sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_asconf.h>
  44 #include <netinet/sctp_timer.h>
  45
  46 /*
  47  * debug flags:
  48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  49  * SCTP_DEBUG_ASCONF2: detailed info
  50  */
  51
  52
  53 /*
  54  * RFC 5061
  55  *
  56  * An ASCONF parameter queue exists per asoc which holds the pending address
  57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  58  *
  59  * A restricted_addrs list exists per assoc to hold local addresses that are
  60  * not (yet) usable by the assoc as a source address.  These addresses are
  61  * either pending an ASCONF operation (and exist on the ASCONF parameter
  62  * queue), or they are permanently restricted (the peer has returned an
  63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  64  *
  65  * Deleted addresses are always immediately removed from the lists as they will
  66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  67  * only if allowed.
  68  */
  69
  70 /*
  71  * ASCONF parameter processing.
  72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  75  */
  76 static struct mbuf *
  77 sctp_asconf_success_response(uint32_t id)
  78 {
  79         struct mbuf *m_reply = NULL;
  80         struct sctp_asconf_paramhdr *aph;
  81
  82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  83             0, M_DONTWAIT, 1, MT_DATA);
  84         if (m_reply == NULL) {
  85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  86                     "asconf_success_response: couldn't get mbuf!\n");
  87                 return (NULL);
  88         }
  89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  90         aph->correlation_id = id;
  91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  94         aph->ph.param_length = htons(aph->ph.param_length);
  95
  96         return (m_reply);
  97 }
  98
  99 static struct mbuf *
 100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t * error_tlv,
 101     uint16_t tlv_length)
 102 {
 103         struct mbuf *m_reply = NULL;
 104         struct sctp_asconf_paramhdr *aph;
 105         struct sctp_error_cause *error;
 106         uint8_t *tlv;
 107
 108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 109             tlv_length +
 110             sizeof(struct sctp_error_cause)),
 111             0, M_DONTWAIT, 1, MT_DATA);
 112         if (m_reply == NULL) {
 113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 114                     "asconf_error_response: couldn't get mbuf!\n");
 115                 return (NULL);
 116         }
 117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 118         error = (struct sctp_error_cause *)(aph + 1);
 119
 120         aph->correlation_id = id;
 121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 122         error->code = htons(cause);
 123         error->length = tlv_length + sizeof(struct sctp_error_cause);
 124         aph->ph.param_length = error->length +
 125             sizeof(struct sctp_asconf_paramhdr);
 126
 127         if (aph->ph.param_length > MLEN) {
 128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 129                     "asconf_error_response: tlv_length (%xh) too big\n",
 130                     tlv_length);
 131                 sctp_m_freem(m_reply);  /* discard */
 132                 return (NULL);
 133         }
 134         if (error_tlv != NULL) {
 135                 tlv = (uint8_t *) (error + 1);
 136                 memcpy(tlv, error_tlv, tlv_length);
 137         }
 138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 139         error->length = htons(error->length);
 140         aph->ph.param_length = htons(aph->ph.param_length);
 141
 142         return (m_reply);
 143 }
 144
 145 static struct mbuf *
 146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 147     struct sctp_tcb *stcb, int send_hb, int response_required)
 148 {
 149         struct sctp_nets *net;
 150         struct mbuf *m_reply = NULL;
 151         struct sockaddr_storage sa_store;
 152         struct sctp_paramhdr *ph;
 153         uint16_t param_type, param_length, aparam_length;
 154         struct sockaddr *sa;
 155         int zero_address = 0;
 156         int bad_address = 0;
 157
 158 #ifdef INET
 159         struct sockaddr_in *sin;
 160         struct sctp_ipv4addr_param *v4addr;
 161
 162 #endif
 163 #ifdef INET6
 164         struct sockaddr_in6 *sin6;
 165         struct sctp_ipv6addr_param *v6addr;
 166
 167 #endif
 168
 169         aparam_length = ntohs(aph->ph.param_length);
 170         ph = (struct sctp_paramhdr *)(aph + 1);
 171         param_type = ntohs(ph->param_type);
 172         param_length = ntohs(ph->param_length);
 173
 174         sa = (struct sockaddr *)&sa_store;
 175         switch (param_type) {
 176 #ifdef INET
 177         case SCTP_IPV4_ADDRESS:
 178                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 179                         /* invalid param size */
 180                         return (NULL);
 181                 }
 182                 v4addr = (struct sctp_ipv4addr_param *)ph;
 183                 sin = (struct sockaddr_in *)&sa_store;
 184                 bzero(sin, sizeof(*sin));
 185                 sin->sin_family = AF_INET;
 186                 sin->sin_len = sizeof(struct sockaddr_in);
 187                 sin->sin_port = stcb->rport;
 188                 sin->sin_addr.s_addr = v4addr->addr;
 189                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 190                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 191                         bad_address = 1;
 192                 }
 193                 if (sin->sin_addr.s_addr == INADDR_ANY)
 194                         zero_address = 1;
 195                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 196                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 197                 break;
 198 #endif
 199 #ifdef INET6
 200         case SCTP_IPV6_ADDRESS:
 201                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 202                         /* invalid param size */
 203                         return (NULL);
 204                 }
 205                 v6addr = (struct sctp_ipv6addr_param *)ph;
 206                 sin6 = (struct sockaddr_in6 *)&sa_store;
 207                 bzero(sin6, sizeof(*sin6));
 208                 sin6->sin6_family = AF_INET6;
 209                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 210                 sin6->sin6_port = stcb->rport;
 211                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 212                     sizeof(struct in6_addr));
 213                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 214                         bad_address = 1;
 215                 }
 216                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 217                         zero_address = 1;
 218                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 219                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 220                 break;
 221 #endif
 222         default:
 223                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 224                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 225                     aparam_length);
 226                 return (m_reply);
 227         }                       /* end switch */
 228
 229         /* if 0.0.0.0/::0, add the source address instead */
 230         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 231                 sa = src;
 232                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 233                     "process_asconf_add_ip: using source addr ");
 234                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 235         }
 236         /* add the address */
 237         if (bad_address) {
 238                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 239                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *) aph,
 240                     aparam_length);
 241         } else if (sctp_add_remote_addr(stcb, sa, &net, SCTP_DONOT_SETSCOPE,
 242             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 243                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 244                     "process_asconf_add_ip: error adding address\n");
 245                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 246                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *) aph,
 247                     aparam_length);
 248         } else {
 249                 /* notify upper layer */
 250                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 251                 if (response_required) {
 252                         m_reply =
 253                             sctp_asconf_success_response(aph->correlation_id);
 254                 }
 255                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 256                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 257                     stcb, net);
 258                 if (send_hb) {
 259                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 260                 }
 261         }
 262         return (m_reply);
 263 }
 264
 265 static int
 266 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 267 {
 268         struct sctp_nets *src_net, *net;
 269
 270         /* make sure the source address exists as a destination net */
 271         src_net = sctp_findnet(stcb, src);
 272         if (src_net == NULL) {
 273                 /* not found */
 274                 return (-1);
 275         }
 276         /* delete all destination addresses except the source */
 277         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 278                 if (net != src_net) {
 279                         /* delete this address */
 280                         sctp_remove_net(stcb, net);
 281                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 282                             "asconf_del_remote_addrs_except: deleting ");
 283                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 284                             (struct sockaddr *)&net->ro._l_addr);
 285                         /* notify upper layer */
 286                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 287                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 288                 }
 289         }
 290         return (0);
 291 }
 292
 293 static struct mbuf *
 294 sctp_process_asconf_delete_ip(struct sockaddr *src,
 295     struct sctp_asconf_paramhdr *aph,
 296     struct sctp_tcb *stcb, int response_required)
 297 {
 298         struct mbuf *m_reply = NULL;
 299         struct sockaddr_storage sa_store;
 300         struct sctp_paramhdr *ph;
 301         uint16_t param_type, param_length, aparam_length;
 302         struct sockaddr *sa;
 303         int zero_address = 0;
 304         int result;
 305
 306 #ifdef INET
 307         struct sockaddr_in *sin;
 308         struct sctp_ipv4addr_param *v4addr;
 309
 310 #endif
 311 #ifdef INET6
 312         struct sockaddr_in6 *sin6;
 313         struct sctp_ipv6addr_param *v6addr;
 314
 315 #endif
 316
 317         aparam_length = ntohs(aph->ph.param_length);
 318         ph = (struct sctp_paramhdr *)(aph + 1);
 319         param_type = ntohs(ph->param_type);
 320         param_length = ntohs(ph->param_length);
 321
 322         sa = (struct sockaddr *)&sa_store;
 323         switch (param_type) {
 324 #ifdef INET
 325         case SCTP_IPV4_ADDRESS:
 326                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 327                         /* invalid param size */
 328                         return (NULL);
 329                 }
 330                 v4addr = (struct sctp_ipv4addr_param *)ph;
 331                 sin = (struct sockaddr_in *)&sa_store;
 332                 bzero(sin, sizeof(*sin));
 333                 sin->sin_family = AF_INET;
 334                 sin->sin_len = sizeof(struct sockaddr_in);
 335                 sin->sin_port = stcb->rport;
 336                 sin->sin_addr.s_addr = v4addr->addr;
 337                 if (sin->sin_addr.s_addr == INADDR_ANY)
 338                         zero_address = 1;
 339                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 340                     "process_asconf_delete_ip: deleting ");
 341                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 342                 break;
 343 #endif
 344 #ifdef INET6
 345         case SCTP_IPV6_ADDRESS:
 346                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 347                         /* invalid param size */
 348                         return (NULL);
 349                 }
 350                 v6addr = (struct sctp_ipv6addr_param *)ph;
 351                 sin6 = (struct sockaddr_in6 *)&sa_store;
 352                 bzero(sin6, sizeof(*sin6));
 353                 sin6->sin6_family = AF_INET6;
 354                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 355                 sin6->sin6_port = stcb->rport;
 356                 memcpy(&sin6->sin6_addr, v6addr->addr,
 357                     sizeof(struct in6_addr));
 358                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 359                         zero_address = 1;
 360                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 361                     "process_asconf_delete_ip: deleting ");
 362                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 363                 break;
 364 #endif
 365         default:
 366                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 367                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 368                     aparam_length);
 369                 return (m_reply);
 370         }
 371
 372         /* make sure the source address is not being deleted */
 373         if (sctp_cmpaddr(sa, src)) {
 374                 /* trying to delete the source address! */
 375                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 376                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 377                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *) aph,
 378                     aparam_length);
 379                 return (m_reply);
 380         }
 381         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 382         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 383                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 384
 385                 if (result) {
 386                         /* src address did not exist? */
 387                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 388                         /* what error to reply with?? */
 389                         m_reply =
 390                             sctp_asconf_error_response(aph->correlation_id,
 391                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *) aph,
 392                             aparam_length);
 393                 } else if (response_required) {
 394                         m_reply =
 395                             sctp_asconf_success_response(aph->correlation_id);
 396                 }
 397                 return (m_reply);
 398         }
 399         /* delete the address */
 400         result = sctp_del_remote_addr(stcb, sa);
 401         /*
 402          * note if result == -2, the address doesn't exist in the asoc but
 403          * since it's being deleted anyways, we just ack the delete -- but
 404          * this probably means something has already gone awry
 405          */
 406         if (result == -1) {
 407                 /* only one address in the asoc */
 408                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 409                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 410                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *) aph,
 411                     aparam_length);
 412         } else {
 413                 if (response_required) {
 414                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 415                 }
 416                 /* notify upper layer */
 417                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 418         }
 419         return (m_reply);
 420 }
 421
 422 static struct mbuf *
 423 sctp_process_asconf_set_primary(struct sockaddr *src,
 424     struct sctp_asconf_paramhdr *aph,
 425     struct sctp_tcb *stcb, int response_required)
 426 {
 427         struct mbuf *m_reply = NULL;
 428         struct sockaddr_storage sa_store;
 429         struct sctp_paramhdr *ph;
 430         uint16_t param_type, param_length, aparam_length;
 431         struct sockaddr *sa;
 432         int zero_address = 0;
 433
 434 #ifdef INET
 435         struct sockaddr_in *sin;
 436         struct sctp_ipv4addr_param *v4addr;
 437
 438 #endif
 439 #ifdef INET6
 440         struct sockaddr_in6 *sin6;
 441         struct sctp_ipv6addr_param *v6addr;
 442
 443 #endif
 444
 445         aparam_length = ntohs(aph->ph.param_length);
 446         ph = (struct sctp_paramhdr *)(aph + 1);
 447         param_type = ntohs(ph->param_type);
 448         param_length = ntohs(ph->param_length);
 449
 450         sa = (struct sockaddr *)&sa_store;
 451         switch (param_type) {
 452 #ifdef INET
 453         case SCTP_IPV4_ADDRESS:
 454                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 455                         /* invalid param size */
 456                         return (NULL);
 457                 }
 458                 v4addr = (struct sctp_ipv4addr_param *)ph;
 459                 sin = (struct sockaddr_in *)&sa_store;
 460                 bzero(sin, sizeof(*sin));
 461                 sin->sin_family = AF_INET;
 462                 sin->sin_len = sizeof(struct sockaddr_in);
 463                 sin->sin_addr.s_addr = v4addr->addr;
 464                 if (sin->sin_addr.s_addr == INADDR_ANY)
 465                         zero_address = 1;
 466                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 467                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 468                 break;
 469 #endif
 470 #ifdef INET6
 471         case SCTP_IPV6_ADDRESS:
 472                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 473                         /* invalid param size */
 474                         return (NULL);
 475                 }
 476                 v6addr = (struct sctp_ipv6addr_param *)ph;
 477                 sin6 = (struct sockaddr_in6 *)&sa_store;
 478                 bzero(sin6, sizeof(*sin6));
 479                 sin6->sin6_family = AF_INET6;
 480                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 481                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 482                     sizeof(struct in6_addr));
 483                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 484                         zero_address = 1;
 485                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 486                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 487                 break;
 488 #endif
 489         default:
 490                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 491                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 492                     aparam_length);
 493                 return (m_reply);
 494         }
 495
 496         /* if 0.0.0.0/::0, use the source address instead */
 497         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 498                 sa = src;
 499                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 500                     "process_asconf_set_primary: using source addr ");
 501                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 502         }
 503         /* set the primary address */
 504         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 505                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 506                     "process_asconf_set_primary: primary address set\n");
 507                 /* notify upper layer */
 508                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 509                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 510                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 511                     (stcb->asoc.alternate)) {
 512                         sctp_free_remote_addr(stcb->asoc.alternate);
 513                         stcb->asoc.alternate = NULL;
 514                 }
 515                 if (response_required) {
 516                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 517                 }
 518                 /*
 519                  * Mobility adaptation. Ideally, when the reception of SET
 520                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 521                  * destination, unacknowledged DATA are retransmitted
 522                  * immediately to the new primary destination for seamless
 523                  * handover. If the destination is UNCONFIRMED and marked to
 524                  * REQ_PRIM, The retransmission occur when reception of the
 525                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 526                  * sctp_input.c) Also, when change of the primary
 527                  * destination, it is better that all subsequent new DATA
 528                  * containing already queued DATA are transmitted to the new
 529                  * primary destination. (by micchie)
 530                  */
 531                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 532                     SCTP_MOBILITY_BASE) ||
 533                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 534                     SCTP_MOBILITY_FASTHANDOFF)) &&
 535                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 536                     SCTP_MOBILITY_PRIM_DELETED) &&
 537                     (stcb->asoc.primary_destination->dest_state &
 538                     SCTP_ADDR_UNCONFIRMED) == 0) {
 539
 540                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTP_TIMER + SCTP_LOC_7);
 541                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 542                             SCTP_MOBILITY_FASTHANDOFF)) {
 543                                 sctp_assoc_immediate_retrans(stcb,
 544                                     stcb->asoc.primary_destination);
 545                         }
 546                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 547                             SCTP_MOBILITY_BASE)) {
 548                                 sctp_move_chunks_from_net(stcb,
 549                                     stcb->asoc.deleted_primary);
 550                         }
 551                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 552                             stcb->asoc.deleted_primary);
 553                 }
 554         } else {
 555                 /* couldn't set the requested primary address! */
 556                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 557                     "process_asconf_set_primary: set primary failed!\n");
 558                 /* must have been an invalid address, so report */
 559                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 560                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *) aph,
 561                     aparam_length);
 562         }
 563
 564         return (m_reply);
 565 }
 566
 567 /*
 568  * handles an ASCONF chunk.
