1237c478bd9Sstevel@tonic-gate 1247c478bd9Sstevel@tonic-gate int 1257c478bd9Sstevel@tonic-gate sctp_listen(sctp_t *sctp) 1267c478bd9Sstevel@tonic-gate { 1277c478bd9Sstevel@tonic-gate sctp_tf_t *tf; 128f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps; 129bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp; 1307c478bd9Sstevel@tonic-gate 1317c478bd9Sstevel@tonic-gate RUN_SCTP(sctp); 1327c478bd9Sstevel@tonic-gate /* 1337c478bd9Sstevel@tonic-gate * TCP handles listen() increasing the backlog, need to check 1341d8c4025Svi * if it should be handled here too 1357c478bd9Sstevel@tonic-gate */ 136b34b8d1aSkcpoon if (sctp->sctp_state > SCTPS_BOUND || 137b34b8d1aSkcpoon (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) { 1387c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 1397c478bd9Sstevel@tonic-gate return (EINVAL); 1407c478bd9Sstevel@tonic-gate } 1417c478bd9Sstevel@tonic-gate 1427c478bd9Sstevel@tonic-gate /* Do an anonymous bind for unbound socket doing listen(). */ 1437c478bd9Sstevel@tonic-gate if (sctp->sctp_nsaddrs == 0) { 1447c478bd9Sstevel@tonic-gate struct sockaddr_storage ss; 1457c478bd9Sstevel@tonic-gate int ret; 1467c478bd9Sstevel@tonic-gate 1477c478bd9Sstevel@tonic-gate bzero(&ss, sizeof (ss)); 148bd670b35SErik Nordmark ss.ss_family = connp->conn_family; 1497c478bd9Sstevel@tonic-gate 1507c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 1517c478bd9Sstevel@tonic-gate if ((ret = sctp_bind(sctp, (struct sockaddr *)&ss, 152b34b8d1aSkcpoon sizeof (ss))) != 0) 1537c478bd9Sstevel@tonic-gate return (ret); 1547c478bd9Sstevel@tonic-gate RUN_SCTP(sctp) 1557c478bd9Sstevel@tonic-gate } 1567c478bd9Sstevel@tonic-gate 157bd670b35SErik Nordmark /* Cache things in the ixa without any refhold */ 158be4c8f74SErik Nordmark ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 159bd670b35SErik Nordmark connp->conn_ixa->ixa_cred = connp->conn_cred; 160bd670b35SErik Nordmark connp->conn_ixa->ixa_cpid = connp->conn_cpid; 161bd670b35SErik Nordmark if (is_system_labeled()) 162bd670b35SErik Nordmark connp->conn_ixa->ixa_tsl = crgetlabel(connp->conn_cred); 163bd670b35SErik Nordmark 1647c478bd9Sstevel@tonic-gate sctp->sctp_state = SCTPS_LISTEN; 1657c478bd9Sstevel@tonic-gate (void) random_get_pseudo_bytes(sctp->sctp_secret, SCTP_SECRET_LEN); 166d3d50737SRafael Vanoni sctp->sctp_last_secret_update = ddi_get_lbolt64(); 1677c478bd9Sstevel@tonic-gate bzero(sctp->sctp_old_secret, SCTP_SECRET_LEN); 168*5dd46ab5SKacheong Poon 169*5dd46ab5SKacheong Poon /* 170*5dd46ab5SKacheong Poon * If there is an association limit, allocate and initialize 171*5dd46ab5SKacheong Poon * the counter struct. Note that since listen can be called 172*5dd46ab5SKacheong Poon * multiple times, the struct may have been allready allocated. 173*5dd46ab5SKacheong Poon */ 174*5dd46ab5SKacheong Poon if (!list_is_empty(&sctps->sctps_listener_conf) && 175*5dd46ab5SKacheong Poon sctp->sctp_listen_cnt == NULL) { 176*5dd46ab5SKacheong Poon sctp_listen_cnt_t *slc; 177*5dd46ab5SKacheong Poon uint32_t ratio; 178*5dd46ab5SKacheong Poon 179*5dd46ab5SKacheong Poon ratio = sctp_find_listener_conf(sctps, 180*5dd46ab5SKacheong Poon ntohs(connp->conn_lport)); 181*5dd46ab5SKacheong Poon if (ratio != 0) { 182*5dd46ab5SKacheong Poon uint32_t mem_ratio, tot_buf; 183*5dd46ab5SKacheong Poon 184*5dd46ab5SKacheong Poon slc = kmem_alloc(sizeof (sctp_listen_cnt_t), KM_SLEEP); 185*5dd46ab5SKacheong Poon /* 186*5dd46ab5SKacheong Poon * Calculate the connection limit based on 187*5dd46ab5SKacheong Poon * the configured ratio and maxusers. Maxusers 188*5dd46ab5SKacheong Poon * are calculated based on memory size, 189*5dd46ab5SKacheong Poon * ~ 1 user per MB. Note that the conn_rcvbuf 190*5dd46ab5SKacheong Poon * and conn_sndbuf may change after a 191*5dd46ab5SKacheong Poon * connection is accepted. So what we have 192*5dd46ab5SKacheong Poon * is only an approximation. 