17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
545916cd2Sjpk  * Common Development and Distribution License (the "License").
645916cd2Sjpk  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
2177c67f2fSkcpoon 
227c478bd9Sstevel@tonic-gate /*
235dd46ab5SKacheong Poon  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
267c478bd9Sstevel@tonic-gate #include <sys/types.h>
277c478bd9Sstevel@tonic-gate #include <sys/systm.h>
287c478bd9Sstevel@tonic-gate #include <sys/stream.h>
297c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h>
307c478bd9Sstevel@tonic-gate #include <sys/md5.h>
317c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
327c478bd9Sstevel@tonic-gate #include <sys/strsubr.h>
337c478bd9Sstevel@tonic-gate #include <sys/random.h>
3445916cd2Sjpk #include <sys/tsol/tnet.h>
357c478bd9Sstevel@tonic-gate 
367c478bd9Sstevel@tonic-gate #include <netinet/in.h>
377c478bd9Sstevel@tonic-gate #include <netinet/ip6.h>
387c478bd9Sstevel@tonic-gate 
397c478bd9Sstevel@tonic-gate #include <inet/common.h>
407c478bd9Sstevel@tonic-gate #include <inet/ip.h>
417c478bd9Sstevel@tonic-gate #include <inet/ip6.h>
42bd670b35SErik Nordmark #include <inet/ipsec_impl.h>
437c478bd9Sstevel@tonic-gate #include <inet/sctp_ip.h>
447c478bd9Sstevel@tonic-gate #include <inet/ipclassifier.h>
457c478bd9Sstevel@tonic-gate #include "sctp_impl.h"
467c478bd9Sstevel@tonic-gate 
471d8c4025Svi /*
481d8c4025Svi  * Helper function for SunCluster (PSARC/2005/602) to get the original source
491d8c4025Svi  * address from the COOKIE
501d8c4025Svi  */
511d8c4025Svi int cl_sctp_cookie_paddr(sctp_chunk_hdr_t *, in6_addr_t *);
521d8c4025Svi 
537c478bd9Sstevel@tonic-gate /*
547c478bd9Sstevel@tonic-gate  * From RFC 2104. This should probably go into libmd5 (and while
557c478bd9Sstevel@tonic-gate  * we're at it, maybe we should make a libdigest so we can later
567c478bd9Sstevel@tonic-gate  * add SHA1 and others, esp. since some weaknesses have been found
577c478bd9Sstevel@tonic-gate  * with MD5).
587c478bd9Sstevel@tonic-gate  *
597c478bd9Sstevel@tonic-gate  * text		IN			pointer to data stream
607c478bd9Sstevel@tonic-gate  * text_len	IN			length of data stream
617c478bd9Sstevel@tonic-gate  * key		IN			pointer to authentication key
627c478bd9Sstevel@tonic-gate  * key_len	IN			length of authentication key
637c478bd9Sstevel@tonic-gate  * digest	OUT			caller digest to be filled in
647c478bd9Sstevel@tonic-gate  */
657c478bd9Sstevel@tonic-gate static void
hmac_md5(uchar_t * text,size_t text_len,uchar_t * key,size_t key_len,uchar_t * digest)667c478bd9Sstevel@tonic-gate hmac_md5(uchar_t *text, size_t text_len, uchar_t *key, size_t key_len,
677c478bd9Sstevel@tonic-gate     uchar_t *digest)
687c478bd9Sstevel@tonic-gate {
697c478bd9Sstevel@tonic-gate 	MD5_CTX context;
707c478bd9Sstevel@tonic-gate 	uchar_t k_ipad[65];	/* inner padding - key XORd with ipad */
717c478bd9Sstevel@tonic-gate 	uchar_t k_opad[65];	/* outer padding - key XORd with opad */
727c478bd9Sstevel@tonic-gate 	uchar_t tk[16];
737c478bd9Sstevel@tonic-gate 	int i;
747c478bd9Sstevel@tonic-gate 
757c478bd9Sstevel@tonic-gate 	/* if key is longer than 64 bytes reset it to key=MD5(key) */
767c478bd9Sstevel@tonic-gate 	if (key_len > 64) {
777c478bd9Sstevel@tonic-gate 		MD5_CTX tctx;
787c478bd9Sstevel@tonic-gate 
797c478bd9Sstevel@tonic-gate 		MD5Init(&tctx);
807c478bd9Sstevel@tonic-gate 		MD5Update(&tctx, key, key_len);
817c478bd9Sstevel@tonic-gate 		MD5Final(tk, &tctx);
827c478bd9Sstevel@tonic-gate 
837c478bd9Sstevel@tonic-gate 		key = tk;
847c478bd9Sstevel@tonic-gate 		key_len = 16;
857c478bd9Sstevel@tonic-gate 	}
867c478bd9Sstevel@tonic-gate 
877c478bd9Sstevel@tonic-gate 	/*
887c478bd9Sstevel@tonic-gate 	 * the HMAC_MD5 transform looks like:
897c478bd9Sstevel@tonic-gate 	 *
907c478bd9Sstevel@tonic-gate 	 * MD5(K XOR opad, MD5(K XOR ipad, text))
917c478bd9Sstevel@tonic-gate 	 *
927c478bd9Sstevel@tonic-gate 	 * where K is an n byte key
937c478bd9Sstevel@tonic-gate 	 * ipad is the byte 0x36 repeated 64 times
