sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_asconf.h>
  44 #include <netinet/sctp_timer.h>
  45
  46 /*
  47  * debug flags:
  48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  49  * SCTP_DEBUG_ASCONF2: detailed info
  50  */
  51
  52
  53 /*
  54  * RFC 5061
  55  *
  56  * An ASCONF parameter queue exists per asoc which holds the pending address
  57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  58  *
  59  * A restricted_addrs list exists per assoc to hold local addresses that are
  60  * not (yet) usable by the assoc as a source address.  These addresses are
  61  * either pending an ASCONF operation (and exist on the ASCONF parameter
  62  * queue), or they are permanently restricted (the peer has returned an
  63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  64  *
  65  * Deleted addresses are always immediately removed from the lists as they will
  66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  67  * only if allowed.
  68  */
  69
  70 /*
  71  * ASCONF parameter processing.
  72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  75  */
  76 static struct mbuf *
  77 sctp_asconf_success_response(uint32_t id)
  78 {
  79         struct mbuf *m_reply = NULL;
  80         struct sctp_asconf_paramhdr *aph;
  81
  82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  83             0, M_NOWAIT, 1, MT_DATA);
  84         if (m_reply == NULL) {
  85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  86                     "asconf_success_response: couldn't get mbuf!\n");
  87                 return (NULL);
  88         }
  89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  90         aph->correlation_id = id;
  91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  94         aph->ph.param_length = htons(aph->ph.param_length);
  95
  96         return (m_reply);
  97 }
  98
  99 static struct mbuf *
 100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 101     uint16_t tlv_length)
 102 {
 103         struct mbuf *m_reply = NULL;
 104         struct sctp_asconf_paramhdr *aph;
 105         struct sctp_error_cause *error;
 106         uint8_t *tlv;
 107
 108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 109             tlv_length +
 110             sizeof(struct sctp_error_cause)),
 111             0, M_NOWAIT, 1, MT_DATA);
 112         if (m_reply == NULL) {
 113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 114                     "asconf_error_response: couldn't get mbuf!\n");
 115                 return (NULL);
 116         }
 117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 118         error = (struct sctp_error_cause *)(aph + 1);
 119
 120         aph->correlation_id = id;
 121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 122         error->code = htons(cause);
 123         error->length = tlv_length + sizeof(struct sctp_error_cause);
 124         aph->ph.param_length = error->length +
 125             sizeof(struct sctp_asconf_paramhdr);
 126
 127         if (aph->ph.param_length > MLEN) {
 128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 129                     "asconf_error_response: tlv_length (%xh) too big\n",
 130                     tlv_length);
 131                 sctp_m_freem(m_reply);  /* discard */
 132                 return (NULL);
 133         }
 134         if (error_tlv != NULL) {
 135                 tlv = (uint8_t *) (error + 1);
 136                 memcpy(tlv, error_tlv, tlv_length);
 137         }
 138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 139         error->length = htons(error->length);
 140         aph->ph.param_length = htons(aph->ph.param_length);
 141
 142         return (m_reply);
 143 }
 144
 145 static struct mbuf *
 146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 147     struct sctp_tcb *stcb, int send_hb, int response_required)
 148 {
 149         struct sctp_nets *net;
 150         struct mbuf *m_reply = NULL;
 151         union sctp_sockstore store;
 152         struct sctp_paramhdr *ph;
 153         uint16_t param_type, aparam_length;
 154
 155 #if defined(INET) || defined(INET6)
 156         uint16_t param_length;
 157
 158 #endif
 159         struct sockaddr *sa;
 160         int zero_address = 0;
 161         int bad_address = 0;
 162
 163 #ifdef INET
 164         struct sockaddr_in *sin;
 165         struct sctp_ipv4addr_param *v4addr;
 166
 167 #endif
 168 #ifdef INET6
 169         struct sockaddr_in6 *sin6;
 170         struct sctp_ipv6addr_param *v6addr;
 171
 172 #endif
 173
 174         aparam_length = ntohs(aph->ph.param_length);
 175         ph = (struct sctp_paramhdr *)(aph + 1);
 176         param_type = ntohs(ph->param_type);
 177 #if defined(INET) || defined(INET6)
 178         param_length = ntohs(ph->param_length);
 179 #endif
 180         sa = &store.sa;
 181         switch (param_type) {
 182 #ifdef INET
 183         case SCTP_IPV4_ADDRESS:
 184                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 185                         /* invalid param size */
 186                         return (NULL);
 187                 }
 188                 v4addr = (struct sctp_ipv4addr_param *)ph;
 189                 sin = &store.sin;
 190                 bzero(sin, sizeof(*sin));
 191                 sin->sin_family = AF_INET;
 192                 sin->sin_len = sizeof(struct sockaddr_in);
 193                 sin->sin_port = stcb->rport;
 194                 sin->sin_addr.s_addr = v4addr->addr;
 195                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 196                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 197                         bad_address = 1;
 198                 }
 199                 if (sin->sin_addr.s_addr == INADDR_ANY)
 200                         zero_address = 1;
 201                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 202                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 203                 break;
 204 #endif
 205 #ifdef INET6
 206         case SCTP_IPV6_ADDRESS:
 207                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 208                         /* invalid param size */
 209                         return (NULL);
 210                 }
 211                 v6addr = (struct sctp_ipv6addr_param *)ph;
 212                 sin6 = &store.sin6;
 213                 bzero(sin6, sizeof(*sin6));
 214                 sin6->sin6_family = AF_INET6;
 215                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 216                 sin6->sin6_port = stcb->rport;
 217                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 218                     sizeof(struct in6_addr));
 219                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 220                         bad_address = 1;
 221                 }
 222                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 223                         zero_address = 1;
 224                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 225                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 226                 break;
 227 #endif
 228         default:
 229                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 230                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 231                     aparam_length);
 232                 return (m_reply);
 233         }                       /* end switch */
 234
 235         /* if 0.0.0.0/::0, add the source address instead */
 236         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 237                 sa = src;
 238                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 239                     "process_asconf_add_ip: using source addr ");
 240                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 241         }
 242         /* add the address */
 243         if (bad_address) {
 244                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 245                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 246                     aparam_length);
 247         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
 248             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 249                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 250                     "process_asconf_add_ip: error adding address\n");
 251                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 252                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 253                     aparam_length);
 254         } else {
 255                 /* notify upper layer */
 256                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 257                 if (response_required) {
 258                         m_reply =
 259                             sctp_asconf_success_response(aph->correlation_id);
 260                 }
 261                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 262                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 263                     stcb, net);
 264                 if (send_hb) {
 265                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 266                 }
 267         }
 268         return (m_reply);
 269 }
 270
 271 static int
 272 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 273 {
 274         struct sctp_nets *src_net, *net;
 275
 276         /* make sure the source address exists as a destination net */
 277         src_net = sctp_findnet(stcb, src);
 278         if (src_net == NULL) {
 279                 /* not found */
 280                 return (-1);
 281         }
 282         /* delete all destination addresses except the source */
 283         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 284                 if (net != src_net) {
 285                         /* delete this address */
 286                         sctp_remove_net(stcb, net);
 287                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 288                             "asconf_del_remote_addrs_except: deleting ");
 289                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 290                             (struct sockaddr *)&net->ro._l_addr);
 291                         /* notify upper layer */
 292                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 293                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 294                 }
 295         }
 296         return (0);
 297 }
 298
 299 static struct mbuf *
 300 sctp_process_asconf_delete_ip(struct sockaddr *src,
 301     struct sctp_asconf_paramhdr *aph,
 302     struct sctp_tcb *stcb, int response_required)
 303 {
 304         struct mbuf *m_reply = NULL;
 305         union sctp_sockstore store;
 306         struct sctp_paramhdr *ph;
 307         uint16_t param_type, aparam_length;
 308
 309 #if defined(INET) || defined(INET6)
 310         uint16_t param_length;
 311
 312 #endif
 313         struct sockaddr *sa;
 314         int zero_address = 0;
 315         int result;
 316
 317 #ifdef INET
 318         struct sockaddr_in *sin;
 319         struct sctp_ipv4addr_param *v4addr;
 320
 321 #endif
 322 #ifdef INET6
 323         struct sockaddr_in6 *sin6;
 324         struct sctp_ipv6addr_param *v6addr;
 325
 326 #endif
 327
 328         aparam_length = ntohs(aph->ph.param_length);
 329         ph = (struct sctp_paramhdr *)(aph + 1);
 330         param_type = ntohs(ph->param_type);
 331 #if defined(INET) || defined(INET6)
 332         param_length = ntohs(ph->param_length);
 333 #endif
 334         sa = &store.sa;
 335         switch (param_type) {
 336 #ifdef INET
 337         case SCTP_IPV4_ADDRESS:
 338                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 339                         /* invalid param size */
 340                         return (NULL);
 341                 }
 342                 v4addr = (struct sctp_ipv4addr_param *)ph;
 343                 sin = &store.sin;
 344                 bzero(sin, sizeof(*sin));
 345                 sin->sin_family = AF_INET;
 346                 sin->sin_len = sizeof(struct sockaddr_in);
 347                 sin->sin_port = stcb->rport;
 348                 sin->sin_addr.s_addr = v4addr->addr;
 349                 if (sin->sin_addr.s_addr == INADDR_ANY)
 350                         zero_address = 1;
 351                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 352                     "process_asconf_delete_ip: deleting ");
 353                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 354                 break;
 355 #endif
 356 #ifdef INET6
 357         case SCTP_IPV6_ADDRESS:
 358                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 359                         /* invalid param size */
 360                         return (NULL);
 361                 }
 362                 v6addr = (struct sctp_ipv6addr_param *)ph;
 363                 sin6 = &store.sin6;
 364                 bzero(sin6, sizeof(*sin6));
 365                 sin6->sin6_family = AF_INET6;
 366                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 367                 sin6->sin6_port = stcb->rport;
 368                 memcpy(&sin6->sin6_addr, v6addr->addr,
 369                     sizeof(struct in6_addr));
 370                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 371                         zero_address = 1;
 372                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 373                     "process_asconf_delete_ip: deleting ");
 374                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 375                 break;
 376 #endif
 377         default:
 378                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 379                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 380                     aparam_length);
 381                 return (m_reply);
 382         }
 383
 384         /* make sure the source address is not being deleted */
 385         if (sctp_cmpaddr(sa, src)) {
 386                 /* trying to delete the source address! */
 387                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 388                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 389                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 390                     aparam_length);
 391                 return (m_reply);
 392         }
 393         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 394         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 395                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 396
 397                 if (result) {
 398                         /* src address did not exist? */
 399                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 400                         /* what error to reply with?? */
 401                         m_reply =
 402                             sctp_asconf_error_response(aph->correlation_id,
 403                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 404                             aparam_length);
 405                 } else if (response_required) {
 406                         m_reply =
 407                             sctp_asconf_success_response(aph->correlation_id);
 408                 }
 409                 return (m_reply);
 410         }
 411         /* delete the address */
 412         result = sctp_del_remote_addr(stcb, sa);
 413         /*
 414          * note if result == -2, the address doesn't exist in the asoc but
 415          * since it's being deleted anyways, we just ack the delete -- but
 416          * this probably means something has already gone awry
 417          */
 418         if (result == -1) {
 419                 /* only one address in the asoc */
 420                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 421                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 422                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 423                     aparam_length);
 424         } else {
 425                 if (response_required) {
 426                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 427                 }
 428                 /* notify upper layer */
 429                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 430         }
 431         return (m_reply);
 432 }
 433
 434 static struct mbuf *
 435 sctp_process_asconf_set_primary(struct sockaddr *src,
 436     struct sctp_asconf_paramhdr *aph,
 437     struct sctp_tcb *stcb, int response_required)
 438 {
 439         struct mbuf *m_reply = NULL;
 440         union sctp_sockstore store;
 441         struct sctp_paramhdr *ph;
 442         uint16_t param_type, aparam_length;
 443
 444 #if defined(INET) || defined(INET6)
 445         uint16_t param_length;
 446
 447 #endif
 448         struct sockaddr *sa;
 449         int zero_address = 0;
 450
 451 #ifdef INET
 452         struct sockaddr_in *sin;
 453         struct sctp_ipv4addr_param *v4addr;
 454
 455 #endif
 456 #ifdef INET6
 457         struct sockaddr_in6 *sin6;
 458         struct sctp_ipv6addr_param *v6addr;
 459
 460 #endif
 461
 462         aparam_length = ntohs(aph->ph.param_length);
 463         ph = (struct sctp_paramhdr *)(aph + 1);
 464         param_type = ntohs(ph->param_type);
 465 #if defined(INET) || defined(INET6)
 466         param_length = ntohs(ph->param_length);
 467 #endif
 468         sa = &store.sa;
 469         switch (param_type) {
 470 #ifdef INET
 471         case SCTP_IPV4_ADDRESS:
 472                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 473                         /* invalid param size */
 474                         return (NULL);
 475                 }
 476                 v4addr = (struct sctp_ipv4addr_param *)ph;
 477                 sin = &store.sin;
 478                 bzero(sin, sizeof(*sin));
 479                 sin->sin_family = AF_INET;
 480                 sin->sin_len = sizeof(struct sockaddr_in);
 481                 sin->sin_addr.s_addr = v4addr->addr;
 482                 if (sin->sin_addr.s_addr == INADDR_ANY)
 483                         zero_address = 1;
 484                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 485                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 486                 break;
 487 #endif
 488 #ifdef INET6
 489         case SCTP_IPV6_ADDRESS:
 490                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 491                         /* invalid param size */
 492                         return (NULL);
 493                 }
 494                 v6addr = (struct sctp_ipv6addr_param *)ph;
 495                 sin6 = &store.sin6;
 496                 bzero(sin6, sizeof(*sin6));
 497                 sin6->sin6_family = AF_INET6;
 498                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 499                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 500                     sizeof(struct in6_addr));
 501                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 502                         zero_address = 1;
 503                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 504                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 505                 break;
 506 #endif
 507         default:
 508                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 509                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 510                     aparam_length);
 511                 return (m_reply);
 512         }
 513
 514         /* if 0.0.0.0/::0, use the source address instead */
 515         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 516                 sa = src;
 517                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 518                     "process_asconf_set_primary: using source addr ");
 519                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 520         }
 521         /* set the primary address */
 522         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 523                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 524                     "process_asconf_set_primary: primary address set\n");
 525                 /* notify upper layer */
 526                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 527                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 528                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 529                     (stcb->asoc.alternate)) {
 530                         sctp_free_remote_addr(stcb->asoc.alternate);
 531                         stcb->asoc.alternate = NULL;
 532                 }
 533                 if (response_required) {
 534                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 535                 }
 536                 /*
 537                  * Mobility adaptation. Ideally, when the reception of SET
 538                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 539                  * destination, unacknowledged DATA are retransmitted
 540                  * immediately to the new primary destination for seamless
 541                  * handover. If the destination is UNCONFIRMED and marked to
 542                  * REQ_PRIM, The retransmission occur when reception of the
 543                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 544                  * sctp_input.c) Also, when change of the primary
 545                  * destination, it is better that all subsequent new DATA
 546                  * containing already queued DATA are transmitted to the new
 547                  * primary destination. (by micchie)
 548                  */
 549                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 550                     SCTP_MOBILITY_BASE) ||
 551                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 552                     SCTP_MOBILITY_FASTHANDOFF)) &&
 553                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 554                     SCTP_MOBILITY_PRIM_DELETED) &&
 555                     (stcb->asoc.primary_destination->dest_state &
 556                     SCTP_ADDR_UNCONFIRMED) == 0) {
 557
 558                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 559                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 560                             SCTP_MOBILITY_FASTHANDOFF)) {
 561                                 sctp_assoc_immediate_retrans(stcb,
 562                                     stcb->asoc.primary_destination);
 563                         }
 564                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 565                             SCTP_MOBILITY_BASE)) {
 566                                 sctp_move_chunks_from_net(stcb,
 567                                     stcb->asoc.deleted_primary);
 568                         }
 569                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 570                             stcb->asoc.deleted_primary);
 571                 }
 572         } else {
 573                 /* couldn't set the requested primary address! */
 574                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 575                     "process_asconf_set_primary: set primary failed!\n");
 576                 /* must have been an invalid address, so report */
 577                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 578                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 579                     aparam_length);
 580         }
 581
 582         return (m_reply);
 583 }
 584
 585 /*
 586  * handles an ASCONF chunk.