193*5dd46ab5SKacheong Poon */ 194*5dd46ab5SKacheong Poon if ((tot_buf = connp->conn_rcvbuf + 195*5dd46ab5SKacheong Poon connp->conn_sndbuf) < MB) { 196*5dd46ab5SKacheong Poon mem_ratio = MB / tot_buf; 197*5dd46ab5SKacheong Poon slc->slc_max = maxusers / ratio * mem_ratio; 198*5dd46ab5SKacheong Poon } else { 199*5dd46ab5SKacheong Poon mem_ratio = tot_buf / MB; 200*5dd46ab5SKacheong Poon slc->slc_max = maxusers / ratio / mem_ratio; 201*5dd46ab5SKacheong Poon } 202*5dd46ab5SKacheong Poon /* At least we should allow some associations! */ 203*5dd46ab5SKacheong Poon if (slc->slc_max < sctp_min_assoc_listener) 204*5dd46ab5SKacheong Poon slc->slc_max = sctp_min_assoc_listener; 205*5dd46ab5SKacheong Poon slc->slc_cnt = 1; 206*5dd46ab5SKacheong Poon slc->slc_drop = 0; 207*5dd46ab5SKacheong Poon sctp->sctp_listen_cnt = slc; 208*5dd46ab5SKacheong Poon } 209*5dd46ab5SKacheong Poon } 210*5dd46ab5SKacheong Poon 211*5dd46ab5SKacheong Poon 212f4b3ec61Sdh tf = &sctps->sctps_listen_fanout[SCTP_LISTEN_HASH( 213bd670b35SErik Nordmark ntohs(connp->conn_lport))]; 2147c478bd9Sstevel@tonic-gate sctp_listen_hash_insert(tf, sctp); 215*5dd46ab5SKacheong Poon 2167c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 2177c478bd9Sstevel@tonic-gate return (0); 2187c478bd9Sstevel@tonic-gate } 2197c478bd9Sstevel@tonic-gate 2207c478bd9Sstevel@tonic-gate /* 2217c478bd9Sstevel@tonic-gate * Bind the sctp_t to a sockaddr, which includes an address and other 2227c478bd9Sstevel@tonic-gate * information, such as port or flowinfo. 2237c478bd9Sstevel@tonic-gate */ 2247c478bd9Sstevel@tonic-gate int 2257c478bd9Sstevel@tonic-gate sctp_bind(sctp_t *sctp, struct sockaddr *sa, socklen_t len) 2267c478bd9Sstevel@tonic-gate { 2277c478bd9Sstevel@tonic-gate int user_specified; 2287c478bd9Sstevel@tonic-gate boolean_t bind_to_req_port_only; 2297c478bd9Sstevel@tonic-gate in_port_t requested_port; 2307c478bd9Sstevel@tonic-gate in_port_t allocated_port; 2317c478bd9Sstevel@tonic-gate int err = 0; 232bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp; 233bd670b35SErik Nordmark uint_t scope_id; 234bd670b35SErik Nordmark sin_t *sin; 235bd670b35SErik Nordmark sin6_t *sin6; 2367c478bd9Sstevel@tonic-gate 2377c478bd9Sstevel@tonic-gate ASSERT(sctp != NULL); 2387c478bd9Sstevel@tonic-gate 2397c478bd9Sstevel@tonic-gate RUN_SCTP(sctp); 2407c478bd9Sstevel@tonic-gate 2410f1702c5SYu Xiangning if ((sctp->sctp_state >= SCTPS_BOUND) || 2420f1702c5SYu Xiangning (sctp->sctp_connp->conn_state_flags & CONN_CLOSING) || 2430f1702c5SYu Xiangning (sa == NULL || len == 0)) { 2440f1702c5SYu Xiangning /* 2450f1702c5SYu Xiangning * Multiple binds not allowed for any SCTP socket 2460f1702c5SYu Xiangning * Also binding with null address is not supported. 2470f1702c5SYu Xiangning */ 2487c478bd9Sstevel@tonic-gate err = EINVAL; 2497c478bd9Sstevel@tonic-gate goto done; 2507c478bd9Sstevel@tonic-gate } 2517c478bd9Sstevel@tonic-gate 2527c478bd9Sstevel@tonic-gate switch (sa->sa_family) { 2537c478bd9Sstevel@tonic-gate case AF_INET: 254bd670b35SErik Nordmark sin = (sin_t *)sa; 2557c478bd9Sstevel@tonic-gate if (len < sizeof (struct sockaddr_in) || 256bd670b35SErik Nordmark connp->conn_family == AF_INET6) { 2577c478bd9Sstevel@tonic-gate err = EINVAL; 2587c478bd9Sstevel@tonic-gate goto done; 2597c478bd9Sstevel@tonic-gate } 260bd670b35SErik Nordmark requested_port = ntohs(sin->sin_port); 2617c478bd9Sstevel@tonic-gate break; 2627c478bd9Sstevel@tonic-gate case AF_INET6: 263bd670b35SErik Nordmark sin6 = (sin6_t *)sa; 2647c478bd9Sstevel@tonic-gate if (len < sizeof (struct sockaddr_in6) || 265bd670b35SErik Nordmark connp->conn_family == AF_INET) { 2667c478bd9Sstevel@tonic-gate err = EINVAL; 2677c478bd9Sstevel@tonic-gate goto done; 2687c478bd9Sstevel@tonic-gate } 269bd670b35SErik Nordmark requested_port = ntohs(sin6->sin6_port); 2707c478bd9Sstevel@tonic-gate /* Set the flowinfo. */ 271bd670b35SErik Nordmark connp->conn_flowinfo = 272bd670b35SErik Nordmark sin6->sin6_flowinfo & ~IPV6_VERS_AND_FLOW_MASK; 273bd670b35SErik Nordmark 274bd670b35SErik Nordmark scope_id = sin6->sin6_scope_id; 275bd670b35SErik Nordmark if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(&sin6->sin6_addr)) { 276bd670b35SErik Nordmark connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 277bd670b35SErik Nordmark connp->conn_ixa->ixa_scopeid = scope_id; 278bd670b35SErik Nordmark connp->conn_incoming_ifindex = scope_id; 279bd670b35SErik Nordmark } else { 280bd670b35SErik Nordmark connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 281bd670b35SErik Nordmark connp->conn_incoming_ifindex = connp->conn_bound_if; 