947c478bd9Sstevel@tonic-gate 	 * opad is the byte 0x5c repeated 64 times
957c478bd9Sstevel@tonic-gate 	 * and text is the data being protected
967c478bd9Sstevel@tonic-gate 	 */
977c478bd9Sstevel@tonic-gate 
987c478bd9Sstevel@tonic-gate 	/* start out by storing key in pads */
997c478bd9Sstevel@tonic-gate 	bzero(k_ipad, sizeof (k_ipad));
1007c478bd9Sstevel@tonic-gate 	bzero(k_opad, sizeof (k_opad));
1017c478bd9Sstevel@tonic-gate 	bcopy(key, k_ipad, key_len);
1027c478bd9Sstevel@tonic-gate 	bcopy(key, k_opad, key_len);
1037c478bd9Sstevel@tonic-gate 
1047c478bd9Sstevel@tonic-gate 	/* XOR key with ipad and opad values */
1057c478bd9Sstevel@tonic-gate 	for (i = 0; i < 64; i++) {
1067c478bd9Sstevel@tonic-gate 		k_ipad[i] ^= 0x36;
1077c478bd9Sstevel@tonic-gate 		k_opad[i] ^= 0x5c;
1087c478bd9Sstevel@tonic-gate 	}
1097c478bd9Sstevel@tonic-gate 	/*
1107c478bd9Sstevel@tonic-gate 	 * perform inner MD5
1117c478bd9Sstevel@tonic-gate 	 */
1127c478bd9Sstevel@tonic-gate 	MD5Init(&context);			/* init context for 1st */
1137c478bd9Sstevel@tonic-gate 						/* pass */
1147c478bd9Sstevel@tonic-gate 	MD5Update(&context, k_ipad, 64);	/* start with inner pad */
1157c478bd9Sstevel@tonic-gate 	MD5Update(&context, text, text_len);	/* then text of datagram */
1167c478bd9Sstevel@tonic-gate 	MD5Final(digest, &context);		/* finish up 1st pass */
1177c478bd9Sstevel@tonic-gate 	/*
1187c478bd9Sstevel@tonic-gate 	 * perform outer MD5
1197c478bd9Sstevel@tonic-gate 	 */
1207c478bd9Sstevel@tonic-gate 	MD5Init(&context);			/* init context for 2nd */
1217c478bd9Sstevel@tonic-gate 						/* pass */
1227c478bd9Sstevel@tonic-gate 	MD5Update(&context, k_opad, 64);	/* start with outer pad */
1237c478bd9Sstevel@tonic-gate 	MD5Update(&context, digest, 16);	/* then results of 1st */
1247c478bd9Sstevel@tonic-gate 						/* hash */
1257c478bd9Sstevel@tonic-gate 	MD5Final(digest, &context);		/* finish up 2nd pass */
1267c478bd9Sstevel@tonic-gate }
1277c478bd9Sstevel@tonic-gate 
1287c478bd9Sstevel@tonic-gate /*
1297c478bd9Sstevel@tonic-gate  * If inmp is non-NULL, and we need to abort, it will use the IP/SCTP
1307c478bd9Sstevel@tonic-gate  * info in initmp to send the abort. Otherwise, no abort will be sent.
1317c478bd9Sstevel@tonic-gate  *
132c513743fSGeorge Shepherd  * When called from stcp_send_initack() while processing parameters
13377ebe684SGeorge Shepherd  * from a received INIT_CHUNK want_cookie will be NULL.
13477ebe684SGeorge Shepherd  *
13577ebe684SGeorge Shepherd  * When called from sctp_send_cookie_echo() while processing an INIT_ACK,
13677ebe684SGeorge Shepherd  * want_cookie contains a pointer to a pointer of type *sctp_parm_hdr_t.
13777ebe684SGeorge Shepherd  * However, this last pointer will be NULL until the cookie is processed
13877ebe684SGeorge Shepherd  * at which time it will be set to point to a sctp_parm_hdr_t that contains
13977ebe684SGeorge Shepherd  * the cookie info.
14077ebe684SGeorge Shepherd  *
14177ebe684SGeorge Shepherd  * Note: an INIT_ACK is expected to contain a cookie.
14277ebe684SGeorge Shepherd  *
143c513743fSGeorge Shepherd  * When processing an INIT_ACK, an ERROR chunk and chain of one or more
144c513743fSGeorge Shepherd  * error CAUSE blocks will be created if unrecognized parameters marked by
145c513743fSGeorge Shepherd  * the sender as reportable are found.
146c513743fSGeorge Shepherd  *
147c513743fSGeorge Shepherd  * When processing an INIT chunk, a chain of one or more error CAUSE blocks
148c513743fSGeorge Shepherd  * will be created if unrecognized parameters marked by the sender as
149c513743fSGeorge Shepherd  * reportable are found. These are appended directly to the INIT_ACK chunk.
150c513743fSGeorge Shepherd  *
151c513743fSGeorge Shepherd  * In both cases the error chain is visible to the caller via *errmp.
152c513743fSGeorge Shepherd  *
15377ebe684SGeorge Shepherd  * Returns 1 if the parameters are OK (or if there are no optional
15477ebe684SGeorge Shepherd  * parameters), returns 0 otherwise.