 569  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 570  */
 571 void
 572 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 573     struct sockaddr *src,
 574     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 575     int first)
 576 {
 577         struct sctp_association *asoc;
 578         uint32_t serial_num;
 579         struct mbuf *n, *m_ack, *m_result, *m_tail;
 580         struct sctp_asconf_ack_chunk *ack_cp;
 581         struct sctp_asconf_paramhdr *aph, *ack_aph;
 582         struct sctp_ipv6addr_param *p_addr;
 583         unsigned int asconf_limit, cnt;
 584         int error = 0;          /* did an error occur? */
 585
 586         /* asconf param buffer */
 587         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 588         struct sctp_asconf_ack *ack, *ack_next;
 589
 590         /* verify minimum length */
 591         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 592                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 593                     "handle_asconf: chunk too small = %xh\n",
 594                     ntohs(cp->ch.chunk_length));
 595                 return;
 596         }
 597         asoc = &stcb->asoc;
 598         serial_num = ntohl(cp->serial_number);
 599
 600         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 601                 /* got a duplicate ASCONF */
 602                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 603                     "handle_asconf: got duplicate serial number = %xh\n",
 604                     serial_num);
 605                 return;
 606         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 607                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 608                     serial_num, asoc->asconf_seq_in + 1);
 609                 return;
 610         }
 611         /* it's the expected "next" sequence number, so process it */
 612         asoc->asconf_seq_in = serial_num;       /* update sequence */
 613         /* get length of all the param's in the ASCONF */
 614         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 615         SCTPDBG(SCTP_DEBUG_ASCONF1,
 616             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 617             asconf_limit, serial_num);
 618
 619         if (first) {
 620                 /* delete old cache */
 621                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 622
 623                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 624                         if (ack->serial_number == serial_num)
 625                                 break;
 626                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 627                             ack->serial_number, serial_num);
 628                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 629                         if (ack->data != NULL) {
 630                                 sctp_m_freem(ack->data);
 631                         }
 632                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 633                 }
 634         }
 635         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 636             M_DONTWAIT, 1, MT_DATA);
 637         if (m_ack == NULL) {
 638                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 639                     "handle_asconf: couldn't get mbuf!\n");
 640                 return;
 641         }
 642         m_tail = m_ack;         /* current reply chain's tail */
 643
 644         /* fill in ASCONF-ACK header */
 645         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 646         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 647         ack_cp->ch.chunk_flags = 0;
 648         ack_cp->serial_number = htonl(serial_num);
 649         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 650         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 651         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 652
 653         /* skip the lookup address parameter */
 654         offset += sizeof(struct sctp_asconf_chunk);
 655         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *) & aparam_buf);
 656         if (p_addr == NULL) {
 657                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 658                     "handle_asconf: couldn't get lookup addr!\n");
 659                 /* respond with a missing/invalid mandatory parameter error */
 660                 return;
 661         }
 662         /* param_length is already validated in process_control... */
 663         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 664
 665         /* get pointer to first asconf param in ASCONF-ACK */
 666         ack_aph = (struct sctp_asconf_paramhdr *)(mtod(m_ack, caddr_t)+sizeof(struct sctp_asconf_ack_chunk));
 667         if (ack_aph == NULL) {
 668                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Gak in asconf2\n");
 669                 return;
 670         }
 671         /* get pointer to first asconf param in ASCONF */
 672         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *) & aparam_buf);
 673         if (aph == NULL) {
 674                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 675                 goto send_reply;
 676         }
 677         /* process through all parameters */
 678         cnt = 0;
 679         while (aph != NULL) {
 680                 unsigned int param_length, param_type;
 681
 682                 param_type = ntohs(aph->ph.param_type);
 683                 param_length = ntohs(aph->ph.param_length);
 684                 if (offset + param_length > asconf_limit) {
 685                         /* parameter goes beyond end of chunk! */
 686                         sctp_m_freem(m_ack);
 687                         return;
 688                 }
 689                 m_result = NULL;
 690
 691                 if (param_length > sizeof(aparam_buf)) {
 692                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 693                         sctp_m_freem(m_ack);
 694                         return;
 695                 }
 696                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 697                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 698                         sctp_m_freem(m_ack);
 699                 }
 700                 /* get the entire parameter */
 701                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 702                 if (aph == NULL) {
 703                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 704                         sctp_m_freem(m_ack);
 705                         return;
 706                 }
 707                 switch (param_type) {
 708                 case SCTP_ADD_IP_ADDRESS:
 709                         asoc->peer_supports_asconf = 1;
 710                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 711                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 712                         cnt++;
 713                         break;
 714                 case SCTP_DEL_IP_ADDRESS:
 715                         asoc->peer_supports_asconf = 1;
 716                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 717                             error);
 718                         break;
 719                 case SCTP_ERROR_CAUSE_IND:
 720                         /* not valid in an ASCONF chunk */
 721                         break;
 722                 case SCTP_SET_PRIM_ADDR:
 723                         asoc->peer_supports_asconf = 1;
 724                         m_result = sctp_process_asconf_set_primary(src, aph,
 725                             stcb, error);
 726                         break;
 727                 case SCTP_NAT_VTAGS:
 728                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 729                         break;
 730                 case SCTP_SUCCESS_REPORT:
 731                         /* not valid in an ASCONF chunk */
 732                         break;
 733                 case SCTP_ULP_ADAPTATION:
 734                         /* FIX */
 735                         break;
 736                 default:
 737                         if ((param_type & 0x8000) == 0) {
 738                                 /* Been told to STOP at this param */
 739                                 asconf_limit = offset;
 740                                 /*
 741                                  * FIX FIX - We need to call
 742                                  * sctp_arethere_unrecognized_parameters()
 743                                  * to get a operr and send it for any
 744                                  * param's with the 0x4000 bit set OR do it
 745                                  * here ourselves... note we still must STOP
 746                                  * if the 0x8000 bit is clear.
 747                                  */
 748                         }
 749                         /* unknown/invalid param type */
 750                         break;
 751                 }               /* switch */
 752
 753                 /* add any (error) result to the reply mbuf chain */
 754                 if (m_result != NULL) {
 755                         SCTP_BUF_NEXT(m_tail) = m_result;
 756                         m_tail = m_result;
 757                         /* update lengths, make sure it's aligned too */
 758                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 759                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 760                         /* set flag to force success reports */
 761                         error = 1;
 762                 }
 763                 offset += SCTP_SIZE32(param_length);
 764                 /* update remaining ASCONF message length to process */
 765                 if (offset >= asconf_limit) {
 766                         /* no more data in the mbuf chain */
 767                         break;
 768                 }
 769                 /* get pointer to next asconf param */
 770                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 771                     sizeof(struct sctp_asconf_paramhdr),
 772                     (uint8_t *) & aparam_buf);
 773                 if (aph == NULL) {
 774                         /* can't get an asconf paramhdr */
 775                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 776                         /* FIX ME - add error here... */
 777                 }
 778         }
 779
 780 send_reply:
 781         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 782         /* save the ASCONF-ACK reply */
 783         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 784             struct sctp_asconf_ack);
 785         if (ack == NULL) {
 786                 sctp_m_freem(m_ack);
 787                 return;
 788         }
 789         ack->serial_number = serial_num;
 790         ack->last_sent_to = NULL;
 791         ack->data = m_ack;
 792         ack->len = 0;
 793         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 794                 ack->len += SCTP_BUF_LEN(n);
 795         }
 796         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 797
 798         /* see if last_control_chunk_from is set properly (use IP src addr) */
 799         if (stcb->asoc.last_control_chunk_from == NULL) {
 800                 /*
 801                  * this could happen if the source address was just newly
 802                  * added
 803                  */
 804                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 805                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 806                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 807                 /* look up the from address */
 808                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 809 #ifdef SCTP_DEBUG
 810                 if (stcb->asoc.last_control_chunk_from == NULL) {
 811                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 812                 }
 813 #endif
 814         }
 815 }
 816
 817 /*
 818  * does the address match? returns 0 if not, 1 if so
 819  */
 820 static uint32_t
 821 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 822 {
 823         switch (sa->sa_family) {
 824 #ifdef INET6
 825         case AF_INET6:
 826                 {
 827                         /* XXX scopeid */
 828                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 829
 830                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 831                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 832                             sizeof(struct in6_addr)) == 0)) {
 833                                 return (1);
 834                         }
 835                         break;
 836                 }
 837 #endif
 838 #ifdef INET
 839         case AF_INET:
 840                 {
 841                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 842
 843                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 844                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 845                             sizeof(struct in_addr)) == 0)) {
 846                                 return (1);
 847                         }
 848                         break;
 849                 }
 850 #endif
 851         default:
 852                 break;
 853         }
 854         return (0);
 855 }
 856
 857 /*
 858  * does the address match? returns 0 if not, 1 if so
 859  */
 860 static uint32_t
 861 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 862 {
 863         uint16_t param_type, param_length;
 864
 865         param_type = ntohs(ph->param_type);
 866         param_length = ntohs(ph->param_length);
 867         switch (sa->sa_family) {
 868 #ifdef INET6
 869         case AF_INET6:
 870                 {
 871                         /* XXX scopeid */
 872                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 873                         struct sctp_ipv6addr_param *v6addr;
 874
 875                         v6addr = (struct sctp_ipv6addr_param *)ph;
 876                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 877                             param_length == sizeof(struct sctp_ipv6addr_param) &&
 878                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 879                             sizeof(struct in6_addr)) == 0)) {
 880                                 return (1);
 881                         }
 882                         break;
 883                 }
 884 #endif
 885 #ifdef INET
 886         case AF_INET:
 887                 {
 888                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 889                         struct sctp_ipv4addr_param *v4addr;
 890
 891                         v4addr = (struct sctp_ipv4addr_param *)ph;
 892                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 893                             param_length == sizeof(struct sctp_ipv4addr_param) &&
 894                             (memcmp(&v4addr->addr, &sin->sin_addr,
 895                             sizeof(struct in_addr)) == 0)) {
 896                                 return (1);
 897                         }
 898                         break;
 899                 }
 900 #endif
 901         default:
 902                 break;
 903         }
 904         return (0);
 905 }
 906
 907 /*
 908  * Cleanup for non-responded/OP ERR'd ASCONF
 909  */
 910 void
 911 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 912 {
 913         /* mark peer as ASCONF incapable */
 914         stcb->asoc.peer_supports_asconf = 0;
 915         /*
 916          * clear out any existing asconfs going out
 917          */
 918         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 919             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 920         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 921         /* remove the old ASCONF on our outbound queue */
 922         sctp_toss_old_asconf(stcb);
 923 }
 924
 925 /*
 926  * cleanup any cached source addresses that may be topologically
 927  * incorrect after a new address has been added to this interface.