282bd670b35SErik Nordmark } 2837c478bd9Sstevel@tonic-gate break; 2847c478bd9Sstevel@tonic-gate default: 2857c478bd9Sstevel@tonic-gate err = EAFNOSUPPORT; 2867c478bd9Sstevel@tonic-gate goto done; 2877c478bd9Sstevel@tonic-gate } 2887c478bd9Sstevel@tonic-gate bind_to_req_port_only = requested_port == 0 ? B_FALSE : B_TRUE; 2897c478bd9Sstevel@tonic-gate 29045916cd2Sjpk err = sctp_select_port(sctp, &requested_port, &user_specified); 29145916cd2Sjpk if (err != 0) 2927c478bd9Sstevel@tonic-gate goto done; 2937c478bd9Sstevel@tonic-gate 2941d8c4025Svi if ((err = sctp_bind_add(sctp, sa, 1, B_TRUE, 2951d8c4025Svi user_specified == 1 ? htons(requested_port) : 0)) != 0) { 2967c478bd9Sstevel@tonic-gate goto done; 2971d8c4025Svi } 29845916cd2Sjpk err = sctp_bindi(sctp, requested_port, bind_to_req_port_only, 29945916cd2Sjpk user_specified, &allocated_port); 30045916cd2Sjpk if (err != 0) { 3017c478bd9Sstevel@tonic-gate sctp_free_saddrs(sctp); 30245916cd2Sjpk } else { 30345916cd2Sjpk ASSERT(sctp->sctp_state == SCTPS_BOUND); 3047c478bd9Sstevel@tonic-gate } 3057c478bd9Sstevel@tonic-gate done: 3067c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 3077c478bd9Sstevel@tonic-gate return (err); 3087c478bd9Sstevel@tonic-gate } 3097c478bd9Sstevel@tonic-gate 3107c478bd9Sstevel@tonic-gate /* 3117c478bd9Sstevel@tonic-gate * Perform bind/unbind operation of a list of addresses on a sctp_t 3127c478bd9Sstevel@tonic-gate */ 3137c478bd9Sstevel@tonic-gate int 3147c478bd9Sstevel@tonic-gate sctp_bindx(sctp_t *sctp, const void *addrs, int addrcnt, int bindop) 3157c478bd9Sstevel@tonic-gate { 3167c478bd9Sstevel@tonic-gate ASSERT(sctp != NULL); 3177c478bd9Sstevel@tonic-gate ASSERT(addrs != NULL); 3187c478bd9Sstevel@tonic-gate ASSERT(addrcnt > 0); 3197c478bd9Sstevel@tonic-gate 3207c478bd9Sstevel@tonic-gate switch (bindop) { 3217c478bd9Sstevel@tonic-gate case SCTP_BINDX_ADD_ADDR: 3221d8c4025Svi return (sctp_bind_add(sctp, addrs, addrcnt, B_FALSE, 323bd670b35SErik Nordmark sctp->sctp_connp->conn_lport)); 3247c478bd9Sstevel@tonic-gate case SCTP_BINDX_REM_ADDR: 3257c478bd9Sstevel@tonic-gate return (sctp_bind_del(sctp, addrs, addrcnt, B_FALSE)); 3267c478bd9Sstevel@tonic-gate default: 3277c478bd9Sstevel@tonic-gate return (EINVAL); 3287c478bd9Sstevel@tonic-gate } 3297c478bd9Sstevel@tonic-gate } 3307c478bd9Sstevel@tonic-gate 3317c478bd9Sstevel@tonic-gate /* 3327c478bd9Sstevel@tonic-gate * Add a list of addresses to a sctp_t. 3337c478bd9Sstevel@tonic-gate */ 3347c478bd9Sstevel@tonic-gate int 3357c478bd9Sstevel@tonic-gate sctp_bind_add(sctp_t *sctp, const void *addrs, uint32_t addrcnt, 3361d8c4025Svi boolean_t caller_hold_lock, in_port_t port) 3377c478bd9Sstevel@tonic-gate { 3387c478bd9Sstevel@tonic-gate int err = 0; 3397c478bd9Sstevel@tonic-gate boolean_t do_asconf = B_FALSE; 340f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps; 341bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp; 3427c478bd9Sstevel@tonic-gate 3437c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 3447c478bd9Sstevel@tonic-gate RUN_SCTP(sctp); 3457c478bd9Sstevel@tonic-gate 346b34b8d1aSkcpoon if (sctp->sctp_state > SCTPS_ESTABLISHED || 347b34b8d1aSkcpoon (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) { 3487c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 3497c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 3507c478bd9Sstevel@tonic-gate return (EINVAL); 3517c478bd9Sstevel@tonic-gate } 352df19b344Svi 353df19b344Svi if (sctp->sctp_state > SCTPS_LISTEN) { 354df19b344Svi /* 355df19b344Svi * Let's do some checking here rather than undoing the 356df19b344Svi * add later (for these reasons). 357df19b344Svi */ 358f4b3ec61Sdh if (!sctps->sctps_addip_enabled || 359f4b3ec61Sdh !sctp->sctp_understands_asconf || 360df19b344Svi !sctp->sctp_understands_addip) { 361df19b344Svi if (!caller_hold_lock) 362df19b344Svi WAKE_SCTP(sctp); 363df19b344Svi return (EINVAL); 364df19b344Svi } 3657c478bd9Sstevel@tonic-gate do_asconf = B_TRUE; 366df19b344Svi } 3671d8c4025Svi /* 3681d8c4025Svi * On a clustered node, for an inaddr_any bind, we will pass the list 3691d8c4025Svi * of all the addresses in the global list, minus any address on the 3701d8c4025Svi * loopback interface, and expect the clustering susbsystem to give us 3711d8c4025Svi * the correct list for the 'port'. For explicit binds we give the 3721d8c4025Svi * list of addresses and the clustering module validates it for the 3731d8c4025Svi * 'port'. 