sys/netinet/sctp_asconf.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #include <netinet/sctp_pcb.h>
  42 #include <netinet/sctp_header.h>
  43 #include <netinet/sctputil.h>
  44 #include <netinet/sctp_output.h>
  45 #include <netinet/sctp_asconf.h>
  46 #include <netinet/sctp_timer.h>
  47
  48 /*
  49  * debug flags:
  50  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  51  * SCTP_DEBUG_ASCONF2: detailed info
  52  */
  53
  54
  55 /*
  56  * RFC 5061
  57  *
  58  * An ASCONF parameter queue exists per asoc which holds the pending address
  59  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  60  *
  61  * A restricted_addrs list exists per assoc to hold local addresses that are
  62  * not (yet) usable by the assoc as a source address.  These addresses are
  63  * either pending an ASCONF operation (and exist on the ASCONF parameter
  64  * queue), or they are permanently restricted (the peer has returned an
  65  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  66  *
  67  * Deleted addresses are always immediately removed from the lists as they will
  68  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  69  * only if allowed.
  70  */
  71
  72 /*
  73  * ASCONF parameter processing.
  74  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  75  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  76  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  77  */
  78 static struct mbuf *
  79 sctp_asconf_success_response(uint32_t id)
  80 {
  81         struct mbuf *m_reply = NULL;
  82         struct sctp_asconf_paramhdr *aph;
  83
  84         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  85             0, M_NOWAIT, 1, MT_DATA);
  86         if (m_reply == NULL) {
  87                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  88                     "asconf_success_response: couldn't get mbuf!\n");
  89                 return (NULL);
  90         }
  91         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  92         aph->correlation_id = id;
  93         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  94         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  95         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  96         aph->ph.param_length = htons(aph->ph.param_length);
  97
  98         return (m_reply);
  99 }
 100
 101 static struct mbuf *
 102 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t *error_tlv,
 103     uint16_t tlv_length)
 104 {
 105         struct mbuf *m_reply = NULL;
 106         struct sctp_asconf_paramhdr *aph;
 107         struct sctp_error_cause *error;
 108         uint8_t *tlv;
 109
 110         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 111             tlv_length +
 112             sizeof(struct sctp_error_cause)),
 113             0, M_NOWAIT, 1, MT_DATA);
 114         if (m_reply == NULL) {
 115                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 116                     "asconf_error_response: couldn't get mbuf!\n");
 117                 return (NULL);
 118         }
 119         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 120         error = (struct sctp_error_cause *)(aph + 1);
 121
 122         aph->correlation_id = id;
 123         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 124         error->code = htons(cause);
 125         error->length = tlv_length + sizeof(struct sctp_error_cause);
 126         aph->ph.param_length = error->length +
 127             sizeof(struct sctp_asconf_paramhdr);
 128
 129         if (aph->ph.param_length > MLEN) {
 130                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 131                     "asconf_error_response: tlv_length (%xh) too big\n",
 132                     tlv_length);
 133                 sctp_m_freem(m_reply);  /* discard */
 134                 return (NULL);
 135         }
 136         if (error_tlv != NULL) {
 137                 tlv = (uint8_t *)(error + 1);
 138                 memcpy(tlv, error_tlv, tlv_length);
 139         }
 140         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 141         error->length = htons(error->length);
 142         aph->ph.param_length = htons(aph->ph.param_length);
 143
 144         return (m_reply);
 145 }
 146
 147 static struct mbuf *
 148 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 149     struct sctp_tcb *stcb, int send_hb, int response_required)
 150 {
 151         struct sctp_nets *net;
 152         struct mbuf *m_reply = NULL;
 153         union sctp_sockstore store;
 154         struct sctp_paramhdr *ph;
 155         uint16_t param_type, aparam_length;
 156 #if defined(INET) || defined(INET6)
 157         uint16_t param_length;
 158 #endif
 159         struct sockaddr *sa;
 160         int zero_address = 0;
 161         int bad_address = 0;
 162 #ifdef INET
 163         struct sockaddr_in *sin;
 164         struct sctp_ipv4addr_param *v4addr;
 165 #endif
 166 #ifdef INET6
 167         struct sockaddr_in6 *sin6;
 168         struct sctp_ipv6addr_param *v6addr;
 169 #endif
 170
 171         aparam_length = ntohs(aph->ph.param_length);
 172         ph = (struct sctp_paramhdr *)(aph + 1);
 173         param_type = ntohs(ph->param_type);
 174 #if defined(INET) || defined(INET6)
 175         param_length = ntohs(ph->param_length);
 176 #endif
 177         sa = &store.sa;
 178         switch (param_type) {
 179 #ifdef INET
 180         case SCTP_IPV4_ADDRESS:
 181                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 182                         /* invalid param size */
 183                         return (NULL);
 184                 }
 185                 v4addr = (struct sctp_ipv4addr_param *)ph;
 186                 sin = &store.sin;
 187                 memset(sin, 0, sizeof(*sin));
 188                 sin->sin_family = AF_INET;
 189                 sin->sin_len = sizeof(struct sockaddr_in);
 190                 sin->sin_port = stcb->rport;
 191                 sin->sin_addr.s_addr = v4addr->addr;
 192                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 193                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 194                         bad_address = 1;
 195                 }
 196                 if (sin->sin_addr.s_addr == INADDR_ANY)
 197                         zero_address = 1;
 198                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 199                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 200                 break;
 201 #endif
 202 #ifdef INET6
 203         case SCTP_IPV6_ADDRESS:
 204                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 205                         /* invalid param size */
 206                         return (NULL);
 207                 }
 208                 v6addr = (struct sctp_ipv6addr_param *)ph;
 209                 sin6 = &store.sin6;
 210                 memset(sin6, 0, sizeof(*sin6));
 211                 sin6->sin6_family = AF_INET6;
 212                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 213                 sin6->sin6_port = stcb->rport;
 214                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 215                     sizeof(struct in6_addr));
 216                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 217                         bad_address = 1;
 218                 }
 219                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 220                         zero_address = 1;
 221                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 222                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 223                 break;
 224 #endif
 225         default:
 226                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 227                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 228                     aparam_length);
 229                 return (m_reply);
 230         }                       /* end switch */
 231
 232         /* if 0.0.0.0/::0, add the source address instead */
 233         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 234                 sa = src;
 235                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 236                     "process_asconf_add_ip: using source addr ");
 237                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 238         }
 239         net = NULL;
 240         /* add the address */
 241         if (bad_address) {
 242                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 243                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 244                     aparam_length);
 245         } else if (sctp_add_remote_addr(stcb, sa, &net, stcb->asoc.port,
 246                     SCTP_DONOT_SETSCOPE,
 247             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 248                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 249                     "process_asconf_add_ip: error adding address\n");
 250                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 251                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph,
 252                     aparam_length);
 253         } else {
 254                 if (response_required) {
 255                         m_reply =
 256                             sctp_asconf_success_response(aph->correlation_id);
 257                 }
 258                 if (net != NULL) {
 259                         /* notify upper layer */
 260                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 261                         sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 262                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 263                             stcb, net);
 264                         if (send_hb) {
 265                                 sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 266                         }
 267                 }
 268         }
 269         return (m_reply);
 270 }
 271
 272 static int
 273 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 274 {
 275         struct sctp_nets *src_net, *net;
 276
 277         /* make sure the source address exists as a destination net */
 278         src_net = sctp_findnet(stcb, src);
 279         if (src_net == NULL) {
 280                 /* not found */
 281                 return (-1);
 282         }
 283
 284         /* delete all destination addresses except the source */
 285         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 286                 if (net != src_net) {
 287                         /* delete this address */
 288                         sctp_remove_net(stcb, net);
 289                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 290                             "asconf_del_remote_addrs_except: deleting ");
 291                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 292                             (struct sockaddr *)&net->ro._l_addr);
 293                         /* notify upper layer */
 294                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 295                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 296                 }
 297         }
 298         return (0);
 299 }
 300
 301 static struct mbuf *
 302 sctp_process_asconf_delete_ip(struct sockaddr *src,
 303     struct sctp_asconf_paramhdr *aph,
 304     struct sctp_tcb *stcb, int response_required)
 305 {
 306         struct mbuf *m_reply = NULL;
 307         union sctp_sockstore store;
 308         struct sctp_paramhdr *ph;
 309         uint16_t param_type, aparam_length;
 310 #if defined(INET) || defined(INET6)
 311         uint16_t param_length;
 312 #endif
 313         struct sockaddr *sa;
 314         int zero_address = 0;
 315         int result;
 316 #ifdef INET
 317         struct sockaddr_in *sin;
 318         struct sctp_ipv4addr_param *v4addr;
 319 #endif
 320 #ifdef INET6
 321         struct sockaddr_in6 *sin6;
 322         struct sctp_ipv6addr_param *v6addr;
 323 #endif
 324
 325         aparam_length = ntohs(aph->ph.param_length);
 326         ph = (struct sctp_paramhdr *)(aph + 1);
 327         param_type = ntohs(ph->param_type);
 328 #if defined(INET) || defined(INET6)
 329         param_length = ntohs(ph->param_length);
 330 #endif
 331         sa = &store.sa;
 332         switch (param_type) {
 333 #ifdef INET
 334         case SCTP_IPV4_ADDRESS:
 335                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 336                         /* invalid param size */
 337                         return (NULL);
 338                 }
 339                 v4addr = (struct sctp_ipv4addr_param *)ph;
 340                 sin = &store.sin;
 341                 memset(sin, 0, sizeof(*sin));
 342                 sin->sin_family = AF_INET;
 343                 sin->sin_len = sizeof(struct sockaddr_in);
 344                 sin->sin_port = stcb->rport;
 345                 sin->sin_addr.s_addr = v4addr->addr;
 346                 if (sin->sin_addr.s_addr == INADDR_ANY)
 347                         zero_address = 1;
 348                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 349                     "process_asconf_delete_ip: deleting ");
 350                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 351                 break;
 352 #endif
 353 #ifdef INET6
 354         case SCTP_IPV6_ADDRESS:
 355                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 356                         /* invalid param size */
 357                         return (NULL);
 358                 }
 359                 v6addr = (struct sctp_ipv6addr_param *)ph;
 360                 sin6 = &store.sin6;
 361                 memset(sin6, 0, sizeof(*sin6));
 362                 sin6->sin6_family = AF_INET6;
 363                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 364                 sin6->sin6_port = stcb->rport;
 365                 memcpy(&sin6->sin6_addr, v6addr->addr,
 366                     sizeof(struct in6_addr));
 367                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 368                         zero_address = 1;
 369                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 370                     "process_asconf_delete_ip: deleting ");
 371                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 372                 break;
 373 #endif
 374         default:
 375                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 376                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 377                     aparam_length);
 378                 return (m_reply);
 379         }
 380
 381         /* make sure the source address is not being deleted */
 382         if (sctp_cmpaddr(sa, src)) {
 383                 /* trying to delete the source address! */
 384                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 385                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 386                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *)aph,
 387                     aparam_length);
 388                 return (m_reply);
 389         }
 390
 391         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 392         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 393                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 394
 395                 if (result) {
 396                         /* src address did not exist? */
 397                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 398                         /* what error to reply with?? */
 399                         m_reply =
 400                             sctp_asconf_error_response(aph->correlation_id,
 401                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *)aph,
 402                             aparam_length);
 403                 } else if (response_required) {
 404                         m_reply =
 405                             sctp_asconf_success_response(aph->correlation_id);
 406                 }
 407                 return (m_reply);
 408         }
 409
 410         /* delete the address */
 411         result = sctp_del_remote_addr(stcb, sa);
 412         /*
 413          * note if result == -2, the address doesn't exist in the asoc but
 414          * since it's being deleted anyways, we just ack the delete -- but
 415          * this probably means something has already gone awry
 416          */
 417         if (result == -1) {
 418                 /* only one address in the asoc */
 419                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 420                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 421                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *)aph,
 422                     aparam_length);
 423         } else {
 424                 if (response_required) {
 425                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 426                 }
 427                 /* notify upper layer */
 428                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 429         }
 430         return (m_reply);
 431 }
 432
 433 static struct mbuf *
 434 sctp_process_asconf_set_primary(struct sockaddr *src,
 435     struct sctp_asconf_paramhdr *aph,
 436     struct sctp_tcb *stcb, int response_required)
 437 {
 438         struct mbuf *m_reply = NULL;
 439         union sctp_sockstore store;
 440         struct sctp_paramhdr *ph;
 441         uint16_t param_type, aparam_length;
 442 #if defined(INET) || defined(INET6)
 443         uint16_t param_length;
 444 #endif
 445         struct sockaddr *sa;
 446         int zero_address = 0;
 447 #ifdef INET
 448         struct sockaddr_in *sin;
 449         struct sctp_ipv4addr_param *v4addr;
 450 #endif
 451 #ifdef INET6
 452         struct sockaddr_in6 *sin6;
 453         struct sctp_ipv6addr_param *v6addr;
 454 #endif
 455
 456         aparam_length = ntohs(aph->ph.param_length);
 457         ph = (struct sctp_paramhdr *)(aph + 1);
 458         param_type = ntohs(ph->param_type);
 459 #if defined(INET) || defined(INET6)
 460         param_length = ntohs(ph->param_length);
 461 #endif
 462         sa = &store.sa;
 463         switch (param_type) {
 464 #ifdef INET
 465         case SCTP_IPV4_ADDRESS:
 466                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 467                         /* invalid param size */
 468                         return (NULL);
 469                 }
 470                 v4addr = (struct sctp_ipv4addr_param *)ph;
 471                 sin = &store.sin;
 472                 memset(sin, 0, sizeof(*sin));
 473                 sin->sin_family = AF_INET;
 474                 sin->sin_len = sizeof(struct sockaddr_in);
 475                 sin->sin_addr.s_addr = v4addr->addr;
 476                 if (sin->sin_addr.s_addr == INADDR_ANY)
 477                         zero_address = 1;
 478                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 479                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 480                 break;
 481 #endif
 482 #ifdef INET6
 483         case SCTP_IPV6_ADDRESS:
 484                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 485                         /* invalid param size */
 486                         return (NULL);
 487                 }
 488                 v6addr = (struct sctp_ipv6addr_param *)ph;
 489                 sin6 = &store.sin6;
 490                 memset(sin6, 0, sizeof(*sin6));
 491                 sin6->sin6_family = AF_INET6;
 492                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 493                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 494                     sizeof(struct in6_addr));
 495                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 496                         zero_address = 1;
 497                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 498                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 499                 break;
 500 #endif
 501         default:
 502                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 503                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 504                     aparam_length);
 505                 return (m_reply);
 506         }
 507
 508         /* if 0.0.0.0/::0, use the source address instead */
 509         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 510                 sa = src;
 511                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 512                     "process_asconf_set_primary: using source addr ");
 513                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 514         }
 515         /* set the primary address */
 516         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 517                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 518                     "process_asconf_set_primary: primary address set\n");
 519                 /* notify upper layer */
 520                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 521                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 522                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 523                     (stcb->asoc.alternate)) {
 524                         sctp_free_remote_addr(stcb->asoc.alternate);
 525                         stcb->asoc.alternate = NULL;
 526                 }
 527                 if (response_required) {
 528                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 529                 }
 530                 /*
 531                  * Mobility adaptation. Ideally, when the reception of SET
 532                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 533                  * destination, unacknowledged DATA are retransmitted
 534                  * immediately to the new primary destination for seamless
 535                  * handover. If the destination is UNCONFIRMED and marked to
 536                  * REQ_PRIM, The retransmission occur when reception of the
 537                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 538                  * sctp_input.c) Also, when change of the primary
 539                  * destination, it is better that all subsequent new DATA
 540                  * containing already queued DATA are transmitted to the new
 541                  * primary destination. (by micchie)
 542                  */
 543                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 544                     SCTP_MOBILITY_BASE) ||
 545                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 546                     SCTP_MOBILITY_FASTHANDOFF)) &&
 547                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 548                     SCTP_MOBILITY_PRIM_DELETED) &&
 549                     (stcb->asoc.primary_destination->dest_state &
 550                     SCTP_ADDR_UNCONFIRMED) == 0) {
 551
 552                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 553                             stcb->sctp_ep, stcb, NULL,
 554                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 555                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 556                             SCTP_MOBILITY_FASTHANDOFF)) {
 557                                 sctp_assoc_immediate_retrans(stcb,
 558                                     stcb->asoc.primary_destination);
 559                         }
 560                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 561                             SCTP_MOBILITY_BASE)) {
 562                                 sctp_move_chunks_from_net(stcb,
 563                                     stcb->asoc.deleted_primary);
 564                         }
 565                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 566                             stcb->asoc.deleted_primary);
 567                 }
 568         } else {
 569                 /* couldn't set the requested primary address! */
 570                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 571                     "process_asconf_set_primary: set primary failed!\n");
 572                 /* must have been an invalid address, so report */
 573                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 574                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 575                     aparam_length);
 576         }
 577
 578         return (m_reply);
 579 }
 580
 581 /*
 582  * handles an ASCONF chunk.
 583  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 584  */
 585 void
 586 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 587     struct sockaddr *src,
 588     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 589     int first)
 590 {
 591         struct sctp_association *asoc;
 592         uint32_t serial_num;
 593         struct mbuf *n, *m_ack, *m_result, *m_tail;
 594         struct sctp_asconf_ack_chunk *ack_cp;
 595         struct sctp_asconf_paramhdr *aph;
 596         struct sctp_ipv6addr_param *p_addr;
 597         unsigned int asconf_limit, cnt;
 598         int error = 0;          /* did an error occur? */
 599
 600         /* asconf param buffer */
 601         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 602         struct sctp_asconf_ack *ack, *ack_next;
 603
 604         /* verify minimum length */
 605         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 606                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 607                     "handle_asconf: chunk too small = %xh\n",
 608                     ntohs(cp->ch.chunk_length));
 609                 return;
 610         }
 611         asoc = &stcb->asoc;
 612         serial_num = ntohl(cp->serial_number);
 613
 614         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 615                 /* got a duplicate ASCONF */
 616                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 617                     "handle_asconf: got duplicate serial number = %xh\n",
 618                     serial_num);
 619                 return;
 620         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 621                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 622                     serial_num, asoc->asconf_seq_in + 1);
 623                 return;
 624         }
 625
 626         /* it's the expected "next" sequence number, so process it */
 627         asoc->asconf_seq_in = serial_num;       /* update sequence */
 628         /* get length of all the param's in the ASCONF */
 629         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 630         SCTPDBG(SCTP_DEBUG_ASCONF1,
 631             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 632             asconf_limit, serial_num);
 633
 634         if (first) {
 635                 /* delete old cache */
 636                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 637
 638                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 639                         if (ack->serial_number == serial_num)
 640                                 break;
 641                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 642                             ack->serial_number, serial_num);
 643                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 644                         if (ack->data != NULL) {
 645                                 sctp_m_freem(ack->data);
 646                         }
 647                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 648                 }
 649         }
 650
 651         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 652             M_NOWAIT, 1, MT_DATA);
 653         if (m_ack == NULL) {
 654                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 655                     "handle_asconf: couldn't get mbuf!\n");
 656                 return;
 657         }
 658         m_tail = m_ack;         /* current reply chain's tail */
 659
 660         /* fill in ASCONF-ACK header */
 661         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 662         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 663         ack_cp->ch.chunk_flags = 0;
 664         ack_cp->serial_number = htonl(serial_num);
 665         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 666         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 667         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 668
 669         /* skip the lookup address parameter */
 670         offset += sizeof(struct sctp_asconf_chunk);
 671         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *)&aparam_buf);
 672         if (p_addr == NULL) {
 673                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 674                     "handle_asconf: couldn't get lookup addr!\n");
 675                 /* respond with a missing/invalid mandatory parameter error */
 676                 sctp_m_freem(m_ack);
 677                 return;
 678         }
 679         /* param_length is already validated in process_control... */
 680         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 681         /* get pointer to first asconf param in ASCONF */
 682         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *)&aparam_buf);
 683         if (aph == NULL) {
 684                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 685                 goto send_reply;
 686         }
 687         /* process through all parameters */
 688         cnt = 0;
 689         while (aph != NULL) {
 690                 unsigned int param_length, param_type;
 691
 692                 param_type = ntohs(aph->ph.param_type);
 693                 param_length = ntohs(aph->ph.param_length);
 694                 if (offset + param_length > asconf_limit) {
 695                         /* parameter goes beyond end of chunk! */
 696                         sctp_m_freem(m_ack);
 697                         return;
 698                 }
 699                 m_result = NULL;
 700
 701                 if (param_length > sizeof(aparam_buf)) {
 702                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 703                         sctp_m_freem(m_ack);
 704                         return;
 705                 }
 706                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 707                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 708                         sctp_m_freem(m_ack);
 709                         return;
 710                 }
 711                 /* get the entire parameter */
 712                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 713                 if (aph == NULL) {
 714                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 715                         sctp_m_freem(m_ack);
 716                         return;
 717                 }
 718                 switch (param_type) {
 719                 case SCTP_ADD_IP_ADDRESS:
 720                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 721                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 722                         cnt++;
 723                         break;
 724                 case SCTP_DEL_IP_ADDRESS:
 725                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 726                             error);
 727                         break;
 728                 case SCTP_ERROR_CAUSE_IND:
 729                         /* not valid in an ASCONF chunk */
 730                         break;
 731                 case SCTP_SET_PRIM_ADDR:
 732                         m_result = sctp_process_asconf_set_primary(src, aph,
 733                             stcb, error);
 734                         break;
 735                 case SCTP_NAT_VTAGS:
 736                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 737                         break;
 738                 case SCTP_SUCCESS_REPORT:
 739                         /* not valid in an ASCONF chunk */
 740                         break;
 741                 case SCTP_ULP_ADAPTATION:
 742                         /* FIX */
 743                         break;
 744                 default:
 745                         if ((param_type & 0x8000) == 0) {
 746                                 /* Been told to STOP at this param */
 747                                 asconf_limit = offset;
 748                                 /*
 749                                  * FIX FIX - We need to call
 750                                  * sctp_arethere_unrecognized_parameters()
 751                                  * to get a operr and send it for any
 752                                  * param's with the 0x4000 bit set OR do it
 753                                  * here ourselves... note we still must STOP
 754                                  * if the 0x8000 bit is clear.
 755                                  */
 756                         }
 757                         /* unknown/invalid param type */
 758                         break;
 759                 }               /* switch */
 760
 761                 /* add any (error) result to the reply mbuf chain */
 762                 if (m_result != NULL) {
 763                         SCTP_BUF_NEXT(m_tail) = m_result;
 764                         m_tail = m_result;
 765                         /* update lengths, make sure it's aligned too */
 766                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 767                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 768                         /* set flag to force success reports */
 769                         error = 1;
 770                 }
 771                 offset += SCTP_SIZE32(param_length);
 772                 /* update remaining ASCONF message length to process */
 773                 if (offset >= asconf_limit) {
 774                         /* no more data in the mbuf chain */
 775                         break;
 776                 }
 777                 /* get pointer to next asconf param */
 778                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 779                     sizeof(struct sctp_asconf_paramhdr),
 780                     (uint8_t *)&aparam_buf);
 781                 if (aph == NULL) {
 782                         /* can't get an asconf paramhdr */
 783                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 784                         /* FIX ME - add error here... */
 785                 }
 786         }
 787
 788 send_reply:
 789         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 790         /* save the ASCONF-ACK reply */
 791         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 792             struct sctp_asconf_ack);
 793         if (ack == NULL) {
 794                 sctp_m_freem(m_ack);
 795                 return;
 796         }
 797         ack->serial_number = serial_num;
 798         ack->last_sent_to = NULL;
 799         ack->data = m_ack;
 800         ack->len = 0;
 801         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 802                 ack->len += SCTP_BUF_LEN(n);
 803         }
 804         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 805
 806         /* see if last_control_chunk_from is set properly (use IP src addr) */
 807         if (stcb->asoc.last_control_chunk_from == NULL) {
 808                 /*
 809                  * this could happen if the source address was just newly
 810                  * added
 811                  */
 812                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 813                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 814                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 815                 /* look up the from address */
 816                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 817 #ifdef SCTP_DEBUG
 818                 if (stcb->asoc.last_control_chunk_from == NULL) {
 819                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 820                 }
 821 #endif
 822         }
 823 }
 824
 825 /*
 826  * does the address match? returns 0 if not, 1 if so
 827  */
 828 static uint32_t
 829 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 830 {
 831         switch (sa->sa_family) {
 832 #ifdef INET6
 833         case AF_INET6:
 834                 {
 835                         /* XXX scopeid */
 836                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 837
 838                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 839                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 840                             sizeof(struct in6_addr)) == 0)) {
 841                                 return (1);
 842                         }
 843                         break;
 844                 }
 845 #endif
 846 #ifdef INET
 847         case AF_INET:
 848                 {
 849                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 850
 851                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 852                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 853                             sizeof(struct in_addr)) == 0)) {
 854                                 return (1);
 855                         }
 856                         break;
 857                 }
 858 #endif
 859         default:
 860                 break;
 861         }
 862         return (0);
 863 }
 864
 865 /*
 866  * does the address match? returns 0 if not, 1 if so
 867  */
 868 static uint32_t
 869 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 870 {
 871 #if defined(INET) || defined(INET6)
 872         uint16_t param_type, param_length;
 873
 874         param_type = ntohs(ph->param_type);
 875         param_length = ntohs(ph->param_length);
 876 #endif
 877         switch (sa->sa_family) {
 878 #ifdef INET6
 879         case AF_INET6:
 880                 {
 881                         /* XXX scopeid */
 882                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 883                         struct sctp_ipv6addr_param *v6addr;
 884
 885                         v6addr = (struct sctp_ipv6addr_param *)ph;
 886                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 887                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 888                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 889                             sizeof(struct in6_addr)) == 0)) {
 890                                 return (1);
 891                         }
 892                         break;
 893                 }
 894 #endif
 895 #ifdef INET
 896         case AF_INET:
 897                 {
 898                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 899                         struct sctp_ipv4addr_param *v4addr;
 900
 901                         v4addr = (struct sctp_ipv4addr_param *)ph;
 902                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 903                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 904                             (memcmp(&v4addr->addr, &sin->sin_addr,
 905                             sizeof(struct in_addr)) == 0)) {
 906                                 return (1);
 907                         }
 908                         break;
 909                 }
 910 #endif
 911         default:
 912                 break;
 913         }
 914         return (0);
 915 }
 916
 917 /*
 918  * Cleanup for non-responded/OP ERR'd ASCONF
 919  */
 920 void
 921 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 922 {
 923         /*
 924          * clear out any existing asconfs going out
 925          */
 926         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 927             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 928         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 929         /* remove the old ASCONF on our outbound queue */
 930         sctp_toss_old_asconf(stcb);
 931 }
 932
 933 /*
 934  * cleanup any cached source addresses that may be topologically
 935  * incorrect after a new address has been added to this interface.