 928  */
 929 static void
 930 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 931 {
 932         struct sctp_nets *net;
 933
 934         /*
 935          * Ideally, we want to only clear cached routes and source addresses
 936          * that are topologically incorrect.  But since there is no easy way
 937          * to know whether the newly added address on the ifn would cause a
 938          * routing change (i.e. a new egress interface would be chosen)
 939          * without doing a new routing lookup and source address selection,
 940          * we will (for now) just flush any cached route using a different
 941          * ifn (and cached source addrs) and let output re-choose them
 942          * during the next send on that net.
 943          */
 944         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 945                 /*
 946                  * clear any cached route (and cached source address) if the
 947                  * route's interface is NOT the same as the address change.
 948                  * If it's the same interface, just clear the cached source
 949                  * address.
 950                  */
 951                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 952                     ((ifn == NULL) ||
 953                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 954                         /* clear any cached route */
 955                         RTFREE(net->ro.ro_rt);
 956                         net->ro.ro_rt = NULL;
 957                 }
 958                 /* clear any cached source address */
 959                 if (net->src_addr_selected) {
 960                         sctp_free_ifa(net->ro._s_addr);
 961                         net->ro._s_addr = NULL;
 962                         net->src_addr_selected = 0;
 963                 }
 964         }
 965 }
 966
 967
 968 void
 969 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 970 {
 971         int error;
 972
 973         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 974                 return;
 975         }
 976         if (stcb->asoc.deleted_primary == NULL) {
 977                 return;
 978         }
 979         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 980                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 981                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 982                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 983                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 984                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 985                     stcb->asoc.deleted_primary,
 986                     SCTP_FROM_SCTP_TIMER + SCTP_LOC_8);
 987                 stcb->asoc.num_send_timers_up--;
 988                 if (stcb->asoc.num_send_timers_up < 0) {
 989                         stcb->asoc.num_send_timers_up = 0;
 990                 }
 991                 SCTP_TCB_LOCK_ASSERT(stcb);
 992                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
 993                     stcb->asoc.deleted_primary);
 994                 if (error) {
 995                         SCTP_INP_DECR_REF(stcb->sctp_ep);
 996                         return;
 997                 }
 998                 SCTP_TCB_LOCK_ASSERT(stcb);
 999 #ifdef SCTP_AUDITING_ENABLED
1000                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1001 #endif
1002                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1003                 if ((stcb->asoc.num_send_timers_up == 0) &&
1004                     (stcb->asoc.sent_queue_cnt > 0)) {
1005                         struct sctp_tmit_chunk *chk;
1006
1007                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1008                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1009                             stcb, chk->whoTo);
1010                 }
1011         }
1012         return;
1013 }
1014
1015 static int
1016     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1017
1018 void
1019 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1020 {
1021         struct sctp_tmit_chunk *chk;
1022
1023         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1024         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1025             SCTP_FROM_SCTP_TIMER + SCTP_LOC_5);
1026         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1027         net->error_count = 0;
1028         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1029                 if (chk->whoTo == net) {
1030                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1031                                 chk->sent = SCTP_DATAGRAM_RESEND;
1032                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1033                                 sctp_flight_size_decrease(chk);
1034                                 sctp_total_flight_decrease(stcb, chk);
1035                                 net->marked_retrans++;
1036                                 stcb->asoc.marked_retrans++;
1037                         }
1038                 }
1039         }
1040         if (net->marked_retrans) {
1041                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1042         }
1043 }
1044
1045 static void
1046 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1047 {
1048         struct sctp_nets *net;
1049         int addrnum, changed;
1050
1051         /*
1052          * If number of local valid addresses is 1, the valid address is
1053          * probably newly added address. Several valid addresses in this
1054          * association.  A source address may not be changed.  Additionally,
1055          * they can be configured on a same interface as "alias" addresses.
1056          * (by micchie)
1057          */
1058         addrnum = sctp_local_addr_count(stcb);
1059         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1060             addrnum);
1061         if (addrnum == 1) {
1062                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1063                         /* clear any cached route and source address */
1064                         if (net->ro.ro_rt) {
1065                                 RTFREE(net->ro.ro_rt);
1066                                 net->ro.ro_rt = NULL;
1067                         }
1068                         if (net->src_addr_selected) {
1069                                 sctp_free_ifa(net->ro._s_addr);
1070                                 net->ro._s_addr = NULL;
1071                                 net->src_addr_selected = 0;
1072                         }
1073                         /* Retransmit unacknowledged DATA chunks immediately */
1074                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1075                             SCTP_MOBILITY_FASTHANDOFF)) {
1076                                 sctp_net_immediate_retrans(stcb, net);
1077                         }
1078                         /* also, SET PRIMARY is maybe already sent */
1079                 }
1080                 return;
1081         }
1082         /* Multiple local addresses exsist in the association.  */
1083         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1084                 /* clear any cached route and source address */
1085                 if (net->ro.ro_rt) {
1086                         RTFREE(net->ro.ro_rt);
1087                         net->ro.ro_rt = NULL;
1088                 }
1089                 if (net->src_addr_selected) {
1090                         sctp_free_ifa(net->ro._s_addr);
1091                         net->ro._s_addr = NULL;
1092                         net->src_addr_selected = 0;
1093                 }
1094                 /*
1095                  * Check if the nexthop is corresponding to the new address.
1096                  * If the new address is corresponding to the current
1097                  * nexthop, the path will be changed. If the new address is
1098                  * NOT corresponding to the current nexthop, the path will
1099                  * not be changed.
1100                  */
1101                 SCTP_RTALLOC((sctp_route_t *) & net->ro,
1102                     stcb->sctp_ep->def_vrf_id);
1103                 if (net->ro.ro_rt == NULL)
1104                         continue;
1105
1106                 changed = 0;
1107                 switch (net->ro._l_addr.sa.sa_family) {
1108 #ifdef INET
1109                 case AF_INET:
1110                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *) & net->ro)) {
1111                                 changed = 1;
1112                         }
1113                         break;
1114 #endif
1115 #ifdef INET6
1116                 case AF_INET6:
1117                         if (sctp_v6src_match_nexthop(
1118                             &newifa->address.sin6, (sctp_route_t *) & net->ro)) {
1119                                 changed = 1;
1120                         }
1121                         break;
1122 #endif
1123                 default:
1124                         break;
1125                 }
1126                 /*
1127                  * if the newly added address does not relate routing
1128                  * information, we skip.
1129                  */
1130                 if (changed == 0)
1131                         continue;
1132                 /* Retransmit unacknowledged DATA chunks immediately */
1133                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1134                     SCTP_MOBILITY_FASTHANDOFF)) {
1135                         sctp_net_immediate_retrans(stcb, net);
1136                 }
1137                 /* Send SET PRIMARY for this new address */
1138                 if (net == stcb->asoc.primary_destination) {
1139                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1140                             SCTP_SET_PRIM_ADDR);
1141                 }
1142         }
1143 }
1144
1145 /*
1146  * process an ADD/DELETE IP ack from peer.
1147  * addr: corresponding sctp_ifa to the address being added/deleted.
1148  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1149  * flag: 1=success, 0=failure.
1150  */
1151 static void
1152 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1153 {
1154         /*
1155          * do the necessary asoc list work- if we get a failure indication,
1156          * leave the address on the assoc's restricted list.  If we get a
1157          * success indication, remove the address from the restricted list.
1158          */
1159         /*
1160          * Note: this will only occur for ADD_IP_ADDRESS, since
1161          * DEL_IP_ADDRESS is never actually added to the list...
1162          */
1163         if (flag) {
1164                 /* success case, so remove from the restricted list */
1165                 sctp_del_local_addr_restricted(stcb, addr);
1166
1167                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1168                     SCTP_MOBILITY_BASE) ||
1169                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1170                     SCTP_MOBILITY_FASTHANDOFF)) {
1171                         sctp_path_check_and_react(stcb, addr);
1172                         return;
1173                 }
1174                 /* clear any cached/topologically incorrect source addresses */
1175                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1176         }
1177         /* else, leave it on the list */
1178 }
1179
1180 /*
1181  * add an asconf add/delete/set primary IP address parameter to the queue.
1182  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1183  * returns 0 if queued, -1 if not queued/removed.
1184  * NOTE: if adding, but a delete for the same address is already scheduled
1185  * (and not yet sent out), simply remove it from queue.  Same for deleting
1186  * an address already scheduled for add.  If a duplicate operation is found,
1187  * ignore the new one.
1188  */
1189 static int
1190 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1191     uint16_t type)
1192 {
1193         struct sctp_asconf_addr *aa, *aa_next;
1194         struct sockaddr *sa;
1195
1196         /* make sure the request isn't already in the queue */
1197         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1198                 /* address match? */
1199                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1200                         continue;
1201                 /*
1202                  * is the request already in queue but not sent? pass the
1203                  * request already sent in order to resolve the following
1204                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1205                  * can't remove the ADD request already sent 3. arrival of
1206                  * ADD
1207                  */
1208                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1209                         return (-1);
1210                 }
1211                 /* is the negative request already in queue, and not sent */
1212                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1213                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1214                         /* add requested, delete already queued */
1215                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1216                         /* remove the ifa from the restricted list */
1217                         sctp_del_local_addr_restricted(stcb, ifa);
1218                         /* free the asconf param */
1219                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1220                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1221                         return (-1);
1222                 }
1223                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1224                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1225                         /* delete requested, add already queued */
1226                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1227                         /* remove the aa->ifa from the restricted list */
1228                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1229                         /* free the asconf param */
1230                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1231                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1232                         return (-1);
1233                 }
1234         }                       /* for each aa */
1235
1236         /* adding new request to the queue */
1237         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1238             SCTP_M_ASC_ADDR);
1239         if (aa == NULL) {
1240                 /* didn't get memory */
1241                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1242                 return (-1);
1243         }
1244         aa->special_del = 0;
1245         /* fill in asconf address parameter fields */
1246         /* top level elements are "networked" during send */
1247         aa->ap.aph.ph.param_type = type;
1248         aa->ifa = ifa;
1249         atomic_add_int(&ifa->refcount, 1);
1250         /* correlation_id filled in during send routine later... */
1251         switch (ifa->address.sa.sa_family) {
1252 #ifdef INET6
1253         case AF_INET6:
1254                 {
1255                         struct sockaddr_in6 *sin6;
1256
1257                         sin6 = (struct sockaddr_in6 *)&ifa->address.sa;
1258                         sa = (struct sockaddr *)sin6;
1259                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1260                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1261                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1262                             sizeof(struct sctp_ipv6addr_param);
1263                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1264                             sizeof(struct in6_addr));
1265                         break;
1266                 }
1267 #endif
1268 #ifdef INET
1269         case AF_INET:
1270                 {
1271                         struct sockaddr_in *sin;
1272
1273                         sin = (struct sockaddr_in *)&ifa->address.sa;
1274                         sa = (struct sockaddr *)sin;
1275                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1276                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1277                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1278                             sizeof(struct sctp_ipv4addr_param);
1279                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1280                             sizeof(struct in_addr));
1281                         break;
1282                 }
1283 #endif
1284         default:
1285                 /* invalid family! */
1286                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1287                 sctp_free_ifa(ifa);
1288                 return (-1);
1289         }
1290         aa->sent = 0;           /* clear sent flag */
1291
1292         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1293 #ifdef SCTP_DEBUG
1294         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1295                 if (type == SCTP_ADD_IP_ADDRESS) {
1296                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1297                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1298                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1299                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1300                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1301                 } else {
1302                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1303                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
1304                 }
1305         }
1306 #endif
1307
1308         return (0);
1309 }
1310
1311
1312 /*
1313  * add an asconf operation for the given ifa and type.
