sys/netinet/sctp_asconf.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_var.h>
  38 #include <netinet/sctp_sysctl.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctp_header.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp_output.h>
  43 #include <netinet/sctp_asconf.h>
  44 #include <netinet/sctp_timer.h>
  45
  46 /*
  47  * debug flags:
  48  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  49  * SCTP_DEBUG_ASCONF2: detailed info
  50  */
  51
  52
  53 /*
  54  * RFC 5061
  55  *
  56  * An ASCONF parameter queue exists per asoc which holds the pending address
  57  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  58  *
  59  * A restricted_addrs list exists per assoc to hold local addresses that are
  60  * not (yet) usable by the assoc as a source address.  These addresses are
  61  * either pending an ASCONF operation (and exist on the ASCONF parameter
  62  * queue), or they are permanently restricted (the peer has returned an
  63  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  64  *
  65  * Deleted addresses are always immediately removed from the lists as they will
  66  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  67  * only if allowed.
  68  */
  69
  70 /*
  71  * ASCONF parameter processing.
  72  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  73  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  74  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  75  */
  76 static struct mbuf *
  77 sctp_asconf_success_response(uint32_t id)
  78 {
  79         struct mbuf *m_reply = NULL;
  80         struct sctp_asconf_paramhdr *aph;
  81
  82         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  83             0, M_NOWAIT, 1, MT_DATA);
  84         if (m_reply == NULL) {
  85                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  86                     "asconf_success_response: couldn't get mbuf!\n");
  87                 return (NULL);
  88         }
  89         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  90         aph->correlation_id = id;
  91         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  92         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  93         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  94         aph->ph.param_length = htons(aph->ph.param_length);
  95
  96         return (m_reply);
  97 }
  98
  99 static struct mbuf *
 100 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t *error_tlv,
 101     uint16_t tlv_length)
 102 {
 103         struct mbuf *m_reply = NULL;
 104         struct sctp_asconf_paramhdr *aph;
 105         struct sctp_error_cause *error;
 106         uint8_t *tlv;
 107
 108         m_reply = sctp_get_mbuf_for_msg((sizeof(struct sctp_asconf_paramhdr) +
 109             tlv_length +
 110             sizeof(struct sctp_error_cause)),
 111             0, M_NOWAIT, 1, MT_DATA);
 112         if (m_reply == NULL) {
 113                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 114                     "asconf_error_response: couldn't get mbuf!\n");
 115                 return (NULL);
 116         }
 117         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 118         error = (struct sctp_error_cause *)(aph + 1);
 119
 120         aph->correlation_id = id;
 121         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 122         error->code = htons(cause);
 123         error->length = tlv_length + sizeof(struct sctp_error_cause);
 124         aph->ph.param_length = error->length +
 125             sizeof(struct sctp_asconf_paramhdr);
 126
 127         if (aph->ph.param_length > MLEN) {
 128                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 129                     "asconf_error_response: tlv_length (%xh) too big\n",
 130                     tlv_length);
 131                 sctp_m_freem(m_reply);  /* discard */
 132                 return (NULL);
 133         }
 134         if (error_tlv != NULL) {
 135                 tlv = (uint8_t *)(error + 1);
 136                 memcpy(tlv, error_tlv, tlv_length);
 137         }
 138         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
 139         error->length = htons(error->length);
 140         aph->ph.param_length = htons(aph->ph.param_length);
 141
 142         return (m_reply);
 143 }
 144
 145 static struct mbuf *
 146 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 147     struct sctp_tcb *stcb, int send_hb, int response_required)
 148 {
 149         struct sctp_nets *net;
 150         struct mbuf *m_reply = NULL;
 151         union sctp_sockstore store;
 152         struct sctp_paramhdr *ph;
 153         uint16_t param_type, aparam_length;
 154 #if defined(INET) || defined(INET6)
 155         uint16_t param_length;
 156 #endif
 157         struct sockaddr *sa;
 158         int zero_address = 0;
 159         int bad_address = 0;
 160 #ifdef INET
 161         struct sockaddr_in *sin;
 162         struct sctp_ipv4addr_param *v4addr;
 163 #endif
 164 #ifdef INET6
 165         struct sockaddr_in6 *sin6;
 166         struct sctp_ipv6addr_param *v6addr;
 167 #endif
 168
 169         aparam_length = ntohs(aph->ph.param_length);
 170         ph = (struct sctp_paramhdr *)(aph + 1);
 171         param_type = ntohs(ph->param_type);
 172 #if defined(INET) || defined(INET6)
 173         param_length = ntohs(ph->param_length);
 174 #endif
 175         sa = &store.sa;
 176         switch (param_type) {
 177 #ifdef INET
 178         case SCTP_IPV4_ADDRESS:
 179                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 180                         /* invalid param size */
 181                         return (NULL);
 182                 }
 183                 v4addr = (struct sctp_ipv4addr_param *)ph;
 184                 sin = &store.sin;
 185                 memset(sin, 0, sizeof(*sin));
 186                 sin->sin_family = AF_INET;
 187                 sin->sin_len = sizeof(struct sockaddr_in);
 188                 sin->sin_port = stcb->rport;
 189                 sin->sin_addr.s_addr = v4addr->addr;
 190                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 191                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 192                         bad_address = 1;
 193                 }
 194                 if (sin->sin_addr.s_addr == INADDR_ANY)
 195                         zero_address = 1;
 196                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 197                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 198                 break;
 199 #endif
 200 #ifdef INET6
 201         case SCTP_IPV6_ADDRESS:
 202                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 203                         /* invalid param size */
 204                         return (NULL);
 205                 }
 206                 v6addr = (struct sctp_ipv6addr_param *)ph;
 207                 sin6 = &store.sin6;
 208                 memset(sin6, 0, sizeof(*sin6));
 209                 sin6->sin6_family = AF_INET6;
 210                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 211                 sin6->sin6_port = stcb->rport;
 212                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 213                     sizeof(struct in6_addr));
 214                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 215                         bad_address = 1;
 216                 }
 217                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 218                         zero_address = 1;
 219                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 220                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 221                 break;
 222 #endif
 223         default:
 224                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 225                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 226                     aparam_length);
 227                 return (m_reply);
 228         }                       /* end switch */
 229
 230         /* if 0.0.0.0/::0, add the source address instead */
 231         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 232                 sa = src;
 233                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 234                     "process_asconf_add_ip: using source addr ");
 235                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 236         }
 237         /* add the address */
 238         if (bad_address) {
 239                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 240                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 241                     aparam_length);
 242         } else if (sctp_add_remote_addr(stcb, sa, &net, stcb->asoc.port,
 243                     SCTP_DONOT_SETSCOPE,
 244             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 245                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 246                     "process_asconf_add_ip: error adding address\n");
 247                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 248                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph,
 249                     aparam_length);
 250         } else {
 251                 /* notify upper layer */
 252                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 253                 if (response_required) {
 254                         m_reply =
 255                             sctp_asconf_success_response(aph->correlation_id);
 256                 }
 257                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 258                 sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 259                     stcb, net);
 260                 if (send_hb) {
 261                         sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 262                 }
 263         }
 264         return (m_reply);
 265 }
 266
 267 static int
 268 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 269 {
 270         struct sctp_nets *src_net, *net;
 271
 272         /* make sure the source address exists as a destination net */
 273         src_net = sctp_findnet(stcb, src);
 274         if (src_net == NULL) {
 275                 /* not found */
 276                 return (-1);
 277         }
 278
 279         /* delete all destination addresses except the source */
 280         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 281                 if (net != src_net) {
 282                         /* delete this address */
 283                         sctp_remove_net(stcb, net);
 284                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 285                             "asconf_del_remote_addrs_except: deleting ");
 286                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 287                             (struct sockaddr *)&net->ro._l_addr);
 288                         /* notify upper layer */
 289                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 290                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 291                 }
 292         }
 293         return (0);
 294 }
 295
 296 static struct mbuf *
 297 sctp_process_asconf_delete_ip(struct sockaddr *src,
 298     struct sctp_asconf_paramhdr *aph,
 299     struct sctp_tcb *stcb, int response_required)
 300 {
 301         struct mbuf *m_reply = NULL;
 302         union sctp_sockstore store;
 303         struct sctp_paramhdr *ph;
 304         uint16_t param_type, aparam_length;
 305 #if defined(INET) || defined(INET6)
 306         uint16_t param_length;
 307 #endif
 308         struct sockaddr *sa;
 309         int zero_address = 0;
 310         int result;
 311 #ifdef INET
 312         struct sockaddr_in *sin;
 313         struct sctp_ipv4addr_param *v4addr;
 314 #endif
 315 #ifdef INET6
 316         struct sockaddr_in6 *sin6;
 317         struct sctp_ipv6addr_param *v6addr;
 318 #endif
 319
 320         aparam_length = ntohs(aph->ph.param_length);
 321         ph = (struct sctp_paramhdr *)(aph + 1);
 322         param_type = ntohs(ph->param_type);
 323 #if defined(INET) || defined(INET6)
 324         param_length = ntohs(ph->param_length);
 325 #endif
 326         sa = &store.sa;
 327         switch (param_type) {
 328 #ifdef INET
 329         case SCTP_IPV4_ADDRESS:
 330                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 331                         /* invalid param size */
 332                         return (NULL);
 333                 }
 334                 v4addr = (struct sctp_ipv4addr_param *)ph;
 335                 sin = &store.sin;
 336                 memset(sin, 0, sizeof(*sin));
 337                 sin->sin_family = AF_INET;
 338                 sin->sin_len = sizeof(struct sockaddr_in);
 339                 sin->sin_port = stcb->rport;
 340                 sin->sin_addr.s_addr = v4addr->addr;
 341                 if (sin->sin_addr.s_addr == INADDR_ANY)
 342                         zero_address = 1;
 343                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 344                     "process_asconf_delete_ip: deleting ");
 345                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 346                 break;
 347 #endif
 348 #ifdef INET6
 349         case SCTP_IPV6_ADDRESS:
 350                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 351                         /* invalid param size */
 352                         return (NULL);
 353                 }
 354                 v6addr = (struct sctp_ipv6addr_param *)ph;
 355                 sin6 = &store.sin6;
 356                 memset(sin6, 0, sizeof(*sin6));
 357                 sin6->sin6_family = AF_INET6;
 358                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 359                 sin6->sin6_port = stcb->rport;
 360                 memcpy(&sin6->sin6_addr, v6addr->addr,
 361                     sizeof(struct in6_addr));
 362                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 363                         zero_address = 1;
 364                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 365                     "process_asconf_delete_ip: deleting ");
 366                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 367                 break;
 368 #endif
 369         default:
 370                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 371                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 372                     aparam_length);
 373                 return (m_reply);
 374         }
 375
 376         /* make sure the source address is not being deleted */
 377         if (sctp_cmpaddr(sa, src)) {
 378                 /* trying to delete the source address! */
 379                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 380                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 381                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *)aph,
 382                     aparam_length);
 383                 return (m_reply);
 384         }
 385
 386         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 387         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 388                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 389
 390                 if (result) {
 391                         /* src address did not exist? */
 392                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 393                         /* what error to reply with?? */
 394                         m_reply =
 395                             sctp_asconf_error_response(aph->correlation_id,
 396                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *)aph,
 397                             aparam_length);
 398                 } else if (response_required) {
 399                         m_reply =
 400                             sctp_asconf_success_response(aph->correlation_id);
 401                 }
 402                 return (m_reply);
 403         }
 404
 405         /* delete the address */
 406         result = sctp_del_remote_addr(stcb, sa);
 407         /*
 408          * note if result == -2, the address doesn't exist in the asoc but
 409          * since it's being deleted anyways, we just ack the delete -- but
 410          * this probably means something has already gone awry
 411          */
 412         if (result == -1) {
 413                 /* only one address in the asoc */
 414                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 415                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 416                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *)aph,
 417                     aparam_length);
 418         } else {
 419                 if (response_required) {
 420                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 421                 }
 422                 /* notify upper layer */
 423                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 424         }
 425         return (m_reply);
 426 }
 427
 428 static struct mbuf *
 429 sctp_process_asconf_set_primary(struct sockaddr *src,
 430     struct sctp_asconf_paramhdr *aph,
 431     struct sctp_tcb *stcb, int response_required)
 432 {
 433         struct mbuf *m_reply = NULL;
 434         union sctp_sockstore store;
 435         struct sctp_paramhdr *ph;
 436         uint16_t param_type, aparam_length;
 437 #if defined(INET) || defined(INET6)
 438         uint16_t param_length;
 439 #endif
 440         struct sockaddr *sa;
 441         int zero_address = 0;
 442 #ifdef INET
 443         struct sockaddr_in *sin;
 444         struct sctp_ipv4addr_param *v4addr;
 445 #endif
 446 #ifdef INET6
 447         struct sockaddr_in6 *sin6;
 448         struct sctp_ipv6addr_param *v6addr;
 449 #endif
 450
 451         aparam_length = ntohs(aph->ph.param_length);
 452         ph = (struct sctp_paramhdr *)(aph + 1);
 453         param_type = ntohs(ph->param_type);
 454 #if defined(INET) || defined(INET6)
 455         param_length = ntohs(ph->param_length);
 456 #endif
 457         sa = &store.sa;
 458         switch (param_type) {
 459 #ifdef INET
 460         case SCTP_IPV4_ADDRESS:
 461                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 462                         /* invalid param size */
 463                         return (NULL);
 464                 }
 465                 v4addr = (struct sctp_ipv4addr_param *)ph;
 466                 sin = &store.sin;
 467                 memset(sin, 0, sizeof(*sin));
 468                 sin->sin_family = AF_INET;
 469                 sin->sin_len = sizeof(struct sockaddr_in);
 470                 sin->sin_addr.s_addr = v4addr->addr;
 471                 if (sin->sin_addr.s_addr == INADDR_ANY)
 472                         zero_address = 1;
 473                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 474                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 475                 break;
 476 #endif
 477 #ifdef INET6
 478         case SCTP_IPV6_ADDRESS:
 479                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 480                         /* invalid param size */
 481                         return (NULL);
 482                 }
 483                 v6addr = (struct sctp_ipv6addr_param *)ph;
 484                 sin6 = &store.sin6;
 485                 memset(sin6, 0, sizeof(*sin6));
 486                 sin6->sin6_family = AF_INET6;
 487                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 488                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 489                     sizeof(struct in6_addr));
 490                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 491                         zero_address = 1;
 492                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 493                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 494                 break;
 495 #endif
 496         default:
 497                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 498                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 499                     aparam_length);
 500                 return (m_reply);
 501         }
 502
 503         /* if 0.0.0.0/::0, use the source address instead */
 504         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 505                 sa = src;
 506                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 507                     "process_asconf_set_primary: using source addr ");
 508                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 509         }
 510         /* set the primary address */
 511         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 512                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 513                     "process_asconf_set_primary: primary address set\n");
 514                 /* notify upper layer */
 515                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 516                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 517                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 518                     (stcb->asoc.alternate)) {
 519                         sctp_free_remote_addr(stcb->asoc.alternate);
 520                         stcb->asoc.alternate = NULL;
 521                 }
 522                 if (response_required) {
 523                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 524                 }
 525                 /*
 526                  * Mobility adaptation. Ideally, when the reception of SET
 527                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 528                  * destination, unacknowledged DATA are retransmitted
 529                  * immediately to the new primary destination for seamless
 530                  * handover. If the destination is UNCONFIRMED and marked to
 531                  * REQ_PRIM, The retransmission occur when reception of the
 532                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 533                  * sctp_input.c) Also, when change of the primary
 534                  * destination, it is better that all subsequent new DATA
 535                  * containing already queued DATA are transmitted to the new
 536                  * primary destination. (by micchie)
 537                  */
 538                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 539                     SCTP_MOBILITY_BASE) ||
 540                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 541                     SCTP_MOBILITY_FASTHANDOFF)) &&
 542                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 543                     SCTP_MOBILITY_PRIM_DELETED) &&
 544                     (stcb->asoc.primary_destination->dest_state &
 545                     SCTP_ADDR_UNCONFIRMED) == 0) {
 546
 547                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 548                             stcb->sctp_ep, stcb, NULL,
 549                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 550                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 551                             SCTP_MOBILITY_FASTHANDOFF)) {
 552                                 sctp_assoc_immediate_retrans(stcb,
 553                                     stcb->asoc.primary_destination);
 554                         }
 555                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 556                             SCTP_MOBILITY_BASE)) {
 557                                 sctp_move_chunks_from_net(stcb,
 558                                     stcb->asoc.deleted_primary);
 559                         }
 560                         sctp_delete_prim_timer(stcb->sctp_ep, stcb,
 561                             stcb->asoc.deleted_primary);
 562                 }
 563         } else {
 564                 /* couldn't set the requested primary address! */
 565                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 566                     "process_asconf_set_primary: set primary failed!\n");
 567                 /* must have been an invalid address, so report */
 568                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 569                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 570                     aparam_length);
 571         }
 572
 573         return (m_reply);
 574 }
 575
 576 /*
 577  * handles an ASCONF chunk.
 578  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 579  */
 580 void
 581 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 582     struct sockaddr *src,
 583     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 584     int first)
 585 {
 586         struct sctp_association *asoc;
 587         uint32_t serial_num;
 588         struct mbuf *n, *m_ack, *m_result, *m_tail;
 589         struct sctp_asconf_ack_chunk *ack_cp;
 590         struct sctp_asconf_paramhdr *aph;
 591         struct sctp_ipv6addr_param *p_addr;
 592         unsigned int asconf_limit, cnt;
 593         int error = 0;          /* did an error occur? */
 594
 595         /* asconf param buffer */
 596         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 597         struct sctp_asconf_ack *ack, *ack_next;
 598
 599         /* verify minimum length */
 600         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 601                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 602                     "handle_asconf: chunk too small = %xh\n",
 603                     ntohs(cp->ch.chunk_length));
 604                 return;
 605         }
 606         asoc = &stcb->asoc;
 607         serial_num = ntohl(cp->serial_number);
 608
 609         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 610                 /* got a duplicate ASCONF */
 611                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 612                     "handle_asconf: got duplicate serial number = %xh\n",
 613                     serial_num);
 614                 return;
 615         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 616                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 617                     serial_num, asoc->asconf_seq_in + 1);
 618                 return;
 619         }
 620
 621         /* it's the expected "next" sequence number, so process it */
 622         asoc->asconf_seq_in = serial_num;       /* update sequence */
 623         /* get length of all the param's in the ASCONF */
 624         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 625         SCTPDBG(SCTP_DEBUG_ASCONF1,
 626             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 627             asconf_limit, serial_num);
 628
 629         if (first) {
 630                 /* delete old cache */
 631                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 632
 633                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 634                         if (ack->serial_number == serial_num)
 635                                 break;
 636                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 637                             ack->serial_number, serial_num);
 638                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 639                         if (ack->data != NULL) {
 640                                 sctp_m_freem(ack->data);
 641                         }
 642                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 643                 }
 644         }
 645
 646         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 647             M_NOWAIT, 1, MT_DATA);
 648         if (m_ack == NULL) {
 649                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 650                     "handle_asconf: couldn't get mbuf!\n");
 651                 return;
 652         }
 653         m_tail = m_ack;         /* current reply chain's tail */
 654
 655         /* fill in ASCONF-ACK header */
 656         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 657         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 658         ack_cp->ch.chunk_flags = 0;
 659         ack_cp->serial_number = htonl(serial_num);
 660         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 661         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 662         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 663
 664         /* skip the lookup address parameter */
 665         offset += sizeof(struct sctp_asconf_chunk);
 666         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *)&aparam_buf);
 667         if (p_addr == NULL) {
 668                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 669                     "handle_asconf: couldn't get lookup addr!\n");
 670                 /* respond with a missing/invalid mandatory parameter error */
 671                 sctp_m_freem(m_ack);
 672                 return;
 673         }
 674         /* param_length is already validated in process_control... */
 675         offset += ntohs(p_addr->ph.param_length);       /* skip lookup addr */
 676         /* get pointer to first asconf param in ASCONF */
 677         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *)&aparam_buf);
 678         if (aph == NULL) {
 679                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 680                 goto send_reply;
 681         }
 682         /* process through all parameters */
 683         cnt = 0;
 684         while (aph != NULL) {
 685                 unsigned int param_length, param_type;
 686
 687                 param_type = ntohs(aph->ph.param_type);
 688                 param_length = ntohs(aph->ph.param_length);
 689                 if (offset + param_length > asconf_limit) {
 690                         /* parameter goes beyond end of chunk! */
 691                         sctp_m_freem(m_ack);
 692                         return;
 693                 }
 694                 m_result = NULL;
 695
 696                 if (param_length > sizeof(aparam_buf)) {
 697                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 698                         sctp_m_freem(m_ack);
 699                         return;
 700                 }
 701                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 702                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 703                         sctp_m_freem(m_ack);
 704                 }
 705                 /* get the entire parameter */
 706                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 707                 if (aph == NULL) {
 708                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 709                         sctp_m_freem(m_ack);
 710                         return;
 711                 }
 712                 switch (param_type) {
 713                 case SCTP_ADD_IP_ADDRESS:
 714                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 715                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 716                         cnt++;
 717                         break;
 718                 case SCTP_DEL_IP_ADDRESS:
 719                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 720                             error);
 721                         break;
 722                 case SCTP_ERROR_CAUSE_IND:
 723                         /* not valid in an ASCONF chunk */
 724                         break;
 725                 case SCTP_SET_PRIM_ADDR:
 726                         m_result = sctp_process_asconf_set_primary(src, aph,
 727                             stcb, error);
 728                         break;
 729                 case SCTP_NAT_VTAGS:
 730                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 731                         break;
 732                 case SCTP_SUCCESS_REPORT:
 733                         /* not valid in an ASCONF chunk */
 734                         break;
 735                 case SCTP_ULP_ADAPTATION:
 736                         /* FIX */
 737                         break;
 738                 default:
 739                         if ((param_type & 0x8000) == 0) {
 740                                 /* Been told to STOP at this param */
 741                                 asconf_limit = offset;
 742                                 /*
 743                                  * FIX FIX - We need to call
 744                                  * sctp_arethere_unrecognized_parameters()
 745                                  * to get a operr and send it for any
 746                                  * param's with the 0x4000 bit set OR do it
 747                                  * here ourselves... note we still must STOP
 748                                  * if the 0x8000 bit is clear.
 749                                  */
 750                         }
 751                         /* unknown/invalid param type */
 752                         break;
 753                 }               /* switch */
 754
 755                 /* add any (error) result to the reply mbuf chain */
 756                 if (m_result != NULL) {
 757                         SCTP_BUF_NEXT(m_tail) = m_result;
 758                         m_tail = m_result;
 759                         /* update lengths, make sure it's aligned too */
 760                         SCTP_BUF_LEN(m_result) = SCTP_SIZE32(SCTP_BUF_LEN(m_result));
 761                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 762                         /* set flag to force success reports */
 763                         error = 1;
 764                 }
 765                 offset += SCTP_SIZE32(param_length);
 766                 /* update remaining ASCONF message length to process */
 767                 if (offset >= asconf_limit) {
 768                         /* no more data in the mbuf chain */
 769                         break;
 770                 }
 771                 /* get pointer to next asconf param */
 772                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 773                     sizeof(struct sctp_asconf_paramhdr),
 774                     (uint8_t *)&aparam_buf);
 775                 if (aph == NULL) {
 776                         /* can't get an asconf paramhdr */
 777                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 778                         /* FIX ME - add error here... */
 779                 }
 780         }
 781
 782 send_reply:
 783         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 784         /* save the ASCONF-ACK reply */
 785         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 786             struct sctp_asconf_ack);
 787         if (ack == NULL) {
 788                 sctp_m_freem(m_ack);
 789                 return;
 790         }
 791         ack->serial_number = serial_num;
 792         ack->last_sent_to = NULL;
 793         ack->data = m_ack;
 794         ack->len = 0;
 795         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 796                 ack->len += SCTP_BUF_LEN(n);
 797         }
 798         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 799
 800         /* see if last_control_chunk_from is set properly (use IP src addr) */
 801         if (stcb->asoc.last_control_chunk_from == NULL) {
 802                 /*
 803                  * this could happen if the source address was just newly
 804                  * added
 805                  */
 806                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 807                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 808                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 809                 /* look up the from address */
 810                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 811 #ifdef SCTP_DEBUG
 812                 if (stcb->asoc.last_control_chunk_from == NULL) {
 813                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 814                 }
 815 #endif
 816         }
 817 }
 818
 819 /*
 820  * does the address match? returns 0 if not, 1 if so
 821  */
 822 static uint32_t
 823 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 824 {
 825         switch (sa->sa_family) {
 826 #ifdef INET6
 827         case AF_INET6:
 828                 {
 829                         /* XXX scopeid */
 830                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 831
 832                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 833                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 834                             sizeof(struct in6_addr)) == 0)) {
 835                                 return (1);
 836                         }
 837                         break;
 838                 }
 839 #endif
 840 #ifdef INET
 841         case AF_INET:
 842                 {
 843                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 844
 845                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 846                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 847                             sizeof(struct in_addr)) == 0)) {
 848                                 return (1);
 849                         }
 850                         break;
 851                 }
 852 #endif
 853         default:
 854                 break;
 855         }
 856         return (0);
 857 }
 858
 859 /*
 860  * does the address match? returns 0 if not, 1 if so
 861  */
 862 static uint32_t
 863 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 864 {
 865 #if defined(INET) || defined(INET6)
 866         uint16_t param_type, param_length;
 867
 868         param_type = ntohs(ph->param_type);
 869         param_length = ntohs(ph->param_length);
 870 #endif
 871         switch (sa->sa_family) {
 872 #ifdef INET6
 873         case AF_INET6:
 874                 {
 875                         /* XXX scopeid */
 876                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 877                         struct sctp_ipv6addr_param *v6addr;
 878
 879                         v6addr = (struct sctp_ipv6addr_param *)ph;
 880                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 881                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 882                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 883                             sizeof(struct in6_addr)) == 0)) {
 884                                 return (1);
 885                         }
 886                         break;
 887                 }
 888 #endif
 889 #ifdef INET
 890         case AF_INET:
 891                 {
 892                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 893                         struct sctp_ipv4addr_param *v4addr;
 894
 895                         v4addr = (struct sctp_ipv4addr_param *)ph;
 896                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 897                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 898                             (memcmp(&v4addr->addr, &sin->sin_addr,
 899                             sizeof(struct in_addr)) == 0)) {
 900                                 return (1);
 901                         }
 902                         break;
 903                 }
 904 #endif
 905         default:
 906                 break;
 907         }
 908         return (0);
 909 }
 910
 911 /*
 912  * Cleanup for non-responded/OP ERR'd ASCONF
 913  */
 914 void
 915 sctp_asconf_cleanup(struct sctp_tcb *stcb, struct sctp_nets *net)
 916 {
 917         /*
 918          * clear out any existing asconfs going out
 919          */
 920         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
 921             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 922         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 923         /* remove the old ASCONF on our outbound queue */
 924         sctp_toss_old_asconf(stcb);
 925 }
 926
 927 /*
 928  * cleanup any cached source addresses that may be topologically
 929  * incorrect after a new address has been added to this interface.