 587  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 588  */
 589 void
 590 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 591     struct sockaddr *src,
 592     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 593     int first)
 594 {
 595         struct sctp_association *asoc;
 596         uint32_t serial_num;
 597         struct mbuf *n, *m_ack, *m_result, *m_tail;
 598         struct sctp_asconf_ack_chunk *ack_cp;
 599         struct sctp_asconf_paramhdr *aph, *ack_aph;
 600         struct sctp_ipv6addr_param *p_addr;
 601         unsigned int asconf_limit, cnt;
 602         int error = 0;          /* did an error occur? */
 603
 604         /* asconf param buffer */
 605         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 606         struct sctp_asconf_ack *ack, *ack_next;
 607
 608         /* verify minimum length */
 609         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 610                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 611                     "handle_asconf: chunk too small = %xh\n",
 612                     ntohs(cp->ch.chunk_length));
 613                 return;
 614         }
 615         asoc = &stcb->asoc;
 616         serial_num = ntohl(cp->serial_number);
 617
 618         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 619                 /* got a duplicate ASCONF */
 620                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 621                     "handle_asconf: got duplicate serial number = %xh\n",
 622                     serial_num);
 623                 return;
 624         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 625                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 626                     serial_num, asoc->asconf_seq_in + 1);
 627                 return;
 628         }
 629         /* it's the expected "next" sequence number, so process it */
 630         asoc->asconf_seq_in = serial_num;       /* update sequence */
 631         /* get length of all the param's in the ASCONF */
 632         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 633         SCTPDBG(SCTP_DEBUG_ASCONF1,
 634             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 635             asconf_limit, serial_num);
 636
 637         if (first) {
 638                 /* delete old cache */
 639                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 640
 641                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 642                         if (ack->serial_number == serial_num)
 643                                 break;
 644                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 645                             ack->serial_number, serial_num);
 646                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 647                         if (ack->data != NULL) {
 648                                 sctp_m_freem(ack->data);
 649                         }
 650                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 651                 }
 652         }
 653         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 654             M_NOWAIT, 1, MT_DATA);
 655         if (m_ack == NULL) {
 656                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 657                     "handle_asconf: couldn't get mbuf!\n");
 658                 return;
 659         }
 660         m_tail = m_ack;         /* current reply chain's tail */
 661
 662         /* fill in ASCONF-ACK header */
 663         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 664         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 665         ack_cp->ch.chunk_flags = 0;
 666         ack_cp->serial_number = htonl(serial_num);
 667         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 668         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 669         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 670
 671         /* skip the lookup address parameter */
 672         offset += sizeof(struct sctp_asconf_chunk);
 673         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 674         if (p_addr == NULL) {
 675                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 676                     "handle_asconf: couldn't get lookup addr!\n");
 677                 /* respond with a missing/invalid mandatory parameter error */
 678                 return;
 679         }
 680         /* param_length is already validated in process_control... */
 681         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 682
 683         /* get pointer to first asconf param in ASCONF-ACK */
 684         ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
 685         if (ack_aph == NULL) {
 686                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
 687                 return;
 688         }
 689         /* get pointer to first asconf param in ASCONF */
 690         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 691         if (aph == NULL) {
 692                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 693                 goto send_reply;
 694         }
 695         /* process through all parameters */
 696         cnt = 0;
 697         while (aph != NULL) {
 698                 unsigned int param_length, param_type;
 699
 700                 param_type = ntohs(aph->ph.param_type);
 701                 param_length = ntohs(aph->ph.param_length);
 702                 if (offset + param_length > asconf_limit) {
 703                         /* parameter goes beyond end of chunk! */
 704                         sctp_m_freem(m_ack);
 705                         return;
 706                 }
 707                 m_result = NULL;
 708
 709                 if (param_length > sizeof(aparam_buf)) {
 710                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 711                         sctp_m_freem(m_ack);
 712                         return;
 713                 }
 714                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 715                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 716                         sctp_m_freem(m_ack);
 717                 }
 718                 /* get the entire parameter */
 719                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 720                 if (aph == NULL) {
 721                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 722                         sctp_m_freem(m_ack);
 723                         return;
 724                 }
 725                 switch (param_type) {
 726                 case SCTP_ADD_IP_ADDRESS:
 727                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 728                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 729                         cnt++;
 730                         break;
 731                 case SCTP_DEL_IP_ADDRESS:
 732                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 733                             error);
 734                         break;
 735                 case SCTP_ERROR_CAUSE_IND:
 736                         /* not valid in an ASCONF chunk */
 737                         break;
 738                 case SCTP_SET_PRIM_ADDR:
 739                         m_result = sctp_process_asconf_set_primary(src, aph,
 740                             stcb, error);
 741                         break;
 742                 case SCTP_NAT_VTAGS:
 743                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 744                         break;
 745                 case SCTP_SUCCESS_REPORT:
 746                         /* not valid in an ASCONF chunk */
 747                         break;
 748                 case SCTP_ULP_ADAPTATION:
 749                         /* FIX */
 750                         break;
 751                 default:
 752                         if ((param_type & 0x8000) == 0) {
 753                                 /* Been told to STOP at this param */
 754                                 asconf_limit = offset;
 755                                 /*
 756                                  * FIX FIX - We need to call
 757                                  * sctp_arethere_unrecognized_parameters()
 758                                  * to get a operr and send it for any
 759                                  * param's with the 0x4000 bit set OR do it
 760                                  * here ourselves... note we still must STOP
 761                                  * if the 0x8000 bit is clear.
 762                                  */
 763                         }
 764                         /* unknown/invalid param type */
 765                         break;
 766                 }               /* switch */
 767
 768                 /* add any (error) result to the reply mbuf chain */
 769                 if (m_result != NULL) {
 770                         SCTP_BUF_NEXT(m_tail) = m_result;
 771                         m_tail = m_result;
 772                         /* update lengths, make sure it's aligned too */
 773                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 774                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 775                         /* set flag to force success reports */
 776                         error = 1;
 777                 }
 778                 offset += SCTP_SIZE32(param_length);
 779                 /* update remaining ASCONF message length to process */
 780                 if (offset >= asconf_limit) {
 781                         /* no more data in the mbuf chain */
 782                         break;
 783                 }
 784                 /* get pointer to next asconf param */
 785                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 786                     sizeof(struct sctp_asconf_paramhdr),
 787                     (uint8_t *) & aparam_buf);
 788                 if (aph == NULL) {
 789                         /* can't get an asconf paramhdr */
 790                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 791                         /* FIX ME - add error here... */
 792                 }
 793         }
 794
 795 send_reply:
 796         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 797         /* save the ASCONF-ACK reply */
 798         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 799             struct sctp_asconf_ack);
 800         if (ack == NULL) {
 801                 sctp_m_freem(m_ack);
 802                 return;
 803         }
 804         ack->serial_number = serial_num;
 805         ack->last_sent_to = NULL;
 806         ack->data = m_ack;
 807         ack->len = 0;
 808         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 809                 ack->len += SCTP_BUF_LEN(n);
 810         }
 811         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 812
 813         /* see if last_control_chunk_from is set properly (use IP src addr) */
 814         if (stcb->asoc.last_control_chunk_from == NULL) {
 815                 /*
 816                  * this could happen if the source address was just newly
 817                  * added
 818                  */
 819                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 820                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 821                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 822                 /* look up the from address */
 823                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 824 #ifdef SCTP_DEBUG
 825                 if (stcb->asoc.last_control_chunk_from == NULL) {
 826                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 827                 }
 828 #endif
 829         }
 830 }
 831
 832 /*
 833  * does the address match? returns 0 if not, 1 if so
 834  */
 835 static uint32_t
 836 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 837 {
 838         switch (sa->sa_family) {
 839 #ifdef INET6
 840         case AF_INET6:
 841                 {
 842                         /* XXX scopeid */
 843                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 844
 845                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 846                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 847                             sizeof(struct in6_addr)) == 0)) {
 848                                 return (1);
 849                         }
 850                         break;
 851                 }
 852 #endif
 853 #ifdef INET
 854         case AF_INET:
 855                 {
 856                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 857
 858                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 859                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 860                             sizeof(struct in_addr)) == 0)) {
 861                                 return (1);
 862                         }
 863                         break;
 864                 }
 865 #endif
 866         default:
 867                 break;
 868         }
 869         return (0);
 870 }
 871
 872 /*
 873  * does the address match? returns 0 if not, 1 if so
 874  */
 875 static uint32_t
 876 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 877 {
 878 #if defined(INET) || defined(INET6)
 879         uint16_t param_type, param_length;
 880
 881         param_type = ntohs(ph->param_type);
 882         param_length = ntohs(ph->param_length);
 883 #endif
 884         switch (sa->sa_family) {
 885 #ifdef INET6
 886         case AF_INET6:
 887                 {
 888                         /* XXX scopeid */
 889                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 890                         struct sctp_ipv6addr_param *v6addr;
 891
 892                         v6addr = (struct sctp_ipv6addr_param *)ph;
 893                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 894                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 895                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 896                             sizeof(struct in6_addr)) == 0)) {
 897                                 return (1);
 898                         }
 899                         break;
 900                 }
 901 #endif
 902 #ifdef INET
 903         case AF_INET:
 904                 {
 905                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 906                         struct sctp_ipv4addr_param *v4addr;
 907
 908                         v4addr = (struct sctp_ipv4addr_param *)ph;
 909                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 910                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 911                             (memcmp(&v4addr->addr, &sin->sin_addr,
 912                             sizeof(struct in_addr)) == 0)) {
 913                                 return (1);
 914                         }
 915                         break;
 916                 }
 917 #endif
 918         default:
 919                 break;
 920         }
 921         return (0);
 922 }
 923
 924 /*
 925  * Cleanup for non-responded/OP ERR'd ASCONF
 926  */
 927 void
 928 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 929 {
 930         /*
 931          * clear out any existing asconfs going out
 932          */
 933         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 934             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 935         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 936         /* remove the old ASCONF on our outbound queue */
 937         sctp_toss_old_asconf(stcb);
 938 }
 939
 940 /*
 941  * cleanup any cached source addresses that may be topologically
 942  * incorrect after a new address has been added to this interface.