1314  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1315  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1316  * advisable.
1317  */
1318 static int
1319 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1320     uint16_t type)
1321 {
1322         uint32_t status;
1323         int pending_delete_queued = 0;
1324
1325         /* see if peer supports ASCONF */
1326         if (stcb->asoc.peer_supports_asconf == 0) {
1327                 return (-1);
1328         }
1329         /*
1330          * if this is deleting the last address from the assoc, mark it as
1331          * pending.
1332          */
1333         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending &&
1334             (sctp_local_addr_count(stcb) < 2)) {
1335                 /* set the pending delete info only */
1336                 stcb->asoc.asconf_del_pending = 1;
1337                 stcb->asoc.asconf_addr_del_pending = ifa;
1338                 atomic_add_int(&ifa->refcount, 1);
1339                 SCTPDBG(SCTP_DEBUG_ASCONF2,
1340                     "asconf_queue_add: mark delete last address pending\n");
1341                 return (-1);
1342         }
1343         /* queue an asconf parameter */
1344         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1345
1346         /*
1347          * if this is an add, and there is a delete also pending (i.e. the
1348          * last local address is being changed), queue the pending delete
1349          * too.
1350          */
1351         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1352                 /* queue in the pending delete */
1353                 if (sctp_asconf_queue_mgmt(stcb,
1354                     stcb->asoc.asconf_addr_del_pending,
1355                     SCTP_DEL_IP_ADDRESS) == 0) {
1356                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1357                         pending_delete_queued = 1;
1358                         /* clear out the pending delete info */
1359                         stcb->asoc.asconf_del_pending = 0;
1360                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1361                         stcb->asoc.asconf_addr_del_pending = NULL;
1362                 }
1363         }
1364         if (pending_delete_queued) {
1365                 struct sctp_nets *net;
1366
1367                 /*
1368                  * since we know that the only/last address is now being
1369                  * changed in this case, reset the cwnd/rto on all nets to
1370                  * start as a new address and path.  Also clear the error
1371                  * counts to give the assoc the best chance to complete the
1372                  * address change.
1373                  */
1374                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1375                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1376                             net);
1377                         net->RTO = 0;
1378                         net->error_count = 0;
1379                 }
1380                 stcb->asoc.overall_error_count = 0;
1381                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1382                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1383                             stcb->asoc.overall_error_count,
1384                             0,
1385                             SCTP_FROM_SCTP_ASCONF,
1386                             __LINE__);
1387                 }
1388                 /* queue in an advisory set primary too */
1389                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1390                 /* let caller know we should send this out immediately */
1391                 status = 1;
1392         }
1393         return (status);
1394 }
1395
1396 /*-
1397  * add an asconf delete IP address parameter to the queue by sockaddr and
1398  * possibly with no sctp_ifa available.  This is only called by the routine
1399  * that checks the addresses in an INIT-ACK against the current address list.
1400  * returns 0 if completed, non-zero if not completed.
1401  * NOTE: if an add is already scheduled (and not yet sent out), simply
1402  * remove it from queue.  If a duplicate operation is found, ignore the
1403  * new one.
1404  */
1405 static int
1406 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1407 {
1408         struct sctp_ifa *ifa;
1409         struct sctp_asconf_addr *aa, *aa_next;
1410         uint32_t vrf_id;
1411
1412         if (stcb == NULL) {
1413                 return (-1);
1414         }
1415         /* see if peer supports ASCONF */
1416         if (stcb->asoc.peer_supports_asconf == 0) {
1417                 return (-1);
1418         }
1419         /* make sure the request isn't already in the queue */
1420         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1421                 /* address match? */
1422                 if (sctp_asconf_addr_match(aa, sa) == 0)
1423                         continue;
1424                 /* is the request already in queue (sent or not) */
1425                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1426                         return (-1);
1427                 }
1428                 /* is the negative request already in queue, and not sent */
1429                 if (aa->sent == 1)
1430                         continue;
1431                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1432                         /* add already queued, so remove existing entry */
1433                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1434                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1435                         /* free the entry */
1436                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1437                         return (-1);
1438                 }
1439         }                       /* for each aa */
1440
1441         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1442         if (stcb) {
1443                 vrf_id = stcb->asoc.vrf_id;
1444         } else {
1445                 vrf_id = SCTP_DEFAULT_VRFID;
1446         }
1447         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
1448
1449         /* adding new request to the queue */
1450         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1451             SCTP_M_ASC_ADDR);
1452         if (aa == NULL) {
1453                 /* didn't get memory */
1454                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1455                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1456                 return (-1);
1457         }
1458         aa->special_del = 0;
1459         /* fill in asconf address parameter fields */
1460         /* top level elements are "networked" during send */
1461         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1462         aa->ifa = ifa;
1463         if (ifa)
1464                 atomic_add_int(&ifa->refcount, 1);
1465         /* correlation_id filled in during send routine later... */
1466         switch (sa->sa_family) {
1467 #ifdef INET6
1468         case AF_INET6:
1469                 {
1470                         /* IPv6 address */
1471                         struct sockaddr_in6 *sin6;
1472
1473                         sin6 = (struct sockaddr_in6 *)sa;
1474                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1475                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1476                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1477                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1478                             sizeof(struct in6_addr));
1479                         break;
1480                 }
1481 #endif
1482 #ifdef INET
1483         case AF_INET:
1484                 {
1485                         /* IPv4 address */
1486                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1487
1488                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1489                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1490                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1491                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1492                             sizeof(struct in_addr));
1493                         break;
1494                 }
1495 #endif
1496         default:
1497                 /* invalid family! */
1498                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1499                 if (ifa)
1500                         sctp_free_ifa(ifa);
1501                 return (-1);
1502         }
1503         aa->sent = 0;           /* clear sent flag */
1504
1505         /* delete goes to the back of the queue */
1506         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1507
1508         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1509         return (0);
1510 }
1511
1512 /*
1513  * find a specific asconf param on our "sent" queue
1514  */
1515 static struct sctp_asconf_addr *
1516 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1517 {
1518         struct sctp_asconf_addr *aa;
1519
1520         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1521                 if (aa->ap.aph.correlation_id == correlation_id &&
1522                     aa->sent == 1) {
1523                         /* found it */
1524                         return (aa);
1525                 }
1526         }
1527         /* didn't find it */
1528         return (NULL);
1529 }
1530
1531 /*
1532  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1533  * notifications based on the error response
1534  */
1535 static void
1536 sctp_asconf_process_error(struct sctp_tcb *stcb,
1537     struct sctp_asconf_paramhdr *aph)
1538 {
1539         struct sctp_error_cause *eh;
1540         struct sctp_paramhdr *ph;
1541         uint16_t param_type;
1542         uint16_t error_code;
1543
1544         eh = (struct sctp_error_cause *)(aph + 1);
1545         ph = (struct sctp_paramhdr *)(eh + 1);
1546         /* validate lengths */
1547         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1548             htons(aph->ph.param_length)) {
1549                 /* invalid error cause length */
1550                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1551                     "asconf_process_error: cause element too long\n");
1552                 return;
1553         }
1554         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1555             htons(eh->length)) {
1556                 /* invalid included TLV length */
1557                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1558                     "asconf_process_error: included TLV too long\n");
1559                 return;
1560         }
1561         /* which error code ? */
1562         error_code = ntohs(eh->code);
1563         param_type = ntohs(aph->ph.param_type);
1564         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1565         switch (error_code) {
1566         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1567                 /* we allow ourselves to "try again" for this error */
1568                 break;
1569         default:
1570                 /* peer can't handle it... */
1571                 switch (param_type) {
1572                 case SCTP_ADD_IP_ADDRESS:
1573                 case SCTP_DEL_IP_ADDRESS:
1574                         stcb->asoc.peer_supports_asconf = 0;
1575                         break;
1576                 case SCTP_SET_PRIM_ADDR:
1577                         stcb->asoc.peer_supports_asconf = 0;
1578                         break;
1579                 default:
1580                         break;
1581                 }
1582         }
1583 }
1584
1585 /*
1586  * process an asconf queue param.
1587  * aparam: parameter to process, will be removed from the queue.
1588  * flag: 1=success case, 0=failure case
1589  */
1590 static void
1591 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1592     struct sctp_asconf_addr *aparam, uint32_t flag)
1593 {
1594         uint16_t param_type;
1595
1596         /* process this param */
1597         param_type = aparam->ap.aph.ph.param_type;
1598         switch (param_type) {
1599         case SCTP_ADD_IP_ADDRESS:
1600                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1601                     "process_param_ack: added IP address\n");
1602                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1603                 break;
1604         case SCTP_DEL_IP_ADDRESS:
1605                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1606                     "process_param_ack: deleted IP address\n");
1607                 /* nothing really to do... lists already updated */
1608                 break;
1609         case SCTP_SET_PRIM_ADDR:
1610                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1611                     "process_param_ack: set primary IP address\n");
1612                 /* nothing to do... peer may start using this addr */
1613                 if (flag == 0)
1614                         stcb->asoc.peer_supports_asconf = 0;
1615                 break;
1616         default:
1617                 /* should NEVER happen */
1618                 break;
1619         }
1620
1621         /* remove the param and free it */
1622         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1623         if (aparam->ifa)
1624                 sctp_free_ifa(aparam->ifa);
1625         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1626 }
1627
1628 /*
1629  * cleanup from a bad asconf ack parameter
1630  */
1631 static void
1632 sctp_asconf_ack_clear(struct sctp_tcb *stcb)
1633 {
1634         /* assume peer doesn't really know how to do asconfs */
1635         stcb->asoc.peer_supports_asconf = 0;
1636         /* XXX we could free the pending queue here */
1637 }
1638
1639 void
1640 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1641     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1642     struct sctp_nets *net, int *abort_no_unlock)
1643 {
1644         struct sctp_association *asoc;
1645         uint32_t serial_num;
1646         uint16_t ack_length;
1647         struct sctp_asconf_paramhdr *aph;
1648         struct sctp_asconf_addr *aa, *aa_next;
1649         uint32_t last_error_id = 0;     /* last error correlation id */
1650         uint32_t id;
1651         struct sctp_asconf_addr *ap;
1652
1653         /* asconf param buffer */
1654         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1655
1656         /* verify minimum length */
1657         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1658                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1659                     "handle_asconf_ack: chunk too small = %xh\n",
1660                     ntohs(cp->ch.chunk_length));
1661                 return;
1662         }
1663         asoc = &stcb->asoc;
1664         serial_num = ntohl(cp->serial_number);
1665
1666         /*
1667          * NOTE: we may want to handle this differently- currently, we will
1668          * abort when we get an ack for the expected serial number + 1 (eg.
1669          * we didn't send it), process an ack normally if it is the expected
1670          * serial number, and re-send the previous ack for *ALL* other
1671          * serial numbers
1672          */
1673
1674         /*
1675          * if the serial number is the next expected, but I didn't send it,
1676          * abort the asoc, since someone probably just hijacked us...
1677          */
1678         if (serial_num == (asoc->asconf_seq_out + 1)) {
1679                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1680                 sctp_abort_an_association(stcb->sctp_ep, stcb, NULL, SCTP_SO_NOT_LOCKED);
1681                 *abort_no_unlock = 1;
1682                 return;
1683         }
1684         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1685                 /* got a duplicate/unexpected ASCONF-ACK */
1686                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1687                     serial_num, asoc->asconf_seq_out_acked + 1);
1688                 return;
1689         }
1690         if (serial_num == asoc->asconf_seq_out - 1) {
1691                 /* stop our timer */
1692                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1693                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1694         }
1695         /* process the ASCONF-ACK contents */
1696         ack_length = ntohs(cp->ch.chunk_length) -
1697             sizeof(struct sctp_asconf_ack_chunk);
1698         offset += sizeof(struct sctp_asconf_ack_chunk);
1699         /* process through all parameters */
1700         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1701                 unsigned int param_length, param_type;
1702
1703                 /* get pointer to next asconf parameter */
1704                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1705                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1706                 if (aph == NULL) {
1707                         /* can't get an asconf paramhdr */
1708                         sctp_asconf_ack_clear(stcb);
1709                         return;
1710                 }
1711                 param_type = ntohs(aph->ph.param_type);
1712                 param_length = ntohs(aph->ph.param_length);
1713                 if (param_length > ack_length) {
1714                         sctp_asconf_ack_clear(stcb);
1715                         return;
1716                 }
1717                 if (param_length < sizeof(struct sctp_paramhdr)) {
1718                         sctp_asconf_ack_clear(stcb);
1719                         return;
1720                 }
1721                 /* get the complete parameter... */
1722                 if (param_length > sizeof(aparam_buf)) {
1723                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1724                             "param length (%u) larger than buffer size!\n", param_length);
1725                         sctp_asconf_ack_clear(stcb);
1726                         return;
1727                 }
1728                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1729                 if (aph == NULL) {
1730                         sctp_asconf_ack_clear(stcb);
1731                         return;
1732                 }
1733                 /* correlation_id is transparent to peer, no ntohl needed */
1734                 id = aph->correlation_id;
1735
1736                 switch (param_type) {
1737                 case SCTP_ERROR_CAUSE_IND:
1738                         last_error_id = id;
1739                         /* find the corresponding asconf param in our queue */
1740                         ap = sctp_asconf_find_param(stcb, id);
1741                         if (ap == NULL) {
1742                                 /* hmm... can't find this in our queue! */
1743                                 break;
1744                         }
1745                         /* process the parameter, failed flag */
1746                         sctp_asconf_process_param_ack(stcb, ap, 0);
1747                         /* process the error response */
1748                         sctp_asconf_process_error(stcb, aph);
1749                         break;
1750                 case SCTP_SUCCESS_REPORT:
1751                         /* find the corresponding asconf param in our queue */
1752                         ap = sctp_asconf_find_param(stcb, id);
1753                         if (ap == NULL) {
1754                                 /* hmm... can't find this in our queue! */
1755                                 break;
1756                         }
1757                         /* process the parameter, success flag */
1758                         sctp_asconf_process_param_ack(stcb, ap, 1);
1759                         break;
1760                 default:
1761                         break;
1762                 }               /* switch */
1763
1764                 /* update remaining ASCONF-ACK message length to process */
1765                 ack_length -= SCTP_SIZE32(param_length);
1766                 if (ack_length <= 0) {
1767                         /* no more data in the mbuf chain */
1768                         break;
1769                 }
1770                 offset += SCTP_SIZE32(param_length);
1771         }                       /* while */
1772
1773         /*
1774          * if there are any "sent" params still on the queue, these are
1775          * implicitly "success", or "failed" (if we got an error back) ...