1557c478bd9Sstevel@tonic-gate  */
1567c478bd9Sstevel@tonic-gate static int
validate_init_params(sctp_t * sctp,sctp_chunk_hdr_t * ch,sctp_init_chunk_t * init,mblk_t * inmp,sctp_parm_hdr_t ** want_cookie,mblk_t ** errmp,int * supp_af,uint_t * sctp_options,ip_recv_attr_t * ira)1577c478bd9Sstevel@tonic-gate validate_init_params(sctp_t *sctp, sctp_chunk_hdr_t *ch,
1587c478bd9Sstevel@tonic-gate     sctp_init_chunk_t *init, mblk_t *inmp, sctp_parm_hdr_t **want_cookie,
159bd670b35SErik Nordmark     mblk_t **errmp, int *supp_af, uint_t *sctp_options, ip_recv_attr_t *ira)
1607c478bd9Sstevel@tonic-gate {
1617c478bd9Sstevel@tonic-gate 	sctp_parm_hdr_t		*cph;
1627c478bd9Sstevel@tonic-gate 	sctp_init_chunk_t	*ic;
1637c478bd9Sstevel@tonic-gate 	ssize_t			remaining;
1647c478bd9Sstevel@tonic-gate 	uint16_t		serror = 0;
1657c478bd9Sstevel@tonic-gate 	char			*details = NULL;
1667c478bd9Sstevel@tonic-gate 	size_t			errlen = 0;
1677c478bd9Sstevel@tonic-gate 	boolean_t		got_cookie = B_FALSE;
16877ebe684SGeorge Shepherd 	boolean_t		got_errchunk = B_FALSE;
1697c478bd9Sstevel@tonic-gate 	uint16_t		ptype;
17047b33325SGeorge Shepherd 	sctp_mpc_t		mpc;
171bd670b35SErik Nordmark 	conn_t			*connp = sctp->sctp_connp;
17247b33325SGeorge Shepherd 
1737c478bd9Sstevel@tonic-gate 
17477ebe684SGeorge Shepherd 	ASSERT(errmp != NULL);
17577ebe684SGeorge Shepherd 
1767c478bd9Sstevel@tonic-gate 	if (sctp_options != NULL)
1777c478bd9Sstevel@tonic-gate 		*sctp_options = 0;
1787c478bd9Sstevel@tonic-gate 
1797c478bd9Sstevel@tonic-gate 	/* First validate stream parameters */
1807c478bd9Sstevel@tonic-gate 	if (init->sic_instr == 0 || init->sic_outstr == 0) {
1817c478bd9Sstevel@tonic-gate 		serror = SCTP_ERR_BAD_MANDPARM;
182222c5bceSkp 		dprint(1, ("validate_init_params: bad sid, is=%d os=%d\n",
183558fbd03Skcpoon 		    htons(init->sic_instr), htons(init->sic_outstr)));
1847c478bd9Sstevel@tonic-gate 		goto abort;
1857c478bd9Sstevel@tonic-gate 	}
1867c478bd9Sstevel@tonic-gate 	if (ntohl(init->sic_inittag) == 0) {
1877c478bd9Sstevel@tonic-gate 		serror = SCTP_ERR_BAD_MANDPARM;
1887c478bd9Sstevel@tonic-gate 		dprint(1, ("validate_init_params: inittag = 0\n"));
1897c478bd9Sstevel@tonic-gate 		goto abort;
1907c478bd9Sstevel@tonic-gate 	}
1917c478bd9Sstevel@tonic-gate 
1927c478bd9Sstevel@tonic-gate 	remaining = ntohs(ch->sch_len) - sizeof (*ch);
1937c478bd9Sstevel@tonic-gate 	ic = (sctp_init_chunk_t *)(ch + 1);
1947c478bd9Sstevel@tonic-gate 	remaining -= sizeof (*ic);
1957c478bd9Sstevel@tonic-gate 	if (remaining < sizeof (*cph)) {
19677ebe684SGeorge Shepherd 		/*
19777ebe684SGeorge Shepherd 		 * When processing a received INIT_ACK, a cookie is
19877ebe684SGeorge Shepherd 		 * expected, if missing there is nothing to validate.
19977ebe684SGeorge Shepherd 		 */
2007c478bd9Sstevel@tonic-gate 		if (want_cookie != NULL)
2017c478bd9Sstevel@tonic-gate 			goto cookie_abort;
2027c478bd9Sstevel@tonic-gate 		return (1);
2037c478bd9Sstevel@tonic-gate 	}
2047c478bd9Sstevel@tonic-gate 
2057c478bd9Sstevel@tonic-gate 	cph = (sctp_parm_hdr_t *)(ic + 1);
2067c478bd9Sstevel@tonic-gate 
2077c478bd9Sstevel@tonic-gate 	while (cph != NULL) {
2087c478bd9Sstevel@tonic-gate 		ptype = ntohs(cph->sph_type);
2097c478bd9Sstevel@tonic-gate 		switch (ptype) {
2107c478bd9Sstevel@tonic-gate 		case PARM_HBINFO:
2117c478bd9Sstevel@tonic-gate 		case PARM_UNRECOGNIZED:
2127c478bd9Sstevel@tonic-gate 		case PARM_ECN:
2137c478bd9Sstevel@tonic-gate 			/* just ignore them */
2147c478bd9Sstevel@tonic-gate 			break;
2157c478bd9Sstevel@tonic-gate 		case PARM_FORWARD_TSN:
2167c478bd9Sstevel@tonic-gate 			if (sctp_options != NULL)
2177c478bd9Sstevel@tonic-gate 				*sctp_options |= SCTP_PRSCTP_OPTION;
2187c478bd9Sstevel@tonic-gate 			break;
2197c478bd9Sstevel@tonic-gate 		case PARM_COOKIE:
2207c478bd9Sstevel@tonic-gate 			got_cookie = B_TRUE;
22177ebe684SGeorge Shepherd 			/*
22277ebe684SGeorge Shepherd 			 * Processing a received INIT_ACK, we have a cookie
22377ebe684SGeorge Shepherd 			 * and a valid pointer in our caller to attach it to.