 936  */
 937 static void
 938 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 939 {
 940         struct sctp_nets *net;
 941
 942         /*
 943          * Ideally, we want to only clear cached routes and source addresses
 944          * that are topologically incorrect.  But since there is no easy way
 945          * to know whether the newly added address on the ifn would cause a
 946          * routing change (i.e. a new egress interface would be chosen)
 947          * without doing a new routing lookup and source address selection,
 948          * we will (for now) just flush any cached route using a different
 949          * ifn (and cached source addrs) and let output re-choose them
 950          * during the next send on that net.
 951          */
 952         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 953                 /*
 954                  * clear any cached route (and cached source address) if the
 955                  * route's interface is NOT the same as the address change.
 956                  * If it's the same interface, just clear the cached source
 957                  * address.
 958                  */
 959                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 960                     ((ifn == NULL) ||
 961                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 962                         /* clear any cached route */
 963                         RTFREE(net->ro.ro_rt);
 964                         net->ro.ro_rt = NULL;
 965                 }
 966                 /* clear any cached source address */
 967                 if (net->src_addr_selected) {
 968                         sctp_free_ifa(net->ro._s_addr);
 969                         net->ro._s_addr = NULL;
 970                         net->src_addr_selected = 0;
 971                 }
 972         }
 973 }
 974
 975
 976 void
 977 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 978 {
 979         int error;
 980
 981         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 982                 return;
 983         }
 984         if (stcb->asoc.deleted_primary == NULL) {
 985                 return;
 986         }
 987
 988         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 989                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 990                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 991                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 992                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 993                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 994                     stcb->asoc.deleted_primary,
 995                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
 996                 stcb->asoc.num_send_timers_up--;
 997                 if (stcb->asoc.num_send_timers_up < 0) {
 998                         stcb->asoc.num_send_timers_up = 0;
 999                 }
1000                 SCTP_TCB_LOCK_ASSERT(stcb);
1001                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1002                     stcb->asoc.deleted_primary);
1003                 if (error) {
1004                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1005                         return;
1006                 }
1007                 SCTP_TCB_LOCK_ASSERT(stcb);
1008 #ifdef SCTP_AUDITING_ENABLED
1009                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1010 #endif
1011                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1012                 if ((stcb->asoc.num_send_timers_up == 0) &&
1013                     (stcb->asoc.sent_queue_cnt > 0)) {
1014                         struct sctp_tmit_chunk *chk;
1015
1016                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1017                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1018                             stcb, chk->whoTo);
1019                 }
1020         }
1021         return;
1022 }
1023
1024 static int
1025     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1026
1027 void
1028 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1029 {
1030         struct sctp_tmit_chunk *chk;
1031
1032         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1033         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1034             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1035         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1036         net->error_count = 0;
1037         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1038                 if (chk->whoTo == net) {
1039                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1040                                 chk->sent = SCTP_DATAGRAM_RESEND;
1041                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1042                                 sctp_flight_size_decrease(chk);
1043                                 sctp_total_flight_decrease(stcb, chk);
1044                                 net->marked_retrans++;
1045                                 stcb->asoc.marked_retrans++;
1046                         }
1047                 }
1048         }
1049         if (net->marked_retrans) {
1050                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1051         }
1052 }
1053
1054 static void
1055 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1056 {
1057         struct sctp_nets *net;
1058         int addrnum, changed;
1059
1060         /*
1061          * If number of local valid addresses is 1, the valid address is
1062          * probably newly added address. Several valid addresses in this
1063          * association.  A source address may not be changed.  Additionally,
1064          * they can be configured on a same interface as "alias" addresses.
1065          * (by micchie)
1066          */
1067         addrnum = sctp_local_addr_count(stcb);
1068         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1069             addrnum);
1070         if (addrnum == 1) {
1071                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1072                         /* clear any cached route and source address */
1073                         if (net->ro.ro_rt) {
1074                                 RTFREE(net->ro.ro_rt);
1075                                 net->ro.ro_rt = NULL;
1076                         }
1077                         if (net->src_addr_selected) {
1078                                 sctp_free_ifa(net->ro._s_addr);
1079                                 net->ro._s_addr = NULL;
1080                                 net->src_addr_selected = 0;
1081                         }
1082                         /* Retransmit unacknowledged DATA chunks immediately */
1083                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1084                             SCTP_MOBILITY_FASTHANDOFF)) {
1085                                 sctp_net_immediate_retrans(stcb, net);
1086                         }
1087                         /* also, SET PRIMARY is maybe already sent */
1088                 }
1089                 return;
1090         }
1091
1092         /* Multiple local addresses exsist in the association.  */
1093         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1094                 /* clear any cached route and source address */
1095                 if (net->ro.ro_rt) {
1096                         RTFREE(net->ro.ro_rt);
1097                         net->ro.ro_rt = NULL;
1098                 }
1099                 if (net->src_addr_selected) {
1100                         sctp_free_ifa(net->ro._s_addr);
1101                         net->ro._s_addr = NULL;
1102                         net->src_addr_selected = 0;
1103                 }
1104                 /*
1105                  * Check if the nexthop is corresponding to the new address.
1106                  * If the new address is corresponding to the current
1107                  * nexthop, the path will be changed. If the new address is
1108                  * NOT corresponding to the current nexthop, the path will
1109                  * not be changed.
1110                  */
1111                 SCTP_RTALLOC((sctp_route_t *)&net->ro,
1112                     stcb->sctp_ep->def_vrf_id,
1113                     stcb->sctp_ep->fibnum);
1114                 if (net->ro.ro_rt == NULL)
1115                         continue;
1116
1117                 changed = 0;
1118                 switch (net->ro._l_addr.sa.sa_family) {
1119 #ifdef INET
1120                 case AF_INET:
1121                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *)&net->ro)) {
1122                                 changed = 1;
1123                         }
1124                         break;
1125 #endif
1126 #ifdef INET6
1127                 case AF_INET6:
1128                         if (sctp_v6src_match_nexthop(
1129                             &newifa->address.sin6, (sctp_route_t *)&net->ro)) {
1130                                 changed = 1;
1131                         }
1132                         break;
1133 #endif
1134                 default:
1135                         break;
1136                 }
1137                 /*
1138                  * if the newly added address does not relate routing
1139                  * information, we skip.
1140                  */
1141                 if (changed == 0)
1142                         continue;
1143                 /* Retransmit unacknowledged DATA chunks immediately */
1144                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1145                     SCTP_MOBILITY_FASTHANDOFF)) {
1146                         sctp_net_immediate_retrans(stcb, net);
1147                 }
1148                 /* Send SET PRIMARY for this new address */
1149                 if (net == stcb->asoc.primary_destination) {
1150                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1151                             SCTP_SET_PRIM_ADDR);
1152                 }
1153         }
1154 }
1155
1156 /*
1157  * process an ADD/DELETE IP ack from peer.
1158  * addr: corresponding sctp_ifa to the address being added/deleted.
1159  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1160  * flag: 1=success, 0=failure.
1161  */
1162 static void
1163 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1164 {
1165         /*
1166          * do the necessary asoc list work- if we get a failure indication,
1167          * leave the address on the assoc's restricted list.  If we get a
1168          * success indication, remove the address from the restricted list.
1169          */
1170         /*
1171          * Note: this will only occur for ADD_IP_ADDRESS, since
1172          * DEL_IP_ADDRESS is never actually added to the list...
1173          */
1174         if (flag) {
1175                 /* success case, so remove from the restricted list */
1176                 sctp_del_local_addr_restricted(stcb, addr);
1177
1178                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1179                     SCTP_MOBILITY_BASE) ||
1180                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1181                     SCTP_MOBILITY_FASTHANDOFF)) {
1182                         sctp_path_check_and_react(stcb, addr);
1183                         return;
1184                 }
1185                 /* clear any cached/topologically incorrect source addresses */
1186                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1187         }
1188         /* else, leave it on the list */
1189 }
1190
1191 /*
1192  * add an asconf add/delete/set primary IP address parameter to the queue.
1193  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1194  * returns 0 if queued, -1 if not queued/removed.
1195  * NOTE: if adding, but a delete for the same address is already scheduled
1196  * (and not yet sent out), simply remove it from queue.  Same for deleting
1197  * an address already scheduled for add.  If a duplicate operation is found,
1198  * ignore the new one.
1199  */
1200 static int
1201 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1202     uint16_t type)
1203 {
1204         struct sctp_asconf_addr *aa, *aa_next;
1205
1206         /* make sure the request isn't already in the queue */
1207         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1208                 /* address match? */
1209                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1210                         continue;
1211                 /*
1212                  * is the request already in queue but not sent? pass the
1213                  * request already sent in order to resolve the following
1214                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1215                  * can't remove the ADD request already sent 3. arrival of
1216                  * ADD
1217                  */
1218                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1219                         return (-1);
1220                 }
1221                 /* is the negative request already in queue, and not sent */
1222                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1223                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1224                         /* add requested, delete already queued */
1225                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1226                         /* remove the ifa from the restricted list */
1227                         sctp_del_local_addr_restricted(stcb, ifa);
1228                         /* free the asconf param */
1229                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1230                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1231                         return (-1);
1232                 }
1233                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1234                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1235                         /* delete requested, add already queued */
1236                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1237                         /* remove the aa->ifa from the restricted list */
1238                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1239                         /* free the asconf param */
1240                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1241                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1242                         return (-1);
1243                 }
1244         }                       /* for each aa */
1245
1246         /* adding new request to the queue */
1247         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1248             SCTP_M_ASC_ADDR);
1249         if (aa == NULL) {
1250                 /* didn't get memory */
1251                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1252                 return (-1);
1253         }
1254         aa->special_del = 0;
1255         /* fill in asconf address parameter fields */
1256         /* top level elements are "networked" during send */
1257         aa->ap.aph.ph.param_type = type;
1258         aa->ifa = ifa;
1259         atomic_add_int(&ifa->refcount, 1);
1260         /* correlation_id filled in during send routine later... */
1261         switch (ifa->address.sa.sa_family) {
1262 #ifdef INET6
1263         case AF_INET6:
1264                 {
1265                         struct sockaddr_in6 *sin6;
1266
1267                         sin6 = &ifa->address.sin6;
1268                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1269                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1270                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1271                             sizeof(struct sctp_ipv6addr_param);
1272                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1273                             sizeof(struct in6_addr));
1274                         break;
1275                 }
1276 #endif
1277 #ifdef INET
1278         case AF_INET:
1279                 {
1280                         struct sockaddr_in *sin;
1281
1282                         sin = &ifa->address.sin;
1283                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1284                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1285                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1286                             sizeof(struct sctp_ipv4addr_param);
1287                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1288                             sizeof(struct in_addr));
1289                         break;
1290                 }
1291 #endif
1292         default:
1293                 /* invalid family! */
1294                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1295                 sctp_free_ifa(ifa);
1296                 return (-1);
1297         }
1298         aa->sent = 0;           /* clear sent flag */
1299
1300         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1301 #ifdef SCTP_DEBUG
1302         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1303                 if (type == SCTP_ADD_IP_ADDRESS) {
1304                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1305                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1306                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1307                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1308                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1309                 } else {
1310                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1311                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1312                 }
1313         }
1314 #endif
1315
1316         return (0);
1317 }
1318
1319
1320 /*
1321  * add an asconf operation for the given ifa and type.