 930  */
 931 static void
 932 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 933 {
 934         struct sctp_nets *net;
 935
 936         /*
 937          * Ideally, we want to only clear cached routes and source addresses
 938          * that are topologically incorrect.  But since there is no easy way
 939          * to know whether the newly added address on the ifn would cause a
 940          * routing change (i.e. a new egress interface would be chosen)
 941          * without doing a new routing lookup and source address selection,
 942          * we will (for now) just flush any cached route using a different
 943          * ifn (and cached source addrs) and let output re-choose them
 944          * during the next send on that net.
 945          */
 946         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 947                 /*
 948                  * clear any cached route (and cached source address) if the
 949                  * route's interface is NOT the same as the address change.
 950                  * If it's the same interface, just clear the cached source
 951                  * address.
 952                  */
 953                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 954                     ((ifn == NULL) ||
 955                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 956                         /* clear any cached route */
 957                         RTFREE(net->ro.ro_rt);
 958                         net->ro.ro_rt = NULL;
 959                 }
 960                 /* clear any cached source address */
 961                 if (net->src_addr_selected) {
 962                         sctp_free_ifa(net->ro._s_addr);
 963                         net->ro._s_addr = NULL;
 964                         net->src_addr_selected = 0;
 965                 }
 966         }
 967 }
 968
 969
 970 void
 971 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 972 {
 973         int error;
 974
 975         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
 976                 return;
 977         }
 978         if (stcb->asoc.deleted_primary == NULL) {
 979                 return;
 980         }
 981
 982         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
 983                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
 984                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
 985                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
 986                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
 987                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
 988                     stcb->asoc.deleted_primary,
 989                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
 990                 stcb->asoc.num_send_timers_up--;
 991                 if (stcb->asoc.num_send_timers_up < 0) {
 992                         stcb->asoc.num_send_timers_up = 0;
 993                 }
 994                 SCTP_TCB_LOCK_ASSERT(stcb);
 995                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
 996                     stcb->asoc.deleted_primary);
 997                 if (error) {
 998                         SCTP_INP_DECR_REF(stcb->sctp_ep);
 999                         return;
1000                 }
1001                 SCTP_TCB_LOCK_ASSERT(stcb);
1002 #ifdef SCTP_AUDITING_ENABLED
1003                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1004 #endif
1005                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1006                 if ((stcb->asoc.num_send_timers_up == 0) &&
1007                     (stcb->asoc.sent_queue_cnt > 0)) {
1008                         struct sctp_tmit_chunk *chk;
1009
1010                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1011                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
1012                             stcb, chk->whoTo);
1013                 }
1014         }
1015         return;
1016 }
1017
1018 static int
1019     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1020
1021 void
1022 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1023 {
1024         struct sctp_tmit_chunk *chk;
1025
1026         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1027         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1028             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1029         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1030         net->error_count = 0;
1031         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1032                 if (chk->whoTo == net) {
1033                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1034                                 chk->sent = SCTP_DATAGRAM_RESEND;
1035                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1036                                 sctp_flight_size_decrease(chk);
1037                                 sctp_total_flight_decrease(stcb, chk);
1038                                 net->marked_retrans++;
1039                                 stcb->asoc.marked_retrans++;
1040                         }
1041                 }
1042         }
1043         if (net->marked_retrans) {
1044                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1045         }
1046 }
1047
1048 static void
1049 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1050 {
1051         struct sctp_nets *net;
1052         int addrnum, changed;
1053
1054         /*
1055          * If number of local valid addresses is 1, the valid address is
1056          * probably newly added address. Several valid addresses in this
1057          * association.  A source address may not be changed.  Additionally,
1058          * they can be configured on a same interface as "alias" addresses.
1059          * (by micchie)
1060          */
1061         addrnum = sctp_local_addr_count(stcb);
1062         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1063             addrnum);
1064         if (addrnum == 1) {
1065                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1066                         /* clear any cached route and source address */
1067                         if (net->ro.ro_rt) {
1068                                 RTFREE(net->ro.ro_rt);
1069                                 net->ro.ro_rt = NULL;
1070                         }
1071                         if (net->src_addr_selected) {
1072                                 sctp_free_ifa(net->ro._s_addr);
1073                                 net->ro._s_addr = NULL;
1074                                 net->src_addr_selected = 0;
1075                         }
1076                         /* Retransmit unacknowledged DATA chunks immediately */
1077                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1078                             SCTP_MOBILITY_FASTHANDOFF)) {
1079                                 sctp_net_immediate_retrans(stcb, net);
1080                         }
1081                         /* also, SET PRIMARY is maybe already sent */
1082                 }
1083                 return;
1084         }
1085
1086         /* Multiple local addresses exsist in the association.  */
1087         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1088                 /* clear any cached route and source address */
1089                 if (net->ro.ro_rt) {
1090                         RTFREE(net->ro.ro_rt);
1091                         net->ro.ro_rt = NULL;
1092                 }
1093                 if (net->src_addr_selected) {
1094                         sctp_free_ifa(net->ro._s_addr);
1095                         net->ro._s_addr = NULL;
1096                         net->src_addr_selected = 0;
1097                 }
1098                 /*
1099                  * Check if the nexthop is corresponding to the new address.
1100                  * If the new address is corresponding to the current
1101                  * nexthop, the path will be changed. If the new address is
1102                  * NOT corresponding to the current nexthop, the path will
1103                  * not be changed.
1104                  */
1105                 SCTP_RTALLOC((sctp_route_t *)&net->ro,
1106                     stcb->sctp_ep->def_vrf_id,
1107                     stcb->sctp_ep->fibnum);
1108                 if (net->ro.ro_rt == NULL)
1109                         continue;
1110
1111                 changed = 0;
1112                 switch (net->ro._l_addr.sa.sa_family) {
1113 #ifdef INET
1114                 case AF_INET:
1115                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *)&net->ro)) {
1116                                 changed = 1;
1117                         }
1118                         break;
1119 #endif
1120 #ifdef INET6
1121                 case AF_INET6:
1122                         if (sctp_v6src_match_nexthop(
1123                             &newifa->address.sin6, (sctp_route_t *)&net->ro)) {
1124                                 changed = 1;
1125                         }
1126                         break;
1127 #endif
1128                 default:
1129                         break;
1130                 }
1131                 /*
1132                  * if the newly added address does not relate routing
1133                  * information, we skip.
1134                  */
1135                 if (changed == 0)
1136                         continue;
1137                 /* Retransmit unacknowledged DATA chunks immediately */
1138                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1139                     SCTP_MOBILITY_FASTHANDOFF)) {
1140                         sctp_net_immediate_retrans(stcb, net);
1141                 }
1142                 /* Send SET PRIMARY for this new address */
1143                 if (net == stcb->asoc.primary_destination) {
1144                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1145                             SCTP_SET_PRIM_ADDR);
1146                 }
1147         }
1148 }
1149
1150 /*
1151  * process an ADD/DELETE IP ack from peer.
1152  * addr: corresponding sctp_ifa to the address being added/deleted.
1153  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1154  * flag: 1=success, 0=failure.
1155  */
1156 static void
1157 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1158 {
1159         /*
1160          * do the necessary asoc list work- if we get a failure indication,
1161          * leave the address on the assoc's restricted list.  If we get a
1162          * success indication, remove the address from the restricted list.
1163          */
1164         /*
1165          * Note: this will only occur for ADD_IP_ADDRESS, since
1166          * DEL_IP_ADDRESS is never actually added to the list...
1167          */
1168         if (flag) {
1169                 /* success case, so remove from the restricted list */
1170                 sctp_del_local_addr_restricted(stcb, addr);
1171
1172                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1173                     SCTP_MOBILITY_BASE) ||
1174                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1175                     SCTP_MOBILITY_FASTHANDOFF)) {
1176                         sctp_path_check_and_react(stcb, addr);
1177                         return;
1178                 }
1179                 /* clear any cached/topologically incorrect source addresses */
1180                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1181         }
1182         /* else, leave it on the list */
1183 }
1184
1185 /*
1186  * add an asconf add/delete/set primary IP address parameter to the queue.
1187  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1188  * returns 0 if queued, -1 if not queued/removed.
1189  * NOTE: if adding, but a delete for the same address is already scheduled
1190  * (and not yet sent out), simply remove it from queue.  Same for deleting
1191  * an address already scheduled for add.  If a duplicate operation is found,
1192  * ignore the new one.
1193  */
1194 static int
1195 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1196     uint16_t type)
1197 {
1198         struct sctp_asconf_addr *aa, *aa_next;
1199
1200         /* make sure the request isn't already in the queue */
1201         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1202                 /* address match? */
1203                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1204                         continue;
1205                 /*
1206                  * is the request already in queue but not sent? pass the
1207                  * request already sent in order to resolve the following
1208                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1209                  * can't remove the ADD request already sent 3. arrival of
1210                  * ADD
1211                  */
1212                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1213                         return (-1);
1214                 }
1215                 /* is the negative request already in queue, and not sent */
1216                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1217                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1218                         /* add requested, delete already queued */
1219                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1220                         /* remove the ifa from the restricted list */
1221                         sctp_del_local_addr_restricted(stcb, ifa);
1222                         /* free the asconf param */
1223                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1224                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1225                         return (-1);
1226                 }
1227                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1228                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1229                         /* delete requested, add already queued */
1230                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1231                         /* remove the aa->ifa from the restricted list */
1232                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1233                         /* free the asconf param */
1234                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1235                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1236                         return (-1);
1237                 }
1238         }                       /* for each aa */
1239
1240         /* adding new request to the queue */
1241         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1242             SCTP_M_ASC_ADDR);
1243         if (aa == NULL) {
1244                 /* didn't get memory */
1245                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1246                 return (-1);
1247         }
1248         aa->special_del = 0;
1249         /* fill in asconf address parameter fields */
1250         /* top level elements are "networked" during send */
1251         aa->ap.aph.ph.param_type = type;
1252         aa->ifa = ifa;
1253         atomic_add_int(&ifa->refcount, 1);
1254         /* correlation_id filled in during send routine later... */
1255         switch (ifa->address.sa.sa_family) {
1256 #ifdef INET6
1257         case AF_INET6:
1258                 {
1259                         struct sockaddr_in6 *sin6;
1260
1261                         sin6 = &ifa->address.sin6;
1262                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1263                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1264                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1265                             sizeof(struct sctp_ipv6addr_param);
1266                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1267                             sizeof(struct in6_addr));
1268                         break;
1269                 }
1270 #endif
1271 #ifdef INET
1272         case AF_INET:
1273                 {
1274                         struct sockaddr_in *sin;
1275
1276                         sin = &ifa->address.sin;
1277                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1278                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1279                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1280                             sizeof(struct sctp_ipv4addr_param);
1281                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1282                             sizeof(struct in_addr));
1283                         break;
1284                 }
1285 #endif
1286         default:
1287                 /* invalid family! */
1288                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1289                 sctp_free_ifa(ifa);
1290                 return (-1);
1291         }
1292         aa->sent = 0;           /* clear sent flag */
1293
1294         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1295 #ifdef SCTP_DEBUG
1296         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1297                 if (type == SCTP_ADD_IP_ADDRESS) {
1298                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1299                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1300                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1301                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1302                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1303                 } else {
1304                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1305                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1306                 }
1307         }
1308 #endif
1309
1310         return (0);
1311 }
1312
1313
1314 /*
1315  * add an asconf operation for the given ifa and type.