1776          * so process these appropriately
1777          *
1778          * we assume that the correlation_id's are monotonically increasing
1779          * beginning from 1 and that we don't have *that* many outstanding
1780          * at any given time
1781          */
1782         if (last_error_id == 0)
1783                 last_error_id--;/* set to "max" value */
1784         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1785                 if (aa->sent == 1) {
1786                         /*
1787                          * implicitly successful or failed if correlation_id
1788                          * < last_error_id, then success else, failure
1789                          */
1790                         if (aa->ap.aph.correlation_id < last_error_id)
1791                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1792                         else
1793                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1794                 } else {
1795                         /*
1796                          * since we always process in order (FIFO queue) if
1797                          * we reach one that hasn't been sent, the rest
1798                          * should not have been sent either. so, we're
1799                          * done...
1800                          */
1801                         break;
1802                 }
1803         }
1804
1805         /* update the next sequence number to use */
1806         asoc->asconf_seq_out_acked++;
1807         /* remove the old ASCONF on our outbound queue */
1808         sctp_toss_old_asconf(stcb);
1809         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1810 #ifdef SCTP_TIMER_BASED_ASCONF
1811                 /* we have more params, so restart our timer */
1812                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1813                     stcb, net);
1814 #else
1815                 /* we have more params, so send out more */
1816                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1817 #endif
1818         }
1819 }
1820
1821 #ifdef INET6
1822 static uint32_t
1823 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1824 {
1825         struct sockaddr_in6 *sin6, *net6;
1826         struct sctp_nets *net;
1827
1828         if (sa->sa_family != AF_INET6) {
1829                 /* wrong family */
1830                 return (0);
1831         }
1832         sin6 = (struct sockaddr_in6 *)sa;
1833         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1834                 /* not link local address */
1835                 return (0);
1836         }
1837         /* hunt through our destination nets list for this scope_id */
1838         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1839                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1840                     AF_INET6)
1841                         continue;
1842                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1843                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1844                         continue;
1845                 if (sctp_is_same_scope(sin6, net6)) {
1846                         /* found one */
1847                         return (1);
1848                 }
1849         }
1850         /* didn't find one */
1851         return (0);
1852 }
1853
1854 #endif
1855
1856 /*
1857  * address management functions
1858  */
1859 static void
1860 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1861     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1862 {
1863         int status;
1864
1865         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1866             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1867                 /* subset bound, no ASCONF allowed case, so ignore */
1868                 return;
1869         }
1870         /*
1871          * note: we know this is not the subset bound, no ASCONF case eg.
1872          * this is boundall or subset bound w/ASCONF allowed
1873          */
1874
1875         /* first, make sure it's a good address family */
1876         switch (ifa->address.sa.sa_family) {
1877 #ifdef INET6
1878         case AF_INET6:
1879                 break;
1880 #endif
1881 #ifdef INET
1882         case AF_INET:
1883                 break;
1884 #endif
1885         default:
1886                 return;
1887         }
1888 #ifdef INET6
1889         /* make sure we're "allowed" to add this type of addr */
1890         if (ifa->address.sa.sa_family == AF_INET6) {
1891                 /* invalid if we're not a v6 endpoint */
1892                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1893                         return;
1894                 /* is the v6 addr really valid ? */
1895                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1896                         return;
1897                 }
1898         }
1899 #endif
1900         /* put this address on the "pending/do not use yet" list */
1901         sctp_add_local_addr_restricted(stcb, ifa);
1902         /*
1903          * check address scope if address is out of scope, don't queue
1904          * anything... note: this would leave the address on both inp and
1905          * asoc lists
1906          */
1907         switch (ifa->address.sa.sa_family) {
1908 #ifdef INET6
1909         case AF_INET6:
1910                 {
1911                         struct sockaddr_in6 *sin6;
1912
1913                         sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
1914                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1915                                 /* we skip unspecifed addresses */
1916                                 return;
1917                         }
1918                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1919                                 if (stcb->asoc.local_scope == 0) {
1920                                         return;
1921                                 }
1922                                 /* is it the right link local scope? */
1923                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1924                                         return;
1925                                 }
1926                         }
1927                         if (stcb->asoc.site_scope == 0 &&
1928                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1929                                 return;
1930                         }
1931                         break;
1932                 }
1933 #endif
1934 #ifdef INET
1935         case AF_INET:
1936                 {
1937                         struct sockaddr_in *sin;
1938                         struct in6pcb *inp6;
1939
1940                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1941                         /* invalid if we are a v6 only endpoint */
1942                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1943                             SCTP_IPV6_V6ONLY(inp6))
1944                                 return;
1945
1946                         sin = (struct sockaddr_in *)&ifa->address.sa;
1947                         if (sin->sin_addr.s_addr == 0) {
1948                                 /* we skip unspecifed addresses */
1949                                 return;
1950                         }
1951                         if (stcb->asoc.ipv4_local_scope == 0 &&
1952                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1953                                 return;
1954                         }
1955                         break;
1956                 }
1957 #endif
1958         default:
1959                 /* else, not AF_INET or AF_INET6, so skip */
1960                 return;
1961         }
1962
1963         /* queue an asconf for this address add/delete */
1964         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1965                 /* does the peer do asconf? */
1966                 if (stcb->asoc.peer_supports_asconf) {
1967                         /* queue an asconf for this addr */
1968                         status = sctp_asconf_queue_add(stcb, ifa, type);
1969
1970                         /*
1971                          * if queued ok, and in the open state, send out the
1972                          * ASCONF.  If in the non-open state, these will be
1973                          * sent when the state goes open.
1974                          */
1975                         if (status == 0 &&
1976                             SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
1977 #ifdef SCTP_TIMER_BASED_ASCONF
1978                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1979                                     stcb, stcb->asoc.primary_destination);
1980 #else
1981                                 sctp_send_asconf(stcb, NULL, addr_locked);
1982 #endif
1983                         }
1984                 }
1985         }
1986 }
1987
1988
1989 int
1990 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
1991 {
1992         struct sctp_asconf_iterator *asc;
1993         struct sctp_ifa *ifa;
1994         struct sctp_laddr *l;
1995         int cnt_invalid = 0;
1996
1997         asc = (struct sctp_asconf_iterator *)ptr;
1998         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
1999                 ifa = l->ifa;
2000                 switch (ifa->address.sa.sa_family) {
2001 #ifdef INET6
2002                 case AF_INET6:
2003                         /* invalid if we're not a v6 endpoint */
2004                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2005                                 cnt_invalid++;
2006                                 if (asc->cnt == cnt_invalid)
2007                                         return (1);
2008                         }
2009                         break;
2010 #endif
2011 #ifdef INET
2012                 case AF_INET:
2013                         {
2014                                 /* invalid if we are a v6 only endpoint */
2015                                 struct in6pcb *inp6;
2016
2017                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2018                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2019                                     SCTP_IPV6_V6ONLY(inp6)) {
2020                                         cnt_invalid++;
2021                                         if (asc->cnt == cnt_invalid)
2022                                                 return (1);
2023                                 }
2024                                 break;
2025                         }
2026 #endif
2027                 default:
2028                         /* invalid address family */
2029                         cnt_invalid++;
2030                         if (asc->cnt == cnt_invalid)
2031                                 return (1);
2032                 }
2033         }
2034         return (0);
2035 }
2036
2037 static int
2038 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2039 {
2040         struct sctp_ifa *ifa;
2041         struct sctp_asconf_iterator *asc;
2042         struct sctp_laddr *laddr, *nladdr, *l;
2043
2044         /* Only for specific case not bound all */
2045         asc = (struct sctp_asconf_iterator *)ptr;
2046         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2047                 ifa = l->ifa;
2048                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2049                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2050                             sctp_nxt_addr) {
2051                                 if (laddr->ifa == ifa) {
2052                                         laddr->action = 0;
2053                                         break;
2054                                 }
2055                         }
2056                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2057                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2058                                 /* remove only after all guys are done */
2059                                 if (laddr->ifa == ifa) {
2060                                         sctp_del_local_addr_ep(inp, ifa);
2061                                 }
2062                         }
2063                 }
2064         }
2065         return (0);
2066 }
2067
2068 void
2069 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2070     void *ptr, uint32_t val SCTP_UNUSED)
2071 {
2072         struct sctp_asconf_iterator *asc;
2073         struct sctp_ifa *ifa;
2074         struct sctp_laddr *l;
2075         int cnt_invalid = 0;
2076         int type, status;
2077         int num_queued = 0;
2078
2079         asc = (struct sctp_asconf_iterator *)ptr;
2080         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2081                 ifa = l->ifa;
2082                 type = l->action;
2083
2084                 /* address's vrf_id must be the vrf_id of the assoc */
2085                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2086                         continue;
2087                 }
2088                 /* Same checks again for assoc */
2089                 switch (ifa->address.sa.sa_family) {
2090 #ifdef INET6
2091                 case AF_INET6:
2092                         {
2093                                 /* invalid if we're not a v6 endpoint */
2094                                 struct sockaddr_in6 *sin6;
2095
2096                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2097                                         cnt_invalid++;
2098                                         if (asc->cnt == cnt_invalid)
2099                                                 return;
2100                                         else
2101                                                 continue;
2102                                 }
2103                                 sin6 = (struct sockaddr_in6 *)&ifa->address.sin6;
2104                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2105                                         /* we skip unspecifed addresses */
2106                                         continue;
2107                                 }
2108                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2109                                         if (stcb->asoc.local_scope == 0) {
2110                                                 continue;
2111                                         }
2112                                         /* is it the right link local scope? */
2113                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2114                                                 continue;
2115                                         }
2116                                 }
2117                                 break;
2118                         }
2119 #endif
2120 #ifdef INET
2121                 case AF_INET:
2122                         {
2123                                 /* invalid if we are a v6 only endpoint */
2124                                 struct in6pcb *inp6;
2125                                 struct sockaddr_in *sin;
2126
2127                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2128                                 /* invalid if we are a v6 only endpoint */
2129                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2130                                     SCTP_IPV6_V6ONLY(inp6))
2131                                         continue;
2132
2133                                 sin = (struct sockaddr_in *)&ifa->address.sa;
2134                                 if (sin->sin_addr.s_addr == 0) {
2135                                         /* we skip unspecifed addresses */
2136                                         continue;
2137                                 }
2138                                 if (stcb->asoc.ipv4_local_scope == 0 &&
2139                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2140                                         continue;
2141                                 }
2142                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2143                                     SCTP_IPV6_V6ONLY(inp6)) {
2144                                         cnt_invalid++;
2145                                         if (asc->cnt == cnt_invalid)
2146                                                 return;
2147                                         else
2148                                                 continue;
2149                                 }
2150                                 break;
2151                         }
2152 #endif
2153                 default:
2154                         /* invalid address family */
2155                         cnt_invalid++;
2156                         if (asc->cnt == cnt_invalid)
2157                                 return;
2158                         else
2159                                 continue;
2160                         break;
2161                 }
2162
2163                 if (type == SCTP_ADD_IP_ADDRESS) {
2164                         /* prevent this address from being used as a source */
2165                         sctp_add_local_addr_restricted(stcb, ifa);
2166                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2167                         struct sctp_nets *net;
2168
2169                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2170                                 sctp_rtentry_t *rt;
2171
2172                                 /* delete this address if cached */
2173                                 if (net->ro._s_addr == ifa) {
2174                                         sctp_free_ifa(net->ro._s_addr);
2175                                         net->ro._s_addr = NULL;
2176                                         net->src_addr_selected = 0;
2177                                         rt = net->ro.ro_rt;
2178                                         if (rt) {
2179                                                 RTFREE(rt);
2180                                                 net->ro.ro_rt = NULL;
2181                                         }
2182                                         /*
2183                                          * Now we deleted our src address,
2184                                          * should we not also now reset the
2185                                          * cwnd/rto to start as if its a new
2186                                          * address?