3741d8c4025Svi * 3751d8c4025Svi * On a non-clustered node, cl_sctp_check_addrs will be NULL and 3761d8c4025Svi * we proceed as usual. 3771d8c4025Svi */ 3781d8c4025Svi if (cl_sctp_check_addrs != NULL) { 3791d8c4025Svi uchar_t *addrlist = NULL; 3801d8c4025Svi size_t size = 0; 3811d8c4025Svi int unspec = 0; 3821d8c4025Svi boolean_t do_listen; 3831d8c4025Svi uchar_t *llist = NULL; 3841d8c4025Svi size_t lsize = 0; 3851d8c4025Svi 3861d8c4025Svi /* 3871d8c4025Svi * If we are adding addresses after listening, but before 3881d8c4025Svi * an association is established, we need to update the 3891d8c4025Svi * clustering module with this info. 3901d8c4025Svi */ 3911d8c4025Svi do_listen = !do_asconf && sctp->sctp_state > SCTPS_BOUND && 3921d8c4025Svi cl_sctp_listen != NULL; 3931d8c4025Svi 3941d8c4025Svi err = sctp_get_addrlist(sctp, addrs, &addrcnt, &addrlist, 3951d8c4025Svi &unspec, &size); 3961d8c4025Svi if (err != 0) { 3971d8c4025Svi ASSERT(addrlist == NULL); 3981d8c4025Svi ASSERT(addrcnt == 0); 3991d8c4025Svi ASSERT(size == 0); 4001d8c4025Svi if (!caller_hold_lock) 4011d8c4025Svi WAKE_SCTP(sctp); 402f4b3ec61Sdh SCTP_KSTAT(sctps, sctp_cl_check_addrs); 4031d8c4025Svi return (err); 4041d8c4025Svi } 4051d8c4025Svi ASSERT(addrlist != NULL); 406bd670b35SErik Nordmark (*cl_sctp_check_addrs)(connp->conn_family, port, &addrlist, 4071d8c4025Svi size, &addrcnt, unspec == 1); 4081d8c4025Svi if (addrcnt == 0) { 4091d8c4025Svi /* We free the list */ 4101d8c4025Svi kmem_free(addrlist, size); 4111d8c4025Svi if (!caller_hold_lock) 4121d8c4025Svi WAKE_SCTP(sctp); 4131d8c4025Svi return (EINVAL); 4141d8c4025Svi } 4151d8c4025Svi if (do_listen) { 4161d8c4025Svi lsize = sizeof (in6_addr_t) * addrcnt; 4171d8c4025Svi llist = kmem_alloc(lsize, KM_SLEEP); 4181d8c4025Svi } 4191d8c4025Svi err = sctp_valid_addr_list(sctp, addrlist, addrcnt, llist, 4201d8c4025Svi lsize); 4211d8c4025Svi if (err == 0 && do_listen) { 422bd670b35SErik Nordmark (*cl_sctp_listen)(connp->conn_family, llist, 423bd670b35SErik Nordmark addrcnt, connp->conn_lport); 4241d8c4025Svi /* list will be freed by the clustering module */ 4251d8c4025Svi } else if (err != 0 && llist != NULL) { 4261d8c4025Svi kmem_free(llist, lsize); 4271d8c4025Svi } 4281d8c4025Svi /* free the list we allocated */ 4291d8c4025Svi kmem_free(addrlist, size); 4301d8c4025Svi } else { 4311d8c4025Svi err = sctp_valid_addr_list(sctp, addrs, addrcnt, NULL, 0); 4321d8c4025Svi } 4337c478bd9Sstevel@tonic-gate if (err != 0) { 4347c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 4357c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 4367c478bd9Sstevel@tonic-gate return (err); 4377c478bd9Sstevel@tonic-gate } 4387c478bd9Sstevel@tonic-gate /* Need to send ASCONF messages */ 4397c478bd9Sstevel@tonic-gate if (do_asconf) { 4407c478bd9Sstevel@tonic-gate err = sctp_add_ip(sctp, addrs, addrcnt); 4417c478bd9Sstevel@tonic-gate if (err != 0) { 4427c478bd9Sstevel@tonic-gate sctp_del_saddr_list(sctp, addrs, addrcnt, B_FALSE); 4437c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 4447c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 4457c478bd9Sstevel@tonic-gate return (err); 4467c478bd9Sstevel@tonic-gate } 4477c478bd9Sstevel@tonic-gate } 4487c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 4497c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 4507c478bd9Sstevel@tonic-gate return (0); 4517c478bd9Sstevel@tonic-gate } 4527c478bd9Sstevel@tonic-gate 4537c478bd9Sstevel@tonic-gate /* 4547c478bd9Sstevel@tonic-gate * Remove one or more addresses bound to the sctp_t. 4557c478bd9Sstevel@tonic-gate */ 4567c478bd9Sstevel@tonic-gate int 4577c478bd9Sstevel@tonic-gate sctp_bind_del(sctp_t *sctp, const void *addrs, uint32_t addrcnt, 4587c478bd9Sstevel@tonic-gate boolean_t caller_hold_lock) 4597c478bd9Sstevel@tonic-gate { 4607c478bd9Sstevel@tonic-gate int error = 0; 4617c478bd9Sstevel@tonic-gate boolean_t do_asconf = B_FALSE; 4621d8c4025Svi uchar_t *ulist = NULL; 4631d8c4025Svi size_t usize = 0; 464f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps; 465bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp; 4667c478bd9Sstevel@tonic-gate 4677c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 4687c478bd9Sstevel@tonic-gate RUN_SCTP(sctp); 4697c478bd9Sstevel@tonic-gate 470b34b8d1aSkcpoon if (sctp->sctp_state > SCTPS_ESTABLISHED || 471b34b8d1aSkcpoon (sctp->sctp_connp->conn_state_flags & CONN_CLOSING)) { 4727c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 4737c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 4747c478bd9Sstevel@tonic-gate return (EINVAL); 4757c478bd9Sstevel@tonic-gate } 476df19b344Svi /* 477df19b344Svi * Fail the remove if we are beyond listen, but can't send this 478df19b344Svi * to the peer. 479df19b344Svi */ 480df19b344Svi if (sctp->sctp_state > SCTPS_LISTEN) { 481f4b3ec61Sdh if (!sctps->sctps_addip_enabled || 482f4b3ec61Sdh !sctp->sctp_understands_asconf || 483df19b344Svi !sctp->sctp_understands_addip) { 484df19b344Svi if (!caller_hold_lock) 485df19b344Svi WAKE_SCTP(sctp); 486df19b344Svi return (EINVAL); 487df19b344Svi } 4887c478bd9Sstevel@tonic-gate do_asconf = B_TRUE; 489df19b344Svi } 4907c478bd9Sstevel@tonic-gate 4917c478bd9Sstevel@tonic-gate /* Can't delete the last address nor all of the addresses */ 4927c478bd9Sstevel@tonic-gate if (sctp->sctp_nsaddrs == 1 || addrcnt >= sctp->sctp_nsaddrs) { 4937c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 4947c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 4957c478bd9Sstevel@tonic-gate return (EINVAL); 4967c478bd9Sstevel@tonic-gate } 4977c478bd9Sstevel@tonic-gate 4981d8c4025Svi if (cl_sctp_unlisten != NULL && !do_asconf && 4991d8c4025Svi sctp->sctp_state > SCTPS_BOUND) { 5001d8c4025Svi usize = sizeof (in6_addr_t) * addrcnt; 5011d8c4025Svi ulist = kmem_alloc(usize, KM_SLEEP); 5021d8c4025Svi } 5031d8c4025Svi 5041d8c4025Svi error = sctp_del_ip(sctp, addrs, addrcnt, ulist, usize); 5051d8c4025Svi if (error != 0) { 5061d8c4025Svi if (ulist != NULL) 5071d8c4025Svi kmem_free(ulist, usize); 5081d8c4025Svi if (!caller_hold_lock) 5091d8c4025Svi WAKE_SCTP(sctp); 5101d8c4025Svi return (error); 5111d8c4025Svi } 5121d8c4025Svi /* ulist will be non-NULL only if cl_sctp_unlisten is non-NULL */ 5131d8c4025Svi if (ulist != NULL) { 5141d8c4025Svi ASSERT(cl_sctp_unlisten != NULL); 515bd670b35SErik Nordmark (*cl_sctp_unlisten)(connp->conn_family, ulist, addrcnt, 516bd670b35SErik Nordmark connp->conn_lport); 5171d8c4025Svi /* ulist will be freed by the clustering module */ 5181d8c4025Svi } 5197c478bd9Sstevel@tonic-gate if (!caller_hold_lock) 5207c478bd9Sstevel@tonic-gate WAKE_SCTP(sctp); 5217c478bd9Sstevel@tonic-gate return (error); 5227c478bd9Sstevel@tonic-gate } 5237c478bd9Sstevel@tonic-gate 5247c478bd9Sstevel@tonic-gate /* 52545916cd2Sjpk * Returns 0 for success, errno value otherwise. 5267c478bd9Sstevel@tonic-gate * 52745916cd2Sjpk * If the "bind_to_req_port_only" parameter is set and the requested port 52845916cd2Sjpk * number is available, then set allocated_port to it. If not available, 52945916cd2Sjpk * return an error. 5307c478bd9Sstevel@tonic-gate * 53145916cd2Sjpk * If the "bind_to_req_port_only" parameter is not set and the requested port 53245916cd2Sjpk * number is available, then set allocated_port to it. If not available, 53345916cd2Sjpk * find the first anonymous port we can and set allocated_port to that. If no 53445916cd2Sjpk * anonymous ports are available, return an error. 53545916cd2Sjpk * 53645916cd2Sjpk * In either case, when succeeding, update the sctp_t to record the port number 5377c478bd9Sstevel@tonic-gate * and insert it in the bind hash table. 5387c478bd9Sstevel@tonic-gate */ 53945916cd2Sjpk int 54045916cd2Sjpk sctp_bindi(sctp_t *sctp, in_port_t port, boolean_t bind_to_req_port_only, 54145916cd2Sjpk int user_specified, in_port_t *allocated_port) 5427c478bd9Sstevel@tonic-gate { 5437c478bd9Sstevel@tonic-gate /* number of times we have run around the loop */ 5447c478bd9Sstevel@tonic-gate int count = 0; 5457c478bd9Sstevel@tonic-gate /* maximum number of times to run around the loop */ 5467c478bd9Sstevel@tonic-gate int loopmax; 547f4b3ec61Sdh sctp_stack_t *sctps = sctp->sctp_sctps; 548bd670b35SErik Nordmark conn_t *connp = sctp->sctp_connp; 549bd670b35SErik Nordmark zone_t *zone = crgetzone(connp->conn_cred); 550bd670b35SErik Nordmark zoneid_t zoneid = connp->conn_zoneid; 5517c478bd9Sstevel@tonic-gate 5527c478bd9Sstevel@tonic-gate /* 5537c478bd9Sstevel@tonic-gate * Lookup for free addresses is done in a loop and "loopmax" 5547c478bd9Sstevel@tonic-gate * influences how long we spin in the loop 5557c478bd9Sstevel@tonic-gate */ 5567c478bd9Sstevel@tonic-gate if (bind_to_req_port_only) { 5577c478bd9Sstevel@tonic-gate /* 5587c478bd9Sstevel@tonic-gate * If the requested port is busy, don't bother to look 5597c478bd9Sstevel@tonic-gate * for a new one. Setting loop maximum count to 1 has 5607c478bd9Sstevel@tonic-gate * that effect. 