22477ebe684SGeorge Shepherd 			 */
2257c478bd9Sstevel@tonic-gate 			if (want_cookie != NULL) {
2267c478bd9Sstevel@tonic-gate 				*want_cookie = cph;
2277c478bd9Sstevel@tonic-gate 			}
2287c478bd9Sstevel@tonic-gate 			break;
2297c478bd9Sstevel@tonic-gate 		case PARM_ADDR4:
230f551bb10Svi 			*supp_af |= PARM_SUPP_V4;
231f551bb10Svi 			break;
2327c478bd9Sstevel@tonic-gate 		case PARM_ADDR6:
233f551bb10Svi 			*supp_af |= PARM_SUPP_V6;
234f551bb10Svi 			break;
2357c478bd9Sstevel@tonic-gate 		case PARM_COOKIE_PRESERVE:
2367c478bd9Sstevel@tonic-gate 		case PARM_ADAPT_LAYER_IND:
2377c478bd9Sstevel@tonic-gate 			/* These are OK */
2387c478bd9Sstevel@tonic-gate 			break;
2397c478bd9Sstevel@tonic-gate 		case PARM_ADDR_HOST_NAME:
2407c478bd9Sstevel@tonic-gate 			/* Don't support this; abort the association */
2417c478bd9Sstevel@tonic-gate 			serror = SCTP_ERR_BAD_ADDR;
2427c478bd9Sstevel@tonic-gate 			details = (char *)cph;
2437c478bd9Sstevel@tonic-gate 			errlen = ntohs(cph->sph_len);
2447c478bd9Sstevel@tonic-gate 			dprint(1, ("sctp:validate_init_params: host addr\n"));
2457c478bd9Sstevel@tonic-gate 			goto abort;
2467c478bd9Sstevel@tonic-gate 		case PARM_SUPP_ADDRS: {
2477c478bd9Sstevel@tonic-gate 			/* Make sure we have a supported addr intersection */
2487c478bd9Sstevel@tonic-gate 			uint16_t *p, addrtype;
2497c478bd9Sstevel@tonic-gate 			int plen;
2507c478bd9Sstevel@tonic-gate 
2517c478bd9Sstevel@tonic-gate 			plen = ntohs(cph->sph_len);
2527c478bd9Sstevel@tonic-gate 			p = (uint16_t *)(cph + 1);
2537c478bd9Sstevel@tonic-gate 			while (plen > 0) {
2547c478bd9Sstevel@tonic-gate 				addrtype = ntohs(*p);
2557c478bd9Sstevel@tonic-gate 				switch (addrtype) {
2567c478bd9Sstevel@tonic-gate 				case PARM_ADDR6:
2577c478bd9Sstevel@tonic-gate 					*supp_af |= PARM_SUPP_V6;
2587c478bd9Sstevel@tonic-gate 					break;
2597c478bd9Sstevel@tonic-gate 				case PARM_ADDR4:
2607c478bd9Sstevel@tonic-gate 					*supp_af |= PARM_SUPP_V4;
2617c478bd9Sstevel@tonic-gate 					break;
2627c478bd9Sstevel@tonic-gate 				default:
2637c478bd9Sstevel@tonic-gate 					/*
2647c478bd9Sstevel@tonic-gate 					 * Do nothing, silently ignore hostname
2657c478bd9Sstevel@tonic-gate 					 * address.
2667c478bd9Sstevel@tonic-gate 					 */
2677c478bd9Sstevel@tonic-gate 					break;
2687c478bd9Sstevel@tonic-gate 				}
2697c478bd9Sstevel@tonic-gate 				p++;
2707c478bd9Sstevel@tonic-gate 				plen -= sizeof (*p);
2717c478bd9Sstevel@tonic-gate 			}
2727c478bd9Sstevel@tonic-gate 			break;
2737c478bd9Sstevel@tonic-gate 		}
2747c478bd9Sstevel@tonic-gate 		default:
27577ebe684SGeorge Shepherd 			/*
27677ebe684SGeorge Shepherd 			 * Handle any unrecognized params, the two high order
27777ebe684SGeorge Shepherd 			 * bits of ptype define how the remote wants them
27877ebe684SGeorge Shepherd 			 * handled.
27977ebe684SGeorge Shepherd 			 * Top bit:
28077ebe684SGeorge Shepherd 			 *    1. Continue processing other params in the chunk
28177ebe684SGeorge Shepherd 			 *    0. Stop processing params after this one.
28277ebe684SGeorge Shepherd 			 * 2nd bit:
28377ebe684SGeorge Shepherd 			 *    1. Must report this unrecognized param to remote
28477ebe684SGeorge Shepherd 			 *    0. Obey the top bit silently.
28577ebe684SGeorge Shepherd 			 */
28677ebe684SGeorge Shepherd 			if (ptype & SCTP_REPORT_THIS_PARAM) {
287c513743fSGeorge Shepherd 				if (!got_errchunk && want_cookie != NULL) {
28877ebe684SGeorge Shepherd 					/*
2895e8aaf77SGeorge Shepherd 					 * The incoming pointer want_cookie is
2905e8aaf77SGeorge Shepherd 					 * NULL so processing an INIT_ACK.
2915e8aaf77SGeorge Shepherd 					 * This is the first reportable param,
2925e8aaf77SGeorge Shepherd 					 * create an ERROR chunk and populate
2935e8aaf77SGeorge Shepherd 					 * it with a CAUSE block for this parm.
29477ebe684SGeorge Shepherd 					 */
29577ebe684SGeorge Shepherd 					*errmp = sctp_make_err(sctp,
29677ebe684SGeorge Shepherd 					    PARM_UNRECOGNIZED,
29777ebe684SGeorge Shepherd 					    (void *)cph,
29877ebe684SGeorge Shepherd 					    ntohs(cph->sph_len));
29977ebe684SGeorge Shepherd 					got_errchunk = B_TRUE;
30077ebe684SGeorge Shepherd 				} else {
30177ebe684SGeorge Shepherd 					/*
3025e8aaf77SGeorge Shepherd 					 * If processing an INIT_ACK, we already
3035e8aaf77SGeorge Shepherd 					 * have an ERROR chunk, just add a new
3045e8aaf77SGeorge Shepherd 					 * CAUSE block and update ERROR chunk
3055e8aaf77SGeorge Shepherd 					 * length.
3065e8aaf77SGeorge Shepherd 					 * If processing an INIT chunk add a new
3075e8aaf77SGeorge Shepherd 					 * CAUSE block to the INIT_ACK, in this
3085e8aaf77SGeorge Shepherd 					 * case there is no ERROR chunk thus
3095e8aaf77SGeorge Shepherd 					 * got_errchunk will be B_FALSE. Chunk
3105e8aaf77SGeorge Shepherd 					 * length is computed by our caller.
31177ebe684SGeorge Shepherd 					 */
312c513743fSGeorge Shepherd 					sctp_add_unrec_parm(cph, errmp,
313c513743fSGeorge Shepherd 					    got_errchunk);
3147c478bd9Sstevel@tonic-gate 				}
3157c478bd9Sstevel@tonic-gate 			}
31677ebe684SGeorge Shepherd 			if (ptype & SCTP_CONT_PROC_PARAMS) {
3177c478bd9Sstevel@tonic-gate 				/*
31877ebe684SGeorge Shepherd 				 * Continue processing params after this
31977ebe684SGeorge Shepherd 				 * parameter.