2187                                          */
2188                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2189                                         net->RTO = 0;
2190
2191                                 }
2192                         }
2193                 } else if (type == SCTP_SET_PRIM_ADDR) {
2194                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2195                                 /* must validate the ifa is in the ep */
2196                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2197                                         continue;
2198                                 }
2199                         } else {
2200                                 /* Need to check scopes for this guy */
2201                                 if (sctp_is_address_in_scope(ifa,
2202                                     stcb->asoc.ipv4_addr_legal,
2203                                     stcb->asoc.ipv6_addr_legal,
2204                                     stcb->asoc.loopback_scope,
2205                                     stcb->asoc.ipv4_local_scope,
2206                                     stcb->asoc.local_scope,
2207                                     stcb->asoc.site_scope, 0) == 0) {
2208                                         continue;
2209                                 }
2210                         }
2211                 }
2212                 /* queue an asconf for this address add/delete */
2213                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2214                     stcb->asoc.peer_supports_asconf) {
2215                         /* queue an asconf for this addr */
2216                         status = sctp_asconf_queue_add(stcb, ifa, type);
2217                         /*
2218                          * if queued ok, and in the open state, update the
2219                          * count of queued params.  If in the non-open
2220                          * state, these get sent when the assoc goes open.
2221                          */
2222                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2223                                 if (status >= 0) {
2224                                         num_queued++;
2225                                 }
2226                         }
2227                 }
2228         }
2229         /*
2230          * If we have queued params in the open state, send out an ASCONF.
2231          */
2232         if (num_queued > 0) {
2233                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2234         }
2235 }
2236
2237 void
2238 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2239 {
2240         struct sctp_asconf_iterator *asc;
2241         struct sctp_ifa *ifa;
2242         struct sctp_laddr *l, *nl;
2243
2244         asc = (struct sctp_asconf_iterator *)ptr;
2245         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2246                 ifa = l->ifa;
2247                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2248                         /* Clear the defer use flag */
2249                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2250                 }
2251                 sctp_free_ifa(ifa);
2252                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2253                 SCTP_DECR_LADDR_COUNT();
2254         }
2255         SCTP_FREE(asc, SCTP_M_ASC_IT);
2256 }
2257
2258 /*
2259  * sa is the sockaddr to ask the peer to set primary to.
2260  * returns: 0 = completed, -1 = error
2261  */
2262 int32_t
2263 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2264 {
2265         uint32_t vrf_id;
2266         struct sctp_ifa *ifa;
2267
2268         /* find the ifa for the desired set primary */
2269         vrf_id = stcb->asoc.vrf_id;
2270         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2271         if (ifa == NULL) {
2272                 /* Invalid address */
2273                 return (-1);
2274         }
2275         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2276         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2277                 /* set primary queuing succeeded */
2278                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2279                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2280                     (void *)stcb);
2281                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2282                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2283 #ifdef SCTP_TIMER_BASED_ASCONF
2284                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2285                             stcb->sctp_ep, stcb,
2286                             stcb->asoc.primary_destination);
2287 #else
2288                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2289 #endif
2290                 }
2291         } else {
2292                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2293                     (void *)stcb);
2294                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2295                 return (-1);
2296         }
2297         return (0);
2298 }
2299
2300 void
2301 sctp_set_primary_ip_address(struct sctp_ifa *ifa)
2302 {
2303         struct sctp_inpcb *inp;
2304
2305         /* go through all our PCB's */
2306         LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
2307                 struct sctp_tcb *stcb;
2308
2309                 /* process for all associations for this endpoint */
2310                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
2311                         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2312                         if (!sctp_asconf_queue_add(stcb, ifa,
2313                             SCTP_SET_PRIM_ADDR)) {
2314                                 /* set primary queuing succeeded */
2315                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address: queued on stcb=%p, ",
2316                                     (void *)stcb);
2317                                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &ifa->address.sa);
2318                                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) {
2319 #ifdef SCTP_TIMER_BASED_ASCONF
2320                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2321                                             stcb->sctp_ep, stcb,
2322                                             stcb->asoc.primary_destination);
2323 #else
2324                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2325 #endif
2326                                 }
2327                         }
2328                 }               /* for each stcb */
2329         }                       /* for each inp */
2330 }
2331
2332 int
2333 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2334 {
2335         struct sctp_tmit_chunk *chk, *nchk;
2336         unsigned int offset, asconf_limit;
2337         struct sctp_asconf_chunk *acp;
2338         struct sctp_asconf_paramhdr *aph;
2339         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2340         struct sctp_paramhdr *ph;
2341         int add_cnt, del_cnt;
2342         uint16_t last_param_type;
2343
2344         add_cnt = del_cnt = 0;
2345         last_param_type = 0;
2346         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2347                 if (chk->data == NULL) {
2348                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2349                         continue;
2350                 }
2351                 offset = 0;
2352                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2353                 offset += sizeof(struct sctp_asconf_chunk);
2354                 asconf_limit = ntohs(acp->ch.chunk_length);
2355                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2356                 if (ph == NULL) {
2357                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2358                         continue;
2359                 }
2360                 offset += ntohs(ph->param_length);
2361
2362                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2363                 if (aph == NULL) {
2364                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2365                         continue;
2366                 }
2367                 while (aph != NULL) {
2368                         unsigned int param_length, param_type;
2369
2370                         param_type = ntohs(aph->ph.param_type);
2371                         param_length = ntohs(aph->ph.param_length);
2372                         if (offset + param_length > asconf_limit) {
2373                                 /* parameter goes beyond end of chunk! */
2374                                 break;
2375                         }
2376                         if (param_length > sizeof(aparam_buf)) {
2377                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2378                                 break;
2379                         }
2380                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2381                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2382                                 break;
2383                         }
2384                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2385                         if (aph == NULL) {
2386                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2387                                 break;
2388                         }
2389                         ph = (struct sctp_paramhdr *)(aph + 1);
2390                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2391                                 switch (param_type) {
2392                                 case SCTP_ADD_IP_ADDRESS:
2393                                         add_cnt++;
2394                                         break;
2395                                 case SCTP_DEL_IP_ADDRESS:
2396                                         del_cnt++;
2397                                         break;
2398                                 default:
2399                                         break;
2400                                 }
2401                                 last_param_type = param_type;
2402                         }
2403                         offset += SCTP_SIZE32(param_length);
2404                         if (offset >= asconf_limit) {
2405                                 /* no more data in the mbuf chain */
2406                                 break;
2407                         }
2408                         /* get pointer to next asconf param */
2409                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2410                 }
2411         }
2412
2413         /*
2414          * we want to find the sequences which consist of ADD -> DEL -> ADD
2415          * or DEL -> ADD
2416          */
2417         if (add_cnt > del_cnt ||
2418             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2419                 return (1);
2420         }
2421         return (0);
2422 }
2423
2424 static struct sockaddr *
2425 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2426 {
2427         struct sctp_vrf *vrf = NULL;
2428         struct sctp_ifn *sctp_ifn;
2429         struct sctp_ifa *sctp_ifa;
2430
2431         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2432                 SCTP_IPI_ADDR_RLOCK();
2433         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2434         if (vrf == NULL) {
2435                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2436                         SCTP_IPI_ADDR_RUNLOCK();
2437                 return (NULL);
2438         }
2439         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2440                 if (stcb->asoc.loopback_scope == 0 &&
2441                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2442                         /* Skip if loopback_scope not set */
2443                         continue;
2444                 }
2445                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2446                         switch (sctp_ifa->address.sa.sa_family) {
2447 #ifdef INET
2448                         case AF_INET:
2449                                 if (stcb->asoc.ipv4_addr_legal) {
2450                                         struct sockaddr_in *sin;
2451
2452                                         sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
2453                                         if (sin->sin_addr.s_addr == 0) {
2454                                                 /* skip unspecifed addresses */
2455                                                 continue;
2456                                         }
2457                                         if (stcb->asoc.ipv4_local_scope == 0 &&
2458                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2459                                                 continue;
2460
2461                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2462                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2463                                                 continue;
2464                                         /*
2465                                          * found a valid local v4 address to
2466                                          * use
2467                                          */
2468                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2469                                                 SCTP_IPI_ADDR_RUNLOCK();
2470                                         return (&sctp_ifa->address.sa);
2471                                 }
2472                                 break;
2473 #endif
2474 #ifdef INET6
2475                         case AF_INET6:
2476                                 if (stcb->asoc.ipv6_addr_legal) {
2477                                         struct sockaddr_in6 *sin6;
2478
2479                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2480                                                 continue;
2481                                         }
2482                                         sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
2483                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2484                                                 /*
2485                                                  * we skip unspecifed
2486                                                  * addresses
2487                                                  */
2488                                                 continue;
2489                                         }
2490                                         if (stcb->asoc.local_scope == 0 &&
2491                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2492                                                 continue;
2493                                         if (stcb->asoc.site_scope == 0 &&
2494                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2495                                                 continue;
2496
2497                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2498                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2499                                                 continue;
2500                                         /*
2501                                          * found a valid local v6 address to
2502                                          * use
2503                                          */
2504                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2505                                                 SCTP_IPI_ADDR_RUNLOCK();
2506                                         return (&sctp_ifa->address.sa);
2507                                 }
2508                                 break;
2509 #endif
2510                         default:
2511                                 break;
2512                         }
2513                 }
2514         }
2515         /* no valid addresses found */
2516         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2517                 SCTP_IPI_ADDR_RUNLOCK();
2518         return (NULL);
2519 }
2520
2521 static struct sockaddr *
2522 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2523 {
2524         struct sctp_laddr *laddr;
2525
2526         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2527                 if (laddr->ifa == NULL) {
2528                         continue;
2529                 }
2530                 /* is the address restricted ? */
2531                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2532                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2533                         continue;
2534
2535                 /* found a valid local address to use */
2536                 return (&laddr->ifa->address.sa);
2537         }
2538         /* no valid addresses found */
2539         return (NULL);
2540 }
2541
2542 /*
2543  * builds an ASCONF chunk from queued ASCONF params.