5617c478bd9Sstevel@tonic-gate */ 5627c478bd9Sstevel@tonic-gate loopmax = 1; 5637c478bd9Sstevel@tonic-gate } else { 5647c478bd9Sstevel@tonic-gate /* 5657c478bd9Sstevel@tonic-gate * If the requested port is busy, look for a free one 5667c478bd9Sstevel@tonic-gate * in the anonymous port range. 5677c478bd9Sstevel@tonic-gate * Set loopmax appropriately so that one does not look 5687c478bd9Sstevel@tonic-gate * forever in the case all of the anonymous ports are in use. 5697c478bd9Sstevel@tonic-gate */ 570f4b3ec61Sdh loopmax = (sctps->sctps_largest_anon_port - 571f4b3ec61Sdh sctps->sctps_smallest_anon_port + 1); 5727c478bd9Sstevel@tonic-gate } 5737c478bd9Sstevel@tonic-gate do { 5747c478bd9Sstevel@tonic-gate uint16_t lport; 5757c478bd9Sstevel@tonic-gate sctp_tf_t *tbf; 5767c478bd9Sstevel@tonic-gate sctp_t *lsctp; 5777c478bd9Sstevel@tonic-gate int addrcmp; 5787c478bd9Sstevel@tonic-gate 5797c478bd9Sstevel@tonic-gate lport = htons(port); 5807c478bd9Sstevel@tonic-gate 5817c478bd9Sstevel@tonic-gate /* 5827c478bd9Sstevel@tonic-gate * Ensure that the sctp_t is not currently in the bind hash. 5837c478bd9Sstevel@tonic-gate * Hold the lock on the hash bucket to ensure that 5847c478bd9Sstevel@tonic-gate * the duplicate check plus the insertion is an atomic 5857c478bd9Sstevel@tonic-gate * operation. 5867c478bd9Sstevel@tonic-gate * 5877c478bd9Sstevel@tonic-gate * This function does an inline lookup on the bind hash list 5887c478bd9Sstevel@tonic-gate * Make sure that we access only members of sctp_t 5897c478bd9Sstevel@tonic-gate * and that we don't look at sctp_sctp, since we are not 5907c478bd9Sstevel@tonic-gate * doing a SCTPB_REFHOLD. For more details please see the notes 5917c478bd9Sstevel@tonic-gate * in sctp_compress() 5927c478bd9Sstevel@tonic-gate */ 5937c478bd9Sstevel@tonic-gate sctp_bind_hash_remove(sctp); 594f4b3ec61Sdh tbf = &sctps->sctps_bind_fanout[SCTP_BIND_HASH(port)]; 5957c478bd9Sstevel@tonic-gate mutex_enter(&tbf->tf_lock); 5967c478bd9Sstevel@tonic-gate for (lsctp = tbf->tf_sctp; lsctp != NULL; 5977c478bd9Sstevel@tonic-gate lsctp = lsctp->sctp_bind_hash) { 598bd670b35SErik Nordmark conn_t *lconnp = lsctp->sctp_connp; 5997c478bd9Sstevel@tonic-gate 600bd670b35SErik Nordmark if (lport != lconnp->conn_lport || 6017c478bd9Sstevel@tonic-gate lsctp->sctp_state < SCTPS_BOUND) 6027c478bd9Sstevel@tonic-gate continue; 6037c478bd9Sstevel@tonic-gate 60445916cd2Sjpk /* 60545916cd2Sjpk * On a labeled system, we must treat bindings to ports 60645916cd2Sjpk * on shared IP addresses by sockets with MAC exemption 60745916cd2Sjpk * privilege as being in all zones, as there's 60845916cd2Sjpk * otherwise no way to identify the right receiver. 60945916cd2Sjpk */ 610bd670b35SErik Nordmark if (lconnp->conn_zoneid != zoneid && 611bd670b35SErik Nordmark lconnp->conn_mac_mode == CONN_MAC_DEFAULT && 612bd670b35SErik Nordmark connp->conn_mac_mode == CONN_MAC_DEFAULT) 61345916cd2Sjpk continue; 61445916cd2Sjpk 6157c478bd9Sstevel@tonic-gate addrcmp = sctp_compare_saddrs(sctp, lsctp); 6167c478bd9Sstevel@tonic-gate if (addrcmp != SCTP_ADDR_DISJOINT) { 617bd670b35SErik Nordmark if (!connp->conn_reuseaddr) { 6187c478bd9Sstevel@tonic-gate /* in use */ 6197c478bd9Sstevel@tonic-gate break; 6207c478bd9Sstevel@tonic-gate } else if (lsctp->sctp_state == SCTPS_BOUND || 6217c478bd9Sstevel@tonic-gate lsctp->sctp_state == SCTPS_LISTEN) { 6227c478bd9Sstevel@tonic-gate /* 6237c478bd9Sstevel@tonic-gate * socket option SO_REUSEADDR is set 6247c478bd9Sstevel@tonic-gate * on the binding sctp_t. 6257c478bd9Sstevel@tonic-gate * 6267c478bd9Sstevel@tonic-gate * We have found a match of IP source 6277c478bd9Sstevel@tonic-gate * address and source port, which is 6287c478bd9Sstevel@tonic-gate * refused regardless of the 6297c478bd9Sstevel@tonic-gate * SO_REUSEADDR setting, so we break. 