3207c478bd9Sstevel@tonic-gate 				 */
3217c478bd9Sstevel@tonic-gate 				break;
3227c478bd9Sstevel@tonic-gate 			}
3237c478bd9Sstevel@tonic-gate 
3247c478bd9Sstevel@tonic-gate 			/*
32577ebe684SGeorge Shepherd 			 * Stop processing params, report any reportable
32677ebe684SGeorge Shepherd 			 * unrecognized params found so far.
3277c478bd9Sstevel@tonic-gate 			 */
32877ebe684SGeorge Shepherd 			goto done;
3297c478bd9Sstevel@tonic-gate 		}
3307c478bd9Sstevel@tonic-gate 
3317c478bd9Sstevel@tonic-gate 		cph = sctp_next_parm(cph, &remaining);
3327c478bd9Sstevel@tonic-gate 	}
33377ebe684SGeorge Shepherd done:
334f551bb10Svi 	/*
335f551bb10Svi 	 * Some sanity checks.  The following should not fail unless the
336f551bb10Svi 	 * other side is broken.
337f551bb10Svi 	 *
338f551bb10Svi 	 * 1. If this is a V4 endpoint but V4 address is not
339f551bb10Svi 	 * supported, abort.
340f551bb10Svi 	 * 2. If this is a V6 only endpoint but V6 address is
341f551bb10Svi 	 * not supported, abort.  This assumes that a V6
342f551bb10Svi 	 * endpoint can use both V4 and V6 addresses.
343f551bb10Svi 	 * We only care about supp_af when processing INIT, i.e want_cookie
344f551bb10Svi 	 * is NULL.
345f551bb10Svi 	 */
346f551bb10Svi 	if (want_cookie == NULL &&
347bd670b35SErik Nordmark 	    ((connp->conn_family == AF_INET && !(*supp_af & PARM_SUPP_V4)) ||
348bd670b35SErik Nordmark 	    (connp->conn_family == AF_INET6 && !(*supp_af & PARM_SUPP_V6) &&
349f551bb10Svi 	    sctp->sctp_connp->conn_ipv6_v6only))) {
350f551bb10Svi 		dprint(1, ("sctp:validate_init_params: supp addr\n"));
351f551bb10Svi 		serror = SCTP_ERR_BAD_ADDR;
352f551bb10Svi 		goto abort;
353f551bb10Svi 	}
3547c478bd9Sstevel@tonic-gate 
3557c478bd9Sstevel@tonic-gate 	if (want_cookie != NULL && !got_cookie) {
3567c478bd9Sstevel@tonic-gate cookie_abort:
35747b33325SGeorge Shepherd 		/* Will populate the CAUSE block in the ABORT chunk. */
35847b33325SGeorge Shepherd 		mpc.mpc_num =  htons(1);
35947b33325SGeorge Shepherd 		mpc.mpc_param = htons(PARM_COOKIE);
36047b33325SGeorge Shepherd 		mpc.mpc_pad = 0;
36147b33325SGeorge Shepherd 
3627c478bd9Sstevel@tonic-gate 		dprint(1, ("validate_init_params: cookie absent\n"));
3637c478bd9Sstevel@tonic-gate 		sctp_send_abort(sctp, sctp_init2vtag(ch), SCTP_ERR_MISSING_PARM,
364bd670b35SErik Nordmark 		    (char *)&mpc, sizeof (sctp_mpc_t), inmp, 0, B_FALSE, ira);
3657c478bd9Sstevel@tonic-gate 		return (0);
3667c478bd9Sstevel@tonic-gate 	}
3677c478bd9Sstevel@tonic-gate 
3687c478bd9Sstevel@tonic-gate 	/* OK */
3697c478bd9Sstevel@tonic-gate 	return (1);
3707c478bd9Sstevel@tonic-gate 
3717c478bd9Sstevel@tonic-gate abort:
3727c478bd9Sstevel@tonic-gate 	if (want_cookie != NULL)
3737c478bd9Sstevel@tonic-gate 		return (0);
3747c478bd9Sstevel@tonic-gate 
3757c478bd9Sstevel@tonic-gate 	sctp_send_abort(sctp, sctp_init2vtag(ch), serror, details,
376bd670b35SErik Nordmark 	    errlen, inmp, 0, B_FALSE, ira);
3777c478bd9Sstevel@tonic-gate 	return (0);
3787c478bd9Sstevel@tonic-gate }
3797c478bd9Sstevel@tonic-gate 
3807c478bd9Sstevel@tonic-gate /*
3817c478bd9Sstevel@tonic-gate  * Initialize params from the INIT and INIT-ACK when the assoc. is
3827c478bd9Sstevel@tonic-gate  * established.
3837c478bd9Sstevel@tonic-gate  */
3847c478bd9Sstevel@tonic-gate boolean_t
sctp_initialize_params(sctp_t * sctp,sctp_init_chunk_t * init,sctp_init_chunk_t * iack)3857c478bd9Sstevel@tonic-gate sctp_initialize_params(sctp_t *sctp, sctp_init_chunk_t *init,
3867c478bd9Sstevel@tonic-gate     sctp_init_chunk_t *iack)
3877c478bd9Sstevel@tonic-gate {
3887c478bd9Sstevel@tonic-gate 	/* Get initial TSN */
3897c478bd9Sstevel@tonic-gate 	sctp->sctp_ftsn = ntohl(init->sic_inittsn);
3907c478bd9Sstevel@tonic-gate 	sctp->sctp_lastacked = sctp->sctp_ftsn - 1;
3917c478bd9Sstevel@tonic-gate 
3927c478bd9Sstevel@tonic-gate 	/* Serial number is initialized to the same value as the TSN */
3937c478bd9Sstevel@tonic-gate 	sctp->sctp_fcsn = sctp->sctp_lastacked;
3947c478bd9Sstevel@tonic-gate 
3957c478bd9Sstevel@tonic-gate 	/*
3967c478bd9Sstevel@tonic-gate 	 * Get verification tags; no byteordering is necessary, since
3977c478bd9Sstevel@tonic-gate 	 * verfication tags are never processed except for byte-by-byte
3987c478bd9Sstevel@tonic-gate 	 * comparisons.