1316  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1317  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1318  * advisable.
1319  */
1320 static int
1321 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1322     uint16_t type)
1323 {
1324         uint32_t status;
1325         int pending_delete_queued = 0;
1326         int last;
1327
1328         /* see if peer supports ASCONF */
1329         if (stcb->asoc.asconf_supported == 0) {
1330                 return (-1);
1331         }
1332
1333         /*
1334          * if this is deleting the last address from the assoc, mark it as
1335          * pending.
1336          */
1337         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1338                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1339                         last = (sctp_local_addr_count(stcb) == 0);
1340                 } else {
1341                         last = (sctp_local_addr_count(stcb) == 1);
1342                 }
1343                 if (last) {
1344                         /* set the pending delete info only */
1345                         stcb->asoc.asconf_del_pending = 1;
1346                         stcb->asoc.asconf_addr_del_pending = ifa;
1347                         atomic_add_int(&ifa->refcount, 1);
1348                         SCTPDBG(SCTP_DEBUG_ASCONF2,
1349                             "asconf_queue_add: mark delete last address pending\n");
1350                         return (-1);
1351                 }
1352         }
1353
1354         /* queue an asconf parameter */
1355         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1356
1357         /*
1358          * if this is an add, and there is a delete also pending (i.e. the
1359          * last local address is being changed), queue the pending delete
1360          * too.
1361          */
1362         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1363                 /* queue in the pending delete */
1364                 if (sctp_asconf_queue_mgmt(stcb,
1365                     stcb->asoc.asconf_addr_del_pending,
1366                     SCTP_DEL_IP_ADDRESS) == 0) {
1367                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queing pending delete\n");
1368                         pending_delete_queued = 1;
1369                         /* clear out the pending delete info */
1370                         stcb->asoc.asconf_del_pending = 0;
1371                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1372                         stcb->asoc.asconf_addr_del_pending = NULL;
1373                 }
1374         }
1375
1376         if (pending_delete_queued) {
1377                 struct sctp_nets *net;
1378
1379                 /*
1380                  * since we know that the only/last address is now being
1381                  * changed in this case, reset the cwnd/rto on all nets to
1382                  * start as a new address and path.  Also clear the error
1383                  * counts to give the assoc the best chance to complete the
1384                  * address change.
1385                  */
1386                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1387                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1388                             net);
1389                         net->RTO = 0;
1390                         net->error_count = 0;
1391                 }
1392                 stcb->asoc.overall_error_count = 0;
1393                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1394                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1395                             stcb->asoc.overall_error_count,
1396                             0,
1397                             SCTP_FROM_SCTP_ASCONF,
1398                             __LINE__);
1399                 }
1400
1401                 /* queue in an advisory set primary too */
1402                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1403                 /* let caller know we should send this out immediately */
1404                 status = 1;
1405         }
1406         return (status);
1407 }
1408
1409 /*-
1410  * add an asconf delete IP address parameter to the queue by sockaddr and
1411  * possibly with no sctp_ifa available.  This is only called by the routine
1412  * that checks the addresses in an INIT-ACK against the current address list.
1413  * returns 0 if completed, non-zero if not completed.
1414  * NOTE: if an add is already scheduled (and not yet sent out), simply
1415  * remove it from queue.  If a duplicate operation is found, ignore the
1416  * new one.
1417  */
1418 static int
1419 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1420 {
1421         struct sctp_ifa *ifa;
1422         struct sctp_asconf_addr *aa, *aa_next;
1423
1424         if (stcb == NULL) {
1425                 return (-1);
1426         }
1427         /* see if peer supports ASCONF */
1428         if (stcb->asoc.asconf_supported == 0) {
1429                 return (-1);
1430         }
1431         /* make sure the request isn't already in the queue */
1432         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1433                 /* address match? */
1434                 if (sctp_asconf_addr_match(aa, sa) == 0)
1435                         continue;
1436                 /* is the request already in queue (sent or not) */
1437                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1438                         return (-1);
1439                 }
1440                 /* is the negative request already in queue, and not sent */
1441                 if (aa->sent == 1)
1442                         continue;
1443                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1444                         /* add already queued, so remove existing entry */
1445                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1446                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1447                         /* free the entry */
1448                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1449                         return (-1);
1450                 }
1451         }                       /* for each aa */
1452
1453         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1454         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1455
1456         /* adding new request to the queue */
1457         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1458             SCTP_M_ASC_ADDR);
1459         if (aa == NULL) {
1460                 /* didn't get memory */
1461                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1462                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1463                 return (-1);
1464         }
1465         aa->special_del = 0;
1466         /* fill in asconf address parameter fields */
1467         /* top level elements are "networked" during send */
1468         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1469         aa->ifa = ifa;
1470         if (ifa)
1471                 atomic_add_int(&ifa->refcount, 1);
1472         /* correlation_id filled in during send routine later... */
1473         switch (sa->sa_family) {
1474 #ifdef INET6
1475         case AF_INET6:
1476                 {
1477                         /* IPv6 address */
1478                         struct sockaddr_in6 *sin6;
1479
1480                         sin6 = (struct sockaddr_in6 *)sa;
1481                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1482                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1483                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1484                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1485                             sizeof(struct in6_addr));
1486                         break;
1487                 }
1488 #endif
1489 #ifdef INET
1490         case AF_INET:
1491                 {
1492                         /* IPv4 address */
1493                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1494
1495                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1496                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1497                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1498                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1499                             sizeof(struct in_addr));
1500                         break;
1501                 }
1502 #endif
1503         default:
1504                 /* invalid family! */
1505                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1506                 if (ifa)
1507                         sctp_free_ifa(ifa);
1508                 return (-1);
1509         }
1510         aa->sent = 0;           /* clear sent flag */
1511
1512         /* delete goes to the back of the queue */
1513         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1514
1515         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1516         return (0);
1517 }
1518
1519 /*
1520  * find a specific asconf param on our "sent" queue
1521  */
1522 static struct sctp_asconf_addr *
1523 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1524 {
1525         struct sctp_asconf_addr *aa;
1526
1527         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1528                 if (aa->ap.aph.correlation_id == correlation_id &&
1529                     aa->sent == 1) {
1530                         /* found it */
1531                         return (aa);
1532                 }
1533         }
1534         /* didn't find it */
1535         return (NULL);
1536 }
1537
1538 /*
1539  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1540  * notifications based on the error response
1541  */
1542 static void
1543 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1544     struct sctp_asconf_paramhdr *aph)
1545 {
1546         struct sctp_error_cause *eh;
1547         struct sctp_paramhdr *ph;
1548         uint16_t param_type;
1549         uint16_t error_code;
1550
1551         eh = (struct sctp_error_cause *)(aph + 1);
1552         ph = (struct sctp_paramhdr *)(eh + 1);
1553         /* validate lengths */
1554         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1555             htons(aph->ph.param_length)) {
1556                 /* invalid error cause length */
1557                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1558                     "asconf_process_error: cause element too long\n");
1559                 return;
1560         }
1561         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1562             htons(eh->length)) {
1563                 /* invalid included TLV length */
1564                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1565                     "asconf_process_error: included TLV too long\n");
1566                 return;
1567         }
1568         /* which error code ? */
1569         error_code = ntohs(eh->code);
1570         param_type = ntohs(aph->ph.param_type);
1571         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1572         switch (error_code) {
1573         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1574                 /* we allow ourselves to "try again" for this error */
1575                 break;
1576         default:
1577                 /* peer can't handle it... */
1578                 switch (param_type) {
1579                 case SCTP_ADD_IP_ADDRESS:
1580                 case SCTP_DEL_IP_ADDRESS:
1581                 case SCTP_SET_PRIM_ADDR:
1582                         break;
1583                 default:
1584                         break;
1585                 }
1586         }
1587 }
1588
1589 /*
1590  * process an asconf queue param.
1591  * aparam: parameter to process, will be removed from the queue.
1592  * flag: 1=success case, 0=failure case
1593  */
1594 static void
1595 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1596     struct sctp_asconf_addr *aparam, uint32_t flag)
1597 {
1598         uint16_t param_type;
1599
1600         /* process this param */
1601         param_type = aparam->ap.aph.ph.param_type;
1602         switch (param_type) {
1603         case SCTP_ADD_IP_ADDRESS:
1604                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1605                     "process_param_ack: added IP address\n");
1606                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1607                 break;
1608         case SCTP_DEL_IP_ADDRESS:
1609                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1610                     "process_param_ack: deleted IP address\n");
1611                 /* nothing really to do... lists already updated */
1612                 break;
1613         case SCTP_SET_PRIM_ADDR:
1614                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1615                     "process_param_ack: set primary IP address\n");
1616                 /* nothing to do... peer may start using this addr */
1617                 break;
1618         default:
1619                 /* should NEVER happen */
1620                 break;
1621         }
1622
1623         /* remove the param and free it */
1624         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1625         if (aparam->ifa)
1626                 sctp_free_ifa(aparam->ifa);
1627         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1628 }
1629
1630 /*
1631  * cleanup from a bad asconf ack parameter
1632  */
1633 static void
1634 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1635 {
1636         /* assume peer doesn't really know how to do asconfs */
1637         /* XXX we could free the pending queue here */
1638
1639 }
1640
1641 void
1642 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1643     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1644     struct sctp_nets *net, int *abort_no_unlock)
1645 {
1646         struct sctp_association *asoc;
1647         uint32_t serial_num;
1648         uint16_t ack_length;
1649         struct sctp_asconf_paramhdr *aph;
1650         struct sctp_asconf_addr *aa, *aa_next;
1651         uint32_t last_error_id = 0;     /* last error correlation id */
1652         uint32_t id;
1653         struct sctp_asconf_addr *ap;
1654
1655         /* asconf param buffer */
1656         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1657
1658         /* verify minimum length */
1659         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1660                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1661                     "handle_asconf_ack: chunk too small = %xh\n",
1662                     ntohs(cp->ch.chunk_length));
1663                 return;
1664         }
1665         asoc = &stcb->asoc;
1666         serial_num = ntohl(cp->serial_number);
1667
1668         /*
1669          * NOTE: we may want to handle this differently- currently, we will
1670          * abort when we get an ack for the expected serial number + 1 (eg.
1671          * we didn't send it), process an ack normally if it is the expected
1672          * serial number, and re-send the previous ack for *ALL* other
1673          * serial numbers
1674          */
1675
1676         /*
1677          * if the serial number is the next expected, but I didn't send it,
1678          * abort the asoc, since someone probably just hijacked us...
1679          */
1680         if (serial_num == (asoc->asconf_seq_out + 1)) {
1681                 struct mbuf *op_err;
1682                 char msg[SCTP_DIAG_INFO_LEN];
1683
1684                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1685                 snprintf(msg, sizeof(msg), "Never sent serial number %8.8x",
1686                     serial_num);
1687                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1688                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1689                 *abort_no_unlock = 1;
1690                 return;
1691         }
1692         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1693                 /* got a duplicate/unexpected ASCONF-ACK */
1694                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1695                     serial_num, asoc->asconf_seq_out_acked + 1);
1696                 return;
1697         }
1698
1699         if (serial_num == asoc->asconf_seq_out - 1) {
1700                 /* stop our timer */
1701                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, net,
1702                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1703         }
1704
1705         /* process the ASCONF-ACK contents */
1706         ack_length = ntohs(cp->ch.chunk_length) -
1707             sizeof(struct sctp_asconf_ack_chunk);
1708         offset += sizeof(struct sctp_asconf_ack_chunk);
1709         /* process through all parameters */
1710         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1711                 unsigned int param_length, param_type;
1712
1713                 /* get pointer to next asconf parameter */
1714                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1715                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1716                 if (aph == NULL) {
1717                         /* can't get an asconf paramhdr */
1718                         sctp_asconf_ack_clear(stcb);
1719                         return;
1720                 }
1721                 param_type = ntohs(aph->ph.param_type);
1722                 param_length = ntohs(aph->ph.param_length);
1723                 if (param_length > ack_length) {
1724                         sctp_asconf_ack_clear(stcb);
1725                         return;
1726                 }
1727                 if (param_length < sizeof(struct sctp_paramhdr)) {
1728                         sctp_asconf_ack_clear(stcb);
1729                         return;
1730                 }
1731                 /* get the complete parameter... */
1732                 if (param_length > sizeof(aparam_buf)) {
1733                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1734                             "param length (%u) larger than buffer size!\n", param_length);
1735                         sctp_asconf_ack_clear(stcb);
1736                         return;
1737                 }
1738                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1739                 if (aph == NULL) {
1740                         sctp_asconf_ack_clear(stcb);
1741                         return;
1742                 }
1743                 /* correlation_id is transparent to peer, no ntohl needed */
1744                 id = aph->correlation_id;
1745
1746                 switch (param_type) {
1747                 case SCTP_ERROR_CAUSE_IND:
1748                         last_error_id = id;
1749                         /* find the corresponding asconf param in our queue */
1750                         ap = sctp_asconf_find_param(stcb, id);
1751                         if (ap == NULL) {
1752                                 /* hmm... can't find this in our queue! */
1753                                 break;
1754                         }
1755                         /* process the parameter, failed flag */
1756                         sctp_asconf_process_param_ack(stcb, ap, 0);
1757                         /* process the error response */
1758                         sctp_asconf_process_error(stcb, aph);
1759                         break;
1760                 case SCTP_SUCCESS_REPORT:
1761                         /* find the corresponding asconf param in our queue */
1762                         ap = sctp_asconf_find_param(stcb, id);
1763                         if (ap == NULL) {
1764                                 /* hmm... can't find this in our queue! */
1765                                 break;
1766                         }
1767                         /* process the parameter, success flag */
1768                         sctp_asconf_process_param_ack(stcb, ap, 1);
1769                         break;
1770                 default:
1771                         break;
1772                 }               /* switch */
1773
1774                 /* update remaining ASCONF-ACK message length to process */
1775                 ack_length -= SCTP_SIZE32(param_length);
1776                 if (ack_length <= 0) {
1777                         /* no more data in the mbuf chain */
1778                         break;
1779                 }
1780                 offset += SCTP_SIZE32(param_length);
1781         }                       /* while */
1782
1783         /*
1784          * if there are any "sent" params still on the queue, these are
1785          * implicitly "success", or "failed" (if we got an error back) ...