 943  */
 944 static void
 945 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 946 {
 947         struct sctp_nets *net;
 948
 949         /*
 950          * Ideally, we want to only clear cached routes and source addresses
 951          * that are topologically incorrect.  But since there is no easy way
 952          * to know whether the newly added address on the ifn would cause a
 953          * routing change (i.e. a new egress interface would be chosen)
 954          * without doing a new routing lookup and source address selection,
 955          * we will (for now) just flush any cached route using a different
 956          * ifn (and cached source addrs) and let output re-choose them
 957          * during the next send on that net.
 958          */
 959         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 960                 /*
 961                  * clear any cached route (and cached source address) if the
 962                  * route's interface is NOT the same as the address change.
 963                  * If it's the same interface, just clear the cached source
 964                  * address.
 965                  */
 966                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 967                     ((ifn == NULL) ||
 968                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 969                         /* clear any cached route */
 970                         RTFREE(net->ro.ro_rt);
 971                         net->ro.ro_rt = NULL;
 972                 }
 973                 /* clear any cached source address */
 974                 if (net->src_addr_selected) {
 975                         sctp_free_ifa(net->ro._s_addr);
 976                         net->ro._s_addr = NULL;
 977                         net->src_addr_selected = 0;
 978                 }
 979         }
 980 }
 981
 982
 983 void
 984 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 985 {
 986         int error;
 987
 988         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 989                 return;
 990         }
 991         if (stcb->asoc.deleted_primary == NULL) {
 992                 return;
 993         }
 994         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 995                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 996                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 997                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 998                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 999                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
1000                     stcb->asoc.deleted_primary,
1001                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
1002                 stcb->asoc.num_send_timers_up--;
1003                 if (stcb->asoc.num_send_timers_up < 0) {
1004                         stcb->asoc.num_send_timers_up = 0;
1005                 }
1006                 SCTP_TCB_LOCK_ASSERT(stcb);
1007                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1008                     stcb->asoc.deleted_primary);
1009                 if (error) {
1010                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1011                         return;
1012                 }
1013                 SCTP_TCB_LOCK_ASSERT(stcb);
1014 #ifdef SCTP_AUDITING_ENABLED
1015                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1016 #endif
1017                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1018                 if ((stcb->asoc.num_send_timers_up == 0) &&
1019                     (stcb->asoc.sent_queue_cnt > 0)) {
1020                         struct sctp_tmit_chunk *chk;
1021
1022                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1023                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1024                             stcb, chk->whoTo);
1025                 }
1026         }
1027         return;
1028 }
1029
1030 static int
1031     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1032
1033 void
1034 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1035 {
1036         struct sctp_tmit_chunk *chk;
1037
1038         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1039         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1040             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1041         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1042         net->error_count = 0;
1043         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1044                 if (chk->whoTo == net) {
1045                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1046                                 chk->sent = SCTP_DATAGRAM_RESEND;
1047                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1048                                 sctp_flight_size_decrease(chk);
1049                                 sctp_total_flight_decrease(stcb, chk);
1050                                 net->marked_retrans++;
1051                                 stcb->asoc.marked_retrans++;
1052                         }
1053                 }
1054         }
1055         if (net->marked_retrans) {
1056                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1057         }
1058 }
1059
1060 static void
1061 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1062 {
1063         struct sctp_nets *net;
1064         int addrnum, changed;
1065
1066         /*
1067          * If number of local valid addresses is 1, the valid address is
1068          * probably newly added address. Several valid addresses in this
1069          * association.  A source address may not be changed.  Additionally,
1070          * they can be configured on a same interface as "alias" addresses.
1071          * (by micchie)
1072          */
1073         addrnum = sctp_local_addr_count(stcb);
1074         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1075             addrnum);
1076         if (addrnum == 1) {
1077                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1078                         /* clear any cached route and source address */
1079                         if (net->ro.ro_rt) {
1080                                 RTFREE(net->ro.ro_rt);
1081                                 net->ro.ro_rt = NULL;
1082                         }
1083                         if (net->src_addr_selected) {
1084                                 sctp_free_ifa(net->ro._s_addr);
1085                                 net->ro._s_addr = NULL;
1086                                 net->src_addr_selected = 0;
1087                         }
1088                         /* Retransmit unacknowledged DATA chunks immediately */
1089                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1090                             SCTP_MOBILITY_FASTHANDOFF)) {
1091                                 sctp_net_immediate_retrans(stcb, net);
1092                         }
1093                         /* also, SET PRIMARY is maybe already sent */
1094                 }
1095                 return;
1096         }
1097         /* Multiple local addresses exsist in the association.  */
1098         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1099                 /* clear any cached route and source address */
1100                 if (net->ro.ro_rt) {
1101                         RTFREE(net->ro.ro_rt);
1102                         net->ro.ro_rt = NULL;
1103                 }
1104                 if (net->src_addr_selected) {
1105                         sctp_free_ifa(net->ro._s_addr);
1106                         net->ro._s_addr = NULL;
1107                         net->src_addr_selected = 0;
1108                 }
1109                 /*
1110                  * Check if the nexthop is corresponding to the new address.
1111                  * If the new address is corresponding to the current
1112                  * nexthop, the path will be changed. If the new address is
1113                  * NOT corresponding to the current nexthop, the path will
1114                  * not be changed.
1115                  */
1116                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1117                     stcb->sctp_ep->def_vrf_id);
1118                 if (net->ro.ro_rt == NULL)
1119                         continue;
1120
1121                 changed = 0;
1122                 switch (net->ro._l_addr.sa.sa_family) {
1123 #ifdef INET
1124                 case AF_INET:
1125                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
1126                                 changed = 1;
1127                         }
1128                         break;
1129 #endif
1130 #ifdef INET6
1131                 case AF_INET6:
1132                         if (sctp_v6src_match_nexthop(
1133                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
1134                                 changed = 1;
1135                         }
1136                         break;
1137 #endif
1138                 default:
1139                         break;
1140                 }
1141                 /*
1142                  * if the newly added address does not relate routing
1143                  * information, we skip.
1144                  */
1145                 if (changed == 0)
1146                         continue;
1147                 /* Retransmit unacknowledged DATA chunks immediately */
1148                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1149                     SCTP_MOBILITY_FASTHANDOFF)) {
1150                         sctp_net_immediate_retrans(stcb, net);
1151                 }
1152                 /* Send SET PRIMARY for this new address */
1153                 if (net == stcb->asoc.primary_destination) {
1154                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1155                             SCTP_SET_PRIM_ADDR);
1156                 }
1157         }
1158 }
1159
1160 /*
1161  * process an ADD/DELETE IP ack from peer.
1162  * addr: corresponding sctp_ifa to the address being added/deleted.
1163  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1164  * flag: 1=success, 0=failure.
1165  */
1166 static void
1167 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1168 {
1169         /*
1170          * do the necessary asoc list work- if we get a failure indication,
1171          * leave the address on the assoc's restricted list.  If we get a
1172          * success indication, remove the address from the restricted list.
1173          */
1174         /*
1175          * Note: this will only occur for ADD_IP_ADDRESS, since
1176          * DEL_IP_ADDRESS is never actually added to the list...
1177          */
1178         if (flag) {
1179                 /* success case, so remove from the restricted list */
1180                 sctp_del_local_addr_restricted(stcb, addr);
1181
1182                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1183                     SCTP_MOBILITY_BASE) ||
1184                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1185                     SCTP_MOBILITY_FASTHANDOFF)) {
1186                         sctp_path_check_and_react(stcb, addr);
1187                         return;
1188                 }
1189                 /* clear any cached/topologically incorrect source addresses */
1190                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1191         }
1192         /* else, leave it on the list */
1193 }
1194
1195 /*
1196  * add an asconf add/delete/set primary IP address parameter to the queue.
1197  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1198  * returns 0 if queued, -1 if not queued/removed.
1199  * NOTE: if adding, but a delete for the same address is already scheduled
1200  * (and not yet sent out), simply remove it from queue.  Same for deleting
1201  * an address already scheduled for add.  If a duplicate operation is found,
1202  * ignore the new one.
1203  */
1204 static int
1205 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1206     uint16_t type)
1207 {
1208         struct sctp_asconf_addr *aa, *aa_next;
1209
1210         /* make sure the request isn't already in the queue */
1211         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1212                 /* address match? */
1213                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1214                         continue;
1215                 /*
1216                  * is the request already in queue but not sent? pass the
1217                  * request already sent in order to resolve the following
1218                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1219                  * can't remove the ADD request already sent 3. arrival of
1220                  * ADD
1221                  */
1222                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1223                         return (-1);
1224                 }
1225                 /* is the negative request already in queue, and not sent */
1226                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1227                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1228                         /* add requested, delete already queued */
1229                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1230                         /* remove the ifa from the restricted list */
1231                         sctp_del_local_addr_restricted(stcb, ifa);
1232                         /* free the asconf param */
1233                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1234                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1235                         return (-1);
1236                 }
1237                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1238                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1239                         /* delete requested, add already queued */
1240                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1241                         /* remove the aa->ifa from the restricted list */
1242                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1243                         /* free the asconf param */
1244                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1245                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1246                         return (-1);
1247                 }
1248         }                       /* for each aa */
1249
1250         /* adding new request to the queue */
1251         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1252             SCTP_M_ASC_ADDR);
1253         if (aa == NULL) {
1254                 /* didn't get memory */
1255                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1256                 return (-1);
1257         }
1258         aa->special_del = 0;
1259         /* fill in asconf address parameter fields */
1260         /* top level elements are "networked" during send */
1261         aa->ap.aph.ph.param_type = type;
1262         aa->ifa = ifa;
1263         atomic_add_int(&ifa->refcount, 1);
1264         /* correlation_id filled in during send routine later... */
1265         switch (ifa->address.sa.sa_family) {
1266 #ifdef INET6
1267         case AF_INET6:
1268                 {
1269                         struct sockaddr_in6 *sin6;
1270
1271                         sin6 = &ifa->address.sin6;
1272                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1273                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1274                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1275                             sizeof(struct sctp_ipv6addr_param);
1276                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1277                             sizeof(struct in6_addr));
1278                         break;
1279                 }
1280 #endif
1281 #ifdef INET
1282         case AF_INET:
1283                 {
1284                         struct sockaddr_in *sin;
1285
1286                         sin = &ifa->address.sin;
1287                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1288                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1289                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1290                             sizeof(struct sctp_ipv4addr_param);
1291                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1292                             sizeof(struct in_addr));
1293                         break;
1294                 }
1295 #endif
1296         default:
1297                 /* invalid family! */
1298                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1299                 sctp_free_ifa(ifa);
1300                 return (-1);
1301         }
1302         aa->sent = 0;           /* clear sent flag */
1303
1304         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1305 #ifdef SCTP_DEBUG
1306         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1307                 if (type == SCTP_ADD_IP_ADDRESS) {
1308                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1309                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1310                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1311                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1312                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1313                 } else {
1314                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1315                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1316                 }
1317         }
1318 #endif
1319
1320         return (0);
1321 }
1322
1323
1324 /*
1325  * add an asconf operation for the given ifa and type.
1326  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1327  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1328  * advisable.
1329  */
1330 static int
1331 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1332     uint16_t type)
1333 {
1334         uint32_t status;
1335         int pending_delete_queued = 0;
1336
1337         /* see if peer supports ASCONF */
1338         if (stcb->asoc.asconf_supported == 0) {
1339                 return (-1);
1340         }
1341         /*
1342          * if this is deleting the last address from the assoc, mark it as
1343          * pending.