3997c478bd9Sstevel@tonic-gate 	 */
4007c478bd9Sstevel@tonic-gate 	sctp->sctp_fvtag = init->sic_inittag;
4017c478bd9Sstevel@tonic-gate 	sctp->sctp_sctph->sh_verf = init->sic_inittag;
4027c478bd9Sstevel@tonic-gate 	sctp->sctp_sctph6->sh_verf = init->sic_inittag;
4037c478bd9Sstevel@tonic-gate 	sctp->sctp_lvtag = iack->sic_inittag;
4047c478bd9Sstevel@tonic-gate 
4057c478bd9Sstevel@tonic-gate 	/* Get the peer's rwnd */
4067c478bd9Sstevel@tonic-gate 	sctp->sctp_frwnd = ntohl(init->sic_a_rwnd);
4077c478bd9Sstevel@tonic-gate 
4087c478bd9Sstevel@tonic-gate 	/* Allocate the in/out-stream counters */
4097c478bd9Sstevel@tonic-gate 	sctp->sctp_num_ostr = iack->sic_outstr;
4107c478bd9Sstevel@tonic-gate 	sctp->sctp_ostrcntrs = kmem_zalloc(sizeof (uint16_t) *
4117c478bd9Sstevel@tonic-gate 	    sctp->sctp_num_ostr, KM_NOSLEEP);
4127c478bd9Sstevel@tonic-gate 	if (sctp->sctp_ostrcntrs == NULL)
4137c478bd9Sstevel@tonic-gate 		return (B_FALSE);
4147c478bd9Sstevel@tonic-gate 
4157c478bd9Sstevel@tonic-gate 	sctp->sctp_num_istr = iack->sic_instr;
4167c478bd9Sstevel@tonic-gate 	sctp->sctp_instr = kmem_zalloc(sizeof (*sctp->sctp_instr) *
4177c478bd9Sstevel@tonic-gate 	    sctp->sctp_num_istr, KM_NOSLEEP);
4187c478bd9Sstevel@tonic-gate 	if (sctp->sctp_instr == NULL) {
4197c478bd9Sstevel@tonic-gate 		kmem_free(sctp->sctp_ostrcntrs, sizeof (uint16_t) *
4207c478bd9Sstevel@tonic-gate 		    sctp->sctp_num_ostr);
4217c478bd9Sstevel@tonic-gate 		sctp->sctp_ostrcntrs = NULL;
4227c478bd9Sstevel@tonic-gate 		return (B_FALSE);
4237c478bd9Sstevel@tonic-gate 	}
4247c478bd9Sstevel@tonic-gate 	return (B_TRUE);
4257c478bd9Sstevel@tonic-gate }
4267c478bd9Sstevel@tonic-gate 
4271d8c4025Svi /*
4281d8c4025Svi  * Copy the peer's original source address into addr. This relies on the
4291d8c4025Svi  * following format (see sctp_send_initack() below):
430*ab82c29bSToomas Soome  *	relative timestamp for the cookie (int64_t) +
431*ab82c29bSToomas Soome  *	cookie lifetime (uint32_t) +
432*ab82c29bSToomas Soome  *	local tie-tag (uint32_t) +  peer tie-tag (uint32_t) +
433*ab82c29bSToomas Soome  *	Peer's original src ...
4341d8c4025Svi  */
4351d8c4025Svi int
cl_sctp_cookie_paddr(sctp_chunk_hdr_t * ch,in6_addr_t * addr)4361d8c4025Svi cl_sctp_cookie_paddr(sctp_chunk_hdr_t *ch, in6_addr_t *addr)
4371d8c4025Svi {
4381d8c4025Svi 	uchar_t	*off;
4391d8c4025Svi 
4401d8c4025Svi 	ASSERT(addr != NULL);
4411d8c4025Svi 
4421d8c4025Svi 	if (ch->sch_id != CHUNK_COOKIE)
4431d8c4025Svi 		return (EINVAL);
4441d8c4025Svi 
4451d8c4025Svi 	off = (uchar_t *)ch + sizeof (*ch) + sizeof (int64_t) +
4461d8c4025Svi 	    sizeof (uint32_t) + sizeof (uint32_t) + sizeof (uint32_t);
4471d8c4025Svi 
4481d8c4025Svi 	bcopy(off, addr, sizeof (*addr));
4491d8c4025Svi 
4501d8c4025Svi 	return (0);
4511d8c4025Svi }
4521d8c4025Svi 
4537c478bd9Sstevel@tonic-gate #define	SCTP_CALC_COOKIE_LEN(initcp) \
4547c478bd9Sstevel@tonic-gate 	sizeof (int64_t) +		/* timestamp */			\
4557c478bd9Sstevel@tonic-gate 	sizeof (uint32_t) +		/* cookie lifetime */		\
4567c478bd9Sstevel@tonic-gate 	sizeof (sctp_init_chunk_t) +	/* INIT ACK */			\
457*ab82c29bSToomas Soome 	sizeof (in6_addr_t) +		/* peer's original source */	\
4587c478bd9Sstevel@tonic-gate 	ntohs((initcp)->sch_len) +	/* peer's INIT */		\
4597c478bd9Sstevel@tonic-gate 	sizeof (uint32_t) +		/* local tie-tag */		\
4607c478bd9Sstevel@tonic-gate 	sizeof (uint32_t) +		/* peer tie-tag */		\
4617c478bd9Sstevel@tonic-gate 	sizeof (sctp_parm_hdr_t) +	/* param header */		\
4627c478bd9Sstevel@tonic-gate 	16				/* MD5 hash */
4637c478bd9Sstevel@tonic-gate 
464bd670b35SErik Nordmark /*
465bd670b35SErik Nordmark  * Note that sctp is the listener, hence we shouldn't modify it.