1322  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1323  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1324  * advisable.
1325  */
1326 static int
1327 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1328     uint16_t type)
1329 {
1330         uint32_t status;
1331         int pending_delete_queued = 0;
1332         int last;
1333
1334         /* see if peer supports ASCONF */
1335         if (stcb->asoc.asconf_supported == 0) {
1336                 return (-1);
1337         }
1338
1339         /*
1340          * if this is deleting the last address from the assoc, mark it as
1341          * pending.
1342          */
1343         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1344                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1345                         last = (sctp_local_addr_count(stcb) == 0);
1346                 } else {
1347                         last = (sctp_local_addr_count(stcb) == 1);
1348                 }
1349                 if (last) {
1350                         /* set the pending delete info only */
1351                         stcb->asoc.asconf_del_pending = 1;
1352                         stcb->asoc.asconf_addr_del_pending = ifa;
1353                         atomic_add_int(&ifa->refcount, 1);
1354                         SCTPDBG(SCTP_DEBUG_ASCONF2,
1355                             "asconf_queue_add: mark delete last address pending\n");
1356                         return (-1);
1357                 }
1358         }
1359
1360         /* queue an asconf parameter */
1361         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1362
1363         /*
1364          * if this is an add, and there is a delete also pending (i.e. the
1365          * last local address is being changed), queue the pending delete
1366          * too.
1367          */
1368         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1369                 /* queue in the pending delete */
1370                 if (sctp_asconf_queue_mgmt(stcb,
1371                     stcb->asoc.asconf_addr_del_pending,
1372                     SCTP_DEL_IP_ADDRESS) == 0) {
1373                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queuing pending delete\n");
1374                         pending_delete_queued = 1;
1375                         /* clear out the pending delete info */
1376                         stcb->asoc.asconf_del_pending = 0;
1377                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1378                         stcb->asoc.asconf_addr_del_pending = NULL;
1379                 }
1380         }
1381
1382         if (pending_delete_queued) {
1383                 struct sctp_nets *net;
1384
1385                 /*
1386                  * since we know that the only/last address is now being
1387                  * changed in this case, reset the cwnd/rto on all nets to
1388                  * start as a new address and path.  Also clear the error
1389                  * counts to give the assoc the best chance to complete the
1390                  * address change.
1391                  */
1392                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1393                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1394                             net);
1395                         net->RTO = 0;
1396                         net->error_count = 0;
1397                 }
1398                 stcb->asoc.overall_error_count = 0;
1399                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1400                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1401                             stcb->asoc.overall_error_count,
1402                             0,
1403                             SCTP_FROM_SCTP_ASCONF,
1404                             __LINE__);
1405                 }
1406
1407                 /* queue in an advisory set primary too */
1408                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1409                 /* let caller know we should send this out immediately */
1410                 status = 1;
1411         }
1412         return (status);
1413 }
1414
1415 /*-
1416  * add an asconf delete IP address parameter to the queue by sockaddr and
1417  * possibly with no sctp_ifa available.  This is only called by the routine
1418  * that checks the addresses in an INIT-ACK against the current address list.
1419  * returns 0 if completed, non-zero if not completed.
1420  * NOTE: if an add is already scheduled (and not yet sent out), simply
1421  * remove it from queue.  If a duplicate operation is found, ignore the
1422  * new one.
1423  */
1424 static int
1425 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1426 {
1427         struct sctp_ifa *ifa;
1428         struct sctp_asconf_addr *aa, *aa_next;
1429
1430         if (stcb == NULL) {
1431                 return (-1);
1432         }
1433         /* see if peer supports ASCONF */
1434         if (stcb->asoc.asconf_supported == 0) {
1435                 return (-1);
1436         }
1437         /* make sure the request isn't already in the queue */
1438         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1439                 /* address match? */
1440                 if (sctp_asconf_addr_match(aa, sa) == 0)
1441                         continue;
1442                 /* is the request already in queue (sent or not) */
1443                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1444                         return (-1);
1445                 }
1446                 /* is the negative request already in queue, and not sent */
1447                 if (aa->sent == 1)
1448                         continue;
1449                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1450                         /* add already queued, so remove existing entry */
1451                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1452                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1453                         /* free the entry */
1454                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1455                         return (-1);
1456                 }
1457         }                       /* for each aa */
1458
1459         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1460         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1461
1462         /* adding new request to the queue */
1463         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1464             SCTP_M_ASC_ADDR);
1465         if (aa == NULL) {
1466                 /* didn't get memory */
1467                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1468                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1469                 return (-1);
1470         }
1471         aa->special_del = 0;
1472         /* fill in asconf address parameter fields */
1473         /* top level elements are "networked" during send */
1474         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1475         aa->ifa = ifa;
1476         if (ifa)
1477                 atomic_add_int(&ifa->refcount, 1);
1478         /* correlation_id filled in during send routine later... */
1479         switch (sa->sa_family) {
1480 #ifdef INET6
1481         case AF_INET6:
1482                 {
1483                         /* IPv6 address */
1484                         struct sockaddr_in6 *sin6;
1485
1486                         sin6 = (struct sockaddr_in6 *)sa;
1487                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1488                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1489                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1490                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1491                             sizeof(struct in6_addr));
1492                         break;
1493                 }
1494 #endif
1495 #ifdef INET
1496         case AF_INET:
1497                 {
1498                         /* IPv4 address */
1499                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1500
1501                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1502                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1503                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1504                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1505                             sizeof(struct in_addr));
1506                         break;
1507                 }
1508 #endif
1509         default:
1510                 /* invalid family! */
1511                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1512                 if (ifa)
1513                         sctp_free_ifa(ifa);
1514                 return (-1);
1515         }
1516         aa->sent = 0;           /* clear sent flag */
1517
1518         /* delete goes to the back of the queue */
1519         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1520
1521         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1522         return (0);
1523 }
1524
1525 /*
1526  * find a specific asconf param on our "sent" queue
1527  */
1528 static struct sctp_asconf_addr *
1529 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1530 {
1531         struct sctp_asconf_addr *aa;
1532
1533         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1534                 if (aa->ap.aph.correlation_id == correlation_id &&
1535                     aa->sent == 1) {
1536                         /* found it */
1537                         return (aa);
1538                 }
1539         }
1540         /* didn't find it */
1541         return (NULL);
1542 }
1543
1544 /*
1545  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1546  * notifications based on the error response
1547  */
1548 static void
1549 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1550     struct sctp_asconf_paramhdr *aph)
1551 {
1552         struct sctp_error_cause *eh;
1553         struct sctp_paramhdr *ph;
1554         uint16_t param_type;
1555         uint16_t error_code;
1556
1557         eh = (struct sctp_error_cause *)(aph + 1);
1558         ph = (struct sctp_paramhdr *)(eh + 1);
1559         /* validate lengths */
1560         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1561             htons(aph->ph.param_length)) {
1562                 /* invalid error cause length */
1563                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1564                     "asconf_process_error: cause element too long\n");
1565                 return;
1566         }
1567         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1568             htons(eh->length)) {
1569                 /* invalid included TLV length */
1570                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1571                     "asconf_process_error: included TLV too long\n");
1572                 return;
1573         }
1574         /* which error code ? */
1575         error_code = ntohs(eh->code);
1576         param_type = ntohs(aph->ph.param_type);
1577         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1578         switch (error_code) {
1579         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1580                 /* we allow ourselves to "try again" for this error */
1581                 break;
1582         default:
1583                 /* peer can't handle it... */
1584                 switch (param_type) {
1585                 case SCTP_ADD_IP_ADDRESS:
1586                 case SCTP_DEL_IP_ADDRESS:
1587                 case SCTP_SET_PRIM_ADDR:
1588                         break;
1589                 default:
1590                         break;
1591                 }
1592         }
1593 }
1594
1595 /*
1596  * process an asconf queue param.
1597  * aparam: parameter to process, will be removed from the queue.
1598  * flag: 1=success case, 0=failure case
1599  */
1600 static void
1601 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1602     struct sctp_asconf_addr *aparam, uint32_t flag)
1603 {
1604         uint16_t param_type;
1605
1606         /* process this param */
1607         param_type = aparam->ap.aph.ph.param_type;
1608         switch (param_type) {
1609         case SCTP_ADD_IP_ADDRESS:
1610                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1611                     "process_param_ack: added IP address\n");
1612                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1613                 break;
1614         case SCTP_DEL_IP_ADDRESS:
1615                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1616                     "process_param_ack: deleted IP address\n");
1617                 /* nothing really to do... lists already updated */
1618                 break;
1619         case SCTP_SET_PRIM_ADDR:
1620                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1621                     "process_param_ack: set primary IP address\n");
1622                 /* nothing to do... peer may start using this addr */
1623                 break;
1624         default:
1625                 /* should NEVER happen */
1626                 break;
1627         }
1628
1629         /* remove the param and free it */
1630         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1631         if (aparam->ifa)
1632                 sctp_free_ifa(aparam->ifa);
1633         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1634 }
1635
1636 /*
1637  * cleanup from a bad asconf ack parameter
1638  */
1639 static void
1640 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1641 {
1642         /* assume peer doesn't really know how to do asconfs */
1643         /* XXX we could free the pending queue here */
1644
1645 }
1646
1647 void
1648 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1649     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1650     struct sctp_nets *net, int *abort_no_unlock)
1651 {
1652         struct sctp_association *asoc;
1653         uint32_t serial_num;
1654         uint16_t ack_length;
1655         struct sctp_asconf_paramhdr *aph;
1656         struct sctp_asconf_addr *aa, *aa_next;
1657         uint32_t last_error_id = 0;     /* last error correlation id */
1658         uint32_t id;
1659         struct sctp_asconf_addr *ap;
1660
1661         /* asconf param buffer */
1662         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1663
1664         /* verify minimum length */
1665         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1666                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1667                     "handle_asconf_ack: chunk too small = %xh\n",
1668                     ntohs(cp->ch.chunk_length));
1669                 return;
1670         }
1671         asoc = &stcb->asoc;
1672         serial_num = ntohl(cp->serial_number);
1673
1674         /*
1675          * NOTE: we may want to handle this differently- currently, we will
1676          * abort when we get an ack for the expected serial number + 1 (eg.
1677          * we didn't send it), process an ack normally if it is the expected
1678          * serial number, and re-send the previous ack for *ALL* other
1679          * serial numbers
1680          */
1681
1682         /*
1683          * if the serial number is the next expected, but I didn't send it,
1684          * abort the asoc, since someone probably just hijacked us...