1344          */
1345         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1346             (sctp_local_addr_count(stcb) < 2)) {
1347                 /* set the pending delete info only */
1348                 stcb->asoc.asconf_del_pending = 1;
1349                 stcb->asoc.asconf_addr_del_pending = ifa;
1350                 atomic_add_int(&ifa->refcount, 1);
1351                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1352                     "asconf_queue_add: mark delete last address pending\n");
1353                 return (-1);
1354         }
1355         /* queue an asconf parameter */
1356         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1357
1358         /*
1359          * if this is an add, and there is a delete also pending (i.e. the
1360          * last local address is being changed), queue the pending delete
1361          * too.
1362          */
1363         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1364                 /* queue in the pending delete */
1365                 if (sctp_asconf_queue_mgmt(stcb,
1366                     stcb->asoc.asconf_addr_del_pending,
1367                     SCTP_DEL_IP_ADDRESS) == 0) {
1368                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1369                         pending_delete_queued = 1;
1370                         /* clear out the pending delete info */
1371                         stcb->asoc.asconf_del_pending = 0;
1372                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1373                         stcb->asoc.asconf_addr_del_pending = NULL;
1374                 }
1375         }
1376         if (pending_delete_queued) {
1377                 struct sctp_nets *net;
1378
1379                 /*
1380                  * since we know that the only/last address is now being
1381                  * changed in this case, reset the cwnd/rto on all nets to
1382                  * start as a new address and path.  Also clear the error
1383                  * counts to give the assoc the best chance to complete the
1384                  * address change.
1385                  */
1386                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1387                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1388                             net);
1389                         net->RTO = 0;
1390                         net->error_count = 0;
1391                 }
1392                 stcb->asoc.overall_error_count = 0;
1393                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1394                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1395                             stcb->asoc.overall_error_count,
1396                             0,
1397                             SCTP_FROM_SCTP_ASCONF,
1398                             __LINE__);
1399                 }
1400                 /* queue in an advisory set primary too */
1401                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1402                 /* let caller know we should send this out immediately */
1403                 status = 1;
1404         }
1405         return (status);
1406 }
1407
1408 /*-
1409  * add an asconf delete IP address parameter to the queue by sockaddr and
1410  * possibly with no sctp_ifa available.  This is only called by the routine
1411  * that checks the addresses in an INIT-ACK against the current address list.
1412  * returns 0 if completed, non-zero if not completed.
1413  * NOTE: if an add is already scheduled (and not yet sent out), simply
1414  * remove it from queue.  If a duplicate operation is found, ignore the
1415  * new one.
1416  */
1417 static int
1418 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1419 {
1420         struct sctp_ifa *ifa;
1421         struct sctp_asconf_addr *aa, *aa_next;
1422         uint32_t vrf_id;
1423
1424         if (stcb == NULL) {
1425                 return (-1);
1426         }
1427         /* see if peer supports ASCONF */
1428         if (stcb->asoc.asconf_supported == 0) {
1429                 return (-1);
1430         }
1431         /* make sure the request isn't already in the queue */
1432         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1433                 /* address match? */
1434                 if (sctp_asconf_addr_match(aa, sa) == 0)
1435                         continue;
1436                 /* is the request already in queue (sent or not) */
1437                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1438                         return (-1);
1439                 }
1440                 /* is the negative request already in queue, and not sent */
1441                 if (aa->sent == 1)
1442                         continue;
1443                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1444                         /* add already queued, so remove existing entry */
1445                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1446                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1447                         /* free the entry */
1448                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1449                         return (-1);
1450                 }
1451         }                       /* for each aa */
1452
1453         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1454         if (stcb) {
1455                 vrf_id = stcb->asoc.vrf_id;
1456         } else {
1457                 vrf_id = SCTP_DEFAULT_VRFID;
1458         }
1459         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1460
1461         /* adding new request to the queue */
1462         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1463             SCTP_M_ASC_ADDR);
1464         if (aa == NULL) {
1465                 /* didn't get memory */
1466                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1467                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1468                 return (-1);
1469         }
1470         aa->special_del = 0;
1471         /* fill in asconf address parameter fields */
1472         /* top level elements are "networked" during send */
1473         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1474         aa->ifa = ifa;
1475         if (ifa)
1476                 atomic_add_int(&ifa->refcount, 1);
1477         /* correlation_id filled in during send routine later... */
1478         switch (sa->sa_family) {
1479 #ifdef INET6
1480         case AF_INET6:
1481                 {
1482                         /* IPv6 address */
1483                         struct sockaddr_in6 *sin6;
1484
1485                         sin6 = (struct sockaddr_in6 *)sa;
1486                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1487                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1488                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1489                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1490                             sizeof(struct in6_addr));
1491                         break;
1492                 }
1493 #endif
1494 #ifdef INET
1495         case AF_INET:
1496                 {
1497                         /* IPv4 address */
1498                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1499
1500                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1501                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1502                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1503                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1504                             sizeof(struct in_addr));
1505                         break;
1506                 }
1507 #endif
1508         default:
1509                 /* invalid family! */
1510                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1511                 if (ifa)
1512                         sctp_free_ifa(ifa);
1513                 return (-1);
1514         }
1515         aa->sent = 0;           /* clear sent flag */
1516
1517         /* delete goes to the back of the queue */
1518         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1519
1520         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1521         return (0);
1522 }
1523
1524 /*
1525  * find a specific asconf param on our "sent" queue
1526  */
1527 static struct sctp_asconf_addr *
1528 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1529 {
1530         struct sctp_asconf_addr *aa;
1531
1532         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1533                 if (aa->ap.aph.correlation_id == correlation_id &&
1534                     aa->sent == 1) {
1535                         /* found it */
1536                         return (aa);
1537                 }
1538         }
1539         /* didn't find it */
1540         return (NULL);
1541 }
1542
1543 /*
1544  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1545  * notifications based on the error response
1546  */
1547 static void
1548 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1549     struct sctp_asconf_paramhdr *aph)
1550 {
1551         struct sctp_error_cause *eh;
1552         struct sctp_paramhdr *ph;
1553         uint16_t param_type;
1554         uint16_t error_code;
1555
1556         eh = (struct sctp_error_cause *)(aph + 1);
1557         ph = (struct sctp_paramhdr *)(eh + 1);
1558         /* validate lengths */
1559         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1560             htons(aph->ph.param_length)) {
1561                 /* invalid error cause length */
1562                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1563                     "asconf_process_error: cause element too long\n");
1564                 return;
1565         }
1566         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1567             htons(eh->length)) {
1568                 /* invalid included TLV length */
1569                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1570                     "asconf_process_error: included TLV too long\n");
1571                 return;
1572         }
1573         /* which error code ? */
1574         error_code = ntohs(eh->code);
1575         param_type = ntohs(aph->ph.param_type);
1576         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1577         switch (error_code) {
1578         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1579                 /* we allow ourselves to "try again" for this error */
1580                 break;
1581         default:
1582                 /* peer can't handle it... */
1583                 switch (param_type) {
1584                 case SCTP_ADD_IP_ADDRESS:
1585                 case SCTP_DEL_IP_ADDRESS:
1586                 case SCTP_SET_PRIM_ADDR:
1587                         break;
1588                 default:
1589                         break;
1590                 }
1591         }
1592 }
1593
1594 /*
1595  * process an asconf queue param.
1596  * aparam: parameter to process, will be removed from the queue.
1597  * flag: 1=success case, 0=failure case
1598  */
1599 static void
1600 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1601     struct sctp_asconf_addr *aparam, uint32_t flag)
1602 {
1603         uint16_t param_type;
1604
1605         /* process this param */
1606         param_type = aparam->ap.aph.ph.param_type;
1607         switch (param_type) {
1608         case SCTP_ADD_IP_ADDRESS:
1609                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1610                     "process_param_ack: added IP address\n");
1611                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1612                 break;
1613         case SCTP_DEL_IP_ADDRESS:
1614                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1615                     "process_param_ack: deleted IP address\n");
1616                 /* nothing really to do... lists already updated */
1617                 break;
1618         case SCTP_SET_PRIM_ADDR:
1619                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1620                     "process_param_ack: set primary IP address\n");
1621                 /* nothing to do... peer may start using this addr */
1622                 break;
1623         default:
1624                 /* should NEVER happen */
1625                 break;
1626         }
1627
1628         /* remove the param and free it */
1629         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1630         if (aparam->ifa)
1631                 sctp_free_ifa(aparam->ifa);
1632         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1633 }
1634
1635 /*
1636  * cleanup from a bad asconf ack parameter
1637  */
1638 static void
1639 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1640 {
1641         /* assume peer doesn't really know how to do asconfs */
1642         /* XXX we could free the pending queue here */
1643
1644 }
1645
1646 void
1647 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1648     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1649     struct sctp_nets *net, int *abort_no_unlock)
1650 {
1651         struct sctp_association *asoc;
1652         uint32_t serial_num;
1653         uint16_t ack_length;
1654         struct sctp_asconf_paramhdr *aph;
1655         struct sctp_asconf_addr *aa, *aa_next;
1656         uint32_t last_error_id = 0;     /* last error correlation id */
1657         uint32_t id;
1658         struct sctp_asconf_addr *ap;
1659
1660         /* asconf param buffer */
1661         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1662
1663         /* verify minimum length */
1664         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1665                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1666                     "handle_asconf_ack: chunk too small = %xh\n",
1667                     ntohs(cp->ch.chunk_length));
1668                 return;
1669         }
1670         asoc = &stcb->asoc;
1671         serial_num = ntohl(cp->serial_number);
1672
1673         /*
1674          * NOTE: we may want to handle this differently- currently, we will
1675          * abort when we get an ack for the expected serial number + 1 (eg.
1676          * we didn't send it), process an ack normally if it is the expected
1677          * serial number, and re-send the previous ack for *ALL* other
1678          * serial numbers
1679          */
1680
1681         /*
1682          * if the serial number is the next expected, but I didn't send it,
1683          * abort the asoc, since someone probably just hijacked us...
1684          */
1685         if (serial_num == (asoc->asconf_seq_out + 1)) {
1686                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1687                 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, SCTP_SO_NOT_LOCKED);
1688                 *abort_no_unlock = 1;
1689                 return;
1690         }
1691         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1692                 /* got a duplicate/unexpected ASCONF-ACK */
1693                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1694                     serial_num, asoc->asconf_seq_out_acked + 1);
1695                 return;
1696         }
1697         if (serial_num == asoc->asconf_seq_out - 1) {
1698                 /* stop our timer */
1699                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1700                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1701         }
1702         /* process the ASCONF-ACK contents */
1703         ack_length = ntohs(cp->ch.chunk_length) -
1704             sizeof(struct sctp_asconf_ack_chunk);
1705         offset += sizeof(struct sctp_asconf_ack_chunk);
1706         /* process through all parameters */
1707         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1708                 unsigned int param_length, param_type;
1709
1710                 /* get pointer to next asconf parameter */
1711                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1712                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1713                 if (aph == NULL) {
1714                         /* can't get an asconf paramhdr */
1715                         sctp_asconf_ack_clear(stcb);
1716                         return;
1717                 }
1718                 param_type = ntohs(aph->ph.param_type);
1719                 param_length = ntohs(aph->ph.param_length);
1720                 if (param_length > ack_length) {
1721                         sctp_asconf_ack_clear(stcb);
1722                         return;
1723                 }
1724                 if (param_length < sizeof(struct sctp_paramhdr)) {
1725                         sctp_asconf_ack_clear(stcb);
1726                         return;
1727                 }
1728                 /* get the complete parameter... */
1729                 if (param_length > sizeof(aparam_buf)) {
1730                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1731                             "param length (%u) larger than buffer size!\n", param_length);
1732                         sctp_asconf_ack_clear(stcb);
1733                         return;
1734                 }
1735                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1736                 if (aph == NULL) {
1737                         sctp_asconf_ack_clear(stcb);
1738                         return;
1739                 }
1740                 /* correlation_id is transparent to peer, no ntohl needed */
1741                 id = aph->correlation_id;
1742
1743                 switch (param_type) {
1744                 case SCTP_ERROR_CAUSE_IND:
1745                         last_error_id = id;
1746                         /* find the corresponding asconf param in our queue */
1747                         ap = sctp_asconf_find_param(stcb, id);
1748                         if (ap == NULL) {
1749                                 /* hmm... can't find this in our queue! */
1750                                 break;
1751                         }
1752                         /* process the parameter, failed flag */
1753                         sctp_asconf_process_param_ack(stcb, ap, 0);
1754                         /* process the error response */
1755                         sctp_asconf_process_error(stcb, aph);
1756                         break;
1757                 case SCTP_SUCCESS_REPORT:
1758                         /* find the corresponding asconf param in our queue */
1759                         ap = sctp_asconf_find_param(stcb, id);
1760                         if (ap == NULL) {
1761                                 /* hmm... can't find this in our queue! */
1762                                 break;
1763                         }
1764                         /* process the parameter, success flag */
1765                         sctp_asconf_process_param_ack(stcb, ap, 1);
1766                         break;
1767                 default:
1768                         break;
1769                 }               /* switch */
1770
1771                 /* update remaining ASCONF-ACK message length to process */
1772                 ack_length -= SCTP_SIZE32(param_length);
1773                 if (ack_length <= 0) {
1774                         /* no more data in the mbuf chain */
1775                         break;
1776                 }
1777                 offset += SCTP_SIZE32(param_length);
1778         }                       /* while */
1779
1780         /*
1781          * if there are any "sent" params still on the queue, these are
1782          * implicitly "success", or "failed" (if we got an error back) ...