6307c478bd9Sstevel@tonic-gate */ 6317c478bd9Sstevel@tonic-gate break; 6327c478bd9Sstevel@tonic-gate } 6337c478bd9Sstevel@tonic-gate } 6347c478bd9Sstevel@tonic-gate } 6357c478bd9Sstevel@tonic-gate if (lsctp != NULL) { 6367c478bd9Sstevel@tonic-gate /* The port number is busy */ 6377c478bd9Sstevel@tonic-gate mutex_exit(&tbf->tf_lock); 6387c478bd9Sstevel@tonic-gate } else { 63945916cd2Sjpk if (is_system_labeled()) { 64045916cd2Sjpk mlp_type_t addrtype, mlptype; 641bd670b35SErik Nordmark uint_t ipversion; 64245916cd2Sjpk 64345916cd2Sjpk /* 64445916cd2Sjpk * On a labeled system we must check the type 64545916cd2Sjpk * of the binding requested by the user (either 64645916cd2Sjpk * MLP or SLP on shared and private addresses), 64745916cd2Sjpk * and that the user's requested binding 64845916cd2Sjpk * is permitted. 64945916cd2Sjpk */ 650bd670b35SErik Nordmark if (connp->conn_family == AF_INET) 651bd670b35SErik Nordmark ipversion = IPV4_VERSION; 652bd670b35SErik Nordmark else 653bd670b35SErik Nordmark ipversion = IPV6_VERSION; 654bd670b35SErik Nordmark 6554d6131f6SDan McDonald addrtype = tsol_mlp_addr_type( 6564d6131f6SDan McDonald connp->conn_allzones ? ALL_ZONES : 6574d6131f6SDan McDonald zone->zone_id, 658bd670b35SErik Nordmark ipversion, 659bd670b35SErik Nordmark connp->conn_family == AF_INET ? 66045916cd2Sjpk (void *)&sctp->sctp_ipha->ipha_src : 661f4b3ec61Sdh (void *)&sctp->sctp_ip6h->ip6_src, 662f4b3ec61Sdh sctps->sctps_netstack->netstack_ip); 66345916cd2Sjpk 66445916cd2Sjpk /* 66545916cd2Sjpk * tsol_mlp_addr_type returns the possibilities 66645916cd2Sjpk * for the selected address. Since all local 66745916cd2Sjpk * addresses are either private or shared, the 66845916cd2Sjpk * return value mlptSingle means "local address 66945916cd2Sjpk * not valid (interface not present)." 67045916cd2Sjpk */ 67145916cd2Sjpk if (addrtype == mlptSingle) { 67245916cd2Sjpk mutex_exit(&tbf->tf_lock); 67345916cd2Sjpk return (EADDRNOTAVAIL); 67445916cd2Sjpk } 67545916cd2Sjpk mlptype = tsol_mlp_port_type(zone, IPPROTO_SCTP, 67645916cd2Sjpk port, addrtype); 67745916cd2Sjpk if (mlptype != mlptSingle) { 67845916cd2Sjpk if (secpolicy_net_bindmlp(connp-> 67945916cd2Sjpk conn_cred) != 0) { 68045916cd2Sjpk mutex_exit(&tbf->tf_lock); 68145916cd2Sjpk return (EACCES); 68245916cd2Sjpk } 68345916cd2Sjpk /* 68445916cd2Sjpk * If we're binding a shared MLP, then 68545916cd2Sjpk * make sure that this zone is the one 68645916cd2Sjpk * that owns that MLP. Shared MLPs can 68745916cd2Sjpk * be owned by at most one zone. 688f4b3ec61Sdh * 689f4b3ec61Sdh * No need to handle exclusive-stack 690f4b3ec61Sdh * zones since ALL_ZONES only applies 691f4b3ec61Sdh * to the shared stack. 69245916cd2Sjpk */ 69345916cd2Sjpk 69445916cd2Sjpk if (mlptype == mlptShared && 69545916cd2Sjpk addrtype == mlptShared && 69645916cd2Sjpk connp->conn_zoneid != 69745916cd2Sjpk tsol_mlp_findzone(IPPROTO_SCTP, 69845916cd2Sjpk lport)) { 69945916cd2Sjpk mutex_exit(&tbf->tf_lock); 70045916cd2Sjpk return (EACCES); 70145916cd2Sjpk } 70245916cd2Sjpk connp->conn_mlp_type = mlptype; 70345916cd2Sjpk } 70445916cd2Sjpk } 7057c478bd9Sstevel@tonic-gate /* 7067c478bd9Sstevel@tonic-gate * This port is ours. Insert in fanout and mark as 7077c478bd9Sstevel@tonic-gate * bound to prevent others from getting the port 7087c478bd9Sstevel@tonic-gate * number. 7097c478bd9Sstevel@tonic-gate */ 7107c478bd9Sstevel@tonic-gate sctp->sctp_state = SCTPS_BOUND; 711bd670b35SErik Nordmark connp->conn_lport = lport; 7127c478bd9Sstevel@tonic-gate 713f4b3ec61Sdh ASSERT(&sctps->sctps_bind_fanout[ 714b34b8d1aSkcpoon SCTP_BIND_HASH(port)] == tbf); 7157c478bd9Sstevel@tonic-gate sctp_bind_hash_insert(tbf, sctp, 1); 7167c478bd9Sstevel@tonic-gate 7177c478bd9Sstevel@tonic-gate mutex_exit(&tbf->tf_lock); 7187c478bd9Sstevel@tonic-gate 7197c478bd9Sstevel@tonic-gate /* 7207c478bd9Sstevel@tonic-gate * We don't want sctp_next_port_to_try to "inherit" 7217c478bd9Sstevel@tonic-gate * a port number supplied by the user in a bind. 72245916cd2Sjpk * 7237c478bd9Sstevel@tonic-gate * This is the only place where sctp_next_port_to_try 7247c478bd9Sstevel@tonic-gate * is updated. After the update, it may or may not 7257c478bd9Sstevel@tonic-gate * be in the valid range. 