1685          */
1686         if (serial_num == (asoc->asconf_seq_out + 1)) {
1687                 struct mbuf *op_err;
1688                 char msg[SCTP_DIAG_INFO_LEN];
1689
1690                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1691                 snprintf(msg, sizeof(msg), "Never sent serial number %8.8x",
1692                     serial_num);
1693                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1694                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1695                 *abort_no_unlock = 1;
1696                 return;
1697         }
1698         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1699                 /* got a duplicate/unexpected ASCONF-ACK */
1700                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1701                     serial_num, asoc->asconf_seq_out_acked + 1);
1702                 return;
1703         }
1704
1705         if (serial_num == asoc->asconf_seq_out - 1) {
1706                 /* stop our timer */
1707                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1708                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1709         }
1710
1711         /* process the ASCONF-ACK contents */
1712         ack_length = ntohs(cp->ch.chunk_length) -
1713             sizeof(struct sctp_asconf_ack_chunk);
1714         offset += sizeof(struct sctp_asconf_ack_chunk);
1715         /* process through all parameters */
1716         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1717                 unsigned int param_length, param_type;
1718
1719                 /* get pointer to next asconf parameter */
1720                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1721                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1722                 if (aph == NULL) {
1723                         /* can't get an asconf paramhdr */
1724                         sctp_asconf_ack_clear(stcb);
1725                         return;
1726                 }
1727                 param_type = ntohs(aph->ph.param_type);
1728                 param_length = ntohs(aph->ph.param_length);
1729                 if (param_length > ack_length) {
1730                         sctp_asconf_ack_clear(stcb);
1731                         return;
1732                 }
1733                 if (param_length < sizeof(struct sctp_paramhdr)) {
1734                         sctp_asconf_ack_clear(stcb);
1735                         return;
1736                 }
1737                 /* get the complete parameter... */
1738                 if (param_length > sizeof(aparam_buf)) {
1739                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1740                             "param length (%u) larger than buffer size!\n", param_length);
1741                         sctp_asconf_ack_clear(stcb);
1742                         return;
1743                 }
1744                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1745                 if (aph == NULL) {
1746                         sctp_asconf_ack_clear(stcb);
1747                         return;
1748                 }
1749                 /* correlation_id is transparent to peer, no ntohl needed */
1750                 id = aph->correlation_id;
1751
1752                 switch (param_type) {
1753                 case SCTP_ERROR_CAUSE_IND:
1754                         last_error_id = id;
1755                         /* find the corresponding asconf param in our queue */
1756                         ap = sctp_asconf_find_param(stcb, id);
1757                         if (ap == NULL) {
1758                                 /* hmm... can't find this in our queue! */
1759                                 break;
1760                         }
1761                         /* process the parameter, failed flag */
1762                         sctp_asconf_process_param_ack(stcb, ap, 0);
1763                         /* process the error response */
1764                         sctp_asconf_process_error(stcb, aph);
1765                         break;
1766                 case SCTP_SUCCESS_REPORT:
1767                         /* find the corresponding asconf param in our queue */
1768                         ap = sctp_asconf_find_param(stcb, id);
1769                         if (ap == NULL) {
1770                                 /* hmm... can't find this in our queue! */
1771                                 break;
1772                         }
1773                         /* process the parameter, success flag */
1774                         sctp_asconf_process_param_ack(stcb, ap, 1);
1775                         break;
1776                 default:
1777                         break;
1778                 }               /* switch */
1779
1780                 /* update remaining ASCONF-ACK message length to process */
1781                 ack_length -= SCTP_SIZE32(param_length);
1782                 if (ack_length <= 0) {
1783                         /* no more data in the mbuf chain */
1784                         break;
1785                 }
1786                 offset += SCTP_SIZE32(param_length);
1787         }                       /* while */
1788
1789         /*
1790          * if there are any "sent" params still on the queue, these are
1791          * implicitly "success", or "failed" (if we got an error back) ...
1792          * so process these appropriately
1793          *
1794          * we assume that the correlation_id's are monotonically increasing
1795          * beginning from 1 and that we don't have *that* many outstanding
1796          * at any given time
1797          */
1798         if (last_error_id == 0)
1799                 last_error_id--;        /* set to "max" value */
1800         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1801                 if (aa->sent == 1) {
1802                         /*
1803                          * implicitly successful or failed if correlation_id
1804                          * < last_error_id, then success else, failure
1805                          */
1806                         if (aa->ap.aph.correlation_id < last_error_id)
1807                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1808                         else
1809                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1810                 } else {
1811                         /*
1812                          * since we always process in order (FIFO queue) if
1813                          * we reach one that hasn't been sent, the rest
1814                          * should not have been sent either. so, we're
1815                          * done...
1816                          */
1817                         break;
1818                 }
1819         }
1820
1821         /* update the next sequence number to use */
1822         asoc->asconf_seq_out_acked++;
1823         /* remove the old ASCONF on our outbound queue */
1824         sctp_toss_old_asconf(stcb);
1825         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1826 #ifdef SCTP_TIMER_BASED_ASCONF
1827                 /* we have more params, so restart our timer */
1828                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1829                     stcb, net);
1830 #else
1831                 /* we have more params, so send out more */
1832                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1833 #endif
1834         }
1835 }
1836
1837 #ifdef INET6
1838 static uint32_t
1839 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1840 {
1841         struct sockaddr_in6 *sin6, *net6;
1842         struct sctp_nets *net;
1843
1844         if (sa->sa_family != AF_INET6) {
1845                 /* wrong family */
1846                 return (0);
1847         }
1848         sin6 = (struct sockaddr_in6 *)sa;
1849         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1850                 /* not link local address */
1851                 return (0);
1852         }
1853         /* hunt through our destination nets list for this scope_id */
1854         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1855                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1856                     AF_INET6)
1857                         continue;
1858                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1859                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1860                         continue;
1861                 if (sctp_is_same_scope(sin6, net6)) {
1862                         /* found one */
1863                         return (1);
1864                 }
1865         }
1866         /* didn't find one */
1867         return (0);
1868 }
1869 #endif
1870
1871 /*
1872  * address management functions
1873  */
1874 static void
1875 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1876     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1877 {
1878         int status;
1879
1880         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1881             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1882                 /* subset bound, no ASCONF allowed case, so ignore */
1883                 return;
1884         }
1885         /*
1886          * note: we know this is not the subset bound, no ASCONF case eg.
1887          * this is boundall or subset bound w/ASCONF allowed
1888          */
1889
1890         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1891         switch (ifa->address.sa.sa_family) {
1892 #ifdef INET6
1893         case AF_INET6:
1894                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1895                     &ifa->address.sin6.sin6_addr) != 0) {
1896                         return;
1897                 }
1898                 break;
1899 #endif
1900 #ifdef INET
1901         case AF_INET:
1902                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1903                     &ifa->address.sin.sin_addr) != 0) {
1904                         return;
1905                 }
1906                 break;
1907 #endif
1908         default:
1909                 return;
1910         }
1911 #ifdef INET6
1912         /* make sure we're "allowed" to add this type of addr */
1913         if (ifa->address.sa.sa_family == AF_INET6) {
1914                 /* invalid if we're not a v6 endpoint */
1915                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1916                         return;
1917                 /* is the v6 addr really valid ? */
1918                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1919                         return;
1920                 }
1921         }
1922 #endif
1923         /* put this address on the "pending/do not use yet" list */
1924         sctp_add_local_addr_restricted(stcb, ifa);
1925         /*
1926          * check address scope if address is out of scope, don't queue
1927          * anything... note: this would leave the address on both inp and
1928          * asoc lists
1929          */
1930         switch (ifa->address.sa.sa_family) {
1931 #ifdef INET6
1932         case AF_INET6:
1933                 {
1934                         struct sockaddr_in6 *sin6;
1935
1936                         sin6 = &ifa->address.sin6;
1937                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1938                                 /* we skip unspecifed addresses */
1939                                 return;
1940                         }
1941                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1942                                 if (stcb->asoc.scope.local_scope == 0) {
1943                                         return;
1944                                 }
1945                                 /* is it the right link local scope? */
1946                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1947                                         return;
1948                                 }
1949                         }
1950                         if (stcb->asoc.scope.site_scope == 0 &&
1951                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1952                                 return;
1953                         }
1954                         break;
1955                 }
1956 #endif
1957 #ifdef INET
1958         case AF_INET:
1959                 {
1960                         struct sockaddr_in *sin;
1961                         struct in6pcb *inp6;
1962
1963                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1964                         /* invalid if we are a v6 only endpoint */
1965                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1966                             SCTP_IPV6_V6ONLY(inp6))
1967                                 return;
1968
1969                         sin = &ifa->address.sin;
1970                         if (sin->sin_addr.s_addr == 0) {
1971                                 /* we skip unspecifed addresses */
1972                                 return;
1973                         }
1974                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1975                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1976                                 return;
1977                         }
1978                         break;
1979                 }
1980 #endif
1981         default:
1982                 /* else, not AF_INET or AF_INET6, so skip */
1983                 return;
1984         }
1985
1986         /* queue an asconf for this address add/delete */
1987         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1988                 /* does the peer do asconf? */
1989                 if (stcb->asoc.asconf_supported) {
1990                         /* queue an asconf for this addr */
1991                         status = sctp_asconf_queue_add(stcb, ifa, type);
1992
1993                         /*
1994                          * if queued ok, and in the open state, send out the
1995                          * ASCONF.  If in the non-open state, these will be
1996                          * sent when the state goes open.
1997                          */
1998                         if (status == 0 &&
1999                             ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2000                             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
2001 #ifdef SCTP_TIMER_BASED_ASCONF
2002                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
2003                                     stcb, stcb->asoc.primary_destination);
2004 #else
2005                                 sctp_send_asconf(stcb, NULL, addr_locked);
2006 #endif
2007                         }
2008                 }
2009         }
2010 }
2011
2012
2013 int
2014 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2015 {
2016         struct sctp_asconf_iterator *asc;
2017         struct sctp_ifa *ifa;
2018         struct sctp_laddr *l;
2019         int cnt_invalid = 0;
2020
2021         asc = (struct sctp_asconf_iterator *)ptr;
2022         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2023                 ifa = l->ifa;
2024                 switch (ifa->address.sa.sa_family) {
2025 #ifdef INET6
2026                 case AF_INET6:
2027                         /* invalid if we're not a v6 endpoint */
2028                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2029                                 cnt_invalid++;
2030                                 if (asc->cnt == cnt_invalid)
2031                                         return (1);
2032                         }
2033                         break;
2034 #endif
2035 #ifdef INET
2036                 case AF_INET:
2037                         {
2038                                 /* invalid if we are a v6 only endpoint */
2039                                 struct in6pcb *inp6;
2040
2041                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2042                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2043                                     SCTP_IPV6_V6ONLY(inp6)) {
2044                                         cnt_invalid++;
2045                                         if (asc->cnt == cnt_invalid)
2046                                                 return (1);
2047                                 }
2048                                 break;
2049                         }
2050 #endif
2051                 default:
2052                         /* invalid address family */
2053                         cnt_invalid++;
2054                         if (asc->cnt == cnt_invalid)
2055                                 return (1);
2056                 }
2057         }
2058         return (0);
2059 }
2060
2061 static int
2062 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2063 {
2064         struct sctp_ifa *ifa;
2065         struct sctp_asconf_iterator *asc;
2066         struct sctp_laddr *laddr, *nladdr, *l;
2067
2068         /* Only for specific case not bound all */
2069         asc = (struct sctp_asconf_iterator *)ptr;
2070         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2071                 ifa = l->ifa;
2072                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2073                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2074                             sctp_nxt_addr) {
2075                                 if (laddr->ifa == ifa) {
2076                                         laddr->action = 0;
2077                                         break;
2078                                 }
2079
2080                         }
2081                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2082                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2083                                 /* remove only after all guys are done */
2084                                 if (laddr->ifa == ifa) {
2085                                         sctp_del_local_addr_ep(inp, ifa);
2086                                 }
2087                         }
2088                 }
2089         }
2090         return (0);
2091 }
2092
2093 void
2094 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2095     void *ptr, uint32_t val SCTP_UNUSED)
2096 {
2097         struct sctp_asconf_iterator *asc;
2098         struct sctp_ifa *ifa;
2099         struct sctp_laddr *l;
2100         int cnt_invalid = 0;
2101         int type, status;
2102         int num_queued = 0;
2103
2104         asc = (struct sctp_asconf_iterator *)ptr;
2105         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2106                 ifa = l->ifa;
2107                 type = l->action;
2108
2109                 /* address's vrf_id must be the vrf_id of the assoc */
2110                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2111                         continue;
2112                 }
2113
2114                 /* Same checks again for assoc */
2115                 switch (ifa->address.sa.sa_family) {
2116 #ifdef INET6
2117                 case AF_INET6:
2118                         {
2119                                 /* invalid if we're not a v6 endpoint */
2120                                 struct sockaddr_in6 *sin6;
2121
2122                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2123                                         cnt_invalid++;
2124                                         if (asc->cnt == cnt_invalid)
2125                                                 return;
2126                                         else
2127                                                 continue;
2128                                 }
2129                                 sin6 = &ifa->address.sin6;
2130                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2131                                         /* we skip unspecifed addresses */
2132                                         continue;
2133                                 }
2134                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2135                                     &sin6->sin6_addr) != 0) {
2136                                         continue;
2137                                 }
2138                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2139                                         if (stcb->asoc.scope.local_scope == 0) {
2140                                                 continue;
2141                                         }
2142                                         /* is it the right link local scope? */
2143                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2144                                                 continue;
2145                                         }
2146                                 }
2147                                 break;
2148                         }
2149 #endif
2150 #ifdef INET
2151                 case AF_INET:
2152                         {
2153                                 /* invalid if we are a v6 only endpoint */
2154                                 struct in6pcb *inp6;
2155                                 struct sockaddr_in *sin;
2156
2157                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2158                                 /* invalid if we are a v6 only endpoint */
2159                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2160                                     SCTP_IPV6_V6ONLY(inp6))
2161                                         continue;
2162
2163                                 sin = &ifa->address.sin;
2164                                 if (sin->sin_addr.s_addr == 0) {
2165                                         /* we skip unspecifed addresses */
2166                                         continue;
2167                                 }
2168                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2169                                     &sin->sin_addr) != 0) {
2170                                         continue;
2171                                 }
2172                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2173                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2174                                         continue;
2175                                 }
2176                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2177                                     SCTP_IPV6_V6ONLY(inp6)) {
2178                                         cnt_invalid++;
2179                                         if (asc->cnt == cnt_invalid)
2180                                                 return;
2181                                         else
2182                                                 continue;
2183                                 }
2184                                 break;
2185                         }
2186 #endif
2187                 default:
2188                         /* invalid address family */
2189                         cnt_invalid++;
2190                         if (asc->cnt == cnt_invalid)
2191                                 return;
2192                         else
2193                                 continue;
2194                         break;
2195                 }
2196
2197                 if (type == SCTP_ADD_IP_ADDRESS) {
2198                         /* prevent this address from being used as a source */
2199                         sctp_add_local_addr_restricted(stcb, ifa);
2200                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2201                         struct sctp_nets *net;
2202
2203                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2204                                 sctp_rtentry_t *rt;
2205
2206                                 /* delete this address if cached */
2207                                 if (net->ro._s_addr == ifa) {
2208                                         sctp_free_ifa(net->ro._s_addr);
2209                                         net->ro._s_addr = NULL;
2210                                         net->src_addr_selected = 0;
2211                                         rt = net->ro.ro_rt;
2212                                         if (rt) {
2213                                                 RTFREE(rt);
2214                                                 net->ro.ro_rt = NULL;
2215                                         }
2216                                         /*
2217                                          * Now we deleted our src address,
2218                                          * should we not also now reset the
2219                                          * cwnd/rto to start as if its a new
2220                                          * address?