1783          * so process these appropriately
1784          *
1785          * we assume that the correlation_id's are monotonically increasing
1786          * beginning from 1 and that we don't have *that* many outstanding
1787          * at any given time
1788          */
1789         if (last_error_id == 0)
1790                 last_error_id--;/* set to "max" value */
1791         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1792                 if (aa->sent == 1) {
1793                         /*
1794                          * implicitly successful or failed if correlation_id
1795                          * < last_error_id, then success else, failure
1796                          */
1797                         if (aa->ap.aph.correlation_id < last_error_id)
1798                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1799                         else
1800                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1801                 } else {
1802                         /*
1803                          * since we always process in order (FIFO queue) if
1804                          * we reach one that hasn't been sent, the rest
1805                          * should not have been sent either. so, we're
1806                          * done...
1807                          */
1808                         break;
1809                 }
1810         }
1811
1812         /* update the next sequence number to use */
1813         asoc->asconf_seq_out_acked++;
1814         /* remove the old ASCONF on our outbound queue */
1815         sctp_toss_old_asconf(stcb);
1816         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1817 #ifdef SCTP_TIMER_BASED_ASCONF
1818                 /* we have more params, so restart our timer */
1819                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1820                     stcb, net);
1821 #else
1822                 /* we have more params, so send out more */
1823                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1824 #endif
1825         }
1826 }
1827
1828 #ifdef INET6
1829 static uint32_t
1830 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1831 {
1832         struct sockaddr_in6 *sin6, *net6;
1833         struct sctp_nets *net;
1834
1835         if (sa->sa_family != AF_INET6) {
1836                 /* wrong family */
1837                 return (0);
1838         }
1839         sin6 = (struct sockaddr_in6 *)sa;
1840         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1841                 /* not link local address */
1842                 return (0);
1843         }
1844         /* hunt through our destination nets list for this scope_id */
1845         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1846                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1847                     AF_INET6)
1848                         continue;
1849                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1850                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1851                         continue;
1852                 if (sctp_is_same_scope(sin6, net6)) {
1853                         /* found one */
1854                         return (1);
1855                 }
1856         }
1857         /* didn't find one */
1858         return (0);
1859 }
1860
1861 #endif
1862
1863 /*
1864  * address management functions
1865  */
1866 static void
1867 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1868     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1869 {
1870         int status;
1871
1872         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1873             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1874                 /* subset bound, no ASCONF allowed case, so ignore */
1875                 return;
1876         }
1877         /*
1878          * note: we know this is not the subset bound, no ASCONF case eg.
1879          * this is boundall or subset bound w/ASCONF allowed
1880          */
1881
1882         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1883         switch (ifa->address.sa.sa_family) {
1884 #ifdef INET6
1885         case AF_INET6:
1886                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1887                     &ifa->address.sin6.sin6_addr) != 0) {
1888                         return;
1889                 }
1890                 break;
1891 #endif
1892 #ifdef INET
1893         case AF_INET:
1894                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1895                     &ifa->address.sin.sin_addr) != 0) {
1896                         return;
1897                 }
1898                 break;
1899 #endif
1900         default:
1901                 return;
1902         }
1903 #ifdef INET6
1904         /* make sure we're "allowed" to add this type of addr */
1905         if (ifa->address.sa.sa_family == AF_INET6) {
1906                 /* invalid if we're not a v6 endpoint */
1907                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1908                         return;
1909                 /* is the v6 addr really valid ? */
1910                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1911                         return;
1912                 }
1913         }
1914 #endif
1915         /* put this address on the "pending/do not use yet" list */
1916         sctp_add_local_addr_restricted(stcb, ifa);
1917         /*
1918          * check address scope if address is out of scope, don't queue
1919          * anything... note: this would leave the address on both inp and
1920          * asoc lists
1921          */
1922         switch (ifa->address.sa.sa_family) {
1923 #ifdef INET6
1924         case AF_INET6:
1925                 {
1926                         struct sockaddr_in6 *sin6;
1927
1928                         sin6 = &ifa->address.sin6;
1929                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1930                                 /* we skip unspecifed addresses */
1931                                 return;
1932                         }
1933                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1934                                 if (stcb->asoc.scope.local_scope == 0) {
1935                                         return;
1936                                 }
1937                                 /* is it the right link local scope? */
1938                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1939                                         return;
1940                                 }
1941                         }
1942                         if (stcb->asoc.scope.site_scope == 0 &&
1943                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1944                                 return;
1945                         }
1946                         break;
1947                 }
1948 #endif
1949 #ifdef INET
1950         case AF_INET:
1951                 {
1952                         struct sockaddr_in *sin;
1953                         struct in6pcb *inp6;
1954
1955                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1956                         /* invalid if we are a v6 only endpoint */
1957                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1958                             SCTP_IPV6_V6ONLY(inp6))
1959                                 return;
1960
1961                         sin = &ifa->address.sin;
1962                         if (sin->sin_addr.s_addr == 0) {
1963                                 /* we skip unspecifed addresses */
1964                                 return;
1965                         }
1966                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1967                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1968                                 return;
1969                         }
1970                         break;
1971                 }
1972 #endif
1973         default:
1974                 /* else, not AF_INET or AF_INET6, so skip */
1975                 return;
1976         }
1977
1978         /* queue an asconf for this address add/delete */
1979         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1980                 /* does the peer do asconf? */
1981                 if (stcb->asoc.asconf_supported) {
1982                         /* queue an asconf for this addr */
1983                         status = sctp_asconf_queue_add(stcb, ifa, type);
1984
1985                         /*
1986                          * if queued ok, and in the open state, send out the
1987                          * ASCONF.  If in the non-open state, these will be
1988                          * sent when the state goes open.
1989                          */
1990                         if (status == 0 &&
1991                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
1992 #ifdef SCTP_TIMER_BASED_ASCONF
1993                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1994                                     stcb, stcb->asoc.primary_destination);
1995 #else
1996                                 sctp_send_asconf(stcb, NULL, addr_locked);
1997 #endif
1998                         }
1999                 }
2000         }
2001 }
2002
2003
2004 int
2005 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2006 {
2007         struct sctp_asconf_iterator *asc;
2008         struct sctp_ifa *ifa;
2009         struct sctp_laddr *l;
2010         int cnt_invalid = 0;
2011
2012         asc = (struct sctp_asconf_iterator *)ptr;
2013         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2014                 ifa = l->ifa;
2015                 switch (ifa->address.sa.sa_family) {
2016 #ifdef INET6
2017                 case AF_INET6:
2018                         /* invalid if we're not a v6 endpoint */
2019                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2020                                 cnt_invalid++;
2021                                 if (asc->cnt == cnt_invalid)
2022                                         return (1);
2023                         }
2024                         break;
2025 #endif
2026 #ifdef INET
2027                 case AF_INET:
2028                         {
2029                                 /* invalid if we are a v6 only endpoint */
2030                                 struct in6pcb *inp6;
2031
2032                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2033                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2034                                     SCTP_IPV6_V6ONLY(inp6)) {
2035                                         cnt_invalid++;
2036                                         if (asc->cnt == cnt_invalid)
2037                                                 return (1);
2038                                 }
2039                                 break;
2040                         }
2041 #endif
2042                 default:
2043                         /* invalid address family */
2044                         cnt_invalid++;
2045                         if (asc->cnt == cnt_invalid)
2046                                 return (1);
2047                 }
2048         }
2049         return (0);
2050 }
2051
2052 static int
2053 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2054 {
2055         struct sctp_ifa *ifa;
2056         struct sctp_asconf_iterator *asc;
2057         struct sctp_laddr *laddr, *nladdr, *l;
2058
2059         /* Only for specific case not bound all */
2060         asc = (struct sctp_asconf_iterator *)ptr;
2061         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2062                 ifa = l->ifa;
2063                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2064                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2065                             sctp_nxt_addr) {
2066                                 if (laddr->ifa == ifa) {
2067                                         laddr->action = 0;
2068                                         break;
2069                                 }
2070                         }
2071                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2072                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2073                                 /* remove only after all guys are done */
2074                                 if (laddr->ifa == ifa) {
2075                                         sctp_del_local_addr_ep(inp, ifa);
2076                                 }
2077                         }
2078                 }
2079         }
2080         return (0);
2081 }
2082
2083 void
2084 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2085     void *ptr, uint32_t val SCTP_UNUSED)
2086 {
2087         struct sctp_asconf_iterator *asc;
2088         struct sctp_ifa *ifa;
2089         struct sctp_laddr *l;
2090         int cnt_invalid = 0;
2091         int type, status;
2092         int num_queued = 0;
2093
2094         asc = (struct sctp_asconf_iterator *)ptr;
2095         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2096                 ifa = l->ifa;
2097                 type = l->action;
2098
2099                 /* address's vrf_id must be the vrf_id of the assoc */
2100                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2101                         continue;
2102                 }
2103                 /* Same checks again for assoc */
2104                 switch (ifa->address.sa.sa_family) {
2105 #ifdef INET6
2106                 case AF_INET6:
2107                         {
2108                                 /* invalid if we're not a v6 endpoint */
2109                                 struct sockaddr_in6 *sin6;
2110
2111                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2112                                         cnt_invalid++;
2113                                         if (asc->cnt == cnt_invalid)
2114                                                 return;
2115                                         else
2116                                                 continue;
2117                                 }
2118                                 sin6 = &ifa->address.sin6;
2119                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2120                                         /* we skip unspecifed addresses */
2121                                         continue;
2122                                 }
2123                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2124                                     &sin6->sin6_addr) != 0) {
2125                                         continue;
2126                                 }
2127                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2128                                         if (stcb->asoc.scope.local_scope == 0) {
2129                                                 continue;
2130                                         }
2131                                         /* is it the right link local scope? */
2132                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2133                                                 continue;
2134                                         }
2135                                 }
2136                                 break;
2137                         }
2138 #endif
2139 #ifdef INET
2140                 case AF_INET:
2141                         {
2142                                 /* invalid if we are a v6 only endpoint */
2143                                 struct in6pcb *inp6;
2144                                 struct sockaddr_in *sin;
2145
2146                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2147                                 /* invalid if we are a v6 only endpoint */
2148                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2149                                     SCTP_IPV6_V6ONLY(inp6))
2150                                         continue;
2151
2152                                 sin = &ifa->address.sin;
2153                                 if (sin->sin_addr.s_addr == 0) {
2154                                         /* we skip unspecifed addresses */
2155                                         continue;
2156                                 }
2157                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2158                                     &sin->sin_addr) != 0) {
2159                                         continue;
2160                                 }
2161                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2162                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2163                                         continue;
2164                                 }
2165                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2166                                     SCTP_IPV6_V6ONLY(inp6)) {
2167                                         cnt_invalid++;
2168                                         if (asc->cnt == cnt_invalid)
2169                                                 return;
2170                                         else
2171                                                 continue;
2172                                 }
2173                                 break;
2174                         }
2175 #endif
2176                 default:
2177                         /* invalid address family */
2178                         cnt_invalid++;
2179                         if (asc->cnt == cnt_invalid)
2180                                 return;
2181                         else
2182                                 continue;
2183                         break;
2184                 }
2185
2186                 if (type == SCTP_ADD_IP_ADDRESS) {
2187                         /* prevent this address from being used as a source */
2188                         sctp_add_local_addr_restricted(stcb, ifa);
2189                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2190                         struct sctp_nets *net;
2191
2192                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2193                                 sctp_rtentry_t *rt;
2194
2195                                 /* delete this address if cached */
2196                                 if (net->ro._s_addr == ifa) {
2197                                         sctp_free_ifa(net->ro._s_addr);
2198                                         net->ro._s_addr = NULL;
2199                                         net->src_addr_selected = 0;
2200                                         rt = net->ro.ro_rt;
2201                                         if (rt) {
2202                                                 RTFREE(rt);
2203                                                 net->ro.ro_rt = NULL;
2204                                         }
2205                                         /*
2206                                          * Now we deleted our src address,
2207                                          * should we not also now reset the
2208                                          * cwnd/rto to start as if its a new
2209                                          * address?