466bd670b35SErik Nordmark  */
4677c478bd9Sstevel@tonic-gate void
sctp_send_initack(sctp_t * sctp,sctp_hdr_t * initsh,sctp_chunk_hdr_t * ch,mblk_t * initmp,ip_recv_attr_t * ira)468d7ab25acSkp sctp_send_initack(sctp_t *sctp, sctp_hdr_t *initsh, sctp_chunk_hdr_t *ch,
469bd670b35SErik Nordmark     mblk_t *initmp, ip_recv_attr_t *ira)
4707c478bd9Sstevel@tonic-gate {
4717c478bd9Sstevel@tonic-gate 	ipha_t			*initiph;
4727c478bd9Sstevel@tonic-gate 	ip6_t			*initip6h;
473bd670b35SErik Nordmark 	ipha_t			*iackiph = NULL;
474bd670b35SErik Nordmark 	ip6_t			*iackip6h = NULL;
4757c478bd9Sstevel@tonic-gate 	sctp_chunk_hdr_t	*iack_ch;
4767c478bd9Sstevel@tonic-gate 	sctp_init_chunk_t	*iack;
4777c478bd9Sstevel@tonic-gate 	sctp_init_chunk_t	*init;
4787c478bd9Sstevel@tonic-gate 	sctp_hdr_t		*iacksh;
4797c478bd9Sstevel@tonic-gate 	size_t			cookielen;
4807c478bd9Sstevel@tonic-gate 	size_t			iacklen;
4817c478bd9Sstevel@tonic-gate 	size_t			ipsctplen;
4827c478bd9Sstevel@tonic-gate 	size_t			errlen = 0;
4837c478bd9Sstevel@tonic-gate 	sctp_parm_hdr_t		*cookieph;
4847c478bd9Sstevel@tonic-gate 	mblk_t			*iackmp;
4857c478bd9Sstevel@tonic-gate 	uint32_t		itag;
4867c478bd9Sstevel@tonic-gate 	uint32_t		itsn;
4877c478bd9Sstevel@tonic-gate 	int64_t			*now;
4887c478bd9Sstevel@tonic-gate 	int64_t			nowt;
4897c478bd9Sstevel@tonic-gate 	uint32_t		*lifetime;
4907c478bd9Sstevel@tonic-gate 	char			*p;
4917c478bd9Sstevel@tonic-gate 	boolean_t		 isv4;
492f551bb10Svi 	int			supp_af = 0;
4937c478bd9Sstevel@tonic-gate 	uint_t			sctp_options;
4947c478bd9Sstevel@tonic-gate 	uint32_t		*ttag;
4957c478bd9Sstevel@tonic-gate 	int			pad;
4967c478bd9Sstevel@tonic-gate 	mblk_t			*errmp = NULL;
4977c478bd9Sstevel@tonic-gate 	boolean_t		initcollision = B_FALSE;
498f551bb10Svi 	boolean_t		linklocal = B_FALSE;
499f4b3ec61Sdh 	sctp_stack_t		*sctps = sctp->sctp_sctps;
500bd670b35SErik Nordmark 	conn_t			*connp = sctp->sctp_connp;
501bd670b35SErik Nordmark 	int			err;
502bd670b35SErik Nordmark 	ip_xmit_attr_t		*ixa = NULL;
5037c478bd9Sstevel@tonic-gate 
5047c478bd9Sstevel@tonic-gate 	BUMP_LOCAL(sctp->sctp_ibchunks);
5057c478bd9Sstevel@tonic-gate 	isv4 = (IPH_HDR_VERSION(initmp->b_rptr) == IPV4_VERSION);
5067c478bd9Sstevel@tonic-gate 
5077c478bd9Sstevel@tonic-gate 	/* Extract the INIT chunk */
5087c478bd9Sstevel@tonic-gate 	if (isv4) {
5097c478bd9Sstevel@tonic-gate 		initiph = (ipha_t *)initmp->b_rptr;
5107c478bd9Sstevel@tonic-gate 		ipsctplen = sctp->sctp_ip_hdr_len;
511f551bb10Svi 		supp_af |= PARM_SUPP_V4;
5127c478bd9Sstevel@tonic-gate 	} else {
5137c478bd9Sstevel@tonic-gate 		initip6h = (ip6_t *)initmp->b_rptr;
5147c478bd9Sstevel@tonic-gate 		ipsctplen = sctp->sctp_ip_hdr6_len;
515bd670b35SErik Nordmark 		if (IN6_IS_ADDR_LINKLOCAL(&initip6h->ip6_src) ||
516bd670b35SErik Nordmark 		    IN6_IS_ADDR_LINKLOCAL(&initip6h->ip6_dst))
517f551bb10Svi 			linklocal = B_TRUE;
518f551bb10Svi 		supp_af |= PARM_SUPP_V6;
519bd670b35SErik Nordmark 		if (!sctp->sctp_connp->conn_ipv6_v6only)
520bd670b35SErik Nordmark 			supp_af |= PARM_SUPP_V4;
5217c478bd9Sstevel@tonic-gate 	}
5227c478bd9Sstevel@tonic-gate 	ASSERT(OK_32PTR(initsh));
5237c478bd9Sstevel@tonic-gate 	init = (sctp_init_chunk_t *)((char *)(initsh + 1) + sizeof (*iack_ch));
5247c478bd9Sstevel@tonic-gate 
5257c478bd9Sstevel@tonic-gate 	/* Make sure we like the peer's parameters */
5267c478bd9Sstevel@tonic-gate 	if (validate_init_params(sctp, ch, init, initmp, NULL, &errmp,
527bd670b35SErik Nordmark 	    &supp_af, &sctp_options, ira) == 0) {
5287c478bd9Sstevel@tonic-gate 		return;
5297c478bd9Sstevel@tonic-gate 	}
5307c478bd9Sstevel@tonic-gate 	if (errmp != NULL)
5317c478bd9Sstevel@tonic-gate 		errlen = msgdsize(errmp);
532bd670b35SErik Nordmark 	if (connp->conn_family == AF_INET) {
5337c478bd9Sstevel@tonic-gate 		/*
5345e8aaf77SGeorge Shepherd 		 * Regardless of the supported address in the INIT, v4
5357c478bd9Sstevel@tonic-gate 		 * must be supported.