2544  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2545  */
2546 struct mbuf *
2547 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2548 {
2549         struct mbuf *m_asconf, *m_asconf_chk;
2550         struct sctp_asconf_addr *aa;
2551         struct sctp_asconf_chunk *acp;
2552         struct sctp_asconf_paramhdr *aph;
2553         struct sctp_asconf_addr_param *aap;
2554         uint32_t p_length;
2555         uint32_t correlation_id = 1;    /* 0 is reserved... */
2556         caddr_t ptr, lookup_ptr;
2557         uint8_t lookup_used = 0;
2558
2559         /* are there any asconf params to send? */
2560         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2561                 if (aa->sent == 0)
2562                         break;
2563         }
2564         if (aa == NULL)
2565                 return (NULL);
2566
2567         /*
2568          * get a chunk header mbuf and a cluster for the asconf params since
2569          * it's simpler to fill in the asconf chunk header lookup address on
2570          * the fly
2571          */
2572         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_DONTWAIT, 1, MT_DATA);
2573         if (m_asconf_chk == NULL) {
2574                 /* no mbuf's */
2575                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2576                     "compose_asconf: couldn't get chunk mbuf!\n");
2577                 return (NULL);
2578         }
2579         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
2580         if (m_asconf == NULL) {
2581                 /* no mbuf's */
2582                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2583                     "compose_asconf: couldn't get mbuf!\n");
2584                 sctp_m_freem(m_asconf_chk);
2585                 return (NULL);
2586         }
2587         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2588         SCTP_BUF_LEN(m_asconf) = 0;
2589         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2590         bzero(acp, sizeof(struct sctp_asconf_chunk));
2591         /* save pointers to lookup address and asconf params */
2592         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2593         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2594
2595         /* fill in chunk header info */
2596         acp->ch.chunk_type = SCTP_ASCONF;
2597         acp->ch.chunk_flags = 0;
2598         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2599         stcb->asoc.asconf_seq_out++;
2600
2601         /* add parameters... up to smallest MTU allowed */
2602         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2603                 if (aa->sent)
2604                         continue;
2605                 /* get the parameter length */
2606                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2607                 /* will it fit in current chunk? */
2608                 if (SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) {
2609                         /* won't fit, so we're done with this chunk */
2610                         break;
2611                 }
2612                 /* assign (and store) a correlation id */
2613                 aa->ap.aph.correlation_id = correlation_id++;
2614
2615                 /*
2616                  * fill in address if we're doing a delete this is a simple
2617                  * way for us to fill in the correlation address, which
2618                  * should only be used by the peer if we're deleting our
2619                  * source address and adding a new address (e.g. renumbering
2620                  * case)
2621                  */
2622                 if (lookup_used == 0 &&
2623                     (aa->special_del == 0) &&
2624                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2625                         struct sctp_ipv6addr_param *lookup;
2626                         uint16_t p_size, addr_size;
2627
2628                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2629                         lookup->ph.param_type =
2630                             htons(aa->ap.addrp.ph.param_type);
2631                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2632                                 /* copy IPv6 address */
2633                                 p_size = sizeof(struct sctp_ipv6addr_param);
2634                                 addr_size = sizeof(struct in6_addr);
2635                         } else {
2636                                 /* copy IPv4 address */
2637                                 p_size = sizeof(struct sctp_ipv4addr_param);
2638                                 addr_size = sizeof(struct in_addr);
2639                         }
2640                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2641                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2642                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2643                         lookup_used = 1;
2644                 }
2645                 /* copy into current space */
2646                 memcpy(ptr, &aa->ap, p_length);
2647
2648                 /* network elements and update lengths */
2649                 aph = (struct sctp_asconf_paramhdr *)ptr;
2650                 aap = (struct sctp_asconf_addr_param *)ptr;
2651                 /* correlation_id is transparent to peer, no htonl needed */
2652                 aph->ph.param_type = htons(aph->ph.param_type);
2653                 aph->ph.param_length = htons(aph->ph.param_length);
2654                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2655                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2656
2657                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2658                 ptr += SCTP_SIZE32(p_length);
2659
2660                 /*
2661                  * these params are removed off the pending list upon
2662                  * getting an ASCONF-ACK back from the peer, just set flag
2663                  */
2664                 aa->sent = 1;
2665         }
2666         /* check to see if the lookup addr has been populated yet */
2667         if (lookup_used == 0) {
2668                 /* NOTE: if the address param is optional, can skip this... */
2669                 /* add any valid (existing) address... */
2670                 struct sctp_ipv6addr_param *lookup;
2671                 uint16_t p_size, addr_size;
2672                 struct sockaddr *found_addr;
2673                 caddr_t addr_ptr;
2674
2675                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2676                         found_addr = sctp_find_valid_localaddr(stcb,
2677                             addr_locked);
2678                 else
2679                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2680
2681                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2682                 if (found_addr != NULL) {
2683                         switch (found_addr->sa_family) {
2684 #ifdef INET6
2685                         case AF_INET6:
2686                                 /* copy IPv6 address */
2687                                 lookup->ph.param_type =
2688                                     htons(SCTP_IPV6_ADDRESS);
2689                                 p_size = sizeof(struct sctp_ipv6addr_param);
2690                                 addr_size = sizeof(struct in6_addr);
2691                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2692                                     found_addr)->sin6_addr;
2693                                 break;
2694 #endif
2695 #ifdef INET
2696                         case AF_INET:
2697                                 /* copy IPv4 address */
2698                                 lookup->ph.param_type =
2699                                     htons(SCTP_IPV4_ADDRESS);
2700                                 p_size = sizeof(struct sctp_ipv4addr_param);
2701                                 addr_size = sizeof(struct in_addr);
2702                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2703                                     found_addr)->sin_addr;
2704                                 break;
2705 #endif
2706                         default:
2707                                 p_size = 0;
2708                                 addr_size = 0;
2709                                 addr_ptr = NULL;
2710                                 break;
2711                         }
2712                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2713                         memcpy(lookup->addr, addr_ptr, addr_size);
2714                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2715                 } else {
2716                         /* uh oh... don't have any address?? */
2717                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2718                             "compose_asconf: no lookup addr!\n");
2719                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2720                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2721                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2722                         bzero(lookup->addr, sizeof(struct in_addr));
2723                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2724                 }
2725         }
2726         /* chain it all together */
2727         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2728         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2729         acp->ch.chunk_length = ntohs(*retlen);
2730
2731         return (m_asconf_chk);
2732 }
2733
2734 /*
2735  * section to handle address changes before an association is up eg. changes
2736  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2737  */
2738
2739 /*
2740  * processes the (local) addresses in the INIT-ACK chunk
2741  */
2742 static void
2743 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2744     unsigned int offset, unsigned int length)
2745 {
2746         struct sctp_paramhdr tmp_param, *ph;
2747         uint16_t plen, ptype;
2748         struct sctp_ifa *sctp_ifa;
2749
2750 #ifdef INET6
2751         struct sctp_ipv6addr_param addr6_store;
2752         struct sockaddr_in6 sin6;
2753
2754 #endif
2755 #ifdef INET
2756         struct sctp_ipv4addr_param addr4_store;
2757         struct sockaddr_in sin;
2758
2759 #endif
2760         struct sockaddr *sa;
2761         uint32_t vrf_id;
2762
2763         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2764         if (stcb == NULL)       /* Un-needed check for SA */
2765                 return;
2766
2767         /* convert to upper bound */
2768         length += offset;
2769
2770         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2771                 return;
2772         }
2773         /* init the addresses */
2774 #ifdef INET6
2775         bzero(&sin6, sizeof(sin6));
2776         sin6.sin6_family = AF_INET6;
2777         sin6.sin6_len = sizeof(sin6);
2778         sin6.sin6_port = stcb->rport;
2779 #endif
2780
2781 #ifdef INET
2782         bzero(&sin, sizeof(sin));
2783         sin.sin_family = AF_INET;
2784         sin.sin_len = sizeof(sin);
2785         sin.sin_port = stcb->rport;
2786 #endif
2787
2788         /* go through the addresses in the init-ack */
2789         ph = (struct sctp_paramhdr *)
2790             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2791             (uint8_t *) & tmp_param);
2792         while (ph != NULL) {
2793                 ptype = ntohs(ph->param_type);
2794                 plen = ntohs(ph->param_length);
2795                 switch (ptype) {
2796 #ifdef INET6
2797                 case SCTP_IPV6_ADDRESS:
2798                         {
2799                                 struct sctp_ipv6addr_param *a6p;
2800
2801                                 /* get the entire IPv6 address param */
2802                                 a6p = (struct sctp_ipv6addr_param *)
2803                                     sctp_m_getptr(m, offset,
2804                                     sizeof(struct sctp_ipv6addr_param),
2805                                     (uint8_t *) & addr6_store);
2806                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2807                                     a6p == NULL) {
2808                                         return;
2809                                 }
2810                                 memcpy(&sin6.sin6_addr, a6p->addr,
2811                                     sizeof(struct in6_addr));
2812                                 sa = (struct sockaddr *)&sin6;
2813                                 break;
2814                         }
2815 #endif
2816 #ifdef INET
2817                 case SCTP_IPV4_ADDRESS:
2818                         {
2819                                 struct sctp_ipv4addr_param *a4p;
2820
2821                                 /* get the entire IPv4 address param */
2822                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2823                                     sizeof(struct sctp_ipv4addr_param),
2824                                     (uint8_t *) & addr4_store);
2825                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2826                                     a4p == NULL) {
2827                                         return;
2828                                 }
2829                                 sin.sin_addr.s_addr = a4p->addr;
2830                                 sa = (struct sockaddr *)&sin;
2831                                 break;
2832                         }
2833 #endif
2834                 default:
2835                         goto next_addr;
2836                 }
2837
2838                 /* see if this address really (still) exists */
2839                 if (stcb) {
2840                         vrf_id = stcb->asoc.vrf_id;
2841                 } else {
2842                         vrf_id = SCTP_DEFAULT_VRFID;
2843                 }
2844                 sctp_ifa = sctp_find_ifa_by_addr(sa, vrf_id,
2845                     SCTP_ADDR_NOT_LOCKED);
2846                 if (sctp_ifa == NULL) {
2847                         /* address doesn't exist anymore */
2848                         int status;
2849
2850                         /* are ASCONFs allowed ? */
2851                         if ((sctp_is_feature_on(stcb->sctp_ep,
2852                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2853                             stcb->asoc.peer_supports_asconf) {
2854                                 /* queue an ASCONF DEL_IP_ADDRESS */
2855                                 status = sctp_asconf_queue_sa_delete(stcb, sa);
2856                                 /*
2857                                  * if queued ok, and in correct state, send
2858                                  * out the ASCONF.
2859                                  */
2860                                 if (status == 0 &&
2861                                     SCTP_GET_STATE(&stcb->asoc) ==
2862                                     SCTP_STATE_OPEN) {
2863 #ifdef SCTP_TIMER_BASED_ASCONF
2864                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2865                                             stcb->sctp_ep, stcb,
2866                                             stcb->asoc.primary_destination);
2867 #else
2868                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2869 #endif
2870                                 }
2871                         }
2872                 }
2873 next_addr:
2874                 /*
2875                  * Sanity check:  Make sure the length isn't 0, otherwise
2876                  * we'll be stuck in this loop for a long time...
2877                  */
2878                 if (SCTP_SIZE32(plen) == 0) {
2879                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2880                             plen, ptype);
2881                         return;
2882                 }
2883                 /* get next parameter */
2884                 offset += SCTP_SIZE32(plen);
2885                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2886                         return;
2887                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2888                     sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2889         }                       /* while */
2890 }
2891
2892 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2893 /*
2894  * checks to see if a specific address is in the initack address list returns
2895  * 1 if found, 0 if not
2896  */
2897 static uint32_t
2898 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2899 {
2900         struct sctp_paramhdr tmp_param, *ph;
2901         uint16_t plen, ptype;
2902
2903 #ifdef INET
2904         struct sockaddr_in *sin;
2905         struct sctp_ipv4addr_param *a4p;
2906         struct sctp_ipv6addr_param addr4_store;
2907
2908 #endif
2909 #ifdef INET6
2910         struct sockaddr_in6 *sin6;
2911         struct sctp_ipv6addr_param *a6p;
2912         struct sctp_ipv6addr_param addr6_store;
2913         struct sockaddr_in6 sin6_tmp;
2914
2915 #endif
2916
2917         switch (sa->sa_family) {
2918 #ifdef INET
2919         case AF_INET:
2920                 break;
2921 #endif
2922 #ifdef INET6
2923         case AF_INET6:
2924                 break;
2925 #endif
2926         default:
2927                 return (0);
2928         }
2929
2930         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2931         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2932         /* convert to upper bound */
2933         length += offset;
2934
2935         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2936                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2937                     "find_initack_addr: invalid offset?\n");
2938                 return (0);
2939         }
2940         /* go through the addresses in the init-ack */
2941         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2942             sizeof(struct sctp_paramhdr), (uint8_t *) & tmp_param);
2943         while (ph != NULL) {
2944                 ptype = ntohs(ph->param_type);
2945                 plen = ntohs(ph->param_length);
2946                 switch (ptype) {
2947 #ifdef INET6
2948                 case SCTP_IPV6_ADDRESS:
2949                         if (sa->sa_family == AF_INET6) {
2950                                 /* get the entire IPv6 address param */
2951                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2952                                         break;
2953                                 }
2954                                 /* get the entire IPv6 address param */
2955                                 a6p = (struct sctp_ipv6addr_param *)
2956                                     sctp_m_getptr(m, offset,
2957                                     sizeof(struct sctp_ipv6addr_param),
2958                                     (uint8_t *) & addr6_store);
2959                                 if (a6p == NULL) {
2960                                         return (0);
2961                                 }
2962                                 sin6 = (struct sockaddr_in6 *)sa;
2963                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2964                                         /* create a copy and clear scope */
2965                                         memcpy(&sin6_tmp, sin6,
2966                                             sizeof(struct sockaddr_in6));
2967                                         sin6 = &sin6_tmp;
2968                                         in6_clearscope(&sin6->sin6_addr);
2969                                 }
2970                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2971                                     sizeof(struct in6_addr)) == 0) {
2972                                         /* found it */
2973                                         return (1);
2974                                 }
2975                         }
2976                         break;
2977 #endif                          /* INET6 */
2978 #ifdef INET
2979                 case SCTP_IPV4_ADDRESS:
2980                         if (sa->sa_family == AF_INET) {
2981                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2982                                         break;
2983                                 }
2984                                 /* get the entire IPv4 address param */
2985                                 a4p = (struct sctp_ipv4addr_param *)
2986                                     sctp_m_getptr(m, offset,
2987                                     sizeof(struct sctp_ipv4addr_param),
2988                                     (uint8_t *) & addr4_store);
2989                                 if (a4p == NULL) {
2990                                         return (0);
2991                                 }
2992                                 sin = (struct sockaddr_in *)sa;
2993                                 if (sin->sin_addr.s_addr == a4p->addr) {
2994                                         /* found it */
2995                                         return (1);
2996                                 }
2997                         }
2998                         break;
2999 #endif
3000                 default:
3001                         break;
3002                 }
3003                 /* get next parameter */
3004                 offset += SCTP_SIZE32(plen);
3005                 if (offset + sizeof(struct sctp_paramhdr) > length) {
3006                         return (0);
3007                 }
3008                 ph = (struct sctp_paramhdr *)