2210                                          */
2211                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2212                                         net->RTO = 0;
2213
2214                                 }
2215                         }
2216                 } else if (type == SCTP_SET_PRIM_ADDR) {
2217                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2218                                 /* must validate the ifa is in the ep */
2219                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2220                                         continue;
2221                                 }
2222                         } else {
2223                                 /* Need to check scopes for this guy */
2224                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2225                                         continue;
2226                                 }
2227                         }
2228                 }
2229                 /* queue an asconf for this address add/delete */
2230                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2231                     stcb->asoc.asconf_supported == 1) {
2232                         /* queue an asconf for this addr */
2233                         status = sctp_asconf_queue_add(stcb, ifa, type);
2234                         /*
2235                          * if queued ok, and in the open state, update the
2236                          * count of queued params.  If in the non-open
2237                          * state, these get sent when the assoc goes open.
2238                          */
2239                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2240                                 if (status >= 0) {
2241                                         num_queued++;
2242                                 }
2243                         }
2244                 }
2245         }
2246         /*
2247          * If we have queued params in the open state, send out an ASCONF.
2248          */
2249         if (num_queued > 0) {
2250                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2251         }
2252 }
2253
2254 void
2255 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2256 {
2257         struct sctp_asconf_iterator *asc;
2258         struct sctp_ifa *ifa;
2259         struct sctp_laddr *l, *nl;
2260
2261         asc = (struct sctp_asconf_iterator *)ptr;
2262         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2263                 ifa = l->ifa;
2264                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2265                         /* Clear the defer use flag */
2266                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2267                 }
2268                 sctp_free_ifa(ifa);
2269                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2270                 SCTP_DECR_LADDR_COUNT();
2271         }
2272         SCTP_FREE(asc, SCTP_M_ASC_IT);
2273 }
2274
2275 /*
2276  * sa is the sockaddr to ask the peer to set primary to.
2277  * returns: 0 = completed, -1 = error
2278  */
2279 int32_t
2280 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2281 {
2282         uint32_t vrf_id;
2283         struct sctp_ifa *ifa;
2284
2285         /* find the ifa for the desired set primary */
2286         vrf_id = stcb->asoc.vrf_id;
2287         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2288         if (ifa == NULL) {
2289                 /* Invalid address */
2290                 return (-1);
2291         }
2292         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2293         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2294                 /* set primary queuing succeeded */
2295                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2296                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2297                     (void *)stcb);
2298                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2299                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2300 #ifdef SCTP_TIMER_BASED_ASCONF
2301                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2302                             stcb->sctp_ep, stcb,
2303                             stcb->asoc.primary_destination);
2304 #else
2305                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2306 #endif
2307                 }
2308         } else {
2309                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2310                     (void *)stcb);
2311                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2312                 return (-1);
2313         }
2314         return (0);
2315 }
2316
2317 void
2318 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2319 {
2320         struct sctp_inpcb *inp;
2321
2322         /* go through all our PCB's */
2323         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2324                 struct sctp_tcb *stcb;
2325
2326                 /* process for all associations for this endpoint */
2327                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2328                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2329                         if (!sctp_asconf_queue_add(stcb, ifa,
2330                             SCTP_SET_PRIM_ADDR)) {
2331                                 /* set primary queuing succeeded */
2332                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2333                                     (void *)stcb);
2334                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2335                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2336 #ifdef SCTP_TIMER_BASED_ASCONF
2337                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2338                                             stcb->sctp_ep, stcb,
2339                                             stcb->asoc.primary_destination);
2340 #else
2341                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2342 #endif
2343                                 }
2344                         }
2345                 }               /* for each stcb */
2346         }                       /* for each inp */
2347 }
2348
2349 int
2350 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2351 {
2352         struct sctp_tmit_chunk *chk, *nchk;
2353         unsigned int offset, asconf_limit;
2354         struct sctp_asconf_chunk *acp;
2355         struct sctp_asconf_paramhdr *aph;
2356         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2357         struct sctp_paramhdr *ph;
2358         int add_cnt, del_cnt;
2359         uint16_t last_param_type;
2360
2361         add_cnt = del_cnt = 0;
2362         last_param_type = 0;
2363         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2364                 if (chk->data == NULL) {
2365                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2366                         continue;
2367                 }
2368                 offset = 0;
2369                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2370                 offset += sizeof(struct sctp_asconf_chunk);
2371                 asconf_limit = ntohs(acp->ch.chunk_length);
2372                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2373                 if (ph == NULL) {
2374                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2375                         continue;
2376                 }
2377                 offset += ntohs(ph->param_length);
2378
2379                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2380                 if (aph == NULL) {
2381                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2382                         continue;
2383                 }
2384                 while (aph != NULL) {
2385                         unsigned int param_length, param_type;
2386
2387                         param_type = ntohs(aph->ph.param_type);
2388                         param_length = ntohs(aph->ph.param_length);
2389                         if (offset + param_length > asconf_limit) {
2390                                 /* parameter goes beyond end of chunk! */
2391                                 break;
2392                         }
2393                         if (param_length > sizeof(aparam_buf)) {
2394                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2395                                 break;
2396                         }
2397                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2398                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2399                                 break;
2400                         }
2401                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2402                         if (aph == NULL) {
2403                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2404                                 break;
2405                         }
2406                         ph = (struct sctp_paramhdr *)(aph + 1);
2407                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2408                                 switch (param_type) {
2409                                 case SCTP_ADD_IP_ADDRESS:
2410                                         add_cnt++;
2411                                         break;
2412                                 case SCTP_DEL_IP_ADDRESS:
2413                                         del_cnt++;
2414                                         break;
2415                                 default:
2416                                         break;
2417                                 }
2418                                 last_param_type = param_type;
2419                         }
2420                         offset += SCTP_SIZE32(param_length);
2421                         if (offset >= asconf_limit) {
2422                                 /* no more data in the mbuf chain */
2423                                 break;
2424                         }
2425                         /* get pointer to next asconf param */
2426                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2427                 }
2428         }
2429
2430         /*
2431          * we want to find the sequences which consist of ADD -> DEL -> ADD
2432          * or DEL -> ADD
2433          */
2434         if (add_cnt > del_cnt ||
2435             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2436                 return (1);
2437         }
2438         return (0);
2439 }
2440
2441 static struct sockaddr *
2442 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2443 {
2444         struct sctp_vrf *vrf = NULL;
2445         struct sctp_ifn *sctp_ifn;
2446         struct sctp_ifa *sctp_ifa;
2447
2448         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2449                 SCTP_IPI_ADDR_RLOCK();
2450         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2451         if (vrf == NULL) {
2452                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2453                         SCTP_IPI_ADDR_RUNLOCK();
2454                 return (NULL);
2455         }
2456         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2457                 if (stcb->asoc.scope.loopback_scope == 0 &&
2458                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2459                         /* Skip if loopback_scope not set */
2460                         continue;
2461                 }
2462                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2463                         switch (sctp_ifa->address.sa.sa_family) {
2464 #ifdef INET
2465                         case AF_INET:
2466                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2467                                         struct sockaddr_in *sin;
2468
2469                                         sin = &sctp_ifa->address.sin;
2470                                         if (sin->sin_addr.s_addr == 0) {
2471                                                 /* skip unspecifed addresses */
2472                                                 continue;
2473                                         }
2474                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2475                                             &sin->sin_addr) != 0) {
2476                                                 continue;
2477                                         }
2478                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2479                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2480                                                 continue;
2481
2482                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2483                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2484                                                 continue;
2485                                         /*
2486                                          * found a valid local v4 address to
2487                                          * use
2488                                          */
2489                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2490                                                 SCTP_IPI_ADDR_RUNLOCK();
2491                                         return (&sctp_ifa->address.sa);
2492                                 }
2493                                 break;
2494 #endif
2495 #ifdef INET6
2496                         case AF_INET6:
2497                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2498                                         struct sockaddr_in6 *sin6;
2499
2500                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2501                                                 continue;
2502                                         }
2503                                         sin6 = &sctp_ifa->address.sin6;
2504                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2505                                                 /*
2506                                                  * we skip unspecifed
2507                                                  * addresses
2508                                                  */
2509                                                 continue;
2510                                         }
2511                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2512                                             &sin6->sin6_addr) != 0) {
2513                                                 continue;
2514                                         }
2515                                         if (stcb->asoc.scope.local_scope == 0 &&
2516                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2517                                                 continue;
2518                                         if (stcb->asoc.scope.site_scope == 0 &&
2519                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2520                                                 continue;
2521
2522                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2523                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2524                                                 continue;
2525                                         /*
2526                                          * found a valid local v6 address to
2527                                          * use
2528                                          */
2529                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2530                                                 SCTP_IPI_ADDR_RUNLOCK();
2531                                         return (&sctp_ifa->address.sa);
2532                                 }
2533                                 break;
2534 #endif
2535                         default:
2536                                 break;
2537                         }
2538                 }
2539         }
2540         /* no valid addresses found */
2541         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2542                 SCTP_IPI_ADDR_RUNLOCK();
2543         return (NULL);
2544 }
2545
2546 static struct sockaddr *
2547 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2548 {
2549         struct sctp_laddr *laddr;
2550
2551         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2552                 if (laddr->ifa == NULL) {
2553                         continue;
2554                 }
2555                 /* is the address restricted ? */
2556                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2557                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2558                         continue;
2559
2560                 /* found a valid local address to use */
2561                 return (&laddr->ifa->address.sa);
2562         }
2563         /* no valid addresses found */
2564         return (NULL);
2565 }
2566
2567 /*
2568  * builds an ASCONF chunk from queued ASCONF params.