2221                                          */
2222                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2223                                         net->RTO = 0;
2224
2225                                 }
2226                         }
2227                 } else if (type == SCTP_SET_PRIM_ADDR) {
2228                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2229                                 /* must validate the ifa is in the ep */
2230                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2231                                         continue;
2232                                 }
2233                         } else {
2234                                 /* Need to check scopes for this guy */
2235                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2236                                         continue;
2237                                 }
2238                         }
2239                 }
2240                 /* queue an asconf for this address add/delete */
2241                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2242                     stcb->asoc.asconf_supported == 1) {
2243                         /* queue an asconf for this addr */
2244                         status = sctp_asconf_queue_add(stcb, ifa, type);
2245                         /*
2246                          * if queued ok, and in the open state, update the
2247                          * count of queued params.  If in the non-open
2248                          * state, these get sent when the assoc goes open.
2249                          */
2250                         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2251                             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2252                                 if (status >= 0) {
2253                                         num_queued++;
2254                                 }
2255                         }
2256                 }
2257         }
2258         /*
2259          * If we have queued params in the open state, send out an ASCONF.
2260          */
2261         if (num_queued > 0) {
2262                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2263         }
2264 }
2265
2266 void
2267 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2268 {
2269         struct sctp_asconf_iterator *asc;
2270         struct sctp_ifa *ifa;
2271         struct sctp_laddr *l, *nl;
2272
2273         asc = (struct sctp_asconf_iterator *)ptr;
2274         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2275                 ifa = l->ifa;
2276                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2277                         /* Clear the defer use flag */
2278                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2279                 }
2280                 sctp_free_ifa(ifa);
2281                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2282                 SCTP_DECR_LADDR_COUNT();
2283         }
2284         SCTP_FREE(asc, SCTP_M_ASC_IT);
2285 }
2286
2287 /*
2288  * sa is the sockaddr to ask the peer to set primary to.
2289  * returns: 0 = completed, -1 = error
2290  */
2291 int32_t
2292 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2293 {
2294         uint32_t vrf_id;
2295         struct sctp_ifa *ifa;
2296
2297         /* find the ifa for the desired set primary */
2298         vrf_id = stcb->asoc.vrf_id;
2299         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2300         if (ifa == NULL) {
2301                 /* Invalid address */
2302                 return (-1);
2303         }
2304
2305         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2306         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2307                 /* set primary queuing succeeded */
2308                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2309                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2310                     (void *)stcb);
2311                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2312                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2313                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2314 #ifdef SCTP_TIMER_BASED_ASCONF
2315                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2316                             stcb->sctp_ep, stcb,
2317                             stcb->asoc.primary_destination);
2318 #else
2319                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2320 #endif
2321                 }
2322         } else {
2323                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2324                     (void *)stcb);
2325                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2326                 return (-1);
2327         }
2328         return (0);
2329 }
2330
2331 int
2332 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2333 {
2334         struct sctp_tmit_chunk *chk, *nchk;
2335         unsigned int offset, asconf_limit;
2336         struct sctp_asconf_chunk *acp;
2337         struct sctp_asconf_paramhdr *aph;
2338         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2339         struct sctp_paramhdr *ph;
2340         int add_cnt, del_cnt;
2341         uint16_t last_param_type;
2342
2343         add_cnt = del_cnt = 0;
2344         last_param_type = 0;
2345         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2346                 if (chk->data == NULL) {
2347                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2348                         continue;
2349                 }
2350                 offset = 0;
2351                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2352                 offset += sizeof(struct sctp_asconf_chunk);
2353                 asconf_limit = ntohs(acp->ch.chunk_length);
2354                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2355                 if (ph == NULL) {
2356                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2357                         continue;
2358                 }
2359                 offset += ntohs(ph->param_length);
2360
2361                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2362                 if (aph == NULL) {
2363                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2364                         continue;
2365                 }
2366                 while (aph != NULL) {
2367                         unsigned int param_length, param_type;
2368
2369                         param_type = ntohs(aph->ph.param_type);
2370                         param_length = ntohs(aph->ph.param_length);
2371                         if (offset + param_length > asconf_limit) {
2372                                 /* parameter goes beyond end of chunk! */
2373                                 break;
2374                         }
2375                         if (param_length > sizeof(aparam_buf)) {
2376                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2377                                 break;
2378                         }
2379                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2380                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2381                                 break;
2382                         }
2383
2384                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2385                         if (aph == NULL) {
2386                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2387                                 break;
2388                         }
2389
2390                         ph = (struct sctp_paramhdr *)(aph + 1);
2391                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2392                                 switch (param_type) {
2393                                 case SCTP_ADD_IP_ADDRESS:
2394                                         add_cnt++;
2395                                         break;
2396                                 case SCTP_DEL_IP_ADDRESS:
2397                                         del_cnt++;
2398                                         break;
2399                                 default:
2400                                         break;
2401                                 }
2402                                 last_param_type = param_type;
2403                         }
2404
2405                         offset += SCTP_SIZE32(param_length);
2406                         if (offset >= asconf_limit) {
2407                                 /* no more data in the mbuf chain */
2408                                 break;
2409                         }
2410                         /* get pointer to next asconf param */
2411                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2412                 }
2413         }
2414
2415         /*
2416          * we want to find the sequences which consist of ADD -> DEL -> ADD
2417          * or DEL -> ADD
2418          */
2419         if (add_cnt > del_cnt ||
2420             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2421                 return (1);
2422         }
2423         return (0);
2424 }
2425
2426 static struct sockaddr *
2427 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2428 {
2429         struct sctp_vrf *vrf = NULL;
2430         struct sctp_ifn *sctp_ifn;
2431         struct sctp_ifa *sctp_ifa;
2432
2433         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2434                 SCTP_IPI_ADDR_RLOCK();
2435         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2436         if (vrf == NULL) {
2437                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2438                         SCTP_IPI_ADDR_RUNLOCK();
2439                 return (NULL);
2440         }
2441         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2442                 if (stcb->asoc.scope.loopback_scope == 0 &&
2443                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2444                         /* Skip if loopback_scope not set */
2445                         continue;
2446                 }
2447                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2448                         switch (sctp_ifa->address.sa.sa_family) {
2449 #ifdef INET
2450                         case AF_INET:
2451                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2452                                         struct sockaddr_in *sin;
2453
2454                                         sin = &sctp_ifa->address.sin;
2455                                         if (sin->sin_addr.s_addr == 0) {
2456                                                 /* skip unspecifed addresses */
2457                                                 continue;
2458                                         }
2459                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2460                                             &sin->sin_addr) != 0) {
2461                                                 continue;
2462                                         }
2463                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2464                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2465                                                 continue;
2466
2467                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2468                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2469                                                 continue;
2470                                         /*
2471                                          * found a valid local v4 address to
2472                                          * use
2473                                          */
2474                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2475                                                 SCTP_IPI_ADDR_RUNLOCK();
2476                                         return (&sctp_ifa->address.sa);
2477                                 }
2478                                 break;
2479 #endif
2480 #ifdef INET6
2481                         case AF_INET6:
2482                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2483                                         struct sockaddr_in6 *sin6;
2484
2485                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2486                                                 continue;
2487                                         }
2488
2489                                         sin6 = &sctp_ifa->address.sin6;
2490                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2491                                                 /*
2492                                                  * we skip unspecifed
2493                                                  * addresses
2494                                                  */
2495                                                 continue;
2496                                         }
2497                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2498                                             &sin6->sin6_addr) != 0) {
2499                                                 continue;
2500                                         }
2501                                         if (stcb->asoc.scope.local_scope == 0 &&
2502                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2503                                                 continue;
2504                                         if (stcb->asoc.scope.site_scope == 0 &&
2505                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2506                                                 continue;
2507
2508                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2509                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2510                                                 continue;
2511                                         /*
2512                                          * found a valid local v6 address to
2513                                          * use
2514                                          */
2515                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2516                                                 SCTP_IPI_ADDR_RUNLOCK();
2517                                         return (&sctp_ifa->address.sa);
2518                                 }
2519                                 break;
2520 #endif
2521                         default:
2522                                 break;
2523                         }
2524                 }
2525         }
2526         /* no valid addresses found */
2527         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2528                 SCTP_IPI_ADDR_RUNLOCK();
2529         return (NULL);
2530 }
2531
2532 static struct sockaddr *
2533 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2534 {
2535         struct sctp_laddr *laddr;
2536
2537         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2538                 if (laddr->ifa == NULL) {
2539                         continue;
2540                 }
2541                 /* is the address restricted ? */
2542                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2543                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2544                         continue;
2545
2546                 /* found a valid local address to use */
2547                 return (&laddr->ifa->address.sa);
2548         }
2549         /* no valid addresses found */
2550         return (NULL);
2551 }
2552
2553 /*
2554  * builds an ASCONF chunk from queued ASCONF params.