3009                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3010                     (uint8_t *) & tmp_param);
3011         }                       /* while */
3012         /* not found! */
3013         return (0);
3014 }
3015
3016 /*
3017  * makes sure that the current endpoint local addr list is consistent with
3018  * the new association (eg. subset bound, asconf allowed) adds addresses as
3019  * necessary
3020  */
3021 static void
3022 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3023     int length, struct sockaddr *init_addr)
3024 {
3025         struct sctp_laddr *laddr;
3026
3027         /* go through the endpoint list */
3028         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3029                 /* be paranoid and validate the laddr */
3030                 if (laddr->ifa == NULL) {
3031                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3032                             "check_addr_list_ep: laddr->ifa is NULL");
3033                         continue;
3034                 }
3035                 if (laddr->ifa == NULL) {
3036                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3037                         continue;
3038                 }
3039                 /* do i have it implicitly? */
3040                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3041                         continue;
3042                 }
3043                 /* check to see if in the init-ack */
3044                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3045                         /* try to add it */
3046                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3047                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3048                 }
3049         }
3050 }
3051
3052 /*
3053  * makes sure that the current kernel address list is consistent with the new
3054  * association (with all addrs bound) adds addresses as necessary
3055  */
3056 static void
3057 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3058     int length, struct sockaddr *init_addr,
3059     uint16_t local_scope, uint16_t site_scope,
3060     uint16_t ipv4_scope, uint16_t loopback_scope)
3061 {
3062         struct sctp_vrf *vrf = NULL;
3063         struct sctp_ifn *sctp_ifn;
3064         struct sctp_ifa *sctp_ifa;
3065         uint32_t vrf_id;
3066
3067 #ifdef INET
3068         struct sockaddr_in *sin;
3069
3070 #endif
3071 #ifdef INET6
3072         struct sockaddr_in6 *sin6;
3073
3074 #endif
3075
3076         if (stcb) {
3077                 vrf_id = stcb->asoc.vrf_id;
3078         } else {
3079                 return;
3080         }
3081         SCTP_IPI_ADDR_RLOCK();
3082         vrf = sctp_find_vrf(vrf_id);
3083         if (vrf == NULL) {
3084                 SCTP_IPI_ADDR_RUNLOCK();
3085                 return;
3086         }
3087         /* go through all our known interfaces */
3088         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3089                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3090                         /* skip loopback interface */
3091                         continue;
3092                 }
3093                 /* go through each interface address */
3094                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3095                         /* do i have it implicitly? */
3096                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3097                                 continue;
3098                         }
3099                         switch (sctp_ifa->address.sa.sa_family) {
3100 #ifdef INET
3101                         case AF_INET:
3102                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sin;
3103                                 if ((ipv4_scope == 0) &&
3104                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3105                                         /* private address not in scope */
3106                                         continue;
3107                                 }
3108                                 break;
3109 #endif
3110 #ifdef INET6
3111                         case AF_INET6:
3112                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sin6;
3113                                 if ((local_scope == 0) &&
3114                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3115                                         continue;
3116                                 }
3117                                 if ((site_scope == 0) &&
3118                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3119                                         continue;
3120                                 }
3121                                 break;
3122 #endif
3123                         default:
3124                                 break;
3125                         }
3126                         /* check to see if in the init-ack */
3127                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3128                                 /* try to add it */
3129                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3130                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3131                                     SCTP_ADDR_LOCKED);
3132                         }
3133                 }               /* end foreach ifa */
3134         }                       /* end foreach ifn */
3135         SCTP_IPI_ADDR_RUNLOCK();
3136 }
3137
3138 /*
3139  * validates an init-ack chunk (from a cookie-echo) with current addresses
3140  * adds addresses from the init-ack into our local address list, if needed
3141  * queues asconf adds/deletes addresses as needed and makes appropriate list
3142  * changes for source address selection m, offset: points to the start of the
3143  * address list in an init-ack chunk length: total length of the address
3144  * params only init_addr: address where my INIT-ACK was sent from
3145  */
3146 void
3147 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3148     int length, struct sockaddr *init_addr,
3149     uint16_t local_scope, uint16_t site_scope,
3150     uint16_t ipv4_scope, uint16_t loopback_scope)
3151 {
3152         /* process the local addresses in the initack */
3153         sctp_process_initack_addresses(stcb, m, offset, length);
3154
3155         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3156                 /* bound all case */
3157                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3158                     local_scope, site_scope, ipv4_scope, loopback_scope);
3159         } else {
3160                 /* subset bound case */
3161                 if (sctp_is_feature_on(stcb->sctp_ep,
3162                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3163                         /* asconf's allowed */
3164                         sctp_check_address_list_ep(stcb, m, offset, length,
3165                             init_addr);
3166                 }
3167                 /* else, no asconfs allowed, so what we sent is what we get */
3168         }
3169 }
3170
3171 /*
3172  * sctp_bindx() support
3173  */
3174 uint32_t
3175 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3176     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3177 {
3178         struct sctp_ifa *ifa;
3179         struct sctp_laddr *laddr, *nladdr;
3180
3181         if (sa->sa_len == 0) {
3182                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3183                 return (EINVAL);
3184         }
3185         if (sctp_ifap) {
3186                 ifa = sctp_ifap;
3187         } else if (type == SCTP_ADD_IP_ADDRESS) {
3188                 /* For an add the address MUST be on the system */
3189                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3190         } else if (type == SCTP_DEL_IP_ADDRESS) {
3191                 /* For a delete we need to find it in the inp */
3192                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3193         } else {
3194                 ifa = NULL;
3195         }
3196         if (ifa != NULL) {
3197                 if (type == SCTP_ADD_IP_ADDRESS) {
3198                         sctp_add_local_addr_ep(inp, ifa, type);
3199                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3200                         if (inp->laddr_count < 2) {
3201                                 /* can't delete the last local address */
3202                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3203                                 return (EINVAL);
3204                         }
3205                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3206                             sctp_nxt_addr) {
3207                                 if (ifa == laddr->ifa) {
3208                                         /* Mark in the delete */
3209                                         laddr->action = type;
3210                                 }
3211                         }
3212                 }
3213                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3214                         /*
3215                          * There is no need to start the iterator if the inp
3216                          * has no associations.
3217                          */
3218                         if (type == SCTP_DEL_IP_ADDRESS) {
3219                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3220                                         if (laddr->ifa == ifa) {
3221                                                 sctp_del_local_addr_ep(inp, ifa);
3222                                         }
3223                                 }
3224                         }
3225                 } else {
3226                         struct sctp_asconf_iterator *asc;
3227                         struct sctp_laddr *wi;
3228
3229                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3230                             sizeof(struct sctp_asconf_iterator),
3231                             SCTP_M_ASC_IT);
3232                         if (asc == NULL) {
3233                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3234                                 return (ENOMEM);
3235                         }
3236                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3237                         if (wi == NULL) {
3238                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3239                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3240                                 return (ENOMEM);
3241                         }
3242                         LIST_INIT(&asc->list_of_work);
3243                         asc->cnt = 1;
3244                         SCTP_INCR_LADDR_COUNT();
3245                         wi->ifa = ifa;
3246                         wi->action = type;
3247                         atomic_add_int(&ifa->refcount, 1);
3248                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3249                         (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
3250                             sctp_asconf_iterator_stcb,
3251                             sctp_asconf_iterator_ep_end,
3252                             SCTP_PCB_ANY_FLAGS,
3253                             SCTP_PCB_ANY_FEATURES,
3254                             SCTP_ASOC_ANY_STATE,
3255                             (void *)asc, 0,
3256                             sctp_asconf_iterator_end, inp, 0);
3257                 }
3258                 return (0);
3259         } else {
3260                 /* invalid address! */
3261                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3262                 return (EADDRNOTAVAIL);
3263         }
3264 }
3265
3266 void
3267 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3268     struct sctp_nets *net)
3269 {
3270         struct sctp_asconf_addr *aa;
3271         struct sctp_ifa *sctp_ifap;
3272         struct sctp_asconf_tag_param *vtag;
3273
3274 #ifdef INET
3275         struct sockaddr_in *to;
3276
3277 #endif
3278 #ifdef INET6
3279         struct sockaddr_in6 *to6;
3280
3281 #endif
3282         if (net == NULL) {
3283                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3284                 return;
3285         }
3286         if (stcb == NULL) {
3287                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3288                 return;
3289         }
3290         /*
3291          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3292          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3293          */
3294         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3295             SCTP_M_ASC_ADDR);
3296         if (aa == NULL) {
3297                 /* didn't get memory */
3298                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3299                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3300                 return;
3301         }
3302         aa->special_del = 0;
3303         /* fill in asconf address parameter fields */
3304         /* top level elements are "networked" during send */
3305         aa->ifa = NULL;
3306         aa->sent = 0;           /* clear sent flag */
3307         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3308         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3309         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3310         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3311         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3312         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3313
3314         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3315             SCTP_M_ASC_ADDR);
3316         if (aa == NULL) {
3317                 /* didn't get memory */
3318                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3319                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3320                 return;
3321         }
3322         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3323         /* fill in asconf address parameter fields */
3324         /* ADD(0.0.0.0) */
3325         switch (net->ro._l_addr.sa.sa_family) {
3326 #ifdef INET
3327         case AF_INET:
3328                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3329                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3330                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3331                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3332                 /* No need to add an address, we are using 0.0.0.0 */
3333                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3334                 break;
3335 #endif
3336 #ifdef INET6
3337         case AF_INET6:
3338                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3339                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3340                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3341                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3342                 /* No need to add an address, we are using 0.0.0.0 */
3343                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3344                 break;
3345 #endif
3346         }
3347         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3348             SCTP_M_ASC_ADDR);
3349         if (aa == NULL) {
3350                 /* didn't get memory */
3351                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3352                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3353                 return;
3354         }
3355         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3356         /* fill in asconf address parameter fields */
3357         /* ADD(0.0.0.0) */
3358         switch (net->ro._l_addr.sa.sa_family) {
3359 #ifdef INET
3360         case AF_INET:
3361                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3362                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3363                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3364                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3365                 /* No need to add an address, we are using 0.0.0.0 */
3366                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3367                 break;
3368 #endif
3369 #ifdef INET6
3370         case AF_INET6:
3371                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3372                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3373                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3374                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3375                 /* No need to add an address, we are using 0.0.0.0 */
3376                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3377                 break;
3378 #endif
3379         }
3380         /* Now we must hunt the addresses and add all global addresses */
3381         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3382                 struct sctp_vrf *vrf = NULL;
3383                 struct sctp_ifn *sctp_ifnp;
3384                 uint32_t vrf_id;
3385
3386                 vrf_id = stcb->sctp_ep->def_vrf_id;
3387                 vrf = sctp_find_vrf(vrf_id);
3388                 if (vrf == NULL) {
3389                         goto skip_rest;
3390                 }
3391                 SCTP_IPI_ADDR_RLOCK();
3392                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3393                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3394                                 switch (sctp_ifap->address.sa.sa_family) {
3395 #ifdef INET
3396                                 case AF_INET:
3397                                         to = &sctp_ifap->address.sin;
3398                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3399                                                 continue;
3400                                         }
3401                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3402                                                 continue;
3403                                         }
3404                                         break;
3405 #endif
3406 #ifdef INET6
3407                                 case AF_INET6:
3408                                         to6 = &sctp_ifap->address.sin6;
3409                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3410                                                 continue;
3411                                         }
3412                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3413                                                 continue;
3414                                         }
3415                                         break;
3416 #endif
3417                                 default:
3418                                         continue;
3419                                 }
3420                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3421                         }
3422                 }
3423                 SCTP_IPI_ADDR_RUNLOCK();
3424         } else {
3425                 struct sctp_laddr *laddr;
3426
3427                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3428                         if (laddr->ifa == NULL) {
3429                                 continue;
3430                         }
3431                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3432                                 /*
3433                                  * Address being deleted by the system, dont
3434                                  * list.
3435                                  */
3436                                 continue;
3437                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3438                                 /*
3439                                  * Address being deleted on this ep don't
3440                                  * list.
3441                                  */
3442                                 continue;
3443                         }
3444                         sctp_ifap = laddr->ifa;
3445                         switch (sctp_ifap->address.sa.sa_family) {
3446 #ifdef INET
3447                         case AF_INET:
3448                                 to = &sctp_ifap->address.sin;
3449                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3450                                         continue;
3451                                 }
3452                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3453                                         continue;
3454                                 }
3455                                 break;
3456 #endif
3457 #ifdef INET6
3458                         case AF_INET6:
3459                                 to6 = &sctp_ifap->address.sin6;
3460                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3461                                         continue;
3462                                 }
3463                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3464                                         continue;
3465                                 }
3466                                 break;
3467 #endif
3468                         default:
3469                                 continue;
3470                         }
3471                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3472                 }
3473         }
3474 skip_rest:
3475         /* Now we must send the asconf into the queue */
3476         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3477 }