2569  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2570  */
2571 struct mbuf *
2572 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2573 {
2574         struct mbuf *m_asconf, *m_asconf_chk;
2575         struct sctp_asconf_addr *aa;
2576         struct sctp_asconf_chunk *acp;
2577         struct sctp_asconf_paramhdr *aph;
2578         struct sctp_asconf_addr_param *aap;
2579         uint32_t p_length;
2580         uint32_t correlation_id = 1;    /* 0 is reserved... */
2581         caddr_t ptr, lookup_ptr;
2582         uint8_t lookup_used = 0;
2583
2584         /* are there any asconf params to send? */
2585         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2586                 if (aa->sent == 0)
2587                         break;
2588         }
2589         if (aa == NULL)
2590                 return (NULL);
2591
2592         /*
2593          * get a chunk header mbuf and a cluster for the asconf params since
2594          * it's simpler to fill in the asconf chunk header lookup address on
2595          * the fly
2596          */
2597         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2598         if (m_asconf_chk == NULL) {
2599                 /* no mbuf's */
2600                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2601                     "compose_asconf: couldn't get chunk mbuf!\n");
2602                 return (NULL);
2603         }
2604         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2605         if (m_asconf == NULL) {
2606                 /* no mbuf's */
2607                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2608                     "compose_asconf: couldn't get mbuf!\n");
2609                 sctp_m_freem(m_asconf_chk);
2610                 return (NULL);
2611         }
2612         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2613         SCTP_BUF_LEN(m_asconf) = 0;
2614         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2615         bzero(acp, sizeof(struct sctp_asconf_chunk));
2616         /* save pointers to lookup address and asconf params */
2617         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2618         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2619
2620         /* fill in chunk header info */
2621         acp->ch.chunk_type = SCTP_ASCONF;
2622         acp->ch.chunk_flags = 0;
2623         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2624         stcb->asoc.asconf_seq_out++;
2625
2626         /* add parameters... up to smallest MTU allowed */
2627         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2628                 if (aa->sent)
2629                         continue;
2630                 /* get the parameter length */
2631                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2632                 /* will it fit in current chunk? */
2633                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2634                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2635                         /* won't fit, so we're done with this chunk */
2636                         break;
2637                 }
2638                 /* assign (and store) a correlation id */
2639                 aa->ap.aph.correlation_id = correlation_id++;
2640
2641                 /*
2642                  * fill in address if we're doing a delete this is a simple
2643                  * way for us to fill in the correlation address, which
2644                  * should only be used by the peer if we're deleting our
2645                  * source address and adding a new address (e.g. renumbering
2646                  * case)
2647                  */
2648                 if (lookup_used == 0 &&
2649                     (aa->special_del == 0) &&
2650                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2651                         struct sctp_ipv6addr_param *lookup;
2652                         uint16_t p_size, addr_size;
2653
2654                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2655                         lookup->ph.param_type =
2656                             htons(aa->ap.addrp.ph.param_type);
2657                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2658                                 /* copy IPv6 address */
2659                                 p_size = sizeof(struct sctp_ipv6addr_param);
2660                                 addr_size = sizeof(struct in6_addr);
2661                         } else {
2662                                 /* copy IPv4 address */
2663                                 p_size = sizeof(struct sctp_ipv4addr_param);
2664                                 addr_size = sizeof(struct in_addr);
2665                         }
2666                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2667                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2668                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2669                         lookup_used = 1;
2670                 }
2671                 /* copy into current space */
2672                 memcpy(ptr, &aa->ap, p_length);
2673
2674                 /* network elements and update lengths */
2675                 aph = (struct sctp_asconf_paramhdr *)ptr;
2676                 aap = (struct sctp_asconf_addr_param *)ptr;
2677                 /* correlation_id is transparent to peer, no htonl needed */
2678                 aph->ph.param_type = htons(aph->ph.param_type);
2679                 aph->ph.param_length = htons(aph->ph.param_length);
2680                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2681                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2682
2683                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2684                 ptr += SCTP_SIZE32(p_length);
2685
2686                 /*
2687                  * these params are removed off the pending list upon
2688                  * getting an ASCONF-ACK back from the peer, just set flag
2689                  */
2690                 aa->sent = 1;
2691         }
2692         /* check to see if the lookup addr has been populated yet */
2693         if (lookup_used == 0) {
2694                 /* NOTE: if the address param is optional, can skip this... */
2695                 /* add any valid (existing) address... */
2696                 struct sctp_ipv6addr_param *lookup;
2697                 uint16_t p_size, addr_size;
2698                 struct sockaddr *found_addr;
2699                 caddr_t addr_ptr;
2700
2701                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2702                         found_addr = sctp_find_valid_localaddr(stcb,
2703                             addr_locked);
2704                 else
2705                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2706
2707                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2708                 if (found_addr != NULL) {
2709                         switch (found_addr->sa_family) {
2710 #ifdef INET6
2711                         case AF_INET6:
2712                                 /* copy IPv6 address */
2713                                 lookup->ph.param_type =
2714                                     htons(SCTP_IPV6_ADDRESS);
2715                                 p_size = sizeof(struct sctp_ipv6addr_param);
2716                                 addr_size = sizeof(struct in6_addr);
2717                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2718                                     found_addr)->sin6_addr;
2719                                 break;
2720 #endif
2721 #ifdef INET
2722                         case AF_INET:
2723                                 /* copy IPv4 address */
2724                                 lookup->ph.param_type =
2725                                     htons(SCTP_IPV4_ADDRESS);
2726                                 p_size = sizeof(struct sctp_ipv4addr_param);
2727                                 addr_size = sizeof(struct in_addr);
2728                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2729                                     found_addr)->sin_addr;
2730                                 break;
2731 #endif
2732                         default:
2733                                 p_size = 0;
2734                                 addr_size = 0;
2735                                 addr_ptr = NULL;
2736                                 break;
2737                         }
2738                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2739                         memcpy(lookup->addr, addr_ptr, addr_size);
2740                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2741                 } else {
2742                         /* uh oh... don't have any address?? */
2743                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2744                             "compose_asconf: no lookup addr!\n");
2745                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2746                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2747                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2748                         bzero(lookup->addr, sizeof(struct in_addr));
2749                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2750                 }
2751         }
2752         /* chain it all together */
2753         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2754         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2755         acp->ch.chunk_length = htons(*retlen);
2756
2757         return (m_asconf_chk);
2758 }
2759
2760 /*
2761  * section to handle address changes before an association is up eg. changes
2762  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2763  */
2764
2765 /*
2766  * processes the (local) addresses in the INIT-ACK chunk
2767  */
2768 static void
2769 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2770     unsigned int offset, unsigned int length)
2771 {
2772         struct sctp_paramhdr tmp_param, *ph;
2773         uint16_t plen, ptype;
2774         struct sctp_ifa *sctp_ifa;
2775         union sctp_sockstore store;
2776
2777 #ifdef INET6
2778         struct sctp_ipv6addr_param addr6_store;
2779
2780 #endif
2781 #ifdef INET
2782         struct sctp_ipv4addr_param addr4_store;
2783
2784 #endif
2785         uint32_t vrf_id;
2786
2787         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2788         if (stcb == NULL)       /* Un-needed check for SA */
2789                 return;
2790
2791         /* convert to upper bound */
2792         length += offset;
2793
2794         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2795                 return;
2796         }
2797         /* go through the addresses in the init-ack */
2798         ph = (struct sctp_paramhdr *)
2799             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2800             (uint8_t *) & tmp_param);
2801         while (ph != NULL) {
2802                 ptype = ntohs(ph->param_type);
2803                 plen = ntohs(ph->param_length);
2804                 switch (ptype) {
2805 #ifdef INET6
2806                 case SCTP_IPV6_ADDRESS:
2807                         {
2808                                 struct sctp_ipv6addr_param *a6p;
2809
2810                                 /* get the entire IPv6 address param */
2811                                 a6p = (struct sctp_ipv6addr_param *)
2812                                     sctp_m_getptr(m, offset,
2813                                     sizeof(struct sctp_ipv6addr_param),
2814                                     (uint8_t *) & addr6_store);
2815                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2816                                     a6p == NULL) {
2817                                         return;
2818                                 }
2819                                 memset(&store, 0, sizeof(union sctp_sockstore));
2820                                 store.sin6.sin6_family = AF_INET6;
2821                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2822                                 store.sin6.sin6_port = stcb->rport;
2823                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2824                                 break;
2825                         }
2826 #endif
2827 #ifdef INET
2828                 case SCTP_IPV4_ADDRESS:
2829                         {
2830                                 struct sctp_ipv4addr_param *a4p;
2831
2832                                 /* get the entire IPv4 address param */
2833                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2834                                     sizeof(struct sctp_ipv4addr_param),
2835                                     (uint8_t *) & addr4_store);
2836                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2837                                     a4p == NULL) {
2838                                         return;
2839                                 }
2840                                 memset(&store, 0, sizeof(union sctp_sockstore));
2841                                 store.sin.sin_family = AF_INET;
2842                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2843                                 store.sin.sin_port = stcb->rport;
2844                                 store.sin.sin_addr.s_addr = a4p->addr;
2845                                 break;
2846                         }
2847 #endif
2848                 default:
2849                         goto next_addr;
2850                 }
2851
2852                 /* see if this address really (still) exists */
2853                 if (stcb) {
2854                         vrf_id = stcb->asoc.vrf_id;
2855                 } else {
2856                         vrf_id = SCTP_DEFAULT_VRFID;
2857                 }
2858                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, vrf_id,
2859                     SCTP_ADDR_NOT_LOCKED);
2860                 if (sctp_ifa == NULL) {
2861                         /* address doesn't exist anymore */
2862                         int status;
2863
2864                         /* are ASCONFs allowed ? */
2865                         if ((sctp_is_feature_on(stcb->sctp_ep,
2866                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2867                             stcb->asoc.asconf_supported) {
2868                                 /* queue an ASCONF DEL_IP_ADDRESS */
2869                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2870                                 /*
2871                                  * if queued ok, and in correct state, send
2872                                  * out the ASCONF.
2873                                  */
2874                                 if (status == 0 &&
2875                                     SCTP_GET_STATE(&stcb->asoc) ==
2876                                     SCTP_STATE_OPEN) {
2877 #ifdef SCTP_TIMER_BASED_ASCONF
2878                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2879                                             stcb->sctp_ep, stcb,
2880                                             stcb->asoc.primary_destination);
2881 #else
2882                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2883 #endif
2884                                 }
2885                         }
2886                 }
2887 next_addr:
2888                 /*
2889                  * Sanity check:  Make sure the length isn't 0, otherwise
2890                  * we'll be stuck in this loop for a long time...
2891                  */
2892                 if (SCTP_SIZE32(plen) == 0) {
2893                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2894                             plen, ptype);
2895                         return;
2896                 }
2897                 /* get next parameter */
2898                 offset += SCTP_SIZE32(plen);
2899                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2900                         return;
2901                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2902                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2903         }                       /* while */
2904 }
2905
2906 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2907 /*
2908  * checks to see if a specific address is in the initack address list returns
2909  * 1 if found, 0 if not
2910  */
2911 static uint32_t
2912 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2913 {
2914         struct sctp_paramhdr tmp_param, *ph;
2915         uint16_t plen, ptype;
2916
2917 #ifdef INET
2918         struct sockaddr_in *sin;
2919         struct sctp_ipv4addr_param *a4p;
2920         struct sctp_ipv6addr_param addr4_store;
2921
2922 #endif
2923 #ifdef INET6
2924         struct sockaddr_in6 *sin6;
2925         struct sctp_ipv6addr_param *a6p;
2926         struct sctp_ipv6addr_param addr6_store;
2927         struct sockaddr_in6 sin6_tmp;
2928
2929 #endif
2930
2931         switch (sa->sa_family) {
2932 #ifdef INET
2933         case AF_INET:
2934                 break;
2935 #endif
2936 #ifdef INET6
2937         case AF_INET6:
2938                 break;
2939 #endif
2940         default:
2941                 return (0);
2942         }
2943
2944         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2945         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2946         /* convert to upper bound */
2947         length += offset;
2948
2949         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2950                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2951                     "find_initack_addr: invalid offset?\n");
2952                 return (0);
2953         }
2954         /* go through the addresses in the init-ack */
2955         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2956             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2957         while (ph != NULL) {
2958                 ptype = ntohs(ph->param_type);
2959                 plen = ntohs(ph->param_length);
2960                 switch (ptype) {
2961 #ifdef INET6
2962                 case SCTP_IPV6_ADDRESS:
2963                         if (sa->sa_family == AF_INET6) {
2964                                 /* get the entire IPv6 address param */
2965                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2966                                         break;
2967                                 }
2968                                 /* get the entire IPv6 address param */
2969                                 a6p = (struct sctp_ipv6addr_param *)
2970                                     sctp_m_getptr(m, offset,
2971                                     sizeof(struct sctp_ipv6addr_param),
2972                                     (uint8_t *) & addr6_store);
2973                                 if (a6p == NULL) {
2974                                         return (0);
2975                                 }
2976                                 sin6 = (struct sockaddr_in6 *)sa;
2977                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2978                                         /* create a copy and clear scope */
2979                                         memcpy(&sin6_tmp, sin6,
2980                                             sizeof(struct sockaddr_in6));
2981                                         sin6 = &sin6_tmp;
2982                                         in6_clearscope(&sin6->sin6_addr);
2983                                 }
2984                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2985                                     sizeof(struct in6_addr)) == 0) {
2986                                         /* found it */
2987                                         return (1);
2988                                 }
2989                         }
2990                         break;
2991 #endif                          /* INET6 */
2992 #ifdef INET
2993                 case SCTP_IPV4_ADDRESS:
2994                         if (sa->sa_family == AF_INET) {
2995                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2996                                         break;
2997                                 }
2998                                 /* get the entire IPv4 address param */
2999                                 a4p = (struct sctp_ipv4addr_param *)
3000                                     sctp_m_getptr(m, offset,
3001                                     sizeof(struct sctp_ipv4addr_param),
3002                                     (uint8_t *) & addr4_store);
3003                                 if (a4p == NULL) {
3004                                         return (0);
3005                                 }
3006                                 sin = (struct sockaddr_in *)sa;
3007                                 if (sin->sin_addr.s_addr == a4p->addr) {
3008                                         /* found it */
3009                                         return (1);
3010                                 }
3011                         }
3012                         break;
3013 #endif
3014                 default:
3015                         break;
3016                 }
3017                 /* get next parameter */
3018                 offset += SCTP_SIZE32(plen);
3019                 if (offset + sizeof(struct sctp_paramhdr) > length) {
3020                         return (0);
3021                 }
3022                 ph = (struct sctp_paramhdr *)
3023                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3024                     (uint8_t *) & tmp_param);
3025         }                       /* while */
3026         /* not found! */
3027         return (0);
3028 }
3029
3030 /*
3031  * makes sure that the current endpoint local addr list is consistent with
3032  * the new association (eg. subset bound, asconf allowed) adds addresses as
3033  * necessary
3034  */
3035 static void