7267c478bd9Sstevel@tonic-gate */ 72745916cd2Sjpk if (user_specified == 0) 728f4b3ec61Sdh sctps->sctps_next_port_to_try = port + 1; 72945916cd2Sjpk 73045916cd2Sjpk *allocated_port = port; 73145916cd2Sjpk 73245916cd2Sjpk return (0); 7337c478bd9Sstevel@tonic-gate } 7347c478bd9Sstevel@tonic-gate 7357c478bd9Sstevel@tonic-gate if ((count == 0) && (user_specified)) { 7367c478bd9Sstevel@tonic-gate /* 7377c478bd9Sstevel@tonic-gate * We may have to return an anonymous port. So 7387c478bd9Sstevel@tonic-gate * get one to start with. 7397c478bd9Sstevel@tonic-gate */ 740f4b3ec61Sdh port = sctp_update_next_port( 741f4b3ec61Sdh sctps->sctps_next_port_to_try, 742f4b3ec61Sdh zone, sctps); 7437c478bd9Sstevel@tonic-gate user_specified = 0; 7447c478bd9Sstevel@tonic-gate } else { 745f4b3ec61Sdh port = sctp_update_next_port(port + 1, zone, sctps); 7467c478bd9Sstevel@tonic-gate } 74745916cd2Sjpk if (port == 0) 74845916cd2Sjpk break; 7497c478bd9Sstevel@tonic-gate 7507c478bd9Sstevel@tonic-gate /* 7517c478bd9Sstevel@tonic-gate * Don't let this loop run forever in the case where 7527c478bd9Sstevel@tonic-gate * all of the anonymous ports are in use. 7537c478bd9Sstevel@tonic-gate */ 7547c478bd9Sstevel@tonic-gate } while (++count < loopmax); 75545916cd2Sjpk 75645916cd2Sjpk return (bind_to_req_port_only ? EADDRINUSE : EADDRNOTAVAIL); 7577c478bd9Sstevel@tonic-gate } 7587c478bd9Sstevel@tonic-gate 7597c478bd9Sstevel@tonic-gate /* 7607c478bd9Sstevel@tonic-gate * Don't let port fall into the privileged range. 7617c478bd9Sstevel@tonic-gate * Since the extra privileged ports can be arbitrary we also 7627c478bd9Sstevel@tonic-gate * ensure that we exclude those from consideration. 7637c478bd9Sstevel@tonic-gate * sctp_g_epriv_ports is not sorted thus we loop over it until 7647c478bd9Sstevel@tonic-gate * there are no changes. 7657c478bd9Sstevel@tonic-gate * 7667c478bd9Sstevel@tonic-gate * Note: No locks are held when inspecting sctp_g_*epriv_ports 7677c478bd9Sstevel@tonic-gate * but instead the code relies on: 7687c478bd9Sstevel@tonic-gate * - the fact that the address of the array and its size never changes 7697c478bd9Sstevel@tonic-gate * - the atomic assignment of the elements of the array 7707c478bd9Sstevel@tonic-gate */ 7717c478bd9Sstevel@tonic-gate in_port_t 772f4b3ec61Sdh sctp_update_next_port(in_port_t port, zone_t *zone, sctp_stack_t *sctps) 7737c478bd9Sstevel@tonic-gate { 7747c478bd9Sstevel@tonic-gate int i; 77545916cd2Sjpk boolean_t restart = B_FALSE; 7767c478bd9Sstevel@tonic-gate 7777c478bd9Sstevel@tonic-gate retry: 778f4b3ec61Sdh if (port < sctps->sctps_smallest_anon_port) 779f4b3ec61Sdh port = sctps->sctps_smallest_anon_port; 78045916cd2Sjpk 781f4b3ec61Sdh if (port > sctps->sctps_largest_anon_port) { 78245916cd2Sjpk if (restart) 78345916cd2Sjpk return (0); 78445916cd2Sjpk restart = B_TRUE; 785f4b3ec61Sdh port = sctps->sctps_smallest_anon_port; 78645916cd2Sjpk } 7877c478bd9Sstevel@tonic-gate 788f4b3ec61Sdh if (port < sctps->sctps_smallest_nonpriv_port) 789f4b3ec61Sdh port = sctps->sctps_smallest_nonpriv_port; 7907c478bd9Sstevel@tonic-gate 791f4b3ec61Sdh for (i = 0; i < sctps->sctps_g_num_epriv_ports; i++) { 792f4b3ec61Sdh if (port == sctps->sctps_g_epriv_ports[i]) { 7937c478bd9Sstevel@tonic-gate port++; 7947c478bd9Sstevel@tonic-gate /* 7957c478bd9Sstevel@tonic-gate * Make sure whether the port is in the 7967c478bd9Sstevel@tonic-gate * valid range. 7977c478bd9Sstevel@tonic-gate * 7987c478bd9Sstevel@tonic-gate * XXX Note that if sctp_g_epriv_ports contains 7997c478bd9Sstevel@tonic-gate * all the anonymous ports this will be an 8007c478bd9Sstevel@tonic-gate * infinite loop. 8017c478bd9Sstevel@tonic-gate */ 8027c478bd9Sstevel@tonic-gate goto retry; 8037c478bd9Sstevel@tonic-gate } 8047c478bd9Sstevel@tonic-gate } 80545916cd2Sjpk 80645916cd2Sjpk if (is_system_labeled() && 80745916cd2Sjpk (i = tsol_next_port(zone, port, IPPROTO_SCTP, B_TRUE)) != 0) { 80845916cd2Sjpk port = i; 80945916cd2Sjpk goto retry; 81045916cd2Sjpk } 81145916cd2Sjpk 8127c478bd9Sstevel@tonic-gate return (port); 8137c478bd9Sstevel@tonic-gate } 814