2555  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2556  */
2557 struct mbuf *
2558 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2559 {
2560         struct mbuf *m_asconf, *m_asconf_chk;
2561         struct sctp_asconf_addr *aa;
2562         struct sctp_asconf_chunk *acp;
2563         struct sctp_asconf_paramhdr *aph;
2564         struct sctp_asconf_addr_param *aap;
2565         uint32_t p_length;
2566         uint32_t correlation_id = 1;    /* 0 is reserved... */
2567         caddr_t ptr, lookup_ptr;
2568         uint8_t lookup_used = 0;
2569
2570         /* are there any asconf params to send? */
2571         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2572                 if (aa->sent == 0)
2573                         break;
2574         }
2575         if (aa == NULL)
2576                 return (NULL);
2577
2578         /*
2579          * get a chunk header mbuf and a cluster for the asconf params since
2580          * it's simpler to fill in the asconf chunk header lookup address on
2581          * the fly
2582          */
2583         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2584         if (m_asconf_chk == NULL) {
2585                 /* no mbuf's */
2586                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2587                     "compose_asconf: couldn't get chunk mbuf!\n");
2588                 return (NULL);
2589         }
2590         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2591         if (m_asconf == NULL) {
2592                 /* no mbuf's */
2593                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2594                     "compose_asconf: couldn't get mbuf!\n");
2595                 sctp_m_freem(m_asconf_chk);
2596                 return (NULL);
2597         }
2598         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2599         SCTP_BUF_LEN(m_asconf) = 0;
2600         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2601         memset(acp, 0, sizeof(struct sctp_asconf_chunk));
2602         /* save pointers to lookup address and asconf params */
2603         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2604         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2605
2606         /* fill in chunk header info */
2607         acp->ch.chunk_type = SCTP_ASCONF;
2608         acp->ch.chunk_flags = 0;
2609         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2610         stcb->asoc.asconf_seq_out++;
2611
2612         /* add parameters... up to smallest MTU allowed */
2613         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2614                 if (aa->sent)
2615                         continue;
2616                 /* get the parameter length */
2617                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2618                 /* will it fit in current chunk? */
2619                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2620                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2621                         /* won't fit, so we're done with this chunk */
2622                         break;
2623                 }
2624                 /* assign (and store) a correlation id */
2625                 aa->ap.aph.correlation_id = correlation_id++;
2626
2627                 /*
2628                  * fill in address if we're doing a delete this is a simple
2629                  * way for us to fill in the correlation address, which
2630                  * should only be used by the peer if we're deleting our
2631                  * source address and adding a new address (e.g. renumbering
2632                  * case)
2633                  */
2634                 if (lookup_used == 0 &&
2635                     (aa->special_del == 0) &&
2636                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2637                         struct sctp_ipv6addr_param *lookup;
2638                         uint16_t p_size, addr_size;
2639
2640                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2641                         lookup->ph.param_type =
2642                             htons(aa->ap.addrp.ph.param_type);
2643                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2644                                 /* copy IPv6 address */
2645                                 p_size = sizeof(struct sctp_ipv6addr_param);
2646                                 addr_size = sizeof(struct in6_addr);
2647                         } else {
2648                                 /* copy IPv4 address */
2649                                 p_size = sizeof(struct sctp_ipv4addr_param);
2650                                 addr_size = sizeof(struct in_addr);
2651                         }
2652                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2653                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2654                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2655                         lookup_used = 1;
2656                 }
2657                 /* copy into current space */
2658                 memcpy(ptr, &aa->ap, p_length);
2659
2660                 /* network elements and update lengths */
2661                 aph = (struct sctp_asconf_paramhdr *)ptr;
2662                 aap = (struct sctp_asconf_addr_param *)ptr;
2663                 /* correlation_id is transparent to peer, no htonl needed */
2664                 aph->ph.param_type = htons(aph->ph.param_type);
2665                 aph->ph.param_length = htons(aph->ph.param_length);
2666                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2667                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2668
2669                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2670                 ptr += SCTP_SIZE32(p_length);
2671
2672                 /*
2673                  * these params are removed off the pending list upon
2674                  * getting an ASCONF-ACK back from the peer, just set flag
2675                  */
2676                 aa->sent = 1;
2677         }
2678         /* check to see if the lookup addr has been populated yet */
2679         if (lookup_used == 0) {
2680                 /* NOTE: if the address param is optional, can skip this... */
2681                 /* add any valid (existing) address... */
2682                 struct sctp_ipv6addr_param *lookup;
2683                 uint16_t p_size, addr_size;
2684                 struct sockaddr *found_addr;
2685                 caddr_t addr_ptr;
2686
2687                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2688                         found_addr = sctp_find_valid_localaddr(stcb,
2689                             addr_locked);
2690                 else
2691                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2692
2693                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2694                 if (found_addr != NULL) {
2695                         switch (found_addr->sa_family) {
2696 #ifdef INET6
2697                         case AF_INET6:
2698                                 /* copy IPv6 address */
2699                                 lookup->ph.param_type =
2700                                     htons(SCTP_IPV6_ADDRESS);
2701                                 p_size = sizeof(struct sctp_ipv6addr_param);
2702                                 addr_size = sizeof(struct in6_addr);
2703                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2704                                     found_addr)->sin6_addr;
2705                                 break;
2706 #endif
2707 #ifdef INET
2708                         case AF_INET:
2709                                 /* copy IPv4 address */
2710                                 lookup->ph.param_type =
2711                                     htons(SCTP_IPV4_ADDRESS);
2712                                 p_size = sizeof(struct sctp_ipv4addr_param);
2713                                 addr_size = sizeof(struct in_addr);
2714                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2715                                     found_addr)->sin_addr;
2716                                 break;
2717 #endif
2718                         default:
2719                                 p_size = 0;
2720                                 addr_size = 0;
2721                                 addr_ptr = NULL;
2722                                 break;
2723                         }
2724                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2725                         memcpy(lookup->addr, addr_ptr, addr_size);
2726                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2727                 } else {
2728                         /* uh oh... don't have any address?? */
2729                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2730                             "compose_asconf: no lookup addr!\n");
2731                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2732                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2733                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2734                         memset(lookup->addr, 0, sizeof(struct in_addr));
2735                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2736                 }
2737         }
2738         /* chain it all together */
2739         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2740         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2741         acp->ch.chunk_length = htons(*retlen);
2742
2743         return (m_asconf_chk);
2744 }
2745
2746 /*
2747  * section to handle address changes before an association is up eg. changes
2748  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2749  */
2750
2751 /*
2752  * processes the (local) addresses in the INIT-ACK chunk
2753  */
2754 static void
2755 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2756     unsigned int offset, unsigned int length)
2757 {
2758         struct sctp_paramhdr tmp_param, *ph;
2759         uint16_t plen, ptype;
2760         struct sctp_ifa *sctp_ifa;
2761         union sctp_sockstore store;
2762 #ifdef INET6
2763         struct sctp_ipv6addr_param addr6_store;
2764 #endif
2765 #ifdef INET
2766         struct sctp_ipv4addr_param addr4_store;
2767 #endif
2768
2769         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2770         if (stcb == NULL)       /* Un-needed check for SA */
2771                 return;
2772
2773         /* convert to upper bound */
2774         length += offset;
2775
2776         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2777                 return;
2778         }
2779         /* go through the addresses in the init-ack */
2780         ph = (struct sctp_paramhdr *)
2781             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2782             (uint8_t *)&tmp_param);
2783         while (ph != NULL) {
2784                 ptype = ntohs(ph->param_type);
2785                 plen = ntohs(ph->param_length);
2786                 switch (ptype) {
2787 #ifdef INET6
2788                 case SCTP_IPV6_ADDRESS:
2789                         {
2790                                 struct sctp_ipv6addr_param *a6p;
2791
2792                                 /* get the entire IPv6 address param */
2793                                 a6p = (struct sctp_ipv6addr_param *)
2794                                     sctp_m_getptr(m, offset,
2795                                     sizeof(struct sctp_ipv6addr_param),
2796                                     (uint8_t *)&addr6_store);
2797                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2798                                     a6p == NULL) {
2799                                         return;
2800                                 }
2801                                 memset(&store, 0, sizeof(union sctp_sockstore));
2802                                 store.sin6.sin6_family = AF_INET6;
2803                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2804                                 store.sin6.sin6_port = stcb->rport;
2805                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2806                                 break;
2807                         }
2808 #endif
2809 #ifdef INET
2810                 case SCTP_IPV4_ADDRESS:
2811                         {
2812                                 struct sctp_ipv4addr_param *a4p;
2813
2814                                 /* get the entire IPv4 address param */
2815                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2816                                     sizeof(struct sctp_ipv4addr_param),
2817                                     (uint8_t *)&addr4_store);
2818                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2819                                     a4p == NULL) {
2820                                         return;
2821                                 }
2822                                 memset(&store, 0, sizeof(union sctp_sockstore));
2823                                 store.sin.sin_family = AF_INET;
2824                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2825                                 store.sin.sin_port = stcb->rport;
2826                                 store.sin.sin_addr.s_addr = a4p->addr;
2827                                 break;
2828                         }
2829 #endif
2830                 default:
2831                         goto next_addr;
2832                 }
2833
2834                 /* see if this address really (still) exists */
2835                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2836                     SCTP_ADDR_NOT_LOCKED);
2837                 if (sctp_ifa == NULL) {
2838                         /* address doesn't exist anymore */
2839                         int status;
2840
2841                         /* are ASCONFs allowed ? */
2842                         if ((sctp_is_feature_on(stcb->sctp_ep,
2843                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2844                             stcb->asoc.asconf_supported) {
2845                                 /* queue an ASCONF DEL_IP_ADDRESS */
2846                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2847                                 /*
2848                                  * if queued ok, and in correct state, send
2849                                  * out the ASCONF.
2850                                  */
2851                                 if (status == 0 &&
2852                                     SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {
2853 #ifdef SCTP_TIMER_BASED_ASCONF
2854                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2855                                             stcb->sctp_ep, stcb,
2856                                             stcb->asoc.primary_destination);
2857 #else
2858                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2859 #endif
2860                                 }
2861                         }
2862                 }
2863
2864 next_addr:
2865                 /*
2866                  * Sanity check:  Make sure the length isn't 0, otherwise
2867                  * we'll be stuck in this loop for a long time...
2868                  */
2869                 if (SCTP_SIZE32(plen) == 0) {
2870                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2871                             plen, ptype);
2872                         return;
2873                 }
2874                 /* get next parameter */
2875                 offset += SCTP_SIZE32(plen);
2876                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2877                         return;
2878                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2879                     sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2880         }                       /* while */
2881 }
2882
2883 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2884 /*
2885  * checks to see if a specific address is in the initack address list returns
2886  * 1 if found, 0 if not
2887  */
2888 static uint32_t
2889 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2890 {
2891         struct sctp_paramhdr tmp_param, *ph;
2892         uint16_t plen, ptype;
2893 #ifdef INET
2894         struct sockaddr_in *sin;
2895         struct sctp_ipv4addr_param *a4p;
2896         struct sctp_ipv6addr_param addr4_store;
2897 #endif
2898 #ifdef INET6
2899         struct sockaddr_in6 *sin6;
2900         struct sctp_ipv6addr_param *a6p;
2901         struct sctp_ipv6addr_param addr6_store;
2902         struct sockaddr_in6 sin6_tmp;
2903 #endif
2904
2905         switch (sa->sa_family) {
2906 #ifdef INET
2907         case AF_INET:
2908                 break;
2909 #endif
2910 #ifdef INET6
2911         case AF_INET6:
2912                 break;
2913 #endif
2914         default:
2915                 return (0);
2916         }
2917
2918         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2919         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2920         /* convert to upper bound */
2921         length += offset;
2922
2923         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2924                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2925                     "find_initack_addr: invalid offset?\n");
2926                 return (0);
2927         }
2928         /* go through the addresses in the init-ack */
2929         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2930             sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2931         while (ph != NULL) {
2932                 ptype = ntohs(ph->param_type);
2933                 plen = ntohs(ph->param_length);
2934                 switch (ptype) {
2935 #ifdef INET6
2936                 case SCTP_IPV6_ADDRESS:
2937                         if (sa->sa_family == AF_INET6) {
2938                                 /* get the entire IPv6 address param */
2939                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2940                                         break;
2941                                 }
2942                                 /* get the entire IPv6 address param */
2943                                 a6p = (struct sctp_ipv6addr_param *)
2944                                     sctp_m_getptr(m, offset,
2945                                     sizeof(struct sctp_ipv6addr_param),
2946                                     (uint8_t *)&addr6_store);
2947                                 if (a6p == NULL) {
2948                                         return (0);
2949                                 }
2950                                 sin6 = (struct sockaddr_in6 *)sa;
2951                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2952                                         /* create a copy and clear scope */
2953                                         memcpy(&sin6_tmp, sin6,
2954                                             sizeof(struct sockaddr_in6));
2955                                         sin6 = &sin6_tmp;
2956                                         in6_clearscope(&sin6->sin6_addr);
2957                                 }
2958                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2959                                     sizeof(struct in6_addr)) == 0) {
2960                                         /* found it */
2961                                         return (1);
2962                                 }
2963                         }
2964                         break;
2965 #endif                          /* INET6 */
2966 #ifdef INET
2967                 case SCTP_IPV4_ADDRESS:
2968                         if (sa->sa_family == AF_INET) {
2969                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2970                                         break;
2971                                 }
2972                                 /* get the entire IPv4 address param */
2973                                 a4p = (struct sctp_ipv4addr_param *)
2974                                     sctp_m_getptr(m, offset,
2975                                     sizeof(struct sctp_ipv4addr_param),
2976                                     (uint8_t *)&addr4_store);
2977                                 if (a4p == NULL) {
2978                                         return (0);
2979                                 }
2980                                 sin = (struct sockaddr_in *)sa;
2981                                 if (sin->sin_addr.s_addr == a4p->addr) {
2982                                         /* found it */
2983                                         return (1);
2984                                 }
2985                         }
2986                         break;
2987 #endif
2988                 default:
2989                         break;
2990                 }
2991                 /* get next parameter */
2992                 offset += SCTP_SIZE32(plen);
2993                 if (offset + sizeof(struct sctp_paramhdr) > length) {
2994                         return (0);
2995                 }
2996                 ph = (struct sctp_paramhdr *)
2997                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2998                     (uint8_t *)&tmp_param);
2999         }                       /* while */
3000         /* not found! */
3001         return (0);
3002 }
3003
3004 /*
3005  * makes sure that the current endpoint local addr list is consistent with
3006  * the new association (eg. subset bound, asconf allowed) adds addresses as
3007  * necessary
3008  */
3009 static void
3010 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3011     int length, struct sockaddr *init_addr)
3012 {
3013         struct sctp_laddr *laddr;
3014
3015         /* go through the endpoint list */
3016         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3017                 /* be paranoid and validate the laddr */
3018                 if (laddr->ifa == NULL) {
3019                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3020                             "check_addr_list_ep: laddr->ifa is NULL");
3021                         continue;
3022                 }
3023                 if (laddr->ifa == NULL) {