1786          * so process these appropriately
1787          *
1788          * we assume that the correlation_id's are monotonically increasing
1789          * beginning from 1 and that we don't have *that* many outstanding
1790          * at any given time
1791          */
1792         if (last_error_id == 0)
1793                 last_error_id--;        /* set to "max" value */
1794         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1795                 if (aa->sent == 1) {
1796                         /*
1797                          * implicitly successful or failed if correlation_id
1798                          * < last_error_id, then success else, failure
1799                          */
1800                         if (aa->ap.aph.correlation_id < last_error_id)
1801                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1802                         else
1803                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1804                 } else {
1805                         /*
1806                          * since we always process in order (FIFO queue) if
1807                          * we reach one that hasn't been sent, the rest
1808                          * should not have been sent either. so, we're
1809                          * done...
1810                          */
1811                         break;
1812                 }
1813         }
1814
1815         /* update the next sequence number to use */
1816         asoc->asconf_seq_out_acked++;
1817         /* remove the old ASCONF on our outbound queue */
1818         sctp_toss_old_asconf(stcb);
1819         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1820 #ifdef SCTP_TIMER_BASED_ASCONF
1821                 /* we have more params, so restart our timer */
1822                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1823                     stcb, net);
1824 #else
1825                 /* we have more params, so send out more */
1826                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1827 #endif
1828         }
1829 }
1830
1831 #ifdef INET6
1832 static uint32_t
1833 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1834 {
1835         struct sockaddr_in6 *sin6, *net6;
1836         struct sctp_nets *net;
1837
1838         if (sa->sa_family != AF_INET6) {
1839                 /* wrong family */
1840                 return (0);
1841         }
1842         sin6 = (struct sockaddr_in6 *)sa;
1843         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1844                 /* not link local address */
1845                 return (0);
1846         }
1847         /* hunt through our destination nets list for this scope_id */
1848         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1849                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1850                     AF_INET6)
1851                         continue;
1852                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1853                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1854                         continue;
1855                 if (sctp_is_same_scope(sin6, net6)) {
1856                         /* found one */
1857                         return (1);
1858                 }
1859         }
1860         /* didn't find one */
1861         return (0);
1862 }
1863 #endif
1864
1865 /*
1866  * address management functions
1867  */
1868 static void
1869 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1870     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1871 {
1872         int status;
1873
1874         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1875             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1876                 /* subset bound, no ASCONF allowed case, so ignore */
1877                 return;
1878         }
1879         /*
1880          * note: we know this is not the subset bound, no ASCONF case eg.
1881          * this is boundall or subset bound w/ASCONF allowed
1882          */
1883
1884         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1885         switch (ifa->address.sa.sa_family) {
1886 #ifdef INET6
1887         case AF_INET6:
1888                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1889                     &ifa->address.sin6.sin6_addr) != 0) {
1890                         return;
1891                 }
1892                 break;
1893 #endif
1894 #ifdef INET
1895         case AF_INET:
1896                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1897                     &ifa->address.sin.sin_addr) != 0) {
1898                         return;
1899                 }
1900                 break;
1901 #endif
1902         default:
1903                 return;
1904         }
1905 #ifdef INET6
1906         /* make sure we're "allowed" to add this type of addr */
1907         if (ifa->address.sa.sa_family == AF_INET6) {
1908                 /* invalid if we're not a v6 endpoint */
1909                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1910                         return;
1911                 /* is the v6 addr really valid ? */
1912                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1913                         return;
1914                 }
1915         }
1916 #endif
1917         /* put this address on the "pending/do not use yet" list */
1918         sctp_add_local_addr_restricted(stcb, ifa);
1919         /*
1920          * check address scope if address is out of scope, don't queue
1921          * anything... note: this would leave the address on both inp and
1922          * asoc lists
1923          */
1924         switch (ifa->address.sa.sa_family) {
1925 #ifdef INET6
1926         case AF_INET6:
1927                 {
1928                         struct sockaddr_in6 *sin6;
1929
1930                         sin6 = &ifa->address.sin6;
1931                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1932                                 /* we skip unspecifed addresses */
1933                                 return;
1934                         }
1935                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1936                                 if (stcb->asoc.scope.local_scope == 0) {
1937                                         return;
1938                                 }
1939                                 /* is it the right link local scope? */
1940                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1941                                         return;
1942                                 }
1943                         }
1944                         if (stcb->asoc.scope.site_scope == 0 &&
1945                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1946                                 return;
1947                         }
1948                         break;
1949                 }
1950 #endif
1951 #ifdef INET
1952         case AF_INET:
1953                 {
1954                         struct sockaddr_in *sin;
1955                         struct in6pcb *inp6;
1956
1957                         inp6 = (struct in6pcb *)&inp->ip_inp.inp;
1958                         /* invalid if we are a v6 only endpoint */
1959                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1960                             SCTP_IPV6_V6ONLY(inp6))
1961                                 return;
1962
1963                         sin = &ifa->address.sin;
1964                         if (sin->sin_addr.s_addr == 0) {
1965                                 /* we skip unspecifed addresses */
1966                                 return;
1967                         }
1968                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1969                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1970                                 return;
1971                         }
1972                         break;
1973                 }
1974 #endif
1975         default:
1976                 /* else, not AF_INET or AF_INET6, so skip */
1977                 return;
1978         }
1979
1980         /* queue an asconf for this address add/delete */
1981         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1982                 /* does the peer do asconf? */
1983                 if (stcb->asoc.asconf_supported) {
1984                         /* queue an asconf for this addr */
1985                         status = sctp_asconf_queue_add(stcb, ifa, type);
1986
1987                         /*
1988                          * if queued ok, and in the open state, send out the
1989                          * ASCONF.  If in the non-open state, these will be
1990                          * sent when the state goes open.
1991                          */
1992                         if (status == 0 &&
1993                             ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
1994                             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
1995 #ifdef SCTP_TIMER_BASED_ASCONF
1996                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
1997                                     stcb, stcb->asoc.primary_destination);
1998 #else
1999                                 sctp_send_asconf(stcb, NULL, addr_locked);
2000 #endif
2001                         }
2002                 }
2003         }
2004 }
2005
2006
2007 int
2008 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2009 {
2010         struct sctp_asconf_iterator *asc;
2011         struct sctp_ifa *ifa;
2012         struct sctp_laddr *l;
2013         int cnt_invalid = 0;
2014
2015         asc = (struct sctp_asconf_iterator *)ptr;
2016         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2017                 ifa = l->ifa;
2018                 switch (ifa->address.sa.sa_family) {
2019 #ifdef INET6
2020                 case AF_INET6:
2021                         /* invalid if we're not a v6 endpoint */
2022                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2023                                 cnt_invalid++;
2024                                 if (asc->cnt == cnt_invalid)
2025                                         return (1);
2026                         }
2027                         break;
2028 #endif
2029 #ifdef INET
2030                 case AF_INET:
2031                         {
2032                                 /* invalid if we are a v6 only endpoint */
2033                                 struct in6pcb *inp6;
2034
2035                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2036                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2037                                     SCTP_IPV6_V6ONLY(inp6)) {
2038                                         cnt_invalid++;
2039                                         if (asc->cnt == cnt_invalid)
2040                                                 return (1);
2041                                 }
2042                                 break;
2043                         }
2044 #endif
2045                 default:
2046                         /* invalid address family */
2047                         cnt_invalid++;
2048                         if (asc->cnt == cnt_invalid)
2049                                 return (1);
2050                 }
2051         }
2052         return (0);
2053 }
2054
2055 static int
2056 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2057 {
2058         struct sctp_ifa *ifa;
2059         struct sctp_asconf_iterator *asc;
2060         struct sctp_laddr *laddr, *nladdr, *l;
2061
2062         /* Only for specific case not bound all */
2063         asc = (struct sctp_asconf_iterator *)ptr;
2064         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2065                 ifa = l->ifa;
2066                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2067                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2068                             sctp_nxt_addr) {
2069                                 if (laddr->ifa == ifa) {
2070                                         laddr->action = 0;
2071                                         break;
2072                                 }
2073
2074                         }
2075                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2076                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2077                                 /* remove only after all guys are done */
2078                                 if (laddr->ifa == ifa) {
2079                                         sctp_del_local_addr_ep(inp, ifa);
2080                                 }
2081                         }
2082                 }
2083         }
2084         return (0);
2085 }
2086
2087 void
2088 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2089     void *ptr, uint32_t val SCTP_UNUSED)
2090 {
2091         struct sctp_asconf_iterator *asc;
2092         struct sctp_ifa *ifa;
2093         struct sctp_laddr *l;
2094         int cnt_invalid = 0;
2095         int type, status;
2096         int num_queued = 0;
2097
2098         asc = (struct sctp_asconf_iterator *)ptr;
2099         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2100                 ifa = l->ifa;
2101                 type = l->action;
2102
2103                 /* address's vrf_id must be the vrf_id of the assoc */
2104                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2105                         continue;
2106                 }
2107
2108                 /* Same checks again for assoc */
2109                 switch (ifa->address.sa.sa_family) {
2110 #ifdef INET6
2111                 case AF_INET6:
2112                         {
2113                                 /* invalid if we're not a v6 endpoint */
2114                                 struct sockaddr_in6 *sin6;
2115
2116                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2117                                         cnt_invalid++;
2118                                         if (asc->cnt == cnt_invalid)
2119                                                 return;
2120                                         else
2121                                                 continue;
2122                                 }
2123                                 sin6 = &ifa->address.sin6;
2124                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2125                                         /* we skip unspecifed addresses */
2126                                         continue;
2127                                 }
2128                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2129                                     &sin6->sin6_addr) != 0) {
2130                                         continue;
2131                                 }
2132                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2133                                         if (stcb->asoc.scope.local_scope == 0) {
2134                                                 continue;
2135                                         }
2136                                         /* is it the right link local scope? */
2137                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2138                                                 continue;
2139                                         }
2140                                 }
2141                                 break;
2142                         }
2143 #endif
2144 #ifdef INET
2145                 case AF_INET:
2146                         {
2147                                 /* invalid if we are a v6 only endpoint */
2148                                 struct in6pcb *inp6;
2149                                 struct sockaddr_in *sin;
2150
2151                                 inp6 = (struct in6pcb *)&inp->ip_inp.inp;
2152                                 /* invalid if we are a v6 only endpoint */
2153                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2154                                     SCTP_IPV6_V6ONLY(inp6))
2155                                         continue;
2156
2157                                 sin = &ifa->address.sin;
2158                                 if (sin->sin_addr.s_addr == 0) {
2159                                         /* we skip unspecifed addresses */
2160                                         continue;
2161                                 }
2162                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2163                                     &sin->sin_addr) != 0) {
2164                                         continue;
2165                                 }
2166                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2167                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2168                                         continue;
2169                                 }
2170                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2171                                     SCTP_IPV6_V6ONLY(inp6)) {
2172                                         cnt_invalid++;
2173                                         if (asc->cnt == cnt_invalid)
2174                                                 return;
2175                                         else
2176                                                 continue;
2177                                 }
2178                                 break;
2179                         }
2180 #endif
2181                 default:
2182                         /* invalid address family */
2183                         cnt_invalid++;
2184                         if (asc->cnt == cnt_invalid)
2185                                 return;
2186                         else
2187                                 continue;
2188                         break;
2189                 }
2190
2191                 if (type == SCTP_ADD_IP_ADDRESS) {
2192                         /* prevent this address from being used as a source */
2193                         sctp_add_local_addr_restricted(stcb, ifa);
2194                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2195                         struct sctp_nets *net;
2196
2197                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2198                                 sctp_rtentry_t *rt;
2199
2200                                 /* delete this address if cached */
2201                                 if (net->ro._s_addr == ifa) {
2202                                         sctp_free_ifa(net->ro._s_addr);
2203                                         net->ro._s_addr = NULL;
2204                                         net->src_addr_selected = 0;
2205                                         rt = net->ro.ro_rt;
2206                                         if (rt) {
2207                                                 RTFREE(rt);
2208                                                 net->ro.ro_rt = NULL;
2209                                         }
2210                                         /*
2211                                          * Now we deleted our src address,
2212                                          * should we not also now reset the
2213                                          * cwnd/rto to start as if its a new
2214                                          * address?