3036 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3037     int length, struct sockaddr *init_addr)
3038 {
3039         struct sctp_laddr *laddr;
3040
3041         /* go through the endpoint list */
3042         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3043                 /* be paranoid and validate the laddr */
3044                 if (laddr->ifa == NULL) {
3045                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3046                             "check_addr_list_ep: laddr->ifa is NULL");
3047                         continue;
3048                 }
3049                 if (laddr->ifa == NULL) {
3050                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3051                         continue;
3052                 }
3053                 /* do i have it implicitly? */
3054                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3055                         continue;
3056                 }
3057                 /* check to see if in the init-ack */
3058                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3059                         /* try to add it */
3060                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3061                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3062                 }
3063         }
3064 }
3065
3066 /*
3067  * makes sure that the current kernel address list is consistent with the new
3068  * association (with all addrs bound) adds addresses as necessary
3069  */
3070 static void
3071 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3072     int length, struct sockaddr *init_addr,
3073     uint16_t local_scope, uint16_t site_scope,
3074     uint16_t ipv4_scope, uint16_t loopback_scope)
3075 {
3076         struct sctp_vrf *vrf = NULL;
3077         struct sctp_ifn *sctp_ifn;
3078         struct sctp_ifa *sctp_ifa;
3079         uint32_t vrf_id;
3080
3081 #ifdef INET
3082         struct sockaddr_in *sin;
3083
3084 #endif
3085 #ifdef INET6
3086         struct sockaddr_in6 *sin6;
3087
3088 #endif
3089
3090         if (stcb) {
3091                 vrf_id = stcb->asoc.vrf_id;
3092         } else {
3093                 return;
3094         }
3095         SCTP_IPI_ADDR_RLOCK();
3096         vrf = sctp_find_vrf(vrf_id);
3097         if (vrf == NULL) {
3098                 SCTP_IPI_ADDR_RUNLOCK();
3099                 return;
3100         }
3101         /* go through all our known interfaces */
3102         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3103                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3104                         /* skip loopback interface */
3105                         continue;
3106                 }
3107                 /* go through each interface address */
3108                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3109                         /* do i have it implicitly? */
3110                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3111                                 continue;
3112                         }
3113                         switch (sctp_ifa->address.sa.sa_family) {
3114 #ifdef INET
3115                         case AF_INET:
3116                                 sin = &sctp_ifa->address.sin;
3117                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3118                                     &sin->sin_addr) != 0) {
3119                                         continue;
3120                                 }
3121                                 if ((ipv4_scope == 0) &&
3122                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3123                                         /* private address not in scope */
3124                                         continue;
3125                                 }
3126                                 break;
3127 #endif
3128 #ifdef INET6
3129                         case AF_INET6:
3130                                 sin6 = &sctp_ifa->address.sin6;
3131                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3132                                     &sin6->sin6_addr) != 0) {
3133                                         continue;
3134                                 }
3135                                 if ((local_scope == 0) &&
3136                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3137                                         continue;
3138                                 }
3139                                 if ((site_scope == 0) &&
3140                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3141                                         continue;
3142                                 }
3143                                 break;
3144 #endif
3145                         default:
3146                                 break;
3147                         }
3148                         /* check to see if in the init-ack */
3149                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3150                                 /* try to add it */
3151                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3152                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3153                                     SCTP_ADDR_LOCKED);
3154                         }
3155                 }               /* end foreach ifa */
3156         }                       /* end foreach ifn */
3157         SCTP_IPI_ADDR_RUNLOCK();
3158 }
3159
3160 /*
3161  * validates an init-ack chunk (from a cookie-echo) with current addresses
3162  * adds addresses from the init-ack into our local address list, if needed
3163  * queues asconf adds/deletes addresses as needed and makes appropriate list
3164  * changes for source address selection m, offset: points to the start of the
3165  * address list in an init-ack chunk length: total length of the address
3166  * params only init_addr: address where my INIT-ACK was sent from
3167  */
3168 void
3169 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3170     int length, struct sockaddr *init_addr,
3171     uint16_t local_scope, uint16_t site_scope,
3172     uint16_t ipv4_scope, uint16_t loopback_scope)
3173 {
3174         /* process the local addresses in the initack */
3175         sctp_process_initack_addresses(stcb, m, offset, length);
3176
3177         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3178                 /* bound all case */
3179                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3180                     local_scope, site_scope, ipv4_scope, loopback_scope);
3181         } else {
3182                 /* subset bound case */
3183                 if (sctp_is_feature_on(stcb->sctp_ep,
3184                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3185                         /* asconf's allowed */
3186                         sctp_check_address_list_ep(stcb, m, offset, length,
3187                             init_addr);
3188                 }
3189                 /* else, no asconfs allowed, so what we sent is what we get */
3190         }
3191 }
3192
3193 /*
3194  * sctp_bindx() support
3195  */
3196 uint32_t
3197 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3198     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3199 {
3200         struct sctp_ifa *ifa;
3201         struct sctp_laddr *laddr, *nladdr;
3202
3203         if (sa->sa_len == 0) {
3204                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3205                 return (EINVAL);
3206         }
3207         if (sctp_ifap) {
3208                 ifa = sctp_ifap;
3209         } else if (type == SCTP_ADD_IP_ADDRESS) {
3210                 /* For an add the address MUST be on the system */
3211                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3212         } else if (type == SCTP_DEL_IP_ADDRESS) {
3213                 /* For a delete we need to find it in the inp */
3214                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3215         } else {
3216                 ifa = NULL;
3217         }
3218         if (ifa != NULL) {
3219                 if (type == SCTP_ADD_IP_ADDRESS) {
3220                         sctp_add_local_addr_ep(inp, ifa, type);
3221                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3222                         if (inp->laddr_count < 2) {
3223                                 /* can't delete the last local address */
3224                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3225                                 return (EINVAL);
3226                         }
3227                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3228                             sctp_nxt_addr) {
3229                                 if (ifa == laddr->ifa) {
3230                                         /* Mark in the delete */
3231                                         laddr->action = type;
3232                                 }
3233                         }
3234                 }
3235                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3236                         /*
3237                          * There is no need to start the iterator if the inp
3238                          * has no associations.
3239                          */
3240                         if (type == SCTP_DEL_IP_ADDRESS) {
3241                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3242                                         if (laddr->ifa == ifa) {
3243                                                 sctp_del_local_addr_ep(inp, ifa);
3244                                         }
3245                                 }
3246                         }
3247                 } else {
3248                         struct sctp_asconf_iterator *asc;
3249                         struct sctp_laddr *wi;
3250
3251                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3252                             sizeof(struct sctp_asconf_iterator),
3253                             SCTP_M_ASC_IT);
3254                         if (asc == NULL) {
3255                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3256                                 return (ENOMEM);
3257                         }
3258                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3259                         if (wi == NULL) {
3260                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3261                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3262                                 return (ENOMEM);
3263                         }
3264                         LIST_INIT(&asc->list_of_work);
3265                         asc->cnt = 1;
3266                         SCTP_INCR_LADDR_COUNT();
3267                         wi->ifa = ifa;
3268                         wi->action = type;
3269                         atomic_add_int(&ifa->refcount, 1);
3270                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3271                         (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3272                             sctp_asconf_iterator_stcb,
3273                             sctp_asconf_iterator_ep_end,
3274                             SCTP_PCB_ANY_FLAGS,
3275                             SCTP_PCB_ANY_FEATURES,
3276                             SCTP_ASOC_ANY_STATE,
3277                             (void *)asc, 0,
3278                             sctp_asconf_iterator_end, inp, 0);
3279                 }
3280                 return (0);
3281         } else {
3282                 /* invalid address! */
3283                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3284                 return (EADDRNOTAVAIL);
3285         }
3286 }
3287
3288 void
3289 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3290     struct sctp_nets *net)
3291 {
3292         struct sctp_asconf_addr *aa;
3293         struct sctp_ifa *sctp_ifap;
3294         struct sctp_asconf_tag_param *vtag;
3295
3296 #ifdef INET
3297         struct sockaddr_in *to;
3298
3299 #endif
3300 #ifdef INET6
3301         struct sockaddr_in6 *to6;
3302
3303 #endif
3304         if (net == NULL) {
3305                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3306                 return;
3307         }
3308         if (stcb == NULL) {
3309                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3310                 return;
3311         }
3312         /*
3313          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3314          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3315          */
3316         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3317             SCTP_M_ASC_ADDR);
3318         if (aa == NULL) {
3319                 /* didn't get memory */
3320                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3321                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3322                 return;
3323         }
3324         aa->special_del = 0;
3325         /* fill in asconf address parameter fields */
3326         /* top level elements are "networked" during send */
3327         aa->ifa = NULL;
3328         aa->sent = 0;           /* clear sent flag */
3329         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3330         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3331         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3332         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3333         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3334         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3335
3336         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3337             SCTP_M_ASC_ADDR);
3338         if (aa == NULL) {
3339                 /* didn't get memory */
3340                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3341                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3342                 return;
3343         }
3344         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3345         /* fill in asconf address parameter fields */
3346         /* ADD(0.0.0.0) */
3347         switch (net->ro._l_addr.sa.sa_family) {
3348 #ifdef INET
3349         case AF_INET:
3350                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3351                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3352                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3353                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3354                 /* No need to add an address, we are using 0.0.0.0 */
3355                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3356                 break;
3357 #endif
3358 #ifdef INET6
3359         case AF_INET6:
3360                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3361                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3362                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3363                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3364                 /* No need to add an address, we are using 0.0.0.0 */
3365                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3366                 break;
3367 #endif
3368         }
3369         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3370             SCTP_M_ASC_ADDR);
3371         if (aa == NULL) {
3372                 /* didn't get memory */
3373                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3374                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3375                 return;
3376         }
3377         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3378         /* fill in asconf address parameter fields */
3379         /* ADD(0.0.0.0) */
3380         switch (net->ro._l_addr.sa.sa_family) {
3381 #ifdef INET
3382         case AF_INET:
3383                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3384                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3385                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3386                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3387                 /* No need to add an address, we are using 0.0.0.0 */
3388                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3389                 break;
3390 #endif
3391 #ifdef INET6
3392         case AF_INET6:
3393                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3394                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3395                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3396                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3397                 /* No need to add an address, we are using 0.0.0.0 */
3398                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3399                 break;
3400 #endif
3401         }
3402         /* Now we must hunt the addresses and add all global addresses */
3403         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3404                 struct sctp_vrf *vrf = NULL;
3405                 struct sctp_ifn *sctp_ifnp;
3406                 uint32_t vrf_id;
3407
3408                 vrf_id = stcb->sctp_ep->def_vrf_id;
3409                 vrf = sctp_find_vrf(vrf_id);
3410                 if (vrf == NULL) {
3411                         goto skip_rest;
3412                 }
3413                 SCTP_IPI_ADDR_RLOCK();
3414                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3415                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3416                                 switch (sctp_ifap->address.sa.sa_family) {
3417 #ifdef INET
3418                                 case AF_INET:
3419                                         to = &sctp_ifap->address.sin;
3420                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3421                                             &to->sin_addr) != 0) {
3422                                                 continue;
3423                                         }
3424                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3425                                                 continue;
3426                                         }
3427                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3428                                                 continue;
3429                                         }
3430                                         break;
3431 #endif
3432 #ifdef INET6
3433                                 case AF_INET6:
3434                                         to6 = &sctp_ifap->address.sin6;
3435                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3436                                             &to6->sin6_addr) != 0) {
3437                                                 continue;
3438                                         }
3439                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3440                                                 continue;
3441                                         }
3442                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3443                                                 continue;
3444                                         }
3445                                         break;
3446 #endif
3447                                 default:
3448                                         continue;
3449                                 }
3450                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3451                         }
3452                 }
3453                 SCTP_IPI_ADDR_RUNLOCK();
3454         } else {
3455                 struct sctp_laddr *laddr;
3456
3457                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3458                         if (laddr->ifa == NULL) {
3459                                 continue;
3460                         }
3461                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3462                                 /*
3463                                  * Address being deleted by the system, dont
3464                                  * list.
3465                                  */
3466                                 continue;
3467                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3468                                 /*
3469                                  * Address being deleted on this ep don't
3470                                  * list.
3471                                  */
3472                                 continue;
3473                         }
3474                         sctp_ifap = laddr->ifa;
3475                         switch (sctp_ifap->address.sa.sa_family) {
3476 #ifdef INET
3477                         case AF_INET:
3478                                 to = &sctp_ifap->address.sin;
3479                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3480                                         continue;
3481                                 }
3482                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3483                                         continue;
3484                                 }
3485                                 break;
3486 #endif
3487 #ifdef INET6
3488                         case AF_INET6:
3489                                 to6 = &sctp_ifap->address.sin6;
3490                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3491                                         continue;
3492                                 }
3493                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3494                                         continue;
3495                                 }
3496                                 break;
3497 #endif
3498                         default:
3499                                 continue;
3500                         }
3501                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3502                 }
3503         }
3504 skip_rest:
3505         /* Now we must send the asconf into the queue */
3506         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3507 }