3024                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3025                         continue;
3026                 }
3027                 /* do i have it implicitly? */
3028                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3029                         continue;
3030                 }
3031                 /* check to see if in the init-ack */
3032                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3033                         /* try to add it */
3034                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3035                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3036                 }
3037         }
3038 }
3039
3040 /*
3041  * makes sure that the current kernel address list is consistent with the new
3042  * association (with all addrs bound) adds addresses as necessary
3043  */
3044 static void
3045 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3046     int length, struct sockaddr *init_addr,
3047     uint16_t local_scope, uint16_t site_scope,
3048     uint16_t ipv4_scope, uint16_t loopback_scope)
3049 {
3050         struct sctp_vrf *vrf = NULL;
3051         struct sctp_ifn *sctp_ifn;
3052         struct sctp_ifa *sctp_ifa;
3053         uint32_t vrf_id;
3054 #ifdef INET
3055         struct sockaddr_in *sin;
3056 #endif
3057 #ifdef INET6
3058         struct sockaddr_in6 *sin6;
3059 #endif
3060
3061         if (stcb) {
3062                 vrf_id = stcb->asoc.vrf_id;
3063         } else {
3064                 return;
3065         }
3066         SCTP_IPI_ADDR_RLOCK();
3067         vrf = sctp_find_vrf(vrf_id);
3068         if (vrf == NULL) {
3069                 SCTP_IPI_ADDR_RUNLOCK();
3070                 return;
3071         }
3072         /* go through all our known interfaces */
3073         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3074                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3075                         /* skip loopback interface */
3076                         continue;
3077                 }
3078                 /* go through each interface address */
3079                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3080                         /* do i have it implicitly? */
3081                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3082                                 continue;
3083                         }
3084                         switch (sctp_ifa->address.sa.sa_family) {
3085 #ifdef INET
3086                         case AF_INET:
3087                                 sin = &sctp_ifa->address.sin;
3088                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3089                                     &sin->sin_addr) != 0) {
3090                                         continue;
3091                                 }
3092                                 if ((ipv4_scope == 0) &&
3093                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3094                                         /* private address not in scope */
3095                                         continue;
3096                                 }
3097                                 break;
3098 #endif
3099 #ifdef INET6
3100                         case AF_INET6:
3101                                 sin6 = &sctp_ifa->address.sin6;
3102                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3103                                     &sin6->sin6_addr) != 0) {
3104                                         continue;
3105                                 }
3106                                 if ((local_scope == 0) &&
3107                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3108                                         continue;
3109                                 }
3110                                 if ((site_scope == 0) &&
3111                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3112                                         continue;
3113                                 }
3114                                 break;
3115 #endif
3116                         default:
3117                                 break;
3118                         }
3119                         /* check to see if in the init-ack */
3120                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3121                                 /* try to add it */
3122                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3123                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3124                                     SCTP_ADDR_LOCKED);
3125                         }
3126                 }               /* end foreach ifa */
3127         }                       /* end foreach ifn */
3128         SCTP_IPI_ADDR_RUNLOCK();
3129 }
3130
3131 /*
3132  * validates an init-ack chunk (from a cookie-echo) with current addresses
3133  * adds addresses from the init-ack into our local address list, if needed
3134  * queues asconf adds/deletes addresses as needed and makes appropriate list
3135  * changes for source address selection m, offset: points to the start of the
3136  * address list in an init-ack chunk length: total length of the address
3137  * params only init_addr: address where my INIT-ACK was sent from
3138  */
3139 void
3140 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3141     int length, struct sockaddr *init_addr,
3142     uint16_t local_scope, uint16_t site_scope,
3143     uint16_t ipv4_scope, uint16_t loopback_scope)
3144 {
3145         /* process the local addresses in the initack */
3146         sctp_process_initack_addresses(stcb, m, offset, length);
3147
3148         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3149                 /* bound all case */
3150                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3151                     local_scope, site_scope, ipv4_scope, loopback_scope);
3152         } else {
3153                 /* subset bound case */
3154                 if (sctp_is_feature_on(stcb->sctp_ep,
3155                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3156                         /* asconf's allowed */
3157                         sctp_check_address_list_ep(stcb, m, offset, length,
3158                             init_addr);
3159                 }
3160                 /* else, no asconfs allowed, so what we sent is what we get */
3161         }
3162 }
3163
3164 /*
3165  * sctp_bindx() support
3166  */
3167 uint32_t
3168 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3169     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3170 {
3171         struct sctp_ifa *ifa;
3172         struct sctp_laddr *laddr, *nladdr;
3173
3174         if (sa->sa_len == 0) {
3175                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3176                 return (EINVAL);
3177         }
3178         if (sctp_ifap) {
3179                 ifa = sctp_ifap;
3180         } else if (type == SCTP_ADD_IP_ADDRESS) {
3181                 /* For an add the address MUST be on the system */
3182                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3183         } else if (type == SCTP_DEL_IP_ADDRESS) {
3184                 /* For a delete we need to find it in the inp */
3185                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3186         } else {
3187                 ifa = NULL;
3188         }
3189         if (ifa != NULL) {
3190                 if (type == SCTP_ADD_IP_ADDRESS) {
3191                         sctp_add_local_addr_ep(inp, ifa, type);
3192                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3193                         if (inp->laddr_count < 2) {
3194                                 /* can't delete the last local address */
3195                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3196                                 return (EINVAL);
3197                         }
3198                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3199                             sctp_nxt_addr) {
3200                                 if (ifa == laddr->ifa) {
3201                                         /* Mark in the delete */
3202                                         laddr->action = type;
3203                                 }
3204                         }
3205                 }
3206                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3207                         /*
3208                          * There is no need to start the iterator if the inp
3209                          * has no associations.
3210                          */
3211                         if (type == SCTP_DEL_IP_ADDRESS) {
3212                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3213                                         if (laddr->ifa == ifa) {
3214                                                 sctp_del_local_addr_ep(inp, ifa);
3215                                         }
3216                                 }
3217                         }
3218                 } else {
3219                         struct sctp_asconf_iterator *asc;
3220                         struct sctp_laddr *wi;
3221                         int ret;
3222
3223                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3224                             sizeof(struct sctp_asconf_iterator),
3225                             SCTP_M_ASC_IT);
3226                         if (asc == NULL) {
3227                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3228                                 return (ENOMEM);
3229                         }
3230                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3231                         if (wi == NULL) {
3232                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3233                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3234                                 return (ENOMEM);
3235                         }
3236                         LIST_INIT(&asc->list_of_work);
3237                         asc->cnt = 1;
3238                         SCTP_INCR_LADDR_COUNT();
3239                         wi->ifa = ifa;
3240                         wi->action = type;
3241                         atomic_add_int(&ifa->refcount, 1);
3242                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3243                         ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
3244                             sctp_asconf_iterator_stcb,
3245                             sctp_asconf_iterator_ep_end,
3246                             SCTP_PCB_ANY_FLAGS,
3247                             SCTP_PCB_ANY_FEATURES,
3248                             SCTP_ASOC_ANY_STATE,
3249                             (void *)asc, 0,
3250                             sctp_asconf_iterator_end, inp, 0);
3251                         if (ret) {
3252                                 SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
3253                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
3254                                 sctp_asconf_iterator_end(asc, 0);
3255                                 return (EFAULT);
3256                         }
3257                 }
3258                 return (0);
3259         } else {
3260                 /* invalid address! */
3261                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3262                 return (EADDRNOTAVAIL);
3263         }
3264 }
3265
3266 void
3267 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3268     struct sctp_nets *net)
3269 {
3270         struct sctp_asconf_addr *aa;
3271         struct sctp_ifa *sctp_ifap;
3272         struct sctp_asconf_tag_param *vtag;
3273 #ifdef INET
3274         struct sockaddr_in *to;
3275 #endif
3276 #ifdef INET6
3277         struct sockaddr_in6 *to6;
3278 #endif
3279         if (net == NULL) {
3280                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3281                 return;
3282         }
3283         if (stcb == NULL) {
3284                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3285                 return;
3286         }
3287         /*
3288          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3289          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3290          */
3291         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3292             SCTP_M_ASC_ADDR);
3293         if (aa == NULL) {
3294                 /* didn't get memory */
3295                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3296                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3297                 return;
3298         }
3299         aa->special_del = 0;
3300         /* fill in asconf address parameter fields */
3301         /* top level elements are "networked" during send */
3302         aa->ifa = NULL;
3303         aa->sent = 0;           /* clear sent flag */
3304         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3305         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3306         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3307         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3308         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3309         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3310
3311         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3312             SCTP_M_ASC_ADDR);
3313         if (aa == NULL) {
3314                 /* didn't get memory */
3315                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3316                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3317                 return;
3318         }
3319         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3320         /* fill in asconf address parameter fields */
3321         /* ADD(0.0.0.0) */
3322         switch (net->ro._l_addr.sa.sa_family) {
3323 #ifdef INET
3324         case AF_INET:
3325                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3326                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3327                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3328                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3329                 /* No need to add an address, we are using 0.0.0.0 */
3330                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3331                 break;
3332 #endif
3333 #ifdef INET6
3334         case AF_INET6:
3335                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3336                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3337                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3338                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3339                 /* No need to add an address, we are using 0.0.0.0 */
3340                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3341                 break;
3342 #endif
3343         default:
3344                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3345                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3346                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3347                 return;
3348         }
3349         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3350             SCTP_M_ASC_ADDR);
3351         if (aa == NULL) {
3352                 /* didn't get memory */
3353                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3354                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3355                 return;
3356         }
3357         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3358         /* fill in asconf address parameter fields */
3359         /* ADD(0.0.0.0) */
3360         switch (net->ro._l_addr.sa.sa_family) {
3361 #ifdef INET
3362         case AF_INET:
3363                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3364                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3365                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3366                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3367                 /* No need to add an address, we are using 0.0.0.0 */
3368                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3369                 break;
3370 #endif
3371 #ifdef INET6
3372         case AF_INET6:
3373                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3374                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3375                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3376                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3377                 /* No need to add an address, we are using 0.0.0.0 */
3378                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3379                 break;
3380 #endif
3381         default:
3382                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3383                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3384                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3385                 return;
3386         }
3387         /* Now we must hunt the addresses and add all global addresses */
3388         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3389                 struct sctp_vrf *vrf = NULL;
3390                 struct sctp_ifn *sctp_ifnp;
3391                 uint32_t vrf_id;
3392
3393                 vrf_id = stcb->sctp_ep->def_vrf_id;
3394                 vrf = sctp_find_vrf(vrf_id);
3395                 if (vrf == NULL) {
3396                         goto skip_rest;
3397                 }
3398
3399                 SCTP_IPI_ADDR_RLOCK();
3400                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3401                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3402                                 switch (sctp_ifap->address.sa.sa_family) {
3403 #ifdef INET
3404                                 case AF_INET:
3405                                         to = &sctp_ifap->address.sin;
3406                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3407                                             &to->sin_addr) != 0) {
3408                                                 continue;
3409                                         }
3410                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3411                                                 continue;
3412                                         }
3413                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3414                                                 continue;
3415                                         }
3416                                         break;
3417 #endif
3418 #ifdef INET6
3419                                 case AF_INET6:
3420                                         to6 = &sctp_ifap->address.sin6;
3421                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3422                                             &to6->sin6_addr) != 0) {
3423                                                 continue;
3424                                         }
3425                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3426                                                 continue;
3427                                         }
3428                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3429                                                 continue;
3430                                         }
3431                                         break;
3432 #endif
3433                                 default:
3434                                         continue;
3435                                 }
3436                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3437                         }
3438                 }
3439                 SCTP_IPI_ADDR_RUNLOCK();
3440         } else {
3441                 struct sctp_laddr *laddr;
3442
3443                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3444                         if (laddr->ifa == NULL) {
3445                                 continue;
3446                         }
3447                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3448                                 /*
3449                                  * Address being deleted by the system, dont
3450                                  * list.
3451                                  */
3452                                 continue;
3453                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3454                                 /*
3455                                  * Address being deleted on this ep don't
3456                                  * list.
3457                                  */
3458                                 continue;
3459                         }
3460                         sctp_ifap = laddr->ifa;
3461                         switch (sctp_ifap->address.sa.sa_family) {
3462 #ifdef INET
3463                         case AF_INET:
3464                                 to = &sctp_ifap->address.sin;
3465                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3466                                         continue;
3467                                 }
3468                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3469                                         continue;
3470                                 }
3471                                 break;
3472 #endif
3473 #ifdef INET6
3474                         case AF_INET6:
3475                                 to6 = &sctp_ifap->address.sin6;
3476                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3477                                         continue;
3478                                 }
3479                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3480                                         continue;
3481                                 }
3482                                 break;
3483 #endif
3484                         default:
3485                                 continue;
3486                         }
3487                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3488                 }
3489         }
3490 skip_rest:
3491         /* Now we must send the asconf into the queue */
3492         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3493 }