2215                                          */
2216                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2217                                         net->RTO = 0;
2218
2219                                 }
2220                         }
2221                 } else if (type == SCTP_SET_PRIM_ADDR) {
2222                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2223                                 /* must validate the ifa is in the ep */
2224                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2225                                         continue;
2226                                 }
2227                         } else {
2228                                 /* Need to check scopes for this guy */
2229                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2230                                         continue;
2231                                 }
2232                         }
2233                 }
2234                 /* queue an asconf for this address add/delete */
2235                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2236                     stcb->asoc.asconf_supported == 1) {
2237                         /* queue an asconf for this addr */
2238                         status = sctp_asconf_queue_add(stcb, ifa, type);
2239                         /*
2240                          * if queued ok, and in the open state, update the
2241                          * count of queued params.  If in the non-open
2242                          * state, these get sent when the assoc goes open.
2243                          */
2244                         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2245                             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2246                                 if (status >= 0) {
2247                                         num_queued++;
2248                                 }
2249                         }
2250                 }
2251         }
2252         /*
2253          * If we have queued params in the open state, send out an ASCONF.
2254          */
2255         if (num_queued > 0) {
2256                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2257         }
2258 }
2259
2260 void
2261 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2262 {
2263         struct sctp_asconf_iterator *asc;
2264         struct sctp_ifa *ifa;
2265         struct sctp_laddr *l, *nl;
2266
2267         asc = (struct sctp_asconf_iterator *)ptr;
2268         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2269                 ifa = l->ifa;
2270                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2271                         /* Clear the defer use flag */
2272                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2273                 }
2274                 sctp_free_ifa(ifa);
2275                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2276                 SCTP_DECR_LADDR_COUNT();
2277         }
2278         SCTP_FREE(asc, SCTP_M_ASC_IT);
2279 }
2280
2281 /*
2282  * sa is the sockaddr to ask the peer to set primary to.
2283  * returns: 0 = completed, -1 = error
2284  */
2285 int32_t
2286 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2287 {
2288         uint32_t vrf_id;
2289         struct sctp_ifa *ifa;
2290
2291         /* find the ifa for the desired set primary */
2292         vrf_id = stcb->asoc.vrf_id;
2293         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2294         if (ifa == NULL) {
2295                 /* Invalid address */
2296                 return (-1);
2297         }
2298
2299         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2300         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2301                 /* set primary queuing succeeded */
2302                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2303                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2304                     (void *)stcb);
2305                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2306                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2307                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2308 #ifdef SCTP_TIMER_BASED_ASCONF
2309                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2310                             stcb->sctp_ep, stcb,
2311                             stcb->asoc.primary_destination);
2312 #else
2313                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2314 #endif
2315                 }
2316         } else {
2317                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2318                     (void *)stcb);
2319                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2320                 return (-1);
2321         }
2322         return (0);
2323 }
2324
2325 int
2326 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2327 {
2328         struct sctp_tmit_chunk *chk, *nchk;
2329         unsigned int offset, asconf_limit;
2330         struct sctp_asconf_chunk *acp;
2331         struct sctp_asconf_paramhdr *aph;
2332         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2333         struct sctp_paramhdr *ph;
2334         int add_cnt, del_cnt;
2335         uint16_t last_param_type;
2336
2337         add_cnt = del_cnt = 0;
2338         last_param_type = 0;
2339         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2340                 if (chk->data == NULL) {
2341                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2342                         continue;
2343                 }
2344                 offset = 0;
2345                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2346                 offset += sizeof(struct sctp_asconf_chunk);
2347                 asconf_limit = ntohs(acp->ch.chunk_length);
2348                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2349                 if (ph == NULL) {
2350                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2351                         continue;
2352                 }
2353                 offset += ntohs(ph->param_length);
2354
2355                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2356                 if (aph == NULL) {
2357                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2358                         continue;
2359                 }
2360                 while (aph != NULL) {
2361                         unsigned int param_length, param_type;
2362
2363                         param_type = ntohs(aph->ph.param_type);
2364                         param_length = ntohs(aph->ph.param_length);
2365                         if (offset + param_length > asconf_limit) {
2366                                 /* parameter goes beyond end of chunk! */
2367                                 break;
2368                         }
2369                         if (param_length > sizeof(aparam_buf)) {
2370                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2371                                 break;
2372                         }
2373                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2374                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2375                                 break;
2376                         }
2377
2378                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2379                         if (aph == NULL) {
2380                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2381                                 break;
2382                         }
2383
2384                         ph = (struct sctp_paramhdr *)(aph + 1);
2385                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2386                                 switch (param_type) {
2387                                 case SCTP_ADD_IP_ADDRESS:
2388                                         add_cnt++;
2389                                         break;
2390                                 case SCTP_DEL_IP_ADDRESS:
2391                                         del_cnt++;
2392                                         break;
2393                                 default:
2394                                         break;
2395                                 }
2396                                 last_param_type = param_type;
2397                         }
2398
2399                         offset += SCTP_SIZE32(param_length);
2400                         if (offset >= asconf_limit) {
2401                                 /* no more data in the mbuf chain */
2402                                 break;
2403                         }
2404                         /* get pointer to next asconf param */
2405                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2406                 }
2407         }
2408
2409         /*
2410          * we want to find the sequences which consist of ADD -> DEL -> ADD
2411          * or DEL -> ADD
2412          */
2413         if (add_cnt > del_cnt ||
2414             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2415                 return (1);
2416         }
2417         return (0);
2418 }
2419
2420 static struct sockaddr *
2421 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2422 {
2423         struct sctp_vrf *vrf = NULL;
2424         struct sctp_ifn *sctp_ifn;
2425         struct sctp_ifa *sctp_ifa;
2426
2427         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2428                 SCTP_IPI_ADDR_RLOCK();
2429         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2430         if (vrf == NULL) {
2431                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2432                         SCTP_IPI_ADDR_RUNLOCK();
2433                 return (NULL);
2434         }
2435         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2436                 if (stcb->asoc.scope.loopback_scope == 0 &&
2437                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2438                         /* Skip if loopback_scope not set */
2439                         continue;
2440                 }
2441                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2442                         switch (sctp_ifa->address.sa.sa_family) {
2443 #ifdef INET
2444                         case AF_INET:
2445                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2446                                         struct sockaddr_in *sin;
2447
2448                                         sin = &sctp_ifa->address.sin;
2449                                         if (sin->sin_addr.s_addr == 0) {
2450                                                 /* skip unspecifed addresses */
2451                                                 continue;
2452                                         }
2453                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2454                                             &sin->sin_addr) != 0) {
2455                                                 continue;
2456                                         }
2457                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2458                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2459                                                 continue;
2460
2461                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2462                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2463                                                 continue;
2464                                         /*
2465                                          * found a valid local v4 address to
2466                                          * use
2467                                          */
2468                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2469                                                 SCTP_IPI_ADDR_RUNLOCK();
2470                                         return (&sctp_ifa->address.sa);
2471                                 }
2472                                 break;
2473 #endif
2474 #ifdef INET6
2475                         case AF_INET6:
2476                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2477                                         struct sockaddr_in6 *sin6;
2478
2479                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2480                                                 continue;
2481                                         }
2482
2483                                         sin6 = &sctp_ifa->address.sin6;
2484                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2485                                                 /*
2486                                                  * we skip unspecifed
2487                                                  * addresses
2488                                                  */
2489                                                 continue;
2490                                         }
2491                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2492                                             &sin6->sin6_addr) != 0) {
2493                                                 continue;
2494                                         }
2495                                         if (stcb->asoc.scope.local_scope == 0 &&
2496                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2497                                                 continue;
2498                                         if (stcb->asoc.scope.site_scope == 0 &&
2499                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2500                                                 continue;
2501
2502                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2503                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2504                                                 continue;
2505                                         /*
2506                                          * found a valid local v6 address to
2507                                          * use
2508                                          */
2509                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2510                                                 SCTP_IPI_ADDR_RUNLOCK();
2511                                         return (&sctp_ifa->address.sa);
2512                                 }
2513                                 break;
2514 #endif
2515                         default:
2516                                 break;
2517                         }
2518                 }
2519         }
2520         /* no valid addresses found */
2521         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2522                 SCTP_IPI_ADDR_RUNLOCK();
2523         return (NULL);
2524 }
2525
2526 static struct sockaddr *
2527 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2528 {
2529         struct sctp_laddr *laddr;
2530
2531         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2532                 if (laddr->ifa == NULL) {
2533                         continue;
2534                 }
2535                 /* is the address restricted ? */
2536                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2537                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2538                         continue;
2539
2540                 /* found a valid local address to use */
2541                 return (&laddr->ifa->address.sa);
2542         }
2543         /* no valid addresses found */
2544         return (NULL);
2545 }
2546
2547 /*
2548  * builds an ASCONF chunk from queued ASCONF params.