5367c478bd9Sstevel@tonic-gate 		 */
5377c478bd9Sstevel@tonic-gate 		supp_af = PARM_SUPP_V4;
5387c478bd9Sstevel@tonic-gate 	}
5397c478bd9Sstevel@tonic-gate 	if (sctp->sctp_state <= SCTPS_LISTEN) {
5407c478bd9Sstevel@tonic-gate 		/* normal, expected INIT: generate new vtag and itsn */
5417c478bd9Sstevel@tonic-gate 		(void) random_get_pseudo_bytes((uint8_t *)&itag, sizeof (itag));
5427c478bd9Sstevel@tonic-gate 		if (itag == 0)
5437c478bd9Sstevel@tonic-gate 			itag = (uint32_t)gethrtime();
5447c478bd9Sstevel@tonic-gate 		itsn = itag + 1;
5457c478bd9Sstevel@tonic-gate 		itag = htonl(itag);
5467c478bd9Sstevel@tonic-gate 	} else if (sctp->sctp_state == SCTPS_COOKIE_WAIT ||
5477c478bd9Sstevel@tonic-gate 	    sctp->sctp_state == SCTPS_COOKIE_ECHOED) {
5487c478bd9Sstevel@tonic-gate 		/* init collision; copy vtag and itsn from sctp */
5497c478bd9Sstevel@tonic-gate 		itag = sctp->sctp_lvtag;
5507c478bd9Sstevel@tonic-gate 		itsn = sctp->sctp_ltsn;
5517c478bd9Sstevel@tonic-gate 		/*
5527c478bd9Sstevel@tonic-gate 		 * In addition we need to send all the params that was sent
5537c478bd9Sstevel@tonic-gate 		 * in our INIT chunk. Essentially, it is only the supported
5547c478bd9Sstevel@tonic-gate 		 * address params that we need to add.
5557c478bd9Sstevel@tonic-gate 		 */
5567c478bd9Sstevel@tonic-gate 		initcollision = B_TRUE;
557f551bb10Svi 		/*
558f551bb10Svi 		 * When we sent the INIT, we should have set linklocal in
559f551bb10Svi 		 * the sctp which should be good enough.
560f551bb10Svi 		 */
561f551bb10Svi 		if (linklocal)
562f551bb10Svi 			linklocal = B_FALSE;
5637c478bd9Sstevel@tonic-gate 	} else {
5647c478bd9Sstevel@tonic-gate 		/* peer restart; generate new vtag but keep everything else */
5657c478bd9Sstevel@tonic-gate 		(void) random_get_pseudo_bytes((uint8_t *)&itag, sizeof (itag));
5667c478bd9Sstevel@tonic-gate 		if (itag == 0)
5677c478bd9Sstevel@tonic-gate 			itag = (uint32_t)gethrtime();
5687c478bd9Sstevel@tonic-gate 		itag = htonl(itag);
5697c478bd9Sstevel@tonic-gate 		itsn = sctp->sctp_ltsn;
5707c478bd9Sstevel@tonic-gate 	}
5717c478bd9Sstevel@tonic-gate 
5727c478bd9Sstevel@tonic-gate 	/*
5737c478bd9Sstevel@tonic-gate 	 * Allocate a mblk for the INIT ACK, consisting of the link layer
5747c478bd9Sstevel@tonic-gate 	 * header, the IP header, the SCTP common header, and INIT ACK chunk,
5757c478bd9Sstevel@tonic-gate 	 * and finally the COOKIE parameter.
5767c478bd9Sstevel@tonic-gate 	 */
5777c478bd9Sstevel@tonic-gate 	cookielen = SCTP_CALC_COOKIE_LEN(ch);
5787c478bd9Sstevel@tonic-gate 	iacklen = sizeof (*iack_ch) + sizeof (*iack) + cookielen;
579558fbd03Skcpoon 	if (sctp->sctp_send_adaptation)
5807c478bd9Sstevel@tonic-gate 		iacklen += (sizeof (sctp_parm_hdr_t) + sizeof (uint32_t));
5817c478bd9Sstevel@tonic-gate 	if (((sctp_options & SCTP_PRSCTP_OPTION) || initcollision) &&
582f4b3ec61Sdh 	    sctp->sctp_prsctp_aware && sctps->sctps_prsctp_enabled) {
5837c478bd9Sstevel@tonic-gate 		iacklen += sctp_options_param_len(sctp, SCTP_PRSCTP_OPTION);
5847c478bd9Sstevel@tonic-gate 	}
5857c478bd9Sstevel@tonic-gate 	if (initcollision)
5867c478bd9Sstevel@tonic-gate 		iacklen += sctp_supaddr_param_len(sctp);
587f551bb10Svi 	if (!linklocal)
58812f47623Skcpoon 		iacklen += sctp_addr_params(sctp, supp_af, NULL, B_FALSE);
5897c478bd9Sstevel@tonic-gate 	ipsctplen += sizeof (*iacksh) + iacklen;
5907c478bd9Sstevel@tonic-gate 	iacklen += errlen;
5915e8aaf77SGeorge Shepherd 	/*
5925e8aaf77SGeorge Shepherd 	 * Padding is applied after the cookie which is the end of chunk
5935e8aaf77SGeorge Shepherd 	 * unless CAUSE blocks are appended when the pad must also be
5945e8aaf77SGeorge Shepherd 	 * accounted for in iacklen.
5955e8aaf77SGeorge Shepherd 	 */
5965e8aaf77SGeorge Shepherd 	if ((pad = ipsctplen % SCTP_ALIGN) != 0) {
5975e8aaf77SGeorge Shepherd 		pad = SCTP_ALIGN - pad;
5987c478bd9Sstevel@tonic-gate 		ipsctplen += pad;
5995e8aaf77SGeorge Shepherd 		if (errmp != NULL)
6005e8aaf77SGeorge Shepherd 			iacklen += pad;
6017c478bd9Sstevel@tonic-gate 	}
602d7ab25acSkp 
603d7ab25acSkp 	/*
604bd670b35SErik Nordmark 	 * Base the transmission on any routing-related socket options
605bd670b35SErik Nordmark 	 * that have been set on the listener.
606bd670b35SErik Nordmark 	 */
607