2549  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2550  */
2551 struct mbuf *
2552 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2553 {
2554         struct mbuf *m_asconf, *m_asconf_chk;
2555         struct sctp_asconf_addr *aa;
2556         struct sctp_asconf_chunk *acp;
2557         struct sctp_asconf_paramhdr *aph;
2558         struct sctp_asconf_addr_param *aap;
2559         uint32_t p_length;
2560         uint32_t correlation_id = 1;    /* 0 is reserved... */
2561         caddr_t ptr, lookup_ptr;
2562         uint8_t lookup_used = 0;
2563
2564         /* are there any asconf params to send? */
2565         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2566                 if (aa->sent == 0)
2567                         break;
2568         }
2569         if (aa == NULL)
2570                 return (NULL);
2571
2572         /*
2573          * get a chunk header mbuf and a cluster for the asconf params since
2574          * it's simpler to fill in the asconf chunk header lookup address on
2575          * the fly
2576          */
2577         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2578         if (m_asconf_chk == NULL) {
2579                 /* no mbuf's */
2580                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2581                     "compose_asconf: couldn't get chunk mbuf!\n");
2582                 return (NULL);
2583         }
2584         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2585         if (m_asconf == NULL) {
2586                 /* no mbuf's */
2587                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2588                     "compose_asconf: couldn't get mbuf!\n");
2589                 sctp_m_freem(m_asconf_chk);
2590                 return (NULL);
2591         }
2592         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2593         SCTP_BUF_LEN(m_asconf) = 0;
2594         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2595         memset(acp, 0, sizeof(struct sctp_asconf_chunk));
2596         /* save pointers to lookup address and asconf params */
2597         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2598         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2599
2600         /* fill in chunk header info */
2601         acp->ch.chunk_type = SCTP_ASCONF;
2602         acp->ch.chunk_flags = 0;
2603         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2604         stcb->asoc.asconf_seq_out++;
2605
2606         /* add parameters... up to smallest MTU allowed */
2607         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2608                 if (aa->sent)
2609                         continue;
2610                 /* get the parameter length */
2611                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2612                 /* will it fit in current chunk? */
2613                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2614                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2615                         /* won't fit, so we're done with this chunk */
2616                         break;
2617                 }
2618                 /* assign (and store) a correlation id */
2619                 aa->ap.aph.correlation_id = correlation_id++;
2620
2621                 /*
2622                  * fill in address if we're doing a delete this is a simple
2623                  * way for us to fill in the correlation address, which
2624                  * should only be used by the peer if we're deleting our
2625                  * source address and adding a new address (e.g. renumbering
2626                  * case)
2627                  */
2628                 if (lookup_used == 0 &&
2629                     (aa->special_del == 0) &&
2630                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2631                         struct sctp_ipv6addr_param *lookup;
2632                         uint16_t p_size, addr_size;
2633
2634                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2635                         lookup->ph.param_type =
2636                             htons(aa->ap.addrp.ph.param_type);
2637                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2638                                 /* copy IPv6 address */
2639                                 p_size = sizeof(struct sctp_ipv6addr_param);
2640                                 addr_size = sizeof(struct in6_addr);
2641                         } else {
2642                                 /* copy IPv4 address */
2643                                 p_size = sizeof(struct sctp_ipv4addr_param);
2644                                 addr_size = sizeof(struct in_addr);
2645                         }
2646                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2647                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2648                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2649                         lookup_used = 1;
2650                 }
2651                 /* copy into current space */
2652                 memcpy(ptr, &aa->ap, p_length);
2653
2654                 /* network elements and update lengths */
2655                 aph = (struct sctp_asconf_paramhdr *)ptr;
2656                 aap = (struct sctp_asconf_addr_param *)ptr;
2657                 /* correlation_id is transparent to peer, no htonl needed */
2658                 aph->ph.param_type = htons(aph->ph.param_type);
2659                 aph->ph.param_length = htons(aph->ph.param_length);
2660                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2661                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2662
2663                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2664                 ptr += SCTP_SIZE32(p_length);
2665
2666                 /*
2667                  * these params are removed off the pending list upon
2668                  * getting an ASCONF-ACK back from the peer, just set flag
2669                  */
2670                 aa->sent = 1;
2671         }
2672         /* check to see if the lookup addr has been populated yet */
2673         if (lookup_used == 0) {
2674                 /* NOTE: if the address param is optional, can skip this... */
2675                 /* add any valid (existing) address... */
2676                 struct sctp_ipv6addr_param *lookup;
2677                 uint16_t p_size, addr_size;
2678                 struct sockaddr *found_addr;
2679                 caddr_t addr_ptr;
2680
2681                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2682                         found_addr = sctp_find_valid_localaddr(stcb,
2683                             addr_locked);
2684                 else
2685                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2686
2687                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2688                 if (found_addr != NULL) {
2689                         switch (found_addr->sa_family) {
2690 #ifdef INET6
2691                         case AF_INET6:
2692                                 /* copy IPv6 address */
2693                                 lookup->ph.param_type =
2694                                     htons(SCTP_IPV6_ADDRESS);
2695                                 p_size = sizeof(struct sctp_ipv6addr_param);
2696                                 addr_size = sizeof(struct in6_addr);
2697                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2698                                     found_addr)->sin6_addr;
2699                                 break;
2700 #endif
2701 #ifdef INET
2702                         case AF_INET:
2703                                 /* copy IPv4 address */
2704                                 lookup->ph.param_type =
2705                                     htons(SCTP_IPV4_ADDRESS);
2706                                 p_size = sizeof(struct sctp_ipv4addr_param);
2707                                 addr_size = sizeof(struct in_addr);
2708                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2709                                     found_addr)->sin_addr;
2710                                 break;
2711 #endif
2712                         default:
2713                                 p_size = 0;
2714                                 addr_size = 0;
2715                                 addr_ptr = NULL;
2716                                 break;
2717                         }
2718                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2719                         memcpy(lookup->addr, addr_ptr, addr_size);
2720                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2721                 } else {
2722                         /* uh oh... don't have any address?? */
2723                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2724                             "compose_asconf: no lookup addr!\n");
2725                         /* XXX for now, we send a IPv4 address of 0.0.0.0 */
2726                         lookup->ph.param_type = htons(SCTP_IPV4_ADDRESS);
2727                         lookup->ph.param_length = htons(SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param)));
2728                         memset(lookup->addr, 0, sizeof(struct in_addr));
2729                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(sizeof(struct sctp_ipv4addr_param));
2730                 }
2731         }
2732         /* chain it all together */
2733         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2734         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2735         acp->ch.chunk_length = htons(*retlen);
2736
2737         return (m_asconf_chk);
2738 }
2739
2740 /*
2741  * section to handle address changes before an association is up eg. changes
2742  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2743  */
2744
2745 /*
2746  * processes the (local) addresses in the INIT-ACK chunk
2747  */
2748 static void
2749 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2750     unsigned int offset, unsigned int length)
2751 {
2752         struct sctp_paramhdr tmp_param, *ph;
2753         uint16_t plen, ptype;
2754         struct sctp_ifa *sctp_ifa;
2755         union sctp_sockstore store;
2756 #ifdef INET6
2757         struct sctp_ipv6addr_param addr6_store;
2758 #endif
2759 #ifdef INET
2760         struct sctp_ipv4addr_param addr4_store;
2761 #endif
2762
2763         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2764         if (stcb == NULL)       /* Un-needed check for SA */
2765                 return;
2766
2767         /* convert to upper bound */
2768         length += offset;
2769
2770         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2771                 return;
2772         }
2773         /* go through the addresses in the init-ack */
2774         ph = (struct sctp_paramhdr *)
2775             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2776             (uint8_t *)&tmp_param);
2777         while (ph != NULL) {
2778                 ptype = ntohs(ph->param_type);
2779                 plen = ntohs(ph->param_length);
2780                 switch (ptype) {
2781 #ifdef INET6
2782                 case SCTP_IPV6_ADDRESS:
2783                         {
2784                                 struct sctp_ipv6addr_param *a6p;
2785
2786                                 /* get the entire IPv6 address param */
2787                                 a6p = (struct sctp_ipv6addr_param *)
2788                                     sctp_m_getptr(m, offset,
2789                                     sizeof(struct sctp_ipv6addr_param),
2790                                     (uint8_t *)&addr6_store);
2791                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2792                                     a6p == NULL) {
2793                                         return;
2794                                 }
2795                                 memset(&store, 0, sizeof(union sctp_sockstore));
2796                                 store.sin6.sin6_family = AF_INET6;
2797                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2798                                 store.sin6.sin6_port = stcb->rport;
2799                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2800                                 break;
2801                         }
2802 #endif
2803 #ifdef INET
2804                 case SCTP_IPV4_ADDRESS:
2805                         {
2806                                 struct sctp_ipv4addr_param *a4p;
2807
2808                                 /* get the entire IPv4 address param */
2809                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2810                                     sizeof(struct sctp_ipv4addr_param),
2811                                     (uint8_t *)&addr4_store);
2812                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2813                                     a4p == NULL) {
2814                                         return;
2815                                 }
2816                                 memset(&store, 0, sizeof(union sctp_sockstore));
2817                                 store.sin.sin_family = AF_INET;
2818                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2819                                 store.sin.sin_port = stcb->rport;
2820                                 store.sin.sin_addr.s_addr = a4p->addr;
2821                                 break;
2822                         }
2823 #endif
2824                 default:
2825                         goto next_addr;
2826                 }
2827
2828                 /* see if this address really (still) exists */
2829                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2830                     SCTP_ADDR_NOT_LOCKED);
2831                 if (sctp_ifa == NULL) {
2832                         /* address doesn't exist anymore */
2833                         int status;
2834
2835                         /* are ASCONFs allowed ? */
2836                         if ((sctp_is_feature_on(stcb->sctp_ep,
2837                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2838                             stcb->asoc.asconf_supported) {
2839                                 /* queue an ASCONF DEL_IP_ADDRESS */
2840                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2841                                 /*
2842                                  * if queued ok, and in correct state, send
2843                                  * out the ASCONF.
2844                                  */
2845                                 if (status == 0 &&
2846                                     SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {
2847 #ifdef SCTP_TIMER_BASED_ASCONF
2848                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2849                                             stcb->sctp_ep, stcb,
2850                                             stcb->asoc.primary_destination);
2851 #else
2852                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2853 #endif
2854                                 }
2855                         }
2856                 }
2857
2858 next_addr:
2859                 /*
2860                  * Sanity check:  Make sure the length isn't 0, otherwise
2861                  * we'll be stuck in this loop for a long time...
2862                  */
2863                 if (SCTP_SIZE32(plen) == 0) {
2864                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2865                             plen, ptype);
2866                         return;
2867                 }
2868                 /* get next parameter */
2869                 offset += SCTP_SIZE32(plen);
2870                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2871                         return;
2872                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2873                     sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2874         }                       /* while */
2875 }
2876
2877 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2878 /*
2879  * checks to see if a specific address is in the initack address list returns
2880  * 1 if found, 0 if not
2881  */
2882 static uint32_t
2883 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2884 {
2885         struct sctp_paramhdr tmp_param, *ph;
2886         uint16_t plen, ptype;
2887 #ifdef INET
2888         struct sockaddr_in *sin;
2889         struct sctp_ipv4addr_param *a4p;
2890         struct sctp_ipv6addr_param addr4_store;
2891 #endif
2892 #ifdef INET6
2893         struct sockaddr_in6 *sin6;
2894         struct sctp_ipv6addr_param *a6p;
2895         struct sctp_ipv6addr_param addr6_store;
2896         struct sockaddr_in6 sin6_tmp;
2897 #endif
2898
2899         switch (sa->sa_family) {
2900 #ifdef INET
2901         case AF_INET:
2902                 break;
2903 #endif
2904 #ifdef INET6
2905         case AF_INET6:
2906                 break;
2907 #endif
2908         default:
2909                 return (0);
2910         }
2911
2912         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2913         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2914         /* convert to upper bound */
2915         length += offset;
2916
2917         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2918                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2919                     "find_initack_addr: invalid offset?\n");
2920                 return (0);
2921         }
2922         /* go through the addresses in the init-ack */
2923         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2924             sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2925         while (ph != NULL) {
2926                 ptype = ntohs(ph->param_type);
2927                 plen = ntohs(ph->param_length);
2928                 switch (ptype) {
2929 #ifdef INET6
2930                 case SCTP_IPV6_ADDRESS:
2931                         if (sa->sa_family == AF_INET6) {
2932                                 /* get the entire IPv6 address param */
2933                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2934                                         break;
2935                                 }
2936                                 /* get the entire IPv6 address param */
2937                                 a6p = (struct sctp_ipv6addr_param *)
2938                                     sctp_m_getptr(m, offset,
2939                                     sizeof(struct sctp_ipv6addr_param),
2940                                     (uint8_t *)&addr6_store);
2941                                 if (a6p == NULL) {
2942                                         return (0);
2943                                 }
2944                                 sin6 = (struct sockaddr_in6 *)sa;
2945                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2946                                         /* create a copy and clear scope */
2947                                         memcpy(&sin6_tmp, sin6,
2948                                             sizeof(struct sockaddr_in6));
2949                                         sin6 = &sin6_tmp;
2950                                         in6_clearscope(&sin6->sin6_addr);
2951                                 }
2952                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2953                                     sizeof(struct in6_addr)) == 0) {
2954                                         /* found it */
2955                                         return (1);
2956                                 }
2957                         }
2958                         break;
2959 #endif                          /* INET6 */
2960 #ifdef INET
2961                 case SCTP_IPV4_ADDRESS:
2962                         if (sa->sa_family == AF_INET) {
2963                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2964                                         break;
2965                                 }
2966                                 /* get the entire IPv4 address param */
2967                                 a4p = (struct sctp_ipv4addr_param *)
2968                                     sctp_m_getptr(m, offset,
2969                                     sizeof(struct sctp_ipv4addr_param),
2970                                     (uint8_t *)&addr4_store);
2971                                 if (a4p == NULL) {
2972                                         return (0);
2973                                 }
2974                                 sin = (struct sockaddr_in *)sa;
2975                                 if (sin->sin_addr.s_addr == a4p->addr) {
2976                                         /* found it */
2977                                         return (1);
2978                                 }
2979                         }
2980                         break;
2981 #endif
2982                 default:
2983                         break;
2984                 }
2985                 /* get next parameter */
2986                 offset += SCTP_SIZE32(plen);
2987                 if (offset + sizeof(struct sctp_paramhdr) > length) {
2988                         return (0);
2989                 }
2990                 ph = (struct sctp_paramhdr *)
2991                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2992                     (uint8_t *)&tmp_param);
2993         }                       /* while */
2994         /* not found! */
2995         return (0);
2996 }
2997
2998 /*
2999  * makes sure that the current endpoint local addr list is consistent with
3000  * the new association (eg. subset bound, asconf allowed) adds addresses as
3001  * necessary
3002  */
3003 static void
3004 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3005     int length, struct sockaddr *init_addr)
3006 {
3007         struct sctp_laddr *laddr;
3008
3009         /* go through the endpoint list */
3010         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3011                 /* be paranoid and validate the laddr */
3012                 if (laddr->ifa == NULL) {
3013                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3014                             "check_addr_list_ep: laddr->ifa is NULL");
3015                         continue;
3016                 }
3017                 if (laddr->ifa == NULL) {
3018                         SCTPDBG(SCTP_DEBUG_ASCONF1, "check_addr_list_ep: laddr->ifa->ifa_addr is NULL");
3019                         continue;
3020                 }
3021                 /* do i have it implicitly? */
3022                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3023                         continue;
3024                 }
3025                 /* check to see if in the init-ack */
3026                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3027                         /* try to add it */
3028                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3029                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3030                 }
3031         }
3032 }
3033
3034 /*
3035  * makes sure that the current kernel address list is consistent with the new
3036  * association (with all addrs bound) adds addresses as necessary
3037  */
3038 static void
3039 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3040     int length, struct sockaddr *init_addr,
3041     uint16_t local_scope, uint16_t site_scope,
3042     uint16_t ipv4_scope, uint16_t loopback_scope)
3043 {
3044         struct sctp_vrf *vrf = NULL;
3045         struct sctp_ifn *sctp_ifn;
3046         struct sctp_ifa *sctp_ifa;
3047         uint32_t vrf_id;
3048 #ifdef INET
3049         struct sockaddr_in *sin;
3050 #endif
3051 #ifdef INET6
3052         struct sockaddr_in6 *sin6;
3053 #endif
3054
3055         if (stcb) {
3056                 vrf_id = stcb->asoc.vrf_id;
3057         } else {
3058                 return;
3059         }
3060         SCTP_IPI_ADDR_RLOCK();
3061         vrf = sctp_find_vrf(vrf_id);
3062         if (vrf == NULL) {
3063                 SCTP_IPI_ADDR_RUNLOCK();
3064                 return;
3065         }
3066         /* go through all our known interfaces */
3067         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3068                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3069                         /* skip loopback interface */
3070                         continue;
3071                 }
3072                 /* go through each interface address */
3073                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3074                         /* do i have it implicitly? */
3075                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3076                                 continue;
3077                         }
3078                         switch (sctp_ifa->address.sa.sa_family) {
3079 #ifdef INET
3080                         case AF_INET:
3081                                 sin = &sctp_ifa->address.sin;
3082                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3083                                     &sin->sin_addr) != 0) {
3084                                         continue;
3085                                 }
3086                                 if ((ipv4_scope == 0) &&
3087                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3088                                         /* private address not in scope */
3089                                         continue;
3090                                 }
3091                                 break;
3092 #endif
3093 #ifdef INET6
3094                         case AF_INET6:
3095                                 sin6 = &sctp_ifa->address.sin6;
3096                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3097                                     &sin6->sin6_addr) != 0) {
3098                                         continue;
3099                                 }
3100                                 if ((local_scope == 0) &&
3101                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3102                                         continue;
3103                                 }
3104                                 if ((site_scope == 0) &&
3105                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3106                                         continue;
3107                                 }
3108                                 break;
3109 #endif
3110                         default:
3111                                 break;
3112                         }
3113                         /* check to see if in the init-ack */
3114                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3115                                 /* try to add it */
3116                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3117                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3118                                     SCTP_ADDR_LOCKED);
3119                         }
3120                 }               /* end foreach ifa */
3121         }                       /* end foreach ifn */
3122         SCTP_IPI_ADDR_RUNLOCK();
3123 }
3124
3125 /*
3126  * validates an init-ack chunk (from a cookie-echo) with current addresses
3127  * adds addresses from the init-ack into our local address list, if needed
3128  * queues asconf adds/deletes addresses as needed and makes appropriate list
3129  * changes for source address selection m, offset: points to the start of the
3130  * address list in an init-ack chunk length: total length of the address
3131  * params only init_addr: address where my INIT-ACK was sent from
3132  */
3133 void
3134 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3135     int length, struct sockaddr *init_addr,
3136     uint16_t local_scope, uint16_t site_scope,
3137     uint16_t ipv4_scope, uint16_t loopback_scope)
3138 {
3139         /* process the local addresses in the initack */
3140         sctp_process_initack_addresses(stcb, m, offset, length);
3141
3142         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3143                 /* bound all case */
3144                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3145                     local_scope, site_scope, ipv4_scope, loopback_scope);
3146         } else {
3147                 /* subset bound case */
3148                 if (sctp_is_feature_on(stcb->sctp_ep,
3149                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3150                         /* asconf's allowed */
3151                         sctp_check_address_list_ep(stcb, m, offset, length,
3152                             init_addr);
3153                 }
3154                 /* else, no asconfs allowed, so what we sent is what we get */
3155         }
3156 }
3157
3158 /*
3159  * sctp_bindx() support
3160  */
3161 uint32_t
3162 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3163     uint32_t type, uint32_t vrf_id, struct sctp_ifa *sctp_ifap)
3164 {
3165         struct sctp_ifa *ifa;
3166         struct sctp_laddr *laddr, *nladdr;
3167
3168         if (sa->sa_len == 0) {
3169                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3170                 return (EINVAL);
3171         }
3172         if (sctp_ifap) {
3173                 ifa = sctp_ifap;
3174         } else if (type == SCTP_ADD_IP_ADDRESS) {
3175                 /* For an add the address MUST be on the system */
3176                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3177         } else if (type == SCTP_DEL_IP_ADDRESS) {
3178                 /* For a delete we need to find it in the inp */
3179                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3180         } else {
3181                 ifa = NULL;
3182         }
3183         if (ifa != NULL) {
3184                 if (type == SCTP_ADD_IP_ADDRESS) {
3185                         sctp_add_local_addr_ep(inp, ifa, type);
3186                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3187                         if (inp->laddr_count < 2) {
3188                                 /* can't delete the last local address */
3189                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3190                                 return (EINVAL);
3191                         }
3192                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3193                             sctp_nxt_addr) {
3194                                 if (ifa == laddr->ifa) {
3195                                         /* Mark in the delete */
3196                                         laddr->action = type;
3197                                 }
3198                         }
3199                 }
3200                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3201                         /*
3202                          * There is no need to start the iterator if the inp
3203                          * has no associations.
3204                          */
3205                         if (type == SCTP_DEL_IP_ADDRESS) {
3206                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3207                                         if (laddr->ifa == ifa) {
3208                                                 sctp_del_local_addr_ep(inp, ifa);
3209                                         }
3210                                 }
3211                         }
3212                 } else {
3213                         struct sctp_asconf_iterator *asc;
3214                         struct sctp_laddr *wi;
3215                         int ret;
3216
3217                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3218                             sizeof(struct sctp_asconf_iterator),
3219                             SCTP_M_ASC_IT);
3220                         if (asc == NULL) {
3221                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3222                                 return (ENOMEM);
3223                         }
3224                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3225                         if (wi == NULL) {
3226                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3227                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3228                                 return (ENOMEM);
3229                         }
3230                         LIST_INIT(&asc->list_of_work);
3231                         asc->cnt = 1;
3232                         SCTP_INCR_LADDR_COUNT();
3233                         wi->ifa = ifa;
3234                         wi->action = type;
3235                         atomic_add_int(&ifa->refcount, 1);
3236                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3237                         ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
3238                             sctp_asconf_iterator_stcb,
3239                             sctp_asconf_iterator_ep_end,
3240                             SCTP_PCB_ANY_FLAGS,
3241                             SCTP_PCB_ANY_FEATURES,
3242                             SCTP_ASOC_ANY_STATE,
3243                             (void *)asc, 0,
3244                             sctp_asconf_iterator_end, inp, 0);
3245                         if (ret) {
3246                                 SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
3247                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
3248                                 sctp_asconf_iterator_end(asc, 0);
3249                                 return (EFAULT);
3250                         }
3251                 }
3252                 return (0);
3253         } else {
3254                 /* invalid address! */
3255                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3256                 return (EADDRNOTAVAIL);
3257         }
3258 }
3259
3260 void
3261 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb,
3262     struct sctp_nets *net)
3263 {
3264         struct sctp_asconf_addr *aa;
3265         struct sctp_ifa *sctp_ifap;
3266         struct sctp_asconf_tag_param *vtag;
3267 #ifdef INET
3268         struct sockaddr_in *to;
3269 #endif
3270 #ifdef INET6
3271         struct sockaddr_in6 *to6;
3272 #endif
3273         if (net == NULL) {
3274                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3275                 return;
3276         }
3277         if (stcb == NULL) {
3278                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3279                 return;
3280         }
3281         /*
3282          * Need to have in the asconf: - vtagparam(my_vtag/peer_vtag) -
3283          * add(0.0.0.0) - del(0.0.0.0) - Any global addresses add(addr)
3284          */
3285         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3286             SCTP_M_ASC_ADDR);
3287         if (aa == NULL) {
3288                 /* didn't get memory */
3289                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3290                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3291                 return;
3292         }
3293         aa->special_del = 0;
3294         /* fill in asconf address parameter fields */
3295         /* top level elements are "networked" during send */
3296         aa->ifa = NULL;
3297         aa->sent = 0;           /* clear sent flag */
3298         vtag = (struct sctp_asconf_tag_param *)&aa->ap.aph;
3299         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3300         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3301         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3302         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3303         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3304
3305         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3306             SCTP_M_ASC_ADDR);
3307         if (aa == NULL) {
3308                 /* didn't get memory */
3309                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3310                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3311                 return;
3312         }
3313         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3314         /* fill in asconf address parameter fields */
3315         /* ADD(0.0.0.0) */
3316         switch (net->ro._l_addr.sa.sa_family) {
3317 #ifdef INET
3318         case AF_INET:
3319                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3320                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3321                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3322                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3323                 /* No need to add an address, we are using 0.0.0.0 */
3324                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3325                 break;
3326 #endif
3327 #ifdef INET6
3328         case AF_INET6:
3329                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3330                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3331                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3332                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3333                 /* No need to add an address, we are using 0.0.0.0 */
3334                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3335                 break;
3336 #endif
3337         default:
3338                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3339                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3340                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3341                 return;
3342         }
3343         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
3344             SCTP_M_ASC_ADDR);
3345         if (aa == NULL) {
3346                 /* didn't get memory */
3347                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3348                     "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3349                 return;
3350         }
3351         memset(aa, 0, sizeof(struct sctp_asconf_addr));
3352         /* fill in asconf address parameter fields */
3353         /* ADD(0.0.0.0) */
3354         switch (net->ro._l_addr.sa.sa_family) {
3355 #ifdef INET
3356         case AF_INET:
3357                 aa->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3358                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3359                 aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3360                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3361                 /* No need to add an address, we are using 0.0.0.0 */
3362                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3363                 break;
3364 #endif
3365 #ifdef INET6
3366         case AF_INET6:
3367                 aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3368                 aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3369                 aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3370                 aa->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3371                 /* No need to add an address, we are using 0.0.0.0 */
3372                 TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
3373                 break;
3374 #endif
3375         default:
3376                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3377                     "sctp_asconf_send_nat_state_update: unknown address family\n");
3378                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
3379                 return;
3380         }
3381         /* Now we must hunt the addresses and add all global addresses */
3382         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3383                 struct sctp_vrf *vrf = NULL;
3384                 struct sctp_ifn *sctp_ifnp;
3385                 uint32_t vrf_id;
3386
3387                 vrf_id = stcb->sctp_ep->def_vrf_id;
3388                 vrf = sctp_find_vrf(vrf_id);
3389                 if (vrf == NULL) {
3390                         goto skip_rest;
3391                 }
3392
3393                 SCTP_IPI_ADDR_RLOCK();
3394                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3395                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3396                                 switch (sctp_ifap->address.sa.sa_family) {
3397 #ifdef INET
3398                                 case AF_INET:
3399                                         to = &sctp_ifap->address.sin;
3400                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3401                                             &to->sin_addr) != 0) {
3402                                                 continue;
3403                                         }
3404                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3405                                                 continue;
3406                                         }
3407                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3408                                                 continue;
3409                                         }
3410                                         break;
3411 #endif
3412 #ifdef INET6
3413                                 case AF_INET6:
3414                                         to6 = &sctp_ifap->address.sin6;
3415                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3416                                             &to6->sin6_addr) != 0) {
3417                                                 continue;
3418                                         }
3419                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3420                                                 continue;
3421                                         }
3422                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3423                                                 continue;
3424                                         }
3425                                         break;
3426 #endif
3427                                 default:
3428                                         continue;
3429                                 }
3430                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3431                         }
3432                 }
3433                 SCTP_IPI_ADDR_RUNLOCK();
3434         } else {
3435                 struct sctp_laddr *laddr;
3436
3437                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3438                         if (laddr->ifa == NULL) {
3439                                 continue;
3440                         }
3441                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3442                                 /*
3443                                  * Address being deleted by the system, dont
3444                                  * list.
3445                                  */
3446                                 continue;
3447                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3448                                 /*
3449                                  * Address being deleted on this ep don't
3450                                  * list.
3451                                  */
3452                                 continue;
3453                         }
3454                         sctp_ifap = laddr->ifa;
3455                         switch (sctp_ifap->address.sa.sa_family) {
3456 #ifdef INET
3457                         case AF_INET:
3458                                 to = &sctp_ifap->address.sin;
3459                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3460                                         continue;
3461                                 }
3462                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3463                                         continue;
3464                                 }
3465                                 break;
3466 #endif
3467 #ifdef INET6
3468                         case AF_INET6:
3469                                 to6 = &sctp_ifap->address.sin6;
3470                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3471                                         continue;
3472                                 }
3473                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3474                                         continue;
3475                                 }
3476                                 break;
3477 #endif
3478                         default:
3479                                 continue;
3480                         }
3481                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3482                 }
3483         }
3484 skip_rest:
3485         /* Now we must send the asconf into the queue */